Series comparison

-[PULL 00/89] riscv-to-apply queue
+[PULL 00/28] riscv-to-apply queue
-The following changes since commit f6b761bdbd8ba63cee7428d52fb6b46e4224ddab:
+The following changes since commit ad10b4badc1dd5b28305f9b9f1168cf0aa3ae946:
-  Merge tag 'qga-pull-2023-05-04' of https://github.com/kostyanf14/qemu into staging (2023-05-04 12:08:00 +0100)
+  Merge tag 'pull-error-2024-05-27' of https://repo.or.cz/qemu/armbru into staging (2024-05-27 06:40:42 -0700)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230505-1
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240528
-for you to fetch changes up to e1d084a8524a9225a46d485e2d164bb258f326f7:
+for you to fetch changes up to 1806da76cb81088ea026ca3441551782b850e393:
-  target/riscv: add Ventana's Veyron V1 CPU (2023-05-05 10:49:50 +1000)
+  target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR (2024-05-28 12:20:27 +1000)
 ----------------------------------------------------------------
-First RISC-V PR for 8.1
+RISC-V PR for 9.1
-* CPURISCVState related cleanup and simplification
+* APLICs add child earlier than realize
-* Refactor Zicond and reuse in XVentanaCondOps
+* Fix exposure of Zkr
-* Fix invalid riscv,event-to-mhpmcounters entry
+* Raise exceptions on wrs.nto
-* Support subsets of code size reduction extension
+* Implement SBI debug console (DBCN) calls for KVM
-* Fix itrigger when icount is used
+* Support 64-bit addresses for initrd
-* Simplification for RVH related check and code style fix
+* Change RISCV_EXCP_SEMIHOST exception number to 63
-* Add signature dump function for spike to run ACT tests
+* Tolerate KVM disable ext errors
-* Rework MISA writing
+* Set tval in breakpoints
-* Fix mstatus.MPP related support
+* Add support for Zve32x extension
-* Use check for relationship between Zdinx/Zhinx{min} and Zfinx
+* Add support for Zve64x extension
-* Fix the H extension TVM trap
+* Relax vector register check in RISCV gdbstub
-* A large collection of mstatus sum changes and cleanups
+* Fix the element agnostic Vector function problem
-* Zero init APLIC internal state
+* Fix Zvkb extension config
-* Implement query-cpu-definitions
+* Implement dynamic establishment of custom decoder
-* Restore the predicate() NULL check behavior
+* Add th.sxstatus CSR emulation
-* Fix Guest Physical Address Translation
+* Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
-* Make sure an exception is raised if a pte is malformed
+* Check single width operator for vector fp widen instructions
-* Add Ventana's Veyron V1 CPU
+* Check single width operator for vfncvt.rod.f.f.w
 * Remove redudant SEW checking for vector fp narrow/widen instructions
 * Prioritize pmp errors in raise_mmu_exception()
 * Do not set mtval2 for non guest-page faults
 * Remove experimental prefix from "B" extension
 * Fixup CBO extension register calculation
 * Fix the hart bit setting of AIA
 * Fix reg_width in ricsv_gen_dynamic_vector_feature()
 * Decode all of the pmpcfg and pmpaddr CSRs
 * Raise an exception when CSRRS/CSRRC writes a read-only CSR
 ----------------------------------------------------------------
-Alexandre Ghiti (1):
+Alexei Filippov (1):
-      riscv: Make sure an exception is raised if a pte is malformed
+      target/riscv: do not set mtval2 for non guest-page faults
-Bin Meng (1):
+Alistair Francis (2):
-      target/riscv: Restore the predicate() NULL check behavior
+      target/riscv: rvzicbo: Fixup CBO extension register calculation
       disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
-Conor Dooley (1):
+Andrew Jones (2):
-      target/riscv: fix invalid riscv,event-to-mhpmcounters entry
+      target/riscv/kvm: Fix exposure of Zkr
       target/riscv: Raise exceptions on wrs.nto
-Daniel Henrique Barboza (23):
+Cheng Yang (1):
-      target/riscv: sync env->misa_ext* with cpu->cfg in realize()
+      hw/riscv/boot.c: Support 64-bit address for initrd
       target/riscv: remove MISA properties from isa_edata_arr[]
       target/riscv/cpu.c: remove 'multi_letter' from isa_ext_data
       target/riscv: introduce riscv_cpu_add_misa_properties()
       target/riscv: remove cpu->cfg.ext_a
       target/riscv: remove cpu->cfg.ext_c
       target/riscv: remove cpu->cfg.ext_d
       target/riscv: remove cpu->cfg.ext_f
       target/riscv: remove cpu->cfg.ext_i
       target/riscv: remove cpu->cfg.ext_e
       target/riscv: remove cpu->cfg.ext_m
       target/riscv: remove cpu->cfg.ext_s
       target/riscv: remove cpu->cfg.ext_u
       target/riscv: remove cpu->cfg.ext_h
       target/riscv: remove cpu->cfg.ext_j
       target/riscv: remove cpu->cfg.ext_v
       target/riscv: remove riscv_cpu_sync_misa_cfg()
       target/riscv: remove cfg.ext_g setup from rv64_thead_c906_cpu_init()
       target/riscv: add RVG and remove cpu->cfg.ext_g
       target/riscv/cpu.c: redesign register_cpu_props()
       target/riscv: add CPU QOM header
       target/riscv: add query-cpy-definitions support
       target/riscv: add TYPE_RISCV_DYNAMIC_CPU
-Fei Wu (2):
+Christoph Müllner (1):
-      target/riscv: Separate priv from mmu_idx
+      riscv: thead: Add th.sxstatus CSR emulation
       target/riscv: Reduce overhead of MSTATUS_SUM change
-Irina Ryapolova (1):
+Clément Léger (1):
-      target/riscv: Fix Guest Physical Address Translation
+      target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63
-Ivan Klokov (1):
+Daniel Henrique Barboza (6):
-      hw/intc/riscv_aplic: Zero init APLIC internal state
+      target/riscv/kvm: implement SBI debug console (DBCN) calls
       target/riscv/kvm: tolerate KVM disable ext errors
       target/riscv/debug: set tval=pc in breakpoint exceptions
       trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
       target/riscv: prioritize pmp errors in raise_mmu_exception()
       riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()
-LIU Zhiwei (7):
+Huang Tao (2):
-      target/riscv: Fix priv version dependency for vector and zfh
+      target/riscv: Fix the element agnostic function problem
-      target/riscv: Fix itrigger when icount is used
+      target/riscv: Implement dynamic establishment of custom decoder
       target/riscv: Convert env->virt to a bool env->virt_enabled
       target/riscv: Extract virt enabled state from tb flags
       target/riscv: Add a general status enum for extensions
       target/riscv: Encode the FS and VS on a normal way for tb flags
       target/riscv: Add a tb flags field for vstart
-Philipp Tomsich (2):
+Jason Chien (3):
-      target/riscv: refactor Zicond support
+      target/riscv: Add support for Zve32x extension
-      target/riscv: redirect XVentanaCondOps to use the Zicond functions
+      target/riscv: Add support for Zve64x extension
       target/riscv: Relax vector register check in RISCV gdbstub
-Rahul Pathak (1):
+Max Chou (4):
-      target/riscv: add Ventana's Veyron V1 CPU
+      target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
       target/riscv: rvv: Check single width operator for vector fp widen instructions
       target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
       target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
-Richard Henderson (18):
+Rob Bradford (1):
-      target/riscv: Remove mstatus_hs_{fs, vs} from tb_flags
+      target/riscv: Remove experimental prefix from "B" extension
       target/riscv: Use cpu_ld*_code_mmu for HLVX
       target/riscv: Handle HLV, HSV via helpers
       target/riscv: Rename MMU_HYP_ACCESS_BIT to MMU_2STAGE_BIT
       target/riscv: Introduce mmuidx_sum
       target/riscv: Introduce mmuidx_priv
       target/riscv: Introduce mmuidx_2stage
       target/riscv: Move hstatus.spvp check to check_access_hlsv
       target/riscv: Set MMU_2STAGE_BIT in riscv_cpu_mmu_index
       target/riscv: Check SUM in the correct register
       target/riscv: Hoist second stage mode change to callers
       target/riscv: Hoist pbmte and hade out of the level loop
       target/riscv: Move leaf pte processing out of level loop
       target/riscv: Suppress pte update with is_debug
       target/riscv: Don't modify SUM with is_debug
       target/riscv: Merge checks for reserved pte flags
       target/riscv: Reorg access check in get_physical_address
       target/riscv: Reorg sum check in get_physical_address
-Weiwei Li (30):
+Yangyu Chen (1):
-      target/riscv: Avoid env_archcpu() when reading RISCVCPUConfig
+      target/riscv/cpu.c: fix Zvkb extension config
       target/riscv: Simplify getting RISCVCPU pointer from env
       target/riscv: Simplify type conversion for CPURISCVState
       target/riscv: Simplify arguments for riscv_csrrw_check
       target/riscv: add cfg properties for Zc* extension
       target/riscv: add support for Zca extension
       target/riscv: add support for Zcf extension
       target/riscv: add support for Zcd extension
       target/riscv: add support for Zcb extension
       target/riscv: add support for Zcmp extension
       target/riscv: add support for Zcmt extension
       target/riscv: expose properties for Zc* extension
       disas/riscv.c: add disasm support for Zc*
       target/riscv: Add support for Zce
       target/riscv: Remove redundant call to riscv_cpu_virt_enabled
       target/riscv: Remove redundant check on RVH
       target/riscv: Remove check on RVH for riscv_cpu_virt_enabled
       target/riscv: Remove check on RVH for riscv_cpu_set_virt_enabled
       target/riscv: Remove redundant parentheses
       target/riscv: Fix addr type for get_physical_address
       target/riscv: Set opcode to env->bins for illegal/virtual instruction fault
       target/riscv: Remove riscv_cpu_virt_enabled()
       target/riscv: Fix format for indentation
       target/riscv: Fix format for comments
       target/riscv: Fix lines with over 80 characters
       hw/riscv: Add signature dump function for spike to run ACT tests
       target/riscv: Fix the mstatus.MPP value after executing MRET
       target/riscv: Use PRV_RESERVED instead of PRV_H
       target/riscv: Legalize MPP value in write_mstatus
       target/riscv: Use check for relationship between Zdinx/Zhinx{min} and Zfinx
-Yi Chen (1):
+Yong-Xuan Wang (1):
-      target/riscv: fix H extension TVM trap
+      target/riscv/kvm.c: Fix the hart bit setting of AIA
- MAINTAINERS                                        |   2 +-
+Yu-Ming Chang (1):
- qapi/machine-target.json                           |   6 +-
+      target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR
- include/hw/char/riscv_htif.h                       |   3 +
- target/riscv/cpu-qom.h                             |  71 +++
+yang.zhang (1):
- target/riscv/cpu.h                                 | 155 ++---
+      hw/intc/riscv_aplic: APLICs should add child earlier than realize
- target/riscv/cpu_bits.h                            |  27 +-
- target/riscv/cpu_vendorid.h                        |   4 +
+ MAINTAINERS                                    |   1 +
- target/riscv/helper.h                              |  15 +-
+ target/riscv/cpu.h                             |  11 ++
- target/riscv/internals.h                           |  35 ++
+ target/riscv/cpu_bits.h                        |   2 +-
- target/riscv/pmp.h                                 |   9 +-
+ target/riscv/cpu_cfg.h                         |   2 +
- target/riscv/sbi_ecall_interface.h                 |   8 +-
+ target/riscv/helper.h                          |   1 +
- target/riscv/time_helper.h                         |   2 +-
+ target/riscv/sbi_ecall_interface.h             |  17 +++
- target/riscv/insn16.decode                         |  62 +-
+ target/riscv/tcg/tcg-cpu.h                     |  15 +++
- disas/riscv.c                                      | 228 ++++++-
+ disas/riscv.c                                  |  65 +++++++++-
- hw/char/riscv_htif.c                               |  44 +-
+ hw/intc/riscv_aplic.c                          |   8 +-
- hw/intc/riscv_aplic.c                              |   2 +-
+ hw/riscv/boot.c                                |   4 +-
- hw/riscv/spike.c                                   |  13 +
+ target/riscv/cpu.c                             |  10 +-
- target/riscv/arch_dump.c                           |   7 +-
+ target/riscv/cpu_helper.c                      |  37 +++---
- target/riscv/cpu.c                                 | 571 +++++++++++-------
+ target/riscv/csr.c                             |  71 +++++++++--
- target/riscv/cpu_helper.c                          | 671 +++++++++++----------
+ target/riscv/debug.c                           |   3 +
- target/riscv/csr.c                                 | 331 +++++-----
+ target/riscv/gdbstub.c                         |   8 +-
- target/riscv/debug.c                               |  21 +-
+ target/riscv/kvm/kvm-cpu.c                     | 157 ++++++++++++++++++++++++-
- target/riscv/fpu_helper.c                          |  24 +-
+ target/riscv/op_helper.c                       |  17 ++-
- target/riscv/gdbstub.c                             |   9 +-
+ target/riscv/tcg/tcg-cpu.c                     |  50 +++++---
- target/riscv/m128_helper.c                         |  16 +-
+ target/riscv/th_csr.c                          |  79 +++++++++++++
- target/riscv/machine.c                             |  43 +-
+ target/riscv/translate.c                       |  31 +++--
- target/riscv/op_helper.c                           | 147 ++++-
+ target/riscv/vector_internals.c                |  22 ++++
- target/riscv/pmp.c                                 |  66 +-
+ target/riscv/insn_trans/trans_privileged.c.inc |   2 +
- target/riscv/pmu.c                                 |  23 +-
+ target/riscv/insn_trans/trans_rvv.c.inc        |  46 +++++---
- target/riscv/riscv-qmp-cmds.c                      |  57 ++
+ target/riscv/insn_trans/trans_rvzawrs.c.inc    |  29 +++--
- target/riscv/time_helper.c                         |  15 +-
+ target/riscv/insn_trans/trans_rvzicbo.c.inc    |  16 ++-
- target/riscv/translate.c                           | 109 ++--
+ target/riscv/meson.build                       |   1 +
- target/riscv/vector_helper.c                       | 317 +++++-----
+files changed, 596 insertions(+), 109 deletions(-)
- target/riscv/zce_helper.c                          |  55 ++
+ create mode 100644 target/riscv/th_csr.c
- target/riscv/insn_trans/trans_privileged.c.inc     |   8 +-
  target/riscv/insn_trans/trans_rvd.c.inc            |  18 +
  target/riscv/insn_trans/trans_rvf.c.inc            |  20 +-
  target/riscv/insn_trans/trans_rvh.c.inc            | 127 ++--
  target/riscv/insn_trans/trans_rvi.c.inc            |   4 +-
  target/riscv/insn_trans/trans_rvv.c.inc            |  58 +-
  target/riscv/insn_trans/trans_rvzce.c.inc          | 311 ++++++++++
  target/riscv/insn_trans/trans_rvzicond.c.inc       |  36 +-
  target/riscv/insn_trans/trans_xthead.c.inc         |  14 +-
  .../riscv/insn_trans/trans_xventanacondops.c.inc   |  18 +-
  target/riscv/meson.build                           |   6 +-
 files changed, 2488 insertions(+), 1300 deletions(-)
  create mode 100644 target/riscv/cpu-qom.h
  create mode 100644 target/riscv/riscv-qmp-cmds.c
  create mode 100644 target/riscv/zce_helper.c
  create mode 100644 target/riscv/insn_trans/trans_rvzce.c.inc

-[PULL 82/89] hw/intc/riscv_aplic: Zero init APLIC internal state
+[PULL 01/28] hw/intc/riscv_aplic: APLICs should add child earlier than realize
-From: Ivan Klokov <ivan.klokov@syntacore.com>
+From: "yang.zhang" <yang.zhang@hexintek.com>
-Since g_new is used to initialize the RISCVAPLICState->state structure,
+Since only root APLICs can have hw IRQ lines, aplic->parent should
-in some case we get behavior that is not as expected. This patch
+be initialized first.
 changes this to g_new0, which allows to initialize the APLIC in the correct state.
-Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
+Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation")
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: yang.zhang <yang.zhang@hexintek.com>
-Message-Id: <20230413133432.53771-1-ivan.klokov@syntacore.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240409014445.278-1-gaoshanliukou@163.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/riscv_aplic.c | 2 +-
+ hw/intc/riscv_aplic.c | 8 ++++----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_aplic.c
 +++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
+     qdev_prop_set_bit(dev, "msimode", msimode);
-     aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
+     qdev_prop_set_bit(dev, "mmode", mmode);
-     aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
--    aplic->state = g_new(uint32_t, aplic->num_irqs);
++    if (parent) {
-+    aplic->state = g_new0(uint32_t, aplic->num_irqs);
++        riscv_aplic_add_child(parent, dev);
-     aplic->target = g_new0(uint32_t, aplic->num_irqs);
++    }
-     if (!aplic->msimode) {
++
-         for (i = 0; i < aplic->num_irqs; i++) {
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      if (!is_kvm_aia(msimode)) {
          sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
      }
 -    if (parent) {
 -        riscv_aplic_add_child(parent, dev);
 -    }
 -
      if (!msimode) {
          for (i = 0; i < num_harts; i++) {
              CPUState *cpu = cpu_by_arch_id(hartid_base + i);
 --
-.40.0
+.45.1

-[PULL 04/89] target/riscv: Simplify type conversion for CPURISCVState
+[PULL 02/28] target/riscv/kvm: Fix exposure of Zkr
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Andrew Jones <ajones@ventanamicro.com>
-Use CPURISCVState as argument directly in riscv_cpu_update_mip and
+The Zkr extension may only be exposed to KVM guests if the VMM
-riscv_timer_write_timecmp, since type converts from CPURISCVState to
+implements the SEED CSR. Use the same implementation as TCG.
 RISCVCPU in many caller of them and then back to CPURISCVState in them.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Without this patch, running with a KVM which does not forward the
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+SEED CSR access to QEMU will result in an ILL exception being
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+injected into the guest (this results in Linux guests crashing on
 boot). And, when running with a KVM which does forward the access,
 QEMU will crash, since QEMU doesn't know what to do with the exit.
 Fixes: 3108e2f1c69d ("target/riscv/kvm: update KVM exts to Linux 6.8")
 Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230309071329.45932-4-liweiwei@iscas.ac.cn>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240422134605.534207-2-ajones@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  3 ++-
+ target/riscv/cpu.h         |  3 +++
- target/riscv/time_helper.h |  2 +-
+ target/riscv/csr.c         | 18 ++++++++++++++----
- target/riscv/cpu.c         |  6 +++---
+ target/riscv/kvm/kvm-cpu.c | 25 +++++++++++++++++++++++++
- target/riscv/cpu_helper.c  |  8 ++++----
+files changed, 42 insertions(+), 4 deletions(-)
  target/riscv/csr.c         | 35 +++++++++++------------------------
  target/riscv/pmu.c         |  6 +++---
  target/riscv/time_helper.c | 15 +++++++--------
 files changed, 31 insertions(+), 44 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
- bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
- void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
+ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
- int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
--uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value);
++target_ulong riscv_new_csr_seed(target_ulong new_value,
-+uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
++                                target_ulong write_mask);
-+                              uint64_t value);
++
- #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
+ uint8_t satp_mode_max_from_map(uint32_t map);
- void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
+ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
-                              void *arg);
 diff --git a/target/riscv/time_helper.h b/target/riscv/time_helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/time_helper.h
 +++ b/target/riscv/time_helper.h
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "qemu/timer.h"
 -void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
 +void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
                                 uint64_t timecmp, uint64_t delta,
                                 uint32_t timer_irq);
  void riscv_timer_init(RISCVCPU *cpu);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
              if (kvm_enabled()) {
                  kvm_riscv_set_irq(cpu, irq, level);
              } else {
 -                riscv_cpu_update_mip(cpu, 1 << irq, BOOL_TO_MASK(level));
 +                riscv_cpu_update_mip(env, 1 << irq, BOOL_TO_MASK(level));
              }
               break;
          case IRQ_S_EXT:
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
                  kvm_riscv_set_irq(cpu, irq, level);
              } else {
                  env->external_seip = level;
 -                riscv_cpu_update_mip(cpu, 1 << irq,
 +                riscv_cpu_update_mip(env, 1 << irq,
                                       BOOL_TO_MASK(level | env->software_seip));
              }
              break;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
          }
          /* Update mip.SGEIP bit */
 -        riscv_cpu_update_mip(cpu, MIP_SGEIP,
 +        riscv_cpu_update_mip(env, MIP_SGEIP,
                               BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
      } else {
          g_assert_not_reached();
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
           *
           * To solve this, we check and inject interrupt after setting V=1.
           */
 -        riscv_cpu_update_mip(env_archcpu(env), 0, 0);
 +        riscv_cpu_update_mip(env, 0, 0);
      }
  }
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
      }
  }
 -uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
 +uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
 +                              uint64_t value)
  {
 -    CPURISCVState *env = &cpu->env;
 -    CPUState *cs = CPU(cpu);
 +    CPUState *cs = env_cpu(env);
      uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
      if (riscv_cpu_virt_enabled(env)) {
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
- static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
+ #endif
-                                       target_ulong val)
  /* Crypto Extension */
 -static RISCVException rmw_seed(CPURISCVState *env, int csrno,
 -                               target_ulong *ret_value,
 -                               target_ulong new_value,
 -                               target_ulong write_mask)
 +target_ulong riscv_new_csr_seed(target_ulong new_value,
 +                                target_ulong write_mask)
  {
--    RISCVCPU *cpu = env_archcpu(env);
+     uint16_t random_v;
--
+     Error *random_e = NULL;
-     if (riscv_cpu_mxl(env) == MXL_RV32) {
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
+         rval = random_v | SEED_OPST_ES16;
      } else {
          env->vstimecmp = val;
      }
--    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
++    return rval;
-+    riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
++}
-                               env->htimedelta, MIP_VSTIP);
++
++static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-     return RISCV_EXCP_NONE;
++                               target_ulong *ret_value,
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
++                               target_ulong new_value,
- static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
++                               target_ulong write_mask)
-                                        target_ulong val)
++{
 +    target_ulong rval;
 +
 +    rval = riscv_new_csr_seed(new_value, write_mask);
 +
      if (ret_value) {
          *ret_value = rval;
      }
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
      return ret;
  }
 +static int kvm_riscv_handle_csr(CPUState *cs, struct kvm_run *run)
 +{
 +    target_ulong csr_num = run->riscv_csr.csr_num;
 +    target_ulong new_value = run->riscv_csr.new_value;
 +    target_ulong write_mask = run->riscv_csr.write_mask;
 +    int ret = 0;
 +
 +    switch (csr_num) {
 +    case CSR_SEED:
 +        run->riscv_csr.ret_value = riscv_new_csr_seed(new_value, write_mask);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: un-handled CSR EXIT for CSR %lx\n",
 +                      __func__, csr_num);
 +        ret = -1;
 +        break;
 +    }
 +
 +    return ret;
 +}
 +
  int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
  {
--    RISCVCPU *cpu = env_archcpu(env);
+     int ret = 0;
--
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
+     case KVM_EXIT_RISCV_SBI:
--    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+         ret = kvm_riscv_handle_sbi(cs, run);
-+    riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
+         break;
-                               env->htimedelta, MIP_VSTIP);
++    case KVM_EXIT_RISCV_CSR:
++        ret = kvm_riscv_handle_csr(cs, run);
-     return RISCV_EXCP_NONE;
++        break;
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
+     default:
- static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
+         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
-                                      target_ulong val)
+                       __func__, run->exit_reason);
  {
 -    RISCVCPU *cpu = env_archcpu(env);
 -
      if (riscv_cpu_virt_enabled(env)) {
          if (env->hvictl & HVICTL_VTI) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
          env->stimecmp = val;
      }
 -    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
 +    riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
  static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
                                        target_ulong val)
  {
 -    RISCVCPU *cpu = env_archcpu(env);
 -
      if (riscv_cpu_virt_enabled(env)) {
          if (env->hvictl & HVICTL_VTI) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
      }
      env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
 -    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
 +    riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
                                  uint64_t *ret_val,
                                  uint64_t new_val, uint64_t wr_mask)
  {
 -    RISCVCPU *cpu = env_archcpu(env);
      uint64_t old_mip, mask = wr_mask & delegable_ints;
      uint32_t gin;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
          new_val |= env->external_seip * MIP_SEIP;
      }
 -    if (cpu->cfg.ext_sstc && (env->priv == PRV_M) &&
 +    if (riscv_cpu_cfg(env)->ext_sstc && (env->priv == PRV_M) &&
          get_field(env->menvcfg, MENVCFG_STCE)) {
          /* sstc extension forbids STIP & VSTIP to be writeable in mip */
          mask = mask & ~(MIP_STIP | MIP_VSTIP);
      }
      if (mask) {
 -        old_mip = riscv_cpu_update_mip(cpu, mask, (new_val & mask));
 +        old_mip = riscv_cpu_update_mip(env, mask, (new_val & mask));
      } else {
          old_mip = env->mip;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hgeie(CPURISCVState *env, int csrno,
      val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
      env->hgeie = val;
      /* Update mip.SGEIP bit */
 -    riscv_cpu_update_mip(env_archcpu(env), MIP_SGEIP,
 +    riscv_cpu_update_mip(env, MIP_SGEIP,
                           BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
  static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
                                         target_ulong val)
  {
 -    RISCVCPU *cpu = env_archcpu(env);
 -
      if (!env->rdtime_fn) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
          env->htimedelta = val;
      }
 -    if (cpu->cfg.ext_sstc && env->rdtime_fn) {
 -        riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
 +    if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
 +        riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
                                    env->htimedelta, MIP_VSTIP);
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
  static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
                                          target_ulong val)
  {
 -    RISCVCPU *cpu = env_archcpu(env);
 -
      if (!env->rdtime_fn) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
      env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
 -    if (cpu->cfg.ext_sstc && env->rdtime_fn) {
 -        riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
 +    if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
 +        riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
                                    env->htimedelta, MIP_VSTIP);
      }
 diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmu.c
 +++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv32(RISCVCPU *cpu, uint32_t ctr_idx)
              /* Generate interrupt only if OF bit is clear */
              if (!(env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_OF)) {
                  env->mhpmeventh_val[ctr_idx] |= MHPMEVENTH_BIT_OF;
 -                riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
 +                riscv_cpu_update_mip(env, MIP_LCOFIP, BOOL_TO_MASK(1));
              }
          } else {
              counter->mhpmcounterh_val++;
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv64(RISCVCPU *cpu, uint32_t ctr_idx)
          /* Generate interrupt only if OF bit is clear */
          if (!(env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_OF)) {
              env->mhpmevent_val[ctr_idx] |= MHPMEVENT_BIT_OF;
 -            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
 +            riscv_cpu_update_mip(env, MIP_LCOFIP, BOOL_TO_MASK(1));
          }
      } else {
          counter->mhpmcounter_val++;
@@ -XXX,XX +XXX,XX @@ static void pmu_timer_trigger_irq(RISCVCPU *cpu,
          /* Generate interrupt only if OF bit is clear */
          if (!(*mhpmevent_val & of_bit_mask)) {
              *mhpmevent_val |= of_bit_mask;
 -            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
 +            riscv_cpu_update_mip(env, MIP_LCOFIP, BOOL_TO_MASK(1));
          }
      }
  }
 diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/time_helper.c
 +++ b/target/riscv/time_helper.c
@@ -XXX,XX +XXX,XX @@ static void riscv_vstimer_cb(void *opaque)
      RISCVCPU *cpu = opaque;
      CPURISCVState *env = &cpu->env;
      env->vstime_irq = 1;
 -    riscv_cpu_update_mip(cpu, 0, BOOL_TO_MASK(1));
 +    riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(1));
  }
  static void riscv_stimer_cb(void *opaque)
  {
      RISCVCPU *cpu = opaque;
 -    riscv_cpu_update_mip(cpu, MIP_STIP, BOOL_TO_MASK(1));
 +    riscv_cpu_update_mip(&cpu->env, MIP_STIP, BOOL_TO_MASK(1));
  }
  /*
   * Called when timecmp is written to update the QEMU timer or immediately
   * trigger timer interrupt if mtimecmp <= current timer value.
   */
 -void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
 +void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
                                 uint64_t timecmp, uint64_t delta,
                                 uint32_t timer_irq)
  {
      uint64_t diff, ns_diff, next;
 -    CPURISCVState *env = &cpu->env;
      RISCVAclintMTimerState *mtimer = env->rdtime_fn_arg;
      uint32_t timebase_freq = mtimer->timebase_freq;
      uint64_t rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
@@ -XXX,XX +XXX,XX @@ void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
           */
          if (timer_irq == MIP_VSTIP) {
              env->vstime_irq = 1;
 -            riscv_cpu_update_mip(cpu, 0, BOOL_TO_MASK(1));
 +            riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(1));
          } else {
 -            riscv_cpu_update_mip(cpu, MIP_STIP, BOOL_TO_MASK(1));
 +            riscv_cpu_update_mip(env, MIP_STIP, BOOL_TO_MASK(1));
          }
          return;
      }
@@ -XXX,XX +XXX,XX @@ void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
      /* Clear the [VS|S]TIP bit in mip */
      if (timer_irq == MIP_VSTIP) {
          env->vstime_irq = 0;
 -        riscv_cpu_update_mip(cpu, 0, BOOL_TO_MASK(0));
 +        riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(0));
      } else {
 -        riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(0));
 +        riscv_cpu_update_mip(env, timer_irq, BOOL_TO_MASK(0));
      }
      /*
 --
-.40.0
+.45.1

-[PULL 66/89] target/riscv: Handle HLV, HSV via helpers
+[PULL 03/28] target/riscv: Raise exceptions on wrs.nto
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Andrew Jones <ajones@ventanamicro.com>
-Implement these instructions via helpers, in expectation
+Implementing wrs.nto to always just return is consistent with the
-of determining the mmu_idx to use at runtime.  This allows
+specification, as the instruction is permitted to terminate the
-the permission check to also be moved out of line, which
+stall for any reason, but it's not useful for virtualization, where
-allows HLSX to be removed from TB_FLAGS.
+we'd like the guest to trap to the hypervisor in order to allow
 scheduling of the lock holding VCPU. Change to always immediately
 raise exceptions when the appropriate conditions are present,
 otherwise continue to just return. Note, immediately raising
 exceptions is also consistent with the specification since the
 time limit that should expire prior to the exception is
 implementation-specific.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Message-ID: <20240424142808.62936-2-ajones@ventanamicro.com>
 Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230325105429.1142530-11-richard.henderson@linaro.org>
 Message-Id: <20230412114333.118895-11-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                      |   6 +-
+ target/riscv/helper.h                       |  1 +
- target/riscv/helper.h                   |  12 ++-
+ target/riscv/op_helper.c                    | 11 ++++++++
- target/riscv/cpu_helper.c               |  26 ++---
+ target/riscv/insn_trans/trans_rvzawrs.c.inc | 29 ++++++++++++++-------
- target/riscv/op_helper.c                |  99 ++++++++++++++++--
+files changed, 32 insertions(+), 9 deletions(-)
  target/riscv/translate.c                |   2 -
  target/riscv/insn_trans/trans_rvh.c.inc | 129 ++++++++++--------------
 files changed, 165 insertions(+), 109 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, LMUL, 7, 3)
- FIELD(TB_FLAGS, SEW, 10, 3)
- FIELD(TB_FLAGS, VL_EQ_VLMAX, 13, 1)
- FIELD(TB_FLAGS, VILL, 14, 1)
--/* Is a Hypervisor instruction load/store allowed? */
--FIELD(TB_FLAGS, HLSX, 15, 1)
-+FIELD(TB_FLAGS, VSTART_EQ_ZERO, 15, 1)
- /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
- FIELD(TB_FLAGS, XL, 16, 2)
- /* If PointerMasking should be applied */
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VMA, 21, 1)
- FIELD(TB_FLAGS, ITRIGGER, 22, 1)
- /* Virtual mode enabled */
- FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
--FIELD(TB_FLAGS, VSTART_EQ_ZERO, 24, 1)
--FIELD(TB_FLAGS, PRIV, 25, 2)
-+FIELD(TB_FLAGS, PRIV, 24, 2)
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(itrigger_match, void, env)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
- #ifndef CONFIG_USER_ONLY
+ DEF_HELPER_1(sret, tl, env)
- DEF_HELPER_1(hyp_tlb_flush, void, env)
+ DEF_HELPER_1(mret, tl, env)
- DEF_HELPER_1(hyp_gvma_tlb_flush, void, env)
+ DEF_HELPER_1(wfi, void, env)
--DEF_HELPER_2(hyp_hlvx_hu, tl, env, tl)
++DEF_HELPER_1(wrs_nto, void, env)
--DEF_HELPER_2(hyp_hlvx_wu, tl, env, tl)
+ DEF_HELPER_1(tlb_flush, void, env)
-+DEF_HELPER_FLAGS_2(hyp_hlv_bu, TCG_CALL_NO_WG, tl, env, tl)
+ DEF_HELPER_1(tlb_flush_all, void, env)
-+DEF_HELPER_FLAGS_2(hyp_hlv_hu, TCG_CALL_NO_WG, tl, env, tl)
+ /* Native Debug */
 +DEF_HELPER_FLAGS_2(hyp_hlv_wu, TCG_CALL_NO_WG, tl, env, tl)
 +DEF_HELPER_FLAGS_2(hyp_hlv_d, TCG_CALL_NO_WG, tl, env, tl)
 +DEF_HELPER_FLAGS_2(hyp_hlvx_hu, TCG_CALL_NO_WG, tl, env, tl)
 +DEF_HELPER_FLAGS_2(hyp_hlvx_wu, TCG_CALL_NO_WG, tl, env, tl)
 +DEF_HELPER_FLAGS_3(hyp_hsv_b, TCG_CALL_NO_WG, void, env, tl, tl)
 +DEF_HELPER_FLAGS_3(hyp_hsv_h, TCG_CALL_NO_WG, void, env, tl, tl)
 +DEF_HELPER_FLAGS_3(hyp_hsv_w, TCG_CALL_NO_WG, void, env, tl, tl)
 +DEF_HELPER_FLAGS_3(hyp_hsv_d, TCG_CALL_NO_WG, void, env, tl, tl)
  #endif
  /* Vector functions */
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
      fs = get_field(env->mstatus, MSTATUS_FS);
      vs = get_field(env->mstatus, MSTATUS_VS);
 -    if (riscv_has_ext(env, RVH)) {
 -        if (env->priv == PRV_M ||
 -            (env->priv == PRV_S && !env->virt_enabled) ||
 -            (env->priv == PRV_U && !env->virt_enabled &&
 -             get_field(env->hstatus, HSTATUS_HU))) {
 -            flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
 -        }
 -
 -        if (env->virt_enabled) {
 -            flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
 -            /*
 -             * Merge DISABLED and !DIRTY states using MIN.
 -             * We will set both fields when dirtying.
 -             */
 -            fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
 -            vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
 -        }
 +    if (env->virt_enabled) {
 +        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
 +        /*
 +         * Merge DISABLED and !DIRTY states using MIN.
 +         * We will set both fields when dirtying.
 +         */
 +        fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
 +        vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
      }
 +
      if (cpu->cfg.debug && !icount_enabled()) {
          flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
      }
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
-     helper_hyp_tlb_flush(env);
+     }
  }
-+static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
++void helper_wrs_nto(CPURISCVState *env)
 +{
-+    if (env->priv == PRV_M) {
++    if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) &&
-+        /* always allowed */
++        get_field(env->hstatus, HSTATUS_VTW) &&
-+    } else if (env->virt_enabled) {
++        !get_field(env->mstatus, MSTATUS_TW)) {
-+        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra);
++        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
-+    } else if (env->priv == PRV_U && !get_field(env->hstatus, HSTATUS_HU)) {
++    } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) {
-+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
++        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 +    }
-+
-+    return cpu_mmu_index(env, x) | MMU_HYP_ACCESS_BIT;
 +}
 +
-+target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
+ void helper_tlb_flush(CPURISCVState *env)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 +
 +    return cpu_ldb_mmu(env, addr, oi, ra);
 +}
 +
 +target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 +
 +    return cpu_ldw_mmu(env, addr, oi, ra);
 +}
 +
 +target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 +
 +    return cpu_ldl_mmu(env, addr, oi, ra);
 +}
 +
 +target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
 +
 +    return cpu_ldq_mmu(env, addr, oi, ra);
 +}
 +
 +void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 +
 +    cpu_stb_mmu(env, addr, val, oi, ra);
 +}
 +
 +void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 +
 +    cpu_stw_mmu(env, addr, val, oi, ra);
 +}
 +
 +void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 +
 +    cpu_stl_mmu(env, addr, val, oi, ra);
 +}
 +
 +void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
 +{
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, false, ra);
 +    MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
 +
 +    cpu_stq_mmu(env, addr, val, oi, ra);
 +}
 +
  /*
   * TODO: These implementations are not quite correct.  They perform the
   * access using execute permission just fine, but the final PMP check
@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
   * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx
   * which would imply that exact check in tlb_fill.
   */
 -target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong address)
 +target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr)
  {
--    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+     CPUState *cs = env_cpu(env);
-+    uintptr_t ra = GETPC();
+diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
 +    int mmu_idx = check_access_hlsv(env, true, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 -    return cpu_ldw_code_mmu(env, address, oi, GETPC());
 +    return cpu_ldw_code_mmu(env, addr, oi, GETPC());
  }
 -target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong address)
 +target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
  {
 -    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
 +    uintptr_t ra = GETPC();
 +    int mmu_idx = check_access_hlsv(env, true, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 -    return cpu_ldl_code_mmu(env, address, oi, GETPC());
 +    return cpu_ldl_code_mmu(env, addr, oi, ra);
  }
  #endif /* !CONFIG_USER_ONLY */
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/insn_trans/trans_rvzawrs.c.inc
-+++ b/target/riscv/translate.c
++++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool virt_inst_excp;
      bool virt_enabled;
      const RISCVCPUConfig *cfg_ptr;
 -    bool hlsx;
      /* vector extension */
      bool vill;
      /*
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->misa_ext = env->misa_ext;
      ctx->frm = -1;  /* unknown rounding mode */
      ctx->cfg_ptr = &(cpu->cfg);
 -    ctx->hlsx = FIELD_EX32(tb_flags, TB_FLAGS, HLSX);
      ctx->vill = FIELD_EX32(tb_flags, TB_FLAGS, VILL);
      ctx->sew = FIELD_EX32(tb_flags, TB_FLAGS, SEW);
      ctx->lmul = sextract32(FIELD_EX32(tb_flags, TB_FLAGS, LMUL), 0, 3);
 diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/insn_trans/trans_rvh.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvh.c.inc
 +++ b/target/riscv/insn_trans/trans_rvh.c.inc
 @@ -XXX,XX +XXX,XX @@
   * this program.  If not, see <http://www.gnu.org/licenses/>.
   */
--#ifndef CONFIG_USER_ONLY
+-static bool trans_wrs(DisasContext *ctx)
--static bool check_access(DisasContext *ctx)
++static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
--{
+ {
--    if (!ctx->hlsx) {
+     if (!ctx->cfg_ptr->ext_zawrs) {
--        tcg_gen_st_i32(tcg_constant_i32(ctx->opcode), cpu_env,
+         return false;
--                       offsetof(CPURISCVState, bins));
+@@ -XXX,XX +XXX,XX @@ static bool trans_wrs(DisasContext *ctx)
 -        if (ctx->virt_enabled) {
 -            generate_exception(ctx, RISCV_EXCP_VIRT_INSTRUCTION_FAULT);
 -        } else {
 -            generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
 -        }
 -        return false;
 -    }
 +#ifdef CONFIG_USER_ONLY
 +#define do_hlv(ctx, a, func)  false
 +#define do_hsv(ctx, a, func)  false
 +#else
 +static void gen_helper_hyp_hlv_b(TCGv r, TCGv_env e, TCGv a)
 +{
 +    gen_helper_hyp_hlv_bu(r, e, a);
 +    tcg_gen_ext8s_tl(r, r);
 +}
 +
 +static void gen_helper_hyp_hlv_h(TCGv r, TCGv_env e, TCGv a)
 +{
 +    gen_helper_hyp_hlv_hu(r, e, a);
 +    tcg_gen_ext16s_tl(r, r);
 +}
 +
 +static void gen_helper_hyp_hlv_w(TCGv r, TCGv_env e, TCGv a)
 +{
 +    gen_helper_hyp_hlv_wu(r, e, a);
 +    tcg_gen_ext32s_tl(r, r);
 +}
 +
 +static bool do_hlv(DisasContext *ctx, arg_r2 *a,
 +                   void (*func)(TCGv, TCGv_env, TCGv))
 +{
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
 +
 +    decode_save_opc(ctx);
 +    func(dest, cpu_env, addr);
 +    gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
--#endif
+-#define GEN_TRANS_WRS(insn)                                     \
--static bool do_hlv(DisasContext *ctx, arg_r2 *a, MemOp mop)
+-static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
-+static bool do_hsv(DisasContext *ctx, arg_r2_s *a,
+-{                                                               \
-+                   void (*func)(TCGv_env, TCGv, TCGv))
+-    (void)a;                                                    \
- {
+-    return trans_wrs(ctx);                                      \
--#ifdef CONFIG_USER_ONLY
+-}
--    return false;
++static bool trans_wrs_nto(DisasContext *ctx, arg_wrs_nto *a)
--#else
++{
-+    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
++    if (!ctx->cfg_ptr->ext_zawrs) {
-+    TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
++        return false;
 +    }
 -GEN_TRANS_WRS(wrs_nto)
 -GEN_TRANS_WRS(wrs_sto)
 +    /*
 +     * Depending on the mode of execution, mstatus.TW and hstatus.VTW, wrs.nto
 +     * should raise an exception when the implementation-specific bounded time
 +     * limit has expired. Our time limit is zero, so we either return
 +     * immediately, as does our implementation of wrs.sto, or raise an
 +     * exception, as handled by the wrs.nto helper.
 +     */
 +#ifndef CONFIG_USER_ONLY
 +    gen_helper_wrs_nto(tcg_env);
 +#endif
 +
-     decode_save_opc(ctx);
++    /* We only get here when helper_wrs_nto() doesn't raise an exception. */
--    if (check_access(ctx)) {
++    return trans_wrs_sto(ctx, NULL);
--        TCGv dest = dest_gpr(ctx, a->rd);
++}
 -        TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
 -        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
 -        tcg_gen_qemu_ld_tl(dest, addr, mem_idx, mop);
 -        gen_set_gpr(ctx, a->rd, dest);
 -    }
 +    func(cpu_env, addr, data);
      return true;
 -#endif
  }
 +#endif /* CONFIG_USER_ONLY */
  static bool trans_hlv_b(DisasContext *ctx, arg_hlv_b *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_SB);
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_b);
  }
  static bool trans_hlv_h(DisasContext *ctx, arg_hlv_h *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_TESW);
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_h);
  }
  static bool trans_hlv_w(DisasContext *ctx, arg_hlv_w *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_TESL);
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_w);
  }
  static bool trans_hlv_bu(DisasContext *ctx, arg_hlv_bu *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_UB);
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_bu);
  }
  static bool trans_hlv_hu(DisasContext *ctx, arg_hlv_hu *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_TEUW);
 -}
 -
 -static bool do_hsv(DisasContext *ctx, arg_r2_s *a, MemOp mop)
 -{
 -#ifdef CONFIG_USER_ONLY
 -    return false;
 -#else
 -    decode_save_opc(ctx);
 -    if (check_access(ctx)) {
 -        TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
 -        TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
 -        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
 -        tcg_gen_qemu_st_tl(data, addr, mem_idx, mop);
 -    }
 -    return true;
 -#endif
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_hu);
  }
  static bool trans_hsv_b(DisasContext *ctx, arg_hsv_b *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hsv(ctx, a, MO_SB);
 +    return do_hsv(ctx, a, gen_helper_hyp_hsv_b);
  }
  static bool trans_hsv_h(DisasContext *ctx, arg_hsv_h *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hsv(ctx, a, MO_TESW);
 +    return do_hsv(ctx, a, gen_helper_hyp_hsv_h);
  }
  static bool trans_hsv_w(DisasContext *ctx, arg_hsv_w *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -    return do_hsv(ctx, a, MO_TESL);
 +    return do_hsv(ctx, a, gen_helper_hyp_hsv_w);
  }
  static bool trans_hlv_wu(DisasContext *ctx, arg_hlv_wu *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_TEUL);
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_wu);
  }
  static bool trans_hlv_d(DisasContext *ctx, arg_hlv_d *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_EXT(ctx, RVH);
 -    return do_hlv(ctx, a, MO_TEUQ);
 +    return do_hlv(ctx, a, gen_helper_hyp_hlv_d);
  }
  static bool trans_hsv_d(DisasContext *ctx, arg_hsv_d *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_EXT(ctx, RVH);
 -    return do_hsv(ctx, a, MO_TEUQ);
 -}
 -
 -#ifndef CONFIG_USER_ONLY
 -static bool do_hlvx(DisasContext *ctx, arg_r2 *a,
 -                    void (*func)(TCGv, TCGv_env, TCGv))
 -{
 -    decode_save_opc(ctx);
 -    if (check_access(ctx)) {
 -        TCGv dest = dest_gpr(ctx, a->rd);
 -        TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
 -        func(dest, cpu_env, addr);
 -        gen_set_gpr(ctx, a->rd, dest);
 -    }
 -    return true;
 +    return do_hsv(ctx, a, gen_helper_hyp_hsv_d);
  }
 -#endif
  static bool trans_hlvx_hu(DisasContext *ctx, arg_hlvx_hu *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -#ifndef CONFIG_USER_ONLY
 -    return do_hlvx(ctx, a, gen_helper_hyp_hlvx_hu);
 -#else
 -    return false;
 -#endif
 +    return do_hlv(ctx, a, gen_helper_hyp_hlvx_hu);
  }
  static bool trans_hlvx_wu(DisasContext *ctx, arg_hlvx_wu *a)
  {
      REQUIRE_EXT(ctx, RVH);
 -#ifndef CONFIG_USER_ONLY
 -    return do_hlvx(ctx, a, gen_helper_hyp_hlvx_wu);
 -#else
 -    return false;
 -#endif
 +    return do_hlv(ctx, a, gen_helper_hyp_hlvx_wu);
  }
  static bool trans_hfence_gvma(DisasContext *ctx, arg_sfence_vma *a)
 --
-.40.0
+.45.1

-[PULL 36/89] target/riscv: introduce riscv_cpu_add_misa_properties()
+[PULL 04/28] target/riscv/kvm: implement SBI debug console (DBCN) calls
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Ever since RISCVCPUConfig got introduced users are able to set CPU extensions
+SBI defines a Debug Console extension "DBCN" that will, in time, replace
-in the command line. User settings are reflected in the cpu->cfg object
+the legacy console putchar and getchar SBI extensions.
-for later use. These properties are used in the target/riscv/cpu.c code,
-most notably in riscv_cpu_validate_set_extensions(), where most of our
+The appeal of the DBCN extension is that it allows multiple bytes to be
-realize time validations are made.
+read/written in the SBI console in a single SBI call.
-And then there's env->misa_ext, the field where the MISA extensions are
+As far as KVM goes, the DBCN calls are forwarded by an in-kernel KVM
-set, that is read everywhere else. We need to keep env->misa_ext updated
+module to userspace. But this will only happens if the KVM module
-with cpu->cfg settings, since our validations rely on it, forcing us to
+actually supports this SBI extension and we activate it.
-make register_cpu_props() write cpu->cfg.ext_N flags to cover for named
-CPUs that aren't used named properties but also needs to go through the
+We'll check for DBCN support during init time, checking if get-reg-list
-same validation steps. Failing to so will make those name CPUs fail
+is advertising KVM_RISCV_SBI_EXT_DBCN. In that case, we'll enable it via
-validation (see c66ffcd5358b for more info). Not only that, but we also
+kvm_set_one_reg() during kvm_arch_init_vcpu().
-need to sync env->misa_ext with cpu->cfg again during realize() time to
-catch any change the user might have done, since the rest of the code
+Finally, change kvm_riscv_handle_sbi() to handle the incoming calls for
-relies on that.
+SBI_EXT_DBCN, reading and writing as required.
-Making cpu->cfg.ext_N and env->misa_ext reflect each other is not
+A simple KVM guest with 'earlycon=sbi', running in an emulated RISC-V
-needed. What we want is a way for users to enable/disable MISA extensions,
+host, takes around 20 seconds to boot without using DBCN. With this
-and there's nothing stopping us from letting the user write env->misa_ext
+patch we're taking around 14 seconds to boot due to the speed-up in the
-directly. Here are the artifacts that will enable us to do that:
+terminal output.  There's no change in boot time if the guest isn't
+using earlycon.
 - RISCVCPUMisaExtConfig will declare each MISA property;
 - cpu_set_misa_ext_cfg() is the setter for each property. We'll write
   env->misa_ext and env->misa_ext_mask with the appropriate misa_bit;
   cutting off cpu->cfg.ext_N from the logic;
 - cpu_get_misa_ext_cfg() is a getter that will retrieve the current val
   of the property based on env->misa_ext;
 - riscv_cpu_add_misa_properties() will be called in register_cpu_props()
   to init all MISA properties from the misa_ext_cfgs[] array.
 With this infrastructure we'll start to get rid of each cpu->cfg.ext_N
 attribute in the next patches.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20240425155012.581366-1-dbarboza@ventanamicro.com>
 Message-Id: <20230406180351.570807-5-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++
+ target/riscv/sbi_ecall_interface.h |  17 +++++
-file changed, 65 insertions(+)
+ target/riscv/kvm/kvm-cpu.c         | 111 +++++++++++++++++++++++++++++
+files changed, 128 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/sbi_ecall_interface.h
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/sbi_ecall_interface.h
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@
- #endif /* CONFIG_USER_ONLY */
- }
+ /* clang-format off */
-+typedef struct RISCVCPUMisaExtConfig {
++#define SBI_SUCCESS                      0
-+    const char *name;
++#define SBI_ERR_FAILED                  -1
-+    const char *description;
++#define SBI_ERR_NOT_SUPPORTED           -2
-+    target_ulong misa_bit;
++#define SBI_ERR_INVALID_PARAM           -3
-+    bool enabled;
++#define SBI_ERR_DENIED                  -4
-+} RISCVCPUMisaExtConfig;
++#define SBI_ERR_INVALID_ADDRESS         -5
-+
++#define SBI_ERR_ALREADY_AVAILABLE       -6
-+static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
++#define SBI_ERR_ALREADY_STARTED         -7
-+                                 void *opaque, Error **errp)
++#define SBI_ERR_ALREADY_STOPPED         -8
 +#define SBI_ERR_NO_SHMEM                -9
 +
  /* SBI Extension IDs */
  #define SBI_EXT_0_1_SET_TIMER           0x0
  #define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_IPI                     0x735049
  #define SBI_EXT_RFENCE                  0x52464E43
  #define SBI_EXT_HSM                     0x48534D
 +#define SBI_EXT_DBCN                    0x4442434E
  /* SBI function IDs for BASE extension */
  #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_HSM_HART_STOP           0x1
  #define SBI_EXT_HSM_HART_GET_STATUS     0x2
 +/* SBI function IDs for DBCN extension */
 +#define SBI_EXT_DBCN_CONSOLE_WRITE      0x0
 +#define SBI_EXT_DBCN_CONSOLE_READ       0x1
 +#define SBI_EXT_DBCN_CONSOLE_WRITE_BYTE 0x2
 +
  #define SBI_HSM_HART_STATUS_STARTED     0x0
  #define SBI_HSM_HART_STATUS_STOPPED     0x1
  #define SBI_HSM_HART_STATUS_START_PENDING   0x2
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_v_vlenb = {
                     KVM_REG_RISCV_VECTOR_CSR_REG(vlenb)
  };
 +static KVMCPUConfig kvm_sbi_dbcn = {
 +    .name = "sbi_dbcn",
 +    .kvm_reg_id = KVM_REG_RISCV | KVM_REG_SIZE_U64 |
 +                  KVM_REG_RISCV_SBI_EXT | KVM_RISCV_SBI_EXT_DBCN
 +};
 +
  static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
  {
      CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int uint64_cmp(const void *a, const void *b)
      return 0;
  }
 +static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
 +                                             KVMScratchCPU *kvmcpu,
 +                                             struct kvm_reg_list *reglist)
 +{
-+    const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
++    struct kvm_reg_list *reg_search;
-+    target_ulong misa_bit = misa_ext_cfg->misa_bit;
++
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    reg_search = bsearch(&kvm_sbi_dbcn.kvm_reg_id, reglist->reg, reglist->n,
-+    CPURISCVState *env = &cpu->env;
++                         sizeof(uint64_t), uint64_cmp);
-+    bool value;
++
-+
++    if (reg_search) {
-+    if (!visit_type_bool(v, name, &value, errp)) {
++        kvm_sbi_dbcn.supported = true;
 +        return;
 +    }
 +
 +    if (value) {
 +        env->misa_ext |= misa_bit;
 +        env->misa_ext_mask |= misa_bit;
 +    } else {
 +        env->misa_ext &= ~misa_bit;
 +        env->misa_ext_mask &= ~misa_bit;
 +    }
 +}
 +
-+static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+ static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
-+                                 void *opaque, Error **errp)
+                                  struct kvm_reg_list *reglist)
  {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
      if (riscv_has_ext(&cpu->env, RVV)) {
          kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
      }
 +
 +    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
  }
  static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
      return ret;
  }
 +static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
 +{
-+    const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
++    target_ulong reg = 1;
-+    target_ulong misa_bit = misa_ext_cfg->misa_bit;
++
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    if (!kvm_sbi_dbcn.supported) {
-+    CPURISCVState *env = &cpu->env;
++        return 0;
-+    bool value;
++    }
 +
-+    value = env->misa_ext & misa_bit;
++    return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
 +
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
-+static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {};
+ int kvm_arch_init_vcpu(CPUState *cs)
-+
+ {
-+static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      kvm_riscv_update_cpu_misa_ext(cpu, cs);
      kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
 +    ret = kvm_vcpu_enable_sbi_dbcn(cpu, cs);
 +
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
      return true;
  }
 +static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
 +{
-+    int i;
++    g_autofree uint8_t *buf = NULL;
-+
++    RISCVCPU *cpu = RISCV_CPU(cs);
-+    for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
++    target_ulong num_bytes;
-+        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
++    uint64_t addr;
-+
++    unsigned char ch;
-+        object_property_add(cpu_obj, misa_cfg->name, "bool",
++    int ret;
-+                            cpu_get_misa_ext_cfg,
++
-+                            cpu_set_misa_ext_cfg,
++    switch (run->riscv_sbi.function_id) {
-+                            NULL, (void *)misa_cfg);
++    case SBI_EXT_DBCN_CONSOLE_READ:
-+        object_property_set_description(cpu_obj, misa_cfg->name,
++    case SBI_EXT_DBCN_CONSOLE_WRITE:
-+                                        misa_cfg->description);
++        num_bytes = run->riscv_sbi.args[0];
-+        object_property_set_bool(cpu_obj, misa_cfg->name,
++
-+                                 misa_cfg->enabled, NULL);
++        if (num_bytes == 0) {
 +            run->riscv_sbi.ret[0] = SBI_SUCCESS;
 +            run->riscv_sbi.ret[1] = 0;
 +            break;
 +        }
 +
 +        addr = run->riscv_sbi.args[1];
 +
 +        /*
 +         * Handle the case where a 32 bit CPU is running in a
 +         * 64 bit addressing env.
 +         */
 +        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
 +            addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
 +        }
 +
 +        buf = g_malloc0(num_bytes);
 +
 +        if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
 +            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
 +            if (ret < 0) {
 +                error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
 +                             "reading chardev");
 +                exit(1);
 +            }
 +
 +            cpu_physical_memory_write(addr, buf, ret);
 +        } else {
 +            cpu_physical_memory_read(addr, buf, num_bytes);
 +
 +            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
 +            if (ret < 0) {
 +                error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
 +                             "writing chardev");
 +                exit(1);
 +            }
 +        }
 +
 +        run->riscv_sbi.ret[0] = SBI_SUCCESS;
 +        run->riscv_sbi.ret[1] = ret;
 +        break;
 +    case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
 +        ch = run->riscv_sbi.args[0];
 +        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
 +
 +        if (ret < 0) {
 +            error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
 +                         "writing chardev");
 +            exit(1);
 +        }
 +
 +        run->riscv_sbi.ret[0] = SBI_SUCCESS;
 +        run->riscv_sbi.ret[1] = 0;
 +        break;
 +    default:
 +        run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
 +    }
 +}
 +
- static Property riscv_cpu_extensions[] = {
+ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
-     /* Defaults for standard extensions */
+ {
-     DEFINE_PROP_BOOL("i", RISCVCPU, cfg.ext_i, true),
+     int ret = 0;
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
-         return;
+         }
-     }
+         ret = 0;
+         break;
-+    riscv_cpu_add_misa_properties(obj);
++    case SBI_EXT_DBCN:
-+
++        kvm_riscv_handle_sbi_dbcn(cs, run);
-     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
++        break;
-         qdev_property_add_static(dev, prop);
+     default:
-     }
+         qemu_log_mask(LOG_UNIMP,
                        "%s: un-handled SBI EXIT, specific reasons is %lu\n",
 --
-.40.0
+.45.1

-[PULL 85/89] target/riscv: add TYPE_RISCV_DYNAMIC_CPU
+[PULL 05/28] hw/riscv/boot.c: Support 64-bit address for initrd
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Cheng Yang <yangcheng.work@foxmail.com>
-This new abstract type will be used to differentiate between static and
+Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell()
-non-static CPUs in query-cpu-definitions.
+to set the address of initrd in FDT to support 64-bit address.
-All generic CPUs were changed to be of this type. Named CPUs are kept as
+Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com>
-TYPE_RISCV_CPU and will still be considered static.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com>
 This is the output of query-cpu-definitions after this change for the
 riscv64 target:
 $ ./build/qemu-system-riscv64 -S -M virt -display none -qmp stdio
 {"QMP": {"version": (...)}
 {"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
 {"return": {}}
 {"execute": "query-cpu-definitions"}
 {"return": [
 {"name": "rv64", "typename": "rv64-riscv-cpu", "static": false, "deprecated": false},
 {"name": "sifive-e51", "typename": "sifive-e51-riscv-cpu", "static": true, "deprecated": false},
 {"name": "any", "typename": "any-riscv-cpu", "static": false, "deprecated": false},
 {"name": "x-rv128", "typename": "x-rv128-riscv-cpu", "static": false, "deprecated": false},
 {"name": "shakti-c", "typename": "shakti-c-riscv-cpu", "static": true, "deprecated": false},
 {"name": "thead-c906", "typename": "thead-c906-riscv-cpu", "static": true, "deprecated": false},
 {"name": "sifive-u54", "typename": "sifive-u54-riscv-cpu", "static": true, "deprecated": false}
 ]}
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20230411183511.189632-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h        |  2 +-
+ hw/riscv/boot.c | 4 ++--
- target/riscv/cpu.c            | 20 ++++++++++++++++----
+file changed, 2 insertions(+), 2 deletions(-)
  target/riscv/riscv-qmp-cmds.c |  4 ++++
 files changed, 21 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
+diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
+--- a/hw/riscv/boot.c
-+++ b/target/riscv/cpu-qom.h
++++ b/hw/riscv/boot.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
- #include "qom/object.h"
+     /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
+     if (fdt) {
- #define TYPE_RISCV_CPU "riscv-cpu"
+         end = start + size;
-+#define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
+-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", start);
+-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", end);
- #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
++        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-start", start);
- #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
++        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-end", end);
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUClass {
      DeviceRealize parent_realize;
      ResettablePhases parent_phases;
  };
 -
  #endif /* RISCV_CPU_QOM_H */
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_list(void)
          .instance_init = initfn            \
      }
-+#define DEFINE_DYNAMIC_CPU(type_name, initfn) \
-+    {                                         \
-+        .name = type_name,                    \
-+        .parent = TYPE_RISCV_DYNAMIC_CPU,     \
-+        .instance_init = initfn               \
-+    }
-+
- static const TypeInfo riscv_cpu_type_infos[] = {
-     {
-         .name = TYPE_RISCV_CPU,
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
-         .class_size = sizeof(RISCVCPUClass),
-         .class_init = riscv_cpu_class_init,
-     },
--    DEFINE_CPU(TYPE_RISCV_CPU_ANY,              riscv_any_cpu_init),
-+    {
-+        .name = TYPE_RISCV_DYNAMIC_CPU,
-+        .parent = TYPE_RISCV_CPU,
-+        .abstract = true,
-+    },
-+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
- #if defined(CONFIG_KVM)
-     DEFINE_CPU(TYPE_RISCV_CPU_HOST,             riscv_host_cpu_init),
- #endif
- #if defined(TARGET_RISCV32)
--    DEFINE_CPU(TYPE_RISCV_CPU_BASE32,           rv32_base_cpu_init),
-+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,   rv32_base_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,       rv32_sifive_e_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,       rv32_imafcu_nommu_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,       rv32_sifive_u_cpu_init),
- #elif defined(TARGET_RISCV64)
--    DEFINE_CPU(TYPE_RISCV_CPU_BASE64,           rv64_base_cpu_init),
-+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,       rv64_sifive_e_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
--    DEFINE_CPU(TYPE_RISCV_CPU_BASE128,          rv128_base_cpu_init),
-+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
- #endif
- };
-diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/riscv-qmp-cmds.c
-+++ b/target/riscv/riscv-qmp-cmds.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_definition(gpointer data, gpointer user_data)
-     CpuDefinitionInfoList **cpu_list = user_data;
-     CpuDefinitionInfo *info = g_malloc0(sizeof(*info));
-     const char *typename = object_class_get_name(oc);
-+    ObjectClass *dyn_class;
-     info->name = g_strndup(typename,
-                            strlen(typename) - strlen("-" TYPE_RISCV_CPU));
-     info->q_typename = g_strdup(typename);
-+    dyn_class = object_class_dynamic_cast(oc, TYPE_RISCV_DYNAMIC_CPU);
-+    info->q_static = dyn_class == NULL;
-+
-     QAPI_LIST_PREPEND(*cpu_list, info);
  }
 --
-.40.0
+.45.1

-[PULL 88/89] riscv: Make sure an exception is raised if a pte is malformed
+[PULL 06/28] target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63
-From: Alexandre Ghiti <alexghiti@rivosinc.com>
+From: Clément Léger <cleger@rivosinc.com>
-As per the specification, in 64-bit, if any of the pte reserved bits
+The current semihost exception number (16) is a reserved number (range
--54 is set an exception should be triggered (see 4.4.1, "Addressing and
+[16-17]). The upcoming double trap specification uses that number for
-Memory Protection"). In addition, we must check the napot/pbmt bits are
+the double trap exception. Since the privileged spec (Table 22) defines
-not set if those extensions are not active.
+ranges for custom uses change the semihosting exception number to 63
 which belongs to the range [48-63] in order to avoid any future
 collisions with reserved exception.
-Reported-by: Andrea Parri <andrea@rivosinc.com>
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
-Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230420150220.60919-1-alexghiti@rivosinc.com>
+Message-ID: <20240422135840.1959967-1-cleger@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_bits.h   |  1 +
+ target/riscv/cpu_bits.h | 2 +-
- target/riscv/cpu_helper.c | 15 +++++++++++----
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 12 insertions(+), 4 deletions(-)
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
- #define PTE_SOFT            0x300 /* Reserved for Software */
+     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
- #define PTE_PBMT            0x6000000000000000ULL /* Page-based memory types */
+     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
- #define PTE_N               0x8000000000000000ULL /* NAPOT translation */
+     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
-+#define PTE_RESERVED        0x1FC0000000000000ULL /* Reserved bits */
+-    RISCV_EXCP_SEMIHOST = 0x10,
- #define PTE_ATTR            (PTE_N | PTE_PBMT) /* All attributes bits */
+     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
+     RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
- /* Page table PPN shift amount */
+     RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+     RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
-index XXXXXXX..XXXXXXX 100644
++    RISCV_EXCP_SEMIHOST = 0x3f,
---- a/target/riscv/cpu_helper.c
+ } RISCVException;
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ restart:
+ #define RISCV_EXCP_INT_FLAG                0x80000000
          if (riscv_cpu_sxl(env) == MXL_RV32) {
              ppn = pte >> PTE_PPN_SHIFT;
 -        } else if (pbmte || riscv_cpu_cfg(env)->ext_svnapot) {
 -            ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
          } else {
 -            ppn = pte >> PTE_PPN_SHIFT;
 -            if ((pte & ~(target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT) {
 +            if (pte & PTE_RESERVED) {
 +                return TRANSLATE_FAIL;
 +            }
 +
 +            if (!pbmte && (pte & PTE_PBMT)) {
                  return TRANSLATE_FAIL;
              }
 +
 +            if (!riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
 +                return TRANSLATE_FAIL;
 +            }
 +
 +            ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
          }
          if (!(pte & PTE_V)) {
 --
-.40.0
+.45.1

-[PULL 38/89] target/riscv: remove cpu->cfg.ext_c
+[PULL 07/28] target/riscv/kvm: tolerate KVM disable ext errors
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "c" RISCVCPUMisaExtConfig property that will update
+Running a KVM guest using a 6.9-rc3 kernel, in a 6.8 host that has zkr
-env->misa_ext* with RVC. Instances of cpu->cfg.ext_c and similar are
+enabled, will fail with a kernel oops SIGILL right at the start. The
-replaced with riscv_has_ext(env, RVC).
+reason is that we can't expose zkr without implementing the SEED CSR.
 Disabling zkr in the guest would be a workaround, but if the KVM doesn't
 allow it we'll error out and never boot.
-Remove the old "c" property and 'ext_c' from RISCVCPUConfig.
+In hindsight this is too strict. If we keep proceeding, despite not
 disabling the extension in the KVM vcpu, we'll not add the extension in
 the riscv,isa. The guest kernel will be unaware of the extension, i.e.
 it doesn't matter if the KVM vcpu has it enabled underneath or not. So
 it's ok to keep booting in this case.
+Change our current logic to not error out if we fail to disable an
+extension in kvm_set_one_reg(), but show a warning and keep booting. It
+is important to throw a warning because we must make the user aware that
+the extension is still available in the vcpu, meaning that an
+ill-behaved guest can ignore the riscv,isa settings and  use the
+extension.
+The case we're handling happens with an EINVAL error code. If we fail to
+disable the extension in KVM for any other reason, error out.
+We'll also keep erroring out when we fail to enable an extension in KVM,
+since adding the extension in riscv,isa at this point will cause a guest
+malfunction because the extension isn't enabled in the vcpu.
+Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230406180351.570807-7-dbarboza@ventanamicro.com>
+Message-ID: <20240422171425.333037-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 1 -
+ target/riscv/kvm/kvm-cpu.c | 12 ++++++++----
- target/riscv/cpu.c | 9 ++++-----
+file changed, 8 insertions(+), 4 deletions(-)
 files changed, 4 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
-     bool ext_m;
+         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
-     bool ext_f;
+         ret = kvm_set_one_reg(cs, id, &reg);
-     bool ext_d;
+         if (ret != 0) {
--    bool ext_c;
+-            error_report("Unable to %s extension %s in KVM, error %d",
-     bool ext_s;
+-                         reg ? "enable" : "disable",
-     bool ext_u;
+-                         multi_ext_cfg->name, ret);
-     bool ext_h;
+-            exit(EXIT_FAILURE);
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
++            if (!reg && ret == -EINVAL) {
-index XXXXXXX..XXXXXXX 100644
++                warn_report("KVM cannot disable extension %s",
---- a/target/riscv/cpu.c
++                            multi_ext_cfg->name);
-+++ b/target/riscv/cpu.c
++            } else {
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
++                error_report("Unable to enable extension %s in KVM, error %d",
-     set_priv_version(env, PRIV_VERSION_1_11_0);
++                             multi_ext_cfg->name, ret);
++                exit(EXIT_FAILURE);
-     cpu->cfg.ext_g = true;
++            }
 -    cpu->cfg.ext_c = true;
      cpu->cfg.ext_u = true;
      cpu->cfg.ext_s = true;
      cpu->cfg.ext_icsr = true;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          }
      }
+ }
 -    if (cpu->cfg.ext_c) {
 +    if (riscv_has_ext(env, RVC)) {
          cpu->cfg.ext_zca = true;
          if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
              cpu->cfg.ext_zcf = true;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
      if (riscv_cpu_cfg(env)->ext_d) {
          ext |= RVD;
      }
 -    if (riscv_cpu_cfg(env)->ext_c) {
 +    if (riscv_has_ext(env, RVC)) {
          ext |= RVC;
      }
      if (riscv_cpu_cfg(env)->ext_s) {
@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
  static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      {.name = "a", .description = "Atomic instructions",
       .misa_bit = RVA, .enabled = true},
 +    {.name = "c", .description = "Compressed instructions",
 +     .misa_bit = RVC, .enabled = true},
  };
  static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
      DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
      DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
 -    DEFINE_PROP_BOOL("c", RISCVCPU, cfg.ext_c, true),
      DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
      DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
      DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
          cpu->cfg.ext_f = misa_ext & RVF;
          cpu->cfg.ext_d = misa_ext & RVD;
          cpu->cfg.ext_v = misa_ext & RVV;
 -        cpu->cfg.ext_c = misa_ext & RVC;
          cpu->cfg.ext_s = misa_ext & RVS;
          cpu->cfg.ext_u = misa_ext & RVU;
          cpu->cfg.ext_h = misa_ext & RVH;
 --
-.40.0
+.45.1

-[PULL 20/89] target/riscv: Remove redundant call to riscv_cpu_virt_enabled
+[PULL 08/28] target/riscv/debug: set tval=pc in breakpoint exceptions
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The assignment is done under the condition riscv_cpu_virt_enabled()=true.
+We're not setting (s/m)tval when triggering breakpoints of type 2
 (mcontrol) and 6 (mcontrol6). According to the debug spec section
 .7.12, "Match Control Type 6":
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+"The Privileged Spec says that breakpoint exceptions that occur on
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+instruction fetches, loads, or stores update the tval CSR with either
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+zero or the faulting virtual address. The faulting virtual address for
 an mcontrol6 trigger with action = 0 is the address being accessed and
 which caused that trigger to fire."
 A similar text is also found in the Debug spec section 5.7.11 w.r.t.
 mcontrol.
 Note that what we're doing ATM is not violating the spec, but it's
 simple enough to set mtval/stval and it makes life easier for any
 software that relies on this info.
 Given that we always use action = 0, save the faulting address for the
 mcontrol and mcontrol6 trigger breakpoints into env->badaddr, which is
 used as as scratch area for traps with address information. 'tval' is
 then set during riscv_cpu_do_interrupt().
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20240416230437.1869024-2-dbarboza@ventanamicro.com>
 Message-Id: <20230327080858.39703-2-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 4 +---
+ target/riscv/cpu_helper.c | 1 +
-file changed, 1 insertion(+), 3 deletions(-)
+ target/riscv/debug.c      | 3 +++
 files changed, 4 insertions(+)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
 @@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-                 riscv_cpu_swap_hypervisor_regs(env);
+             tval = env->bins;
-                 env->hstatus = set_field(env->hstatus, HSTATUS_SPVP,
+             break;
-                                          env->priv);
+         case RISCV_EXCP_BREAKPOINT:
--                env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
++            tval = env->badaddr;
--                                         riscv_cpu_virt_enabled(env));
+             if (cs->watchpoint_hit) {
--
+                 tval = cs->watchpoint_hit->hitaddr;
-+                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, true);
+                 cs->watchpoint_hit = NULL;
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
-                 htval = env->guest_phys_fault_addr;
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                  if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
                      /* check U/S/M bit against current privilege level */
                      if ((ctrl >> 3) & BIT(env->priv)) {
 +                        env->badaddr = pc;
                          return true;
                      }
                  }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                      if (env->virt_enabled) {
                          /* check VU/VS bit against current privilege level */
                          if ((ctrl >> 23) & BIT(env->priv)) {
 +                            env->badaddr = pc;
                              return true;
                          }
                      } else {
                          /* check U/S/M bit against current privilege level */
                          if ((ctrl >> 3) & BIT(env->priv)) {
 +                            env->badaddr = pc;
                              return true;
                          }
                      }
 --
-.40.0
+.45.1

-[PULL 63/89] target/riscv: Separate priv from mmu_idx
+[PULL 09/28] trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
-From: Fei Wu <fei2.wu@intel.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Currently it's assumed the 2 low bits of mmu_idx map to privilege mode,
+Privileged spec section 4.1.9 mentions:
 this assumption won't last as we are about to add more mmu_idx. Here an
 individual priv field is added into TB_FLAGS.
+"When a trap is taken into S-mode, stval is written with
+exception-specific information to assist software in handling the trap.
+(...)
+If stval is written with a nonzero value when a breakpoint,
+address-misaligned, access-fault, or page-fault exception occurs on an
+instruction fetch, load, or store, then stval will contain the faulting
+virtual address."
+A similar text is found for mtval in section 3.1.16.
+Setting mtval/stval in this scenario is optional, but some softwares read
+these regs when handling ebreaks.
+Write 'badaddr' in all ebreak breakpoints to write the appropriate
+'tval' during riscv_do_cpu_interrrupt().
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Fei Wu <fei2.wu@intel.com>
+Message-ID: <20240416230437.1869024-3-dbarboza@ventanamicro.com>
 Message-Id: <20230324054154.414846-2-fei2.wu@intel.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230325105429.1142530-7-richard.henderson@linaro.org>
 Message-Id: <20230412114333.118895-7-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                             |  2 +-
+ target/riscv/insn_trans/trans_privileged.c.inc | 2 ++
- target/riscv/cpu_helper.c                      |  4 +++-
+file changed, 2 insertions(+)
  target/riscv/translate.c                       |  2 ++
  target/riscv/insn_trans/trans_privileged.c.inc |  2 +-
  target/riscv/insn_trans/trans_xthead.c.inc     | 14 +-------------
 files changed, 8 insertions(+), 16 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
- target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
- void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
--#define TB_FLAGS_PRIV_MMU_MASK                3
- #define TB_FLAGS_PRIV_HYP_ACCESS_MASK   (1 << 2)
- #include "exec/cpu-all.h"
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
- /* Virtual mode enabled */
- FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
- FIELD(TB_FLAGS, VSTART_EQ_ZERO, 24, 1)
-+FIELD(TB_FLAGS, PRIV, 25, 2)
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-     fs = EXT_STATUS_DIRTY;
-     vs = EXT_STATUS_DIRTY;
- #else
-+    flags = FIELD_DP32(flags, TB_FLAGS, PRIV, env->priv);
-+
-     flags |= cpu_mmu_index(env, 0);
-     fs = get_field(env->mstatus, MSTATUS_FS);
-     vs = get_field(env->mstatus, MSTATUS_VS);
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-      */
-     MemTxResult res;
-     MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
--    int mode = mmu_idx & TB_FLAGS_PRIV_MMU_MASK;
-+    int mode = env->priv;
-     bool use_background = false;
-     hwaddr ppn;
-     int napot_bits = 0;
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     RISCVExtStatus mstatus_fs;
-     RISCVExtStatus mstatus_vs;
-     uint32_t mem_idx;
-+    uint32_t priv;
-     /*
-      * Remember the rounding mode encoded in the previous fp instruction,
-      * which we have already installed into env->fp_status.  Or -1 for
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     uint32_t tb_flags = ctx->base.tb->flags;
-     ctx->pc_succ_insn = ctx->base.pc_first;
-+    ctx->priv = FIELD_EX32(tb_flags, TB_FLAGS, PRIV);
-     ctx->mem_idx = FIELD_EX32(tb_flags, TB_FLAGS, MEM_IDX);
-     ctx->mstatus_fs = FIELD_EX32(tb_flags, TB_FLAGS, FS);
-     ctx->mstatus_vs = FIELD_EX32(tb_flags, TB_FLAGS, VS);
 diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_privileged.c.inc
 +++ b/target/riscv/insn_trans/trans_privileged.c.inc
 @@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
-      * that no exception will be raised when fetching them.
+     if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
-      */
+         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
+     } else {
--    if (semihosting_enabled(ctx->mem_idx < PRV_S) &&
++        tcg_gen_st_tl(tcg_constant_tl(ebreak_addr), tcg_env,
-+    if (semihosting_enabled(ctx->priv == PRV_U) &&
++                      offsetof(CPURISCVState, badaddr));
-         (pre_addr & TARGET_PAGE_MASK) == (post_addr & TARGET_PAGE_MASK)) {
+         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
-         pre    = opcode_at(&ctx->base, pre_addr);
+     }
-         ebreak = opcode_at(&ctx->base, ebreak_addr);
+     return true;
 diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_xthead.c.inc
 +++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_th_tst(DisasContext *ctx, arg_th_tst *a)
  /* XTheadCmo */
 -static inline int priv_level(DisasContext *ctx)
 -{
 -#ifdef CONFIG_USER_ONLY
 -    return PRV_U;
 -#else
 -     /* Priv level is part of mem_idx. */
 -    return ctx->mem_idx & TB_FLAGS_PRIV_MMU_MASK;
 -#endif
 -}
 -
  /* Test if priv level is M, S, or U (cannot fail). */
  #define REQUIRE_PRIV_MSU(ctx)
  /* Test if priv level is M or S. */
  #define REQUIRE_PRIV_MS(ctx)                                    \
  do {                                                            \
 -    int priv = priv_level(ctx);                                 \
 -    if (!(priv == PRV_M ||                                      \
 -          priv == PRV_S)) {                                     \
 +    if (ctx->priv == PRV_U) {                                   \
          return false;                                           \
      }                                                           \
  } while (0)
 --
-.40.0
+.45.1

-[PULL 01/89] target/riscv: Avoid env_archcpu() when reading RISCVCPUConfig
+[PULL 10/28] target/riscv: Add support for Zve32x extension
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Jason Chien <jason.chien@sifive.com>
-Use riscv_cpu_cfg(env) instead of env_archcpu().cfg.
+Add support for Zve32x extension and replace some checks for Zve32f with
 Zve32x, since Zve32f depends on Zve32x.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230309071329.45932-2-liweiwei@iscas.ac.cn>
+Message-ID: <20240328022343.6871-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c |  9 ++++-----
+ target/riscv/cpu_cfg.h                  |  1 +
- target/riscv/csr.c        | 40 ++++++++++++---------------------------
+ target/riscv/cpu.c                      |  2 ++
- target/riscv/gdbstub.c    |  4 ++--
+ target/riscv/cpu_helper.c               |  2 +-
-files changed, 18 insertions(+), 35 deletions(-)
+ target/riscv/csr.c                      |  2 +-
  target/riscv/tcg/tcg-cpu.c              | 16 ++++++++--------
  target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
 files changed, 15 insertions(+), 12 deletions(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zhinx;
+     bool ext_zhinxmin;
+     bool ext_zve32f;
++    bool ext_zve32x;
+     bool ext_zve64f;
+     bool ext_zve64d;
+     bool ext_zvbb;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
+     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
++    ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
+     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
+     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
+     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
++    MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
+     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
+     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
+     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                                     int extirq, unsigned int extirq_def_prio,
+     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
-                                     uint64_t pending, uint8_t *iprio)
+     *cs_base = 0;
- {
--    RISCVCPU *cpu = env_archcpu(env);
+-    if (cpu->cfg.ext_zve32f) {
-     int irq, best_irq = RISCV_EXCP_NONE;
++    if (cpu->cfg.ext_zve32x) {
-     unsigned int prio, best_prio = UINT_MAX;
+         /*
+          * If env->vl equals to VLMAX, we can use generic vector operation
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
+          * expanders (GVEC) to accerlate the vector operations.
      }
      irq = ctz64(pending);
 -    if (!((extirq == IRQ_M_EXT) ? cpu->cfg.ext_smaia : cpu->cfg.ext_ssaia)) {
 +    if (!((extirq == IRQ_M_EXT) ? riscv_cpu_cfg(env)->ext_smaia :
 +                                  riscv_cpu_cfg(env)->ext_ssaia)) {
          return irq;
      }
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      int mode = mmu_idx & TB_FLAGS_PRIV_MMU_MASK;
      bool use_background = false;
      hwaddr ppn;
 -    RISCVCPU *cpu = env_archcpu(env);
      int napot_bits = 0;
      target_ulong napot_mask;
@@ -XXX,XX +XXX,XX @@ restart:
          if (riscv_cpu_sxl(env) == MXL_RV32) {
              ppn = pte >> PTE_PPN_SHIFT;
 -        } else if (pbmte || cpu->cfg.ext_svnapot) {
 +        } else if (pbmte || riscv_cpu_cfg(env)->ext_svnapot) {
              ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
          } else {
              ppn = pte >> PTE_PPN_SHIFT;
@@ -XXX,XX +XXX,XX @@ restart:
                 benefit. */
              target_ulong vpn = addr >> PGSHIFT;
 -            if (cpu->cfg.ext_svnapot && (pte & PTE_N)) {
 +            if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
                  napot_bits = ctzl(ppn) + 1;
                  if ((i != (levels - 1)) || (napot_bits != 4)) {
                      return TRANSLATE_FAIL;
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
 @@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
  static RISCVException vs(CPURISCVState *env, int csrno)
  {
--    RISCVCPU *cpu = env_archcpu(env);
+-    if (riscv_cpu_cfg(env)->ext_zve32f) {
--
++    if (riscv_cpu_cfg(env)->ext_zve32x) {
 -    if (cpu->cfg.ext_zve32f) {
 +    if (riscv_cpu_cfg(env)->ext_zve32f) {
  #if !defined(CONFIG_USER_ONLY)
          if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
              return RISCV_EXCP_ILLEGAL_INST;
-@@ -XXX,XX +XXX,XX @@ static RISCVException mctr32(CPURISCVState *env, int csrno)
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
- static RISCVException sscofpmf(CPURISCVState *env, int csrno)
+--- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 -    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
 -        error_setg(errp, "Zve32f/Zve64f extensions require F extension");
 -        return;
 +    /* The Zve32f extension depends on the Zve32x extension */
 +    if (cpu->cfg.ext_zve32f) {
 +        if (!riscv_has_ext(env, RVF)) {
 +            error_setg(errp, "Zve32f/Zve64f extensions require F extension");
 +            return;
 +        }
 +        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
      }
      if (cpu->cfg.ext_zvfh) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zvbc), true);
      }
 -    /*
 -     * In principle Zve*x would also suffice here, were they supported
 -     * in qemu
 -     */
      if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkb || cpu->cfg.ext_zvkg ||
           cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32x) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
  {
--    RISCVCPU *cpu = env_archcpu(env);
+     TCGv s1, dst;
--
--    if (!cpu->cfg.ext_sscofpmf) {
+-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
-+    if (!riscv_cpu_cfg(env)->ext_sscofpmf) {
++    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
-         return RISCV_EXCP_ILLEGAL_INST;
+         return false;
      }
-@@ -XXX,XX +XXX,XX @@ static RISCVException umode32(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
  static RISCVException mstateen(CPURISCVState *env, int csrno)
  {
--    RISCVCPU *cpu = env_archcpu(env);
+     TCGv dst;
--
--    if (!cpu->cfg.ext_smstateen) {
+-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
-+    if (!riscv_cpu_cfg(env)->ext_smstateen) {
++    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
-         return RISCV_EXCP_ILLEGAL_INST;
+         return false;
      }
-@@ -XXX,XX +XXX,XX @@ static RISCVException mstateen(CPURISCVState *env, int csrno)
- static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
- {
--    RISCVCPU *cpu = env_archcpu(env);
--
--    if (!cpu->cfg.ext_smstateen) {
-+    if (!riscv_cpu_cfg(env)->ext_smstateen) {
-         return RISCV_EXCP_ILLEGAL_INST;
-     }
-@@ -XXX,XX +XXX,XX @@ static RISCVException sstateen(CPURISCVState *env, int csrno)
- static RISCVException sstc(CPURISCVState *env, int csrno)
- {
--    RISCVCPU *cpu = env_archcpu(env);
-     bool hmode_check = false;
--    if (!cpu->cfg.ext_sstc || !env->rdtime_fn) {
-+    if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn) {
-         return RISCV_EXCP_ILLEGAL_INST;
-     }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_ignore(CPURISCVState *env, int csrno,
- static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
- {
--    RISCVCPU *cpu = env_archcpu(env);
--
--    *val = cpu->cfg.mvendorid;
-+    *val = riscv_cpu_cfg(env)->mvendorid;
-     return RISCV_EXCP_NONE;
- }
- static RISCVException read_marchid(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
- {
--    RISCVCPU *cpu = env_archcpu(env);
--
--    *val = cpu->cfg.marchid;
-+    *val = riscv_cpu_cfg(env)->marchid;
-     return RISCV_EXCP_NONE;
- }
- static RISCVException read_mimpid(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
- {
--    RISCVCPU *cpu = env_archcpu(env);
--
--    *val = cpu->cfg.mimpid;
-+    *val = riscv_cpu_cfg(env)->mimpid;
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_mstatus(CPURISCVState *env, int csrno,
- static bool validate_vm(CPURISCVState *env, target_ulong vm)
- {
--    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
--
--    return (vm & 0xf) <= satp_mode_max_from_map(cpu->cfg.satp_mode.map);
-+    return (vm & 0xf) <=
-+           satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
- }
- static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
- static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-                                     target_ulong val)
- {
--    RISCVCPUConfig *cfg = &env_archcpu(env)->cfg;
-+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
-     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
-     if (riscv_cpu_mxl(env) == MXL_RV64) {
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
- static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
-                                      target_ulong val)
- {
--    RISCVCPUConfig *cfg = &env_archcpu(env)->cfg;
-+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
-     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                     (cfg->ext_svadu ? MENVCFG_HADE : 0);
-diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/gdbstub.c
-+++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_fpu(CPURISCVState *env, uint8_t *mem_buf, int n)
- static int riscv_gdb_get_vector(CPURISCVState *env, GByteArray *buf, int n)
- {
--    uint16_t vlenb = env_archcpu(env)->cfg.vlen >> 3;
-+    uint16_t vlenb = riscv_cpu_cfg(env)->vlen >> 3;
-     if (n < 32) {
-         int i;
-         int cnt = 0;
-@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_vector(CPURISCVState *env, GByteArray *buf, int n)
- static int riscv_gdb_set_vector(CPURISCVState *env, uint8_t *mem_buf, int n)
- {
--    uint16_t vlenb = env_archcpu(env)->cfg.vlen >> 3;
-+    uint16_t vlenb = riscv_cpu_cfg(env)->vlen >> 3;
-     if (n < 32) {
-         int i;
-         for (i = 0; i < vlenb; i += 8) {
 --
-.40.0
+.45.1

-[PULL 02/89] target/riscv: Fix priv version dependency for vector and zfh
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Vector implicitly enables zve64d, zve64f, zve32f sub extensions. As vector
-only requires PRIV_1_10_0, these sub extensions should not require priv version
-higher than that.
-The same for Zfh.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-Id: <20230321043415.754-1-zhiwei_liu@linux.alibaba.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
-     ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
-     ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_11_0, ext_zfh),
--    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
-+    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_11_0, ext_zfhmin),
-     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
-     ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
-     ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zksed, true, PRIV_VERSION_1_12_0, ext_zksed),
-     ISA_EXT_DATA_ENTRY(zksh, true, PRIV_VERSION_1_12_0, ext_zksh),
-     ISA_EXT_DATA_ENTRY(zkt, true, PRIV_VERSION_1_12_0, ext_zkt),
--    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_12_0, ext_zve32f),
--    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_12_0, ext_zve64f),
--    ISA_EXT_DATA_ENTRY(zve64d, true, PRIV_VERSION_1_12_0, ext_zve64d),
-+    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_10_0, ext_zve32f),
-+    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_10_0, ext_zve64f),
-+    ISA_EXT_DATA_ENTRY(zve64d, true, PRIV_VERSION_1_10_0, ext_zve64d),
-     ISA_EXT_DATA_ENTRY(zvfh, true, PRIV_VERSION_1_12_0, ext_zvfh),
-     ISA_EXT_DATA_ENTRY(zvfhmin, true, PRIV_VERSION_1_12_0, ext_zvfhmin),
-     ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
---
-.40.0

-[PULL 03/89] target/riscv: Simplify getting RISCVCPU pointer from env
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Use env_archcpu() to get RISCVCPU pointer from env directly.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20230309071329.45932-3-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/pmu.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmu.c
-+++ b/target/riscv/pmu.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
-         return true;
-     }
--    cpu = RISCV_CPU(env_cpu(env));
-+    cpu = env_archcpu(env);
-     if (!cpu->pmu_event_ctr_map) {
-         return false;
-     }
-@@ -XXX,XX +XXX,XX @@ bool riscv_pmu_ctr_monitor_cycles(CPURISCVState *env, uint32_t target_ctr)
-         return true;
-     }
--    cpu = RISCV_CPU(env_cpu(env));
-+    cpu = env_archcpu(env);
-     if (!cpu->pmu_event_ctr_map) {
-         return false;
-     }
-@@ -XXX,XX +XXX,XX @@ int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
-                                uint32_t ctr_idx)
- {
-     uint32_t event_idx;
--    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
-+    RISCVCPU *cpu = env_archcpu(env);
-     if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->pmu_event_ctr_map) {
-         return -1;
-@@ -XXX,XX +XXX,XX @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value, uint32_t ctr_idx)
- {
-     uint64_t overflow_delta, overflow_at;
-     int64_t overflow_ns, overflow_left = 0;
--    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
-+    RISCVCPU *cpu = env_archcpu(env);
-     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
-     if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->cfg.ext_sscofpmf) {
---
-.40.0

-[PULL 41/89] target/riscv: remove cpu->cfg.ext_i
+[PULL 11/28] target/riscv: Add support for Zve64x extension
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Jason Chien <jason.chien@sifive.com>
-Create a new "i" RISCVCPUMisaExtConfig property that will update
+Add support for Zve64x extension. Enabling Zve64f enables Zve64x and
-env->misa_ext* with RVI. Instances of cpu->cfg.ext_i and similar are
+enabling Zve64x enables Zve32x according to their dependency.
 replaced with riscv_has_ext(env, RVI).
-Remove the old "i" property and 'ext_i' from RISCVCPUConfig.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2107
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230406180351.570807-10-dbarboza@ventanamicro.com>
+Message-ID: <20240328022343.6871-3-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |  1 -
+ target/riscv/cpu_cfg.h     |  1 +
- target/riscv/cpu.c | 15 +++++++--------
+ target/riscv/cpu.c         |  2 ++
-files changed, 7 insertions(+), 9 deletions(-)
+ target/riscv/tcg/tcg-cpu.c | 17 +++++++++++------
 files changed, 14 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
- } RISCVSATPMap;
+     bool ext_zve32x;
+     bool ext_zve64f;
- struct RISCVCPUConfig {
+     bool ext_zve64d;
--    bool ext_i;
++    bool ext_zve64x;
-     bool ext_e;
+     bool ext_zvbb;
-     bool ext_g;
+     bool ext_zvbc;
-     bool ext_m;
+     bool ext_zvkb;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     CPURISCVState *env = &cpu->env;
+     ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     /* Do some ISA extension error checking */
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
--    if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
++    ISA_EXT_DATA_ENTRY(zve64x, PRIV_VERSION_1_10_0, ext_zve64x),
-+    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) && cpu->cfg.ext_m &&
+     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
-                             riscv_has_ext(env, RVA) &&
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
-                             riscv_has_ext(env, RVF) &&
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
-                             riscv_has_ext(env, RVD) &&
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
+     MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
-         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
+     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
--        cpu->cfg.ext_i = true;
+     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
-         cpu->cfg.ext_m = true;
++    MULTI_EXT_CFG_BOOL("zve64x", ext_zve64x, false),
-         cpu->cfg.ext_icsr = true;
+     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
-         cpu->cfg.ext_ifencei = true;
+     MULTI_EXT_CFG_BOOL("zvfbfwma", ext_zvfbfwma, false),
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+     MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
-         env->misa_ext_mask = env->misa_ext;
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      /* The Zve64d extension depends on the Zve64f extension */
      if (cpu->cfg.ext_zve64d) {
 +        if (!riscv_has_ext(env, RVD)) {
 +            error_setg(errp, "Zve64d/V extensions require D extension");
 +            return;
 +        }
          cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve64f), true);
      }
--    if (cpu->cfg.ext_i && cpu->cfg.ext_e) {
+-    /* The Zve64f extension depends on the Zve32f extension */
-+    if (riscv_has_ext(env, RVI) && cpu->cfg.ext_e) {
++    /* The Zve64f extension depends on the Zve64x and Zve32f extensions */
-         error_setg(errp,
+     if (cpu->cfg.ext_zve64f) {
-                    "I and E extensions are incompatible");
++        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve64x), true);
          cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32f), true);
      }
 -    if (cpu->cfg.ext_zve64d && !riscv_has_ext(env, RVD)) {
 -        error_setg(errp, "Zve64d/V extensions require D extension");
 -        return;
 +    /* The Zve64x extension depends on the Zve32x extension */
 +    if (cpu->cfg.ext_zve64x) {
 +        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
      }
      /* The Zve32f extension depends on the Zve32x extension */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
--    if (!cpu->cfg.ext_i && !cpu->cfg.ext_e) {
+-    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
-+    if (!riscv_has_ext(env, RVI) && !cpu->cfg.ext_e) {
++    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64x) {
-         error_setg(errp,
+         error_setg(
-                    "Either I or E extension must be set");
+             errp,
-         return;
+-            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
++            "Zvbc and Zvknhb extensions require V or Zve64x extensions");
          return;
      }
--    if (cpu->cfg.ext_h && !cpu->cfg.ext_i) {
-+    if (cpu->cfg.ext_h && !riscv_has_ext(env, RVI)) {
-         error_setg(errp,
-                    "H depends on an I base integer ISA with 32 x registers");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
- {
-     uint32_t ext = 0;
--    if (riscv_cpu_cfg(env)->ext_i) {
-+    if (riscv_has_ext(env, RVI)) {
-         ext |= RVI;
-     }
-     if (riscv_cpu_cfg(env)->ext_e) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVD, .enabled = true},
-     {.name = "f", .description = "Single-precision float point",
-      .misa_bit = RVF, .enabled = true},
-+    {.name = "i", .description = "Base integer instruction set",
-+     .misa_bit = RVI, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
--    DEFINE_PROP_BOOL("i", RISCVCPU, cfg.ext_i, true),
-     DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      * later on.
-      */
-     if (cpu->env.misa_ext != 0) {
--        cpu->cfg.ext_i = misa_ext & RVI;
-         cpu->cfg.ext_e = misa_ext & RVE;
-         cpu->cfg.ext_m = misa_ext & RVM;
-         cpu->cfg.ext_v = misa_ext & RVV;
 --
-.40.0
+.45.1

-[PULL 31/89] target/riscv: Fix lines with over 80 characters
+[PULL 12/28] target/riscv: Relax vector register check in RISCV gdbstub
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Jason Chien <jason.chien@sifive.com>
-Fix lines with over 80 characters for both code and comments.
+In current implementation, the gdbstub allows reading vector registers
 only if V extension is supported. However, all vector extensions and
 vector crypto extensions have the vector registers and they all depend
 on Zve32x. The gdbstub should check for Zve32x instead.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20240328022343.6871-4-jason.chien@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230405085813.40643-5-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h           |  4 +-
+ target/riscv/gdbstub.c | 2 +-
- target/riscv/cpu.c           |  3 +-
+file changed, 1 insertion(+), 1 deletion(-)
  target/riscv/cpu_helper.c    |  3 +-
  target/riscv/csr.c           | 38 ++++++++++--------
  target/riscv/debug.c         | 11 +++---
  target/riscv/gdbstub.c       |  3 +-
  target/riscv/pmp.c           |  6 ++-
  target/riscv/pmu.c           |  3 +-
  target/riscv/vector_helper.c | 76 ++++++++++++++++++++++++------------
 files changed, 91 insertions(+), 56 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
- bool riscv_cpu_two_stage_lookup(int mmu_idx);
- int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
- G_NORETURN void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
--                                               MMUAccessType access_type, int mmu_idx,
--                                               uintptr_t retaddr);
-+                                               MMUAccessType access_type,
-+                                               int mmu_idx, uintptr_t retaddr);
- bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                         MMUAccessType access_type, int mmu_idx,
-                         bool probe, uintptr_t retaddr);
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     device_class_set_props(dc, riscv_cpu_properties);
- }
--static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str, int max_str_len)
-+static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
-+                                 int max_str_len)
- {
-     char *old = *isa_str;
-     char *new = *isa_str;
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
-             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
-         } else {
-             cs->exception_index = page_fault_exceptions ?
--                RISCV_EXCP_STORE_PAGE_FAULT : RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
-+                RISCV_EXCP_STORE_PAGE_FAULT :
-+                RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
-         }
-         break;
-     default:
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
- static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP |
-                                               SIP_LCOFIP;
- static const target_ulong hip_writable_mask = MIP_VSSIP;
--static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
-+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP |
-+                                               MIP_VSEIP;
- static const target_ulong vsip_writable_mask = MIP_VSSIP;
- const bool valid_vm_1_10_32[16] = {
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
- static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
-                                         Int128 *val)
- {
--    *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128, env->mstatus));
-+    *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128,
-+                                                      env->mstatus));
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstatus(CPURISCVState *env, int csrno,
- {
-     env->hstatus = val;
-     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
--        qemu_log_mask(LOG_UNIMP, "QEMU does not support mixed HSXLEN options.");
-+        qemu_log_mask(LOG_UNIMP,
-+                      "QEMU does not support mixed HSXLEN options.");
-     }
-     if (get_field(val, HSTATUS_VSBE) != 0) {
-         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mmte(CPURISCVState *env, int csrno,
-     target_ulong wpri_val = val & MMTE_MASK;
-     if (val != wpri_val) {
--        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
--                      "MMTE: WPRI violation written 0x", val,
--                      "vs expected 0x", wpri_val);
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
-+                      TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
-+                      val, "vs expected 0x", wpri_val);
-     }
-     /* for machine mode pm.current is hardwired to 1 */
-     wpri_val |= MMTE_M_PM_CURRENT;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_smte(CPURISCVState *env, int csrno,
-     target_ulong wpri_val = val & SMTE_MASK;
-     if (val != wpri_val) {
--        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
--                      "SMTE: WPRI violation written 0x", val,
--                      "vs expected 0x", wpri_val);
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
-+                      TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
-+                      val, "vs expected 0x", wpri_val);
-     }
-     /* if pm.current==0 we can't modify current PM CSRs */
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_umte(CPURISCVState *env, int csrno,
-     target_ulong wpri_val = val & UMTE_MASK;
-     if (val != wpri_val) {
--        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
--                      "UMTE: WPRI violation written 0x", val,
--                      "vs expected 0x", wpri_val);
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
-+                      TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
-+                      val, "vs expected 0x", wpri_val);
-     }
-     if (check_pm_current_disabled(env, csrno)) {
-@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
-      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
-      * at all defined.
-      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
--     * significant), for those, this fallback is correctly handling the accesses
-+     * significant), for those, this fallback is correctly handling the
-+     * accesses
-      */
-     target_ulong old_value;
-     ret = riscv_csrrw_do64(env, csrno, &old_value,
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     /* Supervisor Trap Setup */
-     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
--                         NULL,                read_sstatus_i128               },
--    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie        },
--    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec    },
-+                         NULL,                read_sstatus_i128              },
-+    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie       },
-+    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec   },
-     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
--                         write_scounteren                                     },
-+                         write_scounteren                                    },
-     /* Supervisor Trap Handling */
-     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
-diff --git a/target/riscv/debug.c b/target/riscv/debug.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/debug.c
-+++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong type2_mcontrol_validate(CPURISCVState *env,
-     /* validate size encoding */
-     size = type2_breakpoint_size(env, ctrl);
-     if (access_size[size] == -1) {
--        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
--                      size);
-+        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
-+                                 "SIZE_ANY\n", size);
-     } else {
-         val |= (ctrl & TYPE2_SIZELO);
-         if (riscv_cpu_mxl(env) == MXL_RV64) {
-@@ -XXX,XX +XXX,XX @@ static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
-     /* validate size encoding */
-     size = extract32(ctrl, 16, 4);
-     if (access_size[size] == -1) {
--        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
--                      size);
-+        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
-+                                 "SIZE_ANY\n", size);
-     } else {
-         val |= (ctrl & TYPE6_SIZE);
-     }
-@@ -XXX,XX +XXX,XX @@ target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
-     int trigger_type;
-     switch (tdata_index) {
-     case TDATA1:
--        trigger_type = extract_trigger_type(env, env->tdata1[env->trigger_cur]);
-+        trigger_type = extract_trigger_type(env,
-+                                            env->tdata1[env->trigger_cur]);
-         if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
-             return deposit64(env->tdata1[env->trigger_cur], 10, 14,
-                              itrigger_get_adjust_count(env));
 diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/gdbstub.c
 +++ b/target/riscv/gdbstub.c
 @@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
+                                  gdb_find_static_feature("riscv-32bit-fpu.xml"),
+);
      }
-     if (env->misa_ext & RVV) {
+-    if (env->misa_ext & RVV) {
-         int base_reg = cs->gdb_num_regs;
++    if (cpu->cfg.ext_zve32x) {
--        gdb_register_coprocessor(cs, riscv_gdb_get_vector, riscv_gdb_set_vector,
+         gdb_register_coprocessor(cs, riscv_gdb_get_vector,
-+        gdb_register_coprocessor(cs, riscv_gdb_get_vector,
+                                  riscv_gdb_set_vector,
-+                                 riscv_gdb_set_vector,
+                                  ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
                                   ricsv_gen_dynamic_vector_xml(cs, base_reg),
                                   "riscv-vector.xml", 0);
      }
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
      }
  }
 -static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 +static void pmp_decode_napot(target_ulong a, target_ulong *sa,
 +                             target_ulong *ea)
  {
      /*
       * aaaa...aaa0   8-byte NAPOT range
@@ -XXX,XX +XXX,XX @@ static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
      pmp_update_rule_nums(env);
  }
 -static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 +static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
 +                           target_ulong addr)
  {
      int result = 0;
 diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmu.c
 +++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value, uint32_t ctr_idx)
      } else {
          return -1;
      }
 -    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + overflow_ns;
 +    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 +                  overflow_ns;
      if (overflow_at > INT64_MAX) {
          overflow_left += overflow_at - INT64_MAX;
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
  }
  /*
 - * masked unit-stride load and store operation will be a special case of stride,
 - * stride = NF * sizeof (MTYPE)
 + * masked unit-stride load and store operation will be a special case of
 + * stride, stride = NF * sizeof (MTYPE)
   */
  #define GEN_VEXT_LD_US(NAME, ETYPE, LOAD_FN)                            \
@@ -XXX,XX +XXX,XX @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
          /* load/store rest of elements of current segment pointed by vstart */
          for (pos = off; pos < max_elems; pos++, env->vstart++) {
              target_ulong addr = base + ((pos + k * max_elems) << log2_esz);
 -            ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd, ra);
 +            ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd,
 +                      ra);
          }
          k++;
      }
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_SHIFT_VV(vsra_vv_h, uint16_t, int16_t, H2, H2, DO_SRL, 0xf)
  GEN_VEXT_SHIFT_VV(vsra_vv_w, uint32_t, int32_t, H4, H4, DO_SRL, 0x1f)
  GEN_VEXT_SHIFT_VV(vsra_vv_d, uint64_t, int64_t, H8, H8, DO_SRL, 0x3f)
 -/* generate the helpers for shift instructions with one vector and one scalar */
 +/*
 + * generate the helpers for shift instructions with one vector and one scalar
 + */
  #define GEN_VEXT_SHIFT_VX(NAME, TD, TS2, HD, HS2, OP, MASK) \
  void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
                    void *vs2, CPURISCVState *env,            \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,     \
                   do_##NAME, ESZ);                               \
  }
 -static inline uint8_t saddu8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t b)
 +static inline uint8_t saddu8(CPURISCVState *env, int vxrm, uint8_t a,
 +                             uint8_t b)
  {
      uint8_t res = a + b;
      if (res < a) {
@@ -XXX,XX +XXX,XX @@ static inline int8_t sadd8(CPURISCVState *env, int vxrm, int8_t a, int8_t b)
      return res;
  }
 -static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
 +static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a,
 +                             int16_t b)
  {
      int16_t res = a + b;
      if ((res ^ a) & (res ^ b) & INT16_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
      return res;
  }
 -static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
 +static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a,
 +                             int32_t b)
  {
      int32_t res = a + b;
      if ((res ^ a) & (res ^ b) & INT32_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
      return res;
  }
 -static inline int64_t sadd64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
 +static inline int64_t sadd64(CPURISCVState *env, int vxrm, int64_t a,
 +                             int64_t b)
  {
      int64_t res = a + b;
      if ((res ^ a) & (res ^ b) & INT64_MIN) {
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX_RM(vsadd_vx_h, 2)
  GEN_VEXT_VX_RM(vsadd_vx_w, 4)
  GEN_VEXT_VX_RM(vsadd_vx_d, 8)
 -static inline uint8_t ssubu8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t b)
 +static inline uint8_t ssubu8(CPURISCVState *env, int vxrm, uint8_t a,
 +                             uint8_t b)
  {
      uint8_t res = a - b;
      if (res > a) {
@@ -XXX,XX +XXX,XX @@ static inline int8_t ssub8(CPURISCVState *env, int vxrm, int8_t a, int8_t b)
      return res;
  }
 -static inline int16_t ssub16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
 +static inline int16_t ssub16(CPURISCVState *env, int vxrm, int16_t a,
 +                             int16_t b)
  {
      int16_t res = a - b;
      if ((res ^ a) & (a ^ b) & INT16_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int16_t ssub16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
      return res;
  }
 -static inline int32_t ssub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
 +static inline int32_t ssub32(CPURISCVState *env, int vxrm, int32_t a,
 +                             int32_t b)
  {
      int32_t res = a - b;
      if ((res ^ a) & (a ^ b) & INT32_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int32_t ssub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
      return res;
  }
 -static inline int64_t ssub64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
 +static inline int64_t ssub64(CPURISCVState *env, int vxrm, int64_t a,
 +                             int64_t b)
  {
      int64_t res = a - b;
      if ((res ^ a) & (a ^ b) & INT64_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline uint8_t get_round(int vxrm, uint64_t v, uint8_t shift)
      return 0; /* round-down (truncate) */
  }
 -static inline int32_t aadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
 +static inline int32_t aadd32(CPURISCVState *env, int vxrm, int32_t a,
 +                             int32_t b)
  {
      int64_t res = (int64_t)a + b;
      uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ static inline int32_t aadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
      return (res >> 1) + round;
  }
 -static inline int64_t aadd64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
 +static inline int64_t aadd64(CPURISCVState *env, int vxrm, int64_t a,
 +                             int64_t b)
  {
      int64_t res = a + b;
      uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX_RM(vaaddu_vx_h, 2)
  GEN_VEXT_VX_RM(vaaddu_vx_w, 4)
  GEN_VEXT_VX_RM(vaaddu_vx_d, 8)
 -static inline int32_t asub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
 +static inline int32_t asub32(CPURISCVState *env, int vxrm, int32_t a,
 +                             int32_t b)
  {
      int64_t res = (int64_t)a - b;
      uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ static inline int32_t asub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
      return (res >> 1) + round;
  }
 -static inline int64_t asub64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
 +static inline int64_t asub64(CPURISCVState *env, int vxrm, int64_t a,
 +                             int64_t b)
  {
      int64_t res = (int64_t)a - b;
      uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_x_f_v_w, WOP_UU_W, H8, H4, float32_to_int64)
  GEN_VEXT_V_ENV(vfwcvt_x_f_v_h, 4)
  GEN_VEXT_V_ENV(vfwcvt_x_f_v_w, 8)
 -/* vfwcvt.f.xu.v vd, vs2, vm # Convert unsigned integer to double-width float */
 +/*
 + * vfwcvt.f.xu.v vd, vs2, vm # Convert unsigned integer to double-width float.
 + */
  RVVCALL(OPFVV1, vfwcvt_f_xu_v_b, WOP_UU_B, H2, H1, uint8_to_float16)
  RVVCALL(OPFVV1, vfwcvt_f_xu_v_h, WOP_UU_H, H4, H2, uint16_to_float32)
  RVVCALL(OPFVV1, vfwcvt_f_xu_v_w, WOP_UU_W, H8, H4, uint32_to_float64)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfwcvt_f_x_v_h, 4)
  GEN_VEXT_V_ENV(vfwcvt_f_x_v_w, 8)
  /*
 - * vfwcvt.f.f.v vd, vs2, vm
 - * Convert single-width float to double-width float.
 + * vfwcvt.f.f.v vd, vs2, vm # Convert single-width float to double-width float.
   */
  static uint32_t vfwcvtffv16(uint16_t a, float_status *s)
  {
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfncvt_x_f_w_b, 1)
  GEN_VEXT_V_ENV(vfncvt_x_f_w_h, 2)
  GEN_VEXT_V_ENV(vfncvt_x_f_w_w, 4)
 -/* vfncvt.f.xu.v vd, vs2, vm # Convert double-width unsigned integer to float */
 +/*
 + * vfncvt.f.xu.v vd, vs2, vm # Convert double-width unsigned integer to float.
 + */
  RVVCALL(OPFVV1, vfncvt_f_xu_w_h, NOP_UU_H, H2, H4, uint32_to_float16)
  RVVCALL(OPFVV1, vfncvt_f_xu_w_w, NOP_UU_W, H4, H8, uint64_to_float32)
  GEN_VEXT_V_ENV(vfncvt_f_xu_w_h, 2)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_FRED(vfredosum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
  GEN_VEXT_FRED(vfredosum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
  /* Maximum value */
 -GEN_VEXT_FRED(vfredmax_vs_h, uint16_t, uint16_t, H2, H2, float16_maximum_number)
 -GEN_VEXT_FRED(vfredmax_vs_w, uint32_t, uint32_t, H4, H4, float32_maximum_number)
 -GEN_VEXT_FRED(vfredmax_vs_d, uint64_t, uint64_t, H8, H8, float64_maximum_number)
 +GEN_VEXT_FRED(vfredmax_vs_h, uint16_t, uint16_t, H2, H2,
 +              float16_maximum_number)
 +GEN_VEXT_FRED(vfredmax_vs_w, uint32_t, uint32_t, H4, H4,
 +              float32_maximum_number)
 +GEN_VEXT_FRED(vfredmax_vs_d, uint64_t, uint64_t, H8, H8,
 +              float64_maximum_number)
  /* Minimum value */
 -GEN_VEXT_FRED(vfredmin_vs_h, uint16_t, uint16_t, H2, H2, float16_minimum_number)
 -GEN_VEXT_FRED(vfredmin_vs_w, uint32_t, uint32_t, H4, H4, float32_minimum_number)
 -GEN_VEXT_FRED(vfredmin_vs_d, uint64_t, uint64_t, H8, H8, float64_minimum_number)
 +GEN_VEXT_FRED(vfredmin_vs_h, uint16_t, uint16_t, H2, H2,
 +              float16_minimum_number)
 +GEN_VEXT_FRED(vfredmin_vs_w, uint32_t, uint32_t, H4, H4,
 +              float32_minimum_number)
 +GEN_VEXT_FRED(vfredmin_vs_d, uint64_t, uint64_t, H8, H8,
 +              float64_minimum_number)
  /* Vector Widening Floating-Point Add Instructions */
  static uint32_t fwadd16(uint32_t a, uint16_t b, float_status *s)
 --
-.40.0
+.45.1

-[PULL 80/89] target/riscv: Reorg access check in get_physical_address
+[PULL 13/28] target/riscv: Fix the element agnostic function problem
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Huang Tao <eric.huang@linux.alibaba.com>
-We were effectively computing the protection bits twice,
+In RVV and vcrypto instructions, the masked and tail elements are set to 1s
-once while performing access checks and once while returning
+using vext_set_elems_1s function if the vma/vta bit is set. It is the element
-the valid bits to the caller.  Reorg so we do this once.
+agnostic policy.
-Move the computation of mxr close to its single use.
+However, this function can't deal the big endian situation. This patch fixes
 the problem by adding handling of such case.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230325105429.1142530-25-richard.henderson@linaro.org>
+Message-ID: <20240325021654.6594-1-eric.huang@linux.alibaba.com>
 Message-Id: <20230412114333.118895-25-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 69 ++++++++++++++++++++-------------------
+ target/riscv/vector_internals.c | 22 ++++++++++++++++++++++
-file changed, 36 insertions(+), 33 deletions(-)
+file changed, 22 insertions(+)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/vector_internals.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/vector_internals.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-  * @is_debug: Is this access from a debugger or the monitor?
+     if (tot - cnt == 0) {
-  */
+         return ;
  static int get_physical_address(CPURISCVState *env, hwaddr *physical,
 -                                int *prot, vaddr addr,
 +                                int *ret_prot, vaddr addr,
                                  target_ulong *fault_pte_addr,
                                  int access_type, int mmu_idx,
                                  bool first_stage, bool two_stage,
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      if (mode == PRV_M || !riscv_cpu_cfg(env)->mmu) {
          *physical = addr;
 -        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 +        *ret_prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
          return TRANSLATE_SUCCESS;
      }
++
--    *prot = 0;
++    if (HOST_BIG_ENDIAN) {
-+    *ret_prot = 0;
++        /*
++         * Deal the situation when the elements are insdie
-     hwaddr base;
++         * only one uint64 block including setting the
--    int levels, ptidxbits, ptesize, vm, sum, mxr, widened;
++         * masked-off element.
--
++         */
--    if (first_stage == true) {
++        if (((tot - 1) ^ cnt) < 8) {
--        mxr = get_field(env->mstatus, MSTATUS_MXR);
++            memset(base + H1(tot - 1), -1, tot - cnt);
--    } else {
++            return;
--        mxr = get_field(env->vsstatus, MSTATUS_MXR);
++        }
--    }
++        /*
-+    int levels, ptidxbits, ptesize, vm, sum, widened;
++         * Otherwise, at least cross two uint64_t blocks.
++         * Set first unaligned block.
-     if (first_stage == true) {
++         */
-         if (use_background) {
++        if (cnt % 8 != 0) {
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
++            uint32_t j = ROUND_UP(cnt, 8);
-       levels = 5; ptidxbits = 9; ptesize = 8; break;
++            memset(base + H1(j - 1), -1, j - cnt);
-     case VM_1_10_MBARE:
++            cnt = j;
-         *physical = addr;
++        }
--        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
++        /* Set other 64bit aligend blocks */
 +        *ret_prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
          return TRANSLATE_SUCCESS;
      default:
        g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ restart:
          return TRANSLATE_FAIL;
      }
 +    int prot = 0;
 +    if (pte & PTE_R) {
 +        prot |= PAGE_READ;
 +    }
-+    if (pte & PTE_W) {
+     memset(base + cnt, -1, tot - cnt);
 +        prot |= PAGE_WRITE;
 +    }
 +    if (pte & PTE_X) {
 +        bool mxr;
 +
 +        if (first_stage == true) {
 +            mxr = get_field(env->mstatus, MSTATUS_MXR);
 +        } else {
 +            mxr = get_field(env->vsstatus, MSTATUS_MXR);
 +        }
 +        if (mxr) {
 +            prot |= PAGE_READ;
 +        }
 +        prot |= PAGE_EXEC;
 +    }
 +
      if ((pte & PTE_U) &&
          ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
          /*
@@ -XXX,XX +XXX,XX @@ restart:
          /* Supervisor PTE flags when not S mode */
          return TRANSLATE_FAIL;
      }
 -    if (access_type == MMU_DATA_LOAD &&
 -        !((pte & PTE_R) || ((pte & PTE_X) && mxr))) {
 -        /* Read access check failed */
 -        return TRANSLATE_FAIL;
 -    }
 -    if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
 -        /* Write access check failed */
 -        return TRANSLATE_FAIL;
 -    }
 -    if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
 -        /* Fetch access check failed */
 +
 +    if (!((prot >> access_type) & 1)) {
 +        /* Access check failed */
          return TRANSLATE_FAIL;
      }
@@ -XXX,XX +XXX,XX @@ restart:
                    (vpn & (((target_ulong)1 << ptshift) - 1))
                   ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
 -    /* set permissions on the TLB entry */
 -    if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
 -        *prot |= PAGE_READ;
 -    }
 -    if (pte & PTE_X) {
 -        *prot |= PAGE_EXEC;
 -    }
      /*
 -     * Add write permission on stores or if the page is already dirty,
 -     * so that we TLB miss on later writes to update the dirty bit.
 +     * Remove write permission unless this is a store, or the page is
 +     * already dirty, so that we TLB miss on later writes to update
 +     * the dirty bit.
       */
 -    if ((pte & PTE_W) && (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
 -        *prot |= PAGE_WRITE;
 +    if (access_type != MMU_DATA_STORE && !(pte & PTE_D)) {
 +        prot &= ~PAGE_WRITE;
      }
 +    *ret_prot = prot;
 +
      return TRANSLATE_SUCCESS;
  }
 --
-.40.0
+.45.1

-[PULL 16/89] target/riscv: expose properties for Zc* extension
+[PULL 14/28] target/riscv/cpu.c: fix Zvkb extension config
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Yangyu Chen <cyy@cyyself.name>
-Expose zca,zcb,zcf,zcd,zcmp,zcmt properties.
+This code has a typo that writes zvkb to zvkg, causing users can't
 enable zvkb through the config. This patch gets this fixed.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Yangyu Chen <cyy@cyyself.name>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Fixes: ea61ef7097d0 ("target/riscv: Move vector crypto extensions to riscv_cpu_extensions")
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-9-liweiwei@iscas.ac.cn>
+Reviewed-by: Max Chou <max.chou@sifive.com>
 Reviewed-by:  Weiwei Li <liwei1518@gmail.com>
 Message-ID: <tencent_7E34EEF0F90B9A68BF38BEE09EC6D4877C0A@qq.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 14 ++++++++++++++
+ target/riscv/cpu.c | 2 +-
-file changed, 14 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-     ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_11_0, ext_zfhmin),
+     /* Vector cryptography extensions */
-     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
+     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
-     ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
+     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
-+    ISA_EXT_DATA_ENTRY(zca, true, PRIV_VERSION_1_12_0, ext_zca),
+-    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
-+    ISA_EXT_DATA_ENTRY(zcb, true, PRIV_VERSION_1_12_0, ext_zcb),
++    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkb, false),
-+    ISA_EXT_DATA_ENTRY(zcf, true, PRIV_VERSION_1_12_0, ext_zcf),
+     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
-+    ISA_EXT_DATA_ENTRY(zcd, true, PRIV_VERSION_1_12_0, ext_zcd),
+     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
-+    ISA_EXT_DATA_ENTRY(zcmp, true, PRIV_VERSION_1_12_0, ext_zcmp),
+     MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
 +    ISA_EXT_DATA_ENTRY(zcmt, true, PRIV_VERSION_1_12_0, ext_zcmt),
      ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
      ISA_EXT_DATA_ENTRY(zbb, true, PRIV_VERSION_1_12_0, ext_zbb),
      ISA_EXT_DATA_ENTRY(zbc, true, PRIV_VERSION_1_12_0, ext_zbc),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* These are experimental so mark with 'x-' */
      DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
      DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
 +
 +    DEFINE_PROP_BOOL("x-zca", RISCVCPU, cfg.ext_zca, false),
 +    DEFINE_PROP_BOOL("x-zcb", RISCVCPU, cfg.ext_zcb, false),
 +    DEFINE_PROP_BOOL("x-zcd", RISCVCPU, cfg.ext_zcd, false),
 +    DEFINE_PROP_BOOL("x-zcf", RISCVCPU, cfg.ext_zcf, false),
 +    DEFINE_PROP_BOOL("x-zcmp", RISCVCPU, cfg.ext_zcmp, false),
 +    DEFINE_PROP_BOOL("x-zcmt", RISCVCPU, cfg.ext_zcmt, false),
 +
      /* ePMP 0.9.3 */
      DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
      DEFINE_PROP_BOOL("x-smaia", RISCVCPU, cfg.ext_smaia, false),
 --
-.40.0
+.45.1

-[PULL 30/89] target/riscv: Fix format for comments
+[PULL 15/28] target/riscv: Implement dynamic establishment of custom decoder
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Huang Tao <eric.huang@linux.alibaba.com>
-Fix formats for multi-lines comments.
+In this patch, we modify the decoder to be a freely composable data
-Add spaces around single line comments(after "/*" and before "*/").
+structure instead of a hardcoded one. It can be dynamically builded up
 according to the extensions.
 This approach has several benefits:
 . Provides support for heterogeneous cpu architectures. As we add decoder in
    RISCVCPU, each cpu can have their own decoder, and the decoders can be
    different due to cpu's features.
 . Improve the decoding efficiency. We run the guard_func to see if the decoder
    can be added to the dynamic_decoder when building up the decoder. Therefore,
    there is no need to run the guard_func when decoding each instruction. It can
    improve the decoding efficiency
 . For vendor or dynamic cpus, it allows them to customize their own decoder
    functions to improve decoding efficiency, especially when vendor-defined
    instruction sets increase. Because of dynamic building up, it can skip the other
    decoder guard functions when decoding.
 . Pre patch for allowing adding a vendor decoder before decode_insn32() with minimal
    overhead for users that don't need this particular vendor decoder.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Suggested-by: Christoph Muellner <christoph.muellner@vrull.eu>
-Acked-by: Richard Henderson <richard.henderson@linaro.org>
+Co-authored-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20240506023607.29544-1-eric.huang@linux.alibaba.com>
 Message-Id: <20230405085813.40643-4-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                      | 26 ++++----
+ target/riscv/cpu.h         |  1 +
- target/riscv/cpu_bits.h                 |  2 +-
+ target/riscv/tcg/tcg-cpu.h | 15 +++++++++++++++
- target/riscv/sbi_ecall_interface.h      |  8 +--
+ target/riscv/cpu.c         |  1 +
- target/riscv/arch_dump.c                |  3 +-
+ target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++
- target/riscv/cpu.c                      |  2 +-
+ target/riscv/translate.c   | 31 +++++++++++++++----------------
- target/riscv/cpu_helper.c               | 57 +++++++++++------
+files changed, 47 insertions(+), 16 deletions(-)
  target/riscv/csr.c                      |  6 +-
  target/riscv/pmp.c                      | 41 +++++++------
  target/riscv/translate.c                | 20 +++---
  target/riscv/vector_helper.c            | 82 +++++++++++++++----------
  target/riscv/insn_trans/trans_rvv.c.inc |  8 ++-
 files changed, 151 insertions(+), 104 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(VTYPE, RESERVED, 10, sizeof(target_ulong) * 8 - 11)
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
- typedef struct PMUCTRState {
+     uint32_t pmu_avail_ctrs;
-     /* Current value of a counter */
+     /* Mapping of events to counters */
-     target_ulong mhpmcounter_val;
+     GHashTable *pmu_event_ctr_map;
--    /* Current value of a counter in RV32*/
++    const GPtrArray *decoders;
 +    /* Current value of a counter in RV32 */
      target_ulong mhpmcounterh_val;
      /* Snapshot values of counter */
      target_ulong mhpmcounter_prev;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      target_ulong satp_hs;
      uint64_t mstatus_hs;
 -    /* Signals whether the current exception occurred with two-stage address
 -       translation active. */
 +    /*
 +     * Signals whether the current exception occurred with two-stage address
 +     * translation active.
 +     */
      bool two_stage_lookup;
      /*
       * Signals whether the current exception occurred while doing two-stage
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      /* PMU counter state */
      PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
 -    /* PMU event selector configured values. First three are unused*/
 +    /* PMU event selector configured values. First three are unused */
      target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 -    /* PMU event selector configured values for RV32*/
 +    /* PMU event selector configured values for RV32 */
      target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
      target_ulong sscratch;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
  OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
 -/**
 +/*
   * RISCVCPUClass:
   * @parent_realize: The parent class' realize handler.
   * @parent_phases: The parent class' reset phase handlers.
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
   * A RISCV CPU model.
   */
  struct RISCVCPUClass {
 -    /*< private >*/
 +    /* < private > */
      CPUClass parent_class;
 -    /*< public >*/
 +    /* < public > */
      DeviceRealize parent_realize;
      ResettablePhases parent_phases;
  };
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+ /**
- typedef struct RISCVCPUConfig RISCVCPUConfig;
+diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
 -/**
 +/*
   * RISCVCPU:
   * @env: #CPURISCVState
   *
   * A RISCV CPU.
   */
  struct ArchCPU {
 -    /*< private >*/
 +    /* < private > */
      CPUState parent_obj;
 -    /*< public >*/
 +    /* < public > */
      CPUNegativeOffsetState neg;
      CPURISCVState env;
@@ -XXX,XX +XXX,XX @@ enum {
      CSR_TABLE_SIZE = 0x1000
  };
 -/**
 +/*
   * The event id are encoded based on the encoding specified in the
   * SBI specification v0.3
   */
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
+--- a/target/riscv/tcg/tcg-cpu.h
-+++ b/target/riscv/cpu_bits.h
++++ b/target/riscv/tcg/tcg-cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
- #define MIE_SSIE                           (1 << IRQ_S_SOFT)
+ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
- #define MIE_USIE                           (1 << IRQ_U_SOFT)
+ bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
--/* General PointerMasking CSR bits*/
++struct DisasContext;
-+/* General PointerMasking CSR bits */
++struct RISCVCPUConfig;
- #define PM_ENABLE       0x00000001ULL
++typedef struct RISCVDecoder {
- #define PM_CURRENT      0x00000002ULL
++    bool (*guard_func)(const struct RISCVCPUConfig *);
- #define PM_INSN         0x00000004ULL
++    bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
-diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
++} RISCVDecoder;
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/riscv/sbi_ecall_interface.h
++typedef bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
-+++ b/target/riscv/sbi_ecall_interface.h
++
-@@ -XXX,XX +XXX,XX @@
++extern const size_t decoder_table_size;
- #define SBI_EXT_RFENCE                  0x52464E43
++
- #define SBI_EXT_HSM                     0x48534D
++extern const RISCVDecoder decoder_table[];
++
--/* SBI function IDs for BASE extension*/
++void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu);
-+/* SBI function IDs for BASE extension */
++
- #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
+ #endif
  #define SBI_EXT_BASE_GET_IMP_ID         0x1
  #define SBI_EXT_BASE_GET_IMP_VERSION    0x2
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_BASE_GET_MARCHID        0x5
  #define SBI_EXT_BASE_GET_MIMPID         0x6
 -/* SBI function IDs for TIME extension*/
 +/* SBI function IDs for TIME extension */
  #define SBI_EXT_TIME_SET_TIMER          0x0
 -/* SBI function IDs for IPI extension*/
 +/* SBI function IDs for IPI extension */
  #define SBI_EXT_IPI_SEND_IPI            0x0
 -/* SBI function IDs for RFENCE extension*/
 +/* SBI function IDs for RFENCE extension */
  #define SBI_EXT_RFENCE_REMOTE_FENCE_I       0x0
  #define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA    0x1
  #define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID  0x2
 diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/arch_dump.c
 +++ b/target/riscv/arch_dump.c
@@ -XXX,XX +XXX,XX @@
 -/* Support for writing ELF notes for RISC-V architectures
 +/*
 + * Support for writing ELF notes for RISC-V architectures
   *
   * Copyright (C) 2021 Huawei Technologies Co., Ltd
   *
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
- #define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
+             error_propagate(errp, local_err);
-     {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+             return;
+         }
--/**
++        riscv_tcg_cpu_finalize_dynamic_decoder(cpu);
-+/*
+     } else if (kvm_enabled()) {
-  * Here are the ordering rules of extension naming defined by RISC-V
+         riscv_kvm_cpu_finalize_features(cpu, &local_err);
-  * specification :
+         if (local_err != NULL) {
-  * 1. All extensions should be separated from other multi-letter extensions
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/tcg/tcg-cpu.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
+@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
      return TRANSLATE_SUCCESS;
  }
 -/* get_physical_address - get the physical address for this virtual address
 +/*
 + * get_physical_address - get the physical address for this virtual address
   *
   * Do a page table walk to obtain the physical address corresponding to a
   * virtual address. Returns 0 if the translation was successful
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
                                  bool first_stage, bool two_stage,
                                  bool is_debug)
  {
 -    /* NOTE: the env->pc value visible here will not be
 +    /*
 +     * NOTE: the env->pc value visible here will not be
       * correct, but the value visible to the exception handler
 -     * (riscv_cpu_do_interrupt) is correct */
 +     * (riscv_cpu_do_interrupt) is correct
 +     */
      MemTxResult res;
      MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
      int mode = mmu_idx & TB_FLAGS_PRIV_MMU_MASK;
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
          use_background = true;
      }
 -    /* MPRV does not affect the virtual-machine load/store
 -       instructions, HLV, HLVX, and HSV. */
 +    /*
 +     * MPRV does not affect the virtual-machine load/store
 +     * instructions, HLV, HLVX, and HSV.
 +     */
      if (riscv_cpu_two_stage_lookup(mmu_idx)) {
          mode = get_field(env->hstatus, HSTATUS_SPVP);
      } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      }
      if (first_stage == false) {
 -        /* We are in stage 2 translation, this is similar to stage 1. */
 -        /* Stage 2 is always taken as U-mode */
 +        /*
 +         * We are in stage 2 translation, this is similar to stage 1.
 +         * Stage 2 is always taken as U-mode
 +         */
          mode = PRV_U;
      }
@@ -XXX,XX +XXX,XX @@ restart:
                      target_ulong *pte_pa =
                          qemu_map_ram_ptr(mr->ram_block, addr1);
  #if TCG_OVERSIZED_GUEST
 -                    /* MTTCG is not enabled on oversized TCG guests so
 -                     * page table updates do not need to be atomic */
 +                    /*
 +                     * MTTCG is not enabled on oversized TCG guests so
 +                     * page table updates do not need to be atomic
 +                     */
                      *pte_pa = pte = updated_pte;
  #else
                      target_ulong old_pte =
@@ -XXX,XX +XXX,XX @@ restart:
                      }
  #endif
                  } else {
 -                    /* misconfigured PTE in ROM (AD bits are not preset) or
 -                     * PTE is in IO space and can't be updated atomically */
 +                    /*
 +                     * misconfigured PTE in ROM (AD bits are not preset) or
 +                     * PTE is in IO space and can't be updated atomically
 +                     */
                      return TRANSLATE_FAIL;
                  }
              }
 -            /* for superpage mappings, make a fake leaf PTE for the TLB's
 -               benefit. */
 +            /*
 +             * for superpage mappings, make a fake leaf PTE for the TLB's
 +             * benefit.
 +             */
              target_ulong vpn = addr >> PGSHIFT;
              if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
@@ -XXX,XX +XXX,XX @@ restart:
              if (pte & PTE_X) {
                  *prot |= PAGE_EXEC;
              }
 -            /* add write permission on stores or if the page is already dirty,
 -               so that we TLB miss on later writes to update the dirty bit */
 +            /*
 +             * add write permission on stores or if the page is already dirty,
 +             * so that we TLB miss on later writes to update the dirty bit
 +             */
              if ((pte & PTE_W) &&
                  (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
                  *prot |= PAGE_WRITE;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                    __func__, address, access_type, mmu_idx);
 -    /* MPRV does not affect the virtual-machine load/store
 -       instructions, HLV, HLVX, and HSV. */
 +    /*
 +     * MPRV does not affect the virtual-machine load/store
 +     * instructions, HLV, HLVX, and HSV.
 +     */
      if (riscv_cpu_two_stage_lookup(mmu_idx)) {
          mode = get_field(env->hstatus, HSTATUS_SPVP);
      } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      bool write_gva = false;
      uint64_t s;
 -    /* cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
 +    /*
 +     * cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
       * so we mask off the MSB and separate into trap type and cause.
       */
      bool async = !!(cs->exception_index & RISCV_EXCP_INT_FLAG);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          riscv_cpu_set_mode(env, PRV_M);
      }
 -    /* NOTE: it is not necessary to yield load reservations here. It is only
 +    /*
 +     * NOTE: it is not necessary to yield load reservations here. It is only
       * necessary for an SC from "another hart" to cause a load reservation
       * to be yielded. Refer to the memory consistency model section of the
       * RISC-V ISA Specification.
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr(CPURISCVState *env, int csrno)
      }
      ctr_index = csrno - base_csrno;
      if (!pmu_num || ctr_index >= pmu_num) {
 -        /* The PMU is not enabled or counter is out of range*/
 +        /* The PMU is not enabled or counter is out of range */
          return RISCV_EXCP_ILLEGAL_INST;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
                                          counter.mhpmcounter_val;
      if (get_field(env->mcountinhibit, BIT(ctr_idx))) {
 -        /**
 +        /*
           * Counter should not increment if inhibit bit is set. We can't really
           * stop the icount counting. Just return the counter value written by
           * the supervisor to indicate that counter was not incremented.
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
          }
      }
 -    /**
 +    /*
       * The kernel computes the perf delta by subtracting the current value from
       * the value it initialized previously (ctr_val).
       */
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
  static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
  {
      /*
 -       aaaa...aaa0   8-byte NAPOT range
 -       aaaa...aa01   16-byte NAPOT range
 -       aaaa...a011   32-byte NAPOT range
 -       ...
 -       aa01...1111   2^XLEN-byte NAPOT range
 -       a011...1111   2^(XLEN+1)-byte NAPOT range
 -       0111...1111   2^(XLEN+2)-byte NAPOT range
 -       1111...1111   Reserved
 -    */
 +     * aaaa...aaa0   8-byte NAPOT range
 +     * aaaa...aa01   16-byte NAPOT range
 +     * aaaa...a011   32-byte NAPOT range
 +     * ...
 +     * aa01...1111   2^XLEN-byte NAPOT range
 +     * a011...1111   2^(XLEN+1)-byte NAPOT range
 +     * 0111...1111   2^(XLEN+2)-byte NAPOT range
 +     * 1111...1111   Reserved
 +     */
      a = (a << 2) | 0x3;
      *sa = a & (a + 1);
      *ea = a | (a + 1);
@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_nums(CPURISCVState *env)
      }
  }
--/* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
++void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
-+/*
++{
-+ * Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
++    GPtrArray *dynamic_decoders;
-  *   end address values.
++    dynamic_decoders = g_ptr_array_sized_new(decoder_table_size);
-  *   This function is called relatively infrequently whereas the check that
++    for (size_t i = 0; i < decoder_table_size; ++i) {
-  *   an address is within a pmp rule is called often, so optimise that one
++        if (decoder_table[i].guard_func &&
-@@ -XXX,XX +XXX,XX @@ int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
++            decoder_table[i].guard_func(&cpu->cfg)) {
-         pmp_size = size;
++            g_ptr_array_add(dynamic_decoders,
-     }
++                            (gpointer)decoder_table[i].riscv_cpu_decode_fn);
++        }
--    /* 1.10 draft priv spec states there is an implicit order
++    }
--         from low to high */
++
-+    /*
++    cpu->decoders = dynamic_decoders;
-+     * 1.10 draft priv spec states there is an implicit order
++}
-+     * from low to high
++
-+     */
+ bool riscv_cpu_tcg_compatible(RISCVCPU *cpu)
-     for (i = 0; i < MAX_RISCV_PMPS; i++) {
+ {
-         s = pmp_is_in_range(env, i, addr);
+     return object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST) == NULL;
          e = pmp_is_in_range(env, i, addr + pmp_size - 1);
@@ -XXX,XX +XXX,XX @@ target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
          return TARGET_PAGE_SIZE;
      } else {
          /*
 -        * At this point we have a tlb_size that is the smallest possible size
 -        * That fits within a TARGET_PAGE_SIZE and the PMP region.
 -        *
 -        * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
 -        * This means the result isn't cached in the TLB and is only used for
 -        * a single translation.
 -        */
 +         * At this point we have a tlb_size that is the smallest possible size
 +         * That fits within a TARGET_PAGE_SIZE and the PMP region.
 +         *
 +         * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
 +         * This means the result isn't cached in the TLB and is only used for
 +         * a single translation.
 +         */
          return 1;
      }
  }
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/helper-info.c.inc"
+ #undef  HELPER_H
++#include "tcg/tcg-cpu.h"
++
+ /* global register indices */
+ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
+ static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
 @@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     uint32_t mstatus_hs_fs;
+     /* FRM is known to contain a valid value. */
-     uint32_t mstatus_hs_vs;
+     bool frm_valid;
-     uint32_t mem_idx;
+     bool insn_start_updated;
--    /* Remember the rounding mode encoded in the previous fp instruction,
++    const GPtrArray *decoders;
--       which we have already installed into env->fp_status.  Or -1 for
+ } DisasContext;
--       no previous fp instruction.  Note that we exit the TB when writing
--       to any system register, which includes CSR_FRM, so we do not have
+ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
--       to reset this known value.  */
+@@ -XXX,XX +XXX,XX @@ static inline int insn_len(uint16_t first_word)
-+    /*
+     return (first_word & 3) == 3 ? 4 : 2;
 +     * Remember the rounding mode encoded in the previous fp instruction,
 +     * which we have already installed into env->fp_status.  Or -1 for
 +     * no previous fp instruction.  Note that we exit the TB when writing
 +     * to any system register, which includes CSR_FRM, so we do not have
 +     * to reset this known value.
 +     */
      int frm;
      RISCVMXL ol;
      bool virt_inst_excp;
@@ -XXX,XX +XXX,XX @@ static TCGv_i64 dest_fpr(DisasContext *ctx, int reg_num)
      }
  }
--/* assume t is nanboxing (for normal) or sign-extended (for zfinx) */
++const RISCVDecoder decoder_table[] = {
-+/* assume it is nanboxing (for normal) or sign-extended (for zfinx) */
++    { always_true_p, decode_insn32 },
- static void gen_set_fpr_hs(DisasContext *ctx, int reg_num, TCGv_i64 t)
++    { has_xthead_p, decode_xthead},
 +    { has_XVentanaCondOps_p, decode_XVentanaCodeOps},
 +};
 +
 +const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
 +
  static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
  {
-     if (!ctx->cfg_ptr->ext_zfinx) {
+-    /*
-@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
+-     * A table with predicate (i.e., guard) functions and decoder functions
 -     * that are tested in-order until a decoder matches onto the opcode.
 -     */
 -    static const struct {
 -        bool (*guard_func)(const RISCVCPUConfig *);
 -        bool (*decode_func)(DisasContext *, uint32_t);
 -    } decoders[] = {
 -        { always_true_p,  decode_insn32 },
 -        { has_xthead_p, decode_xthead },
 -        { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
 -    };
 -
      ctx->virt_inst_excp = false;
      ctx->cur_insn_len = insn_len(opcode);
      /* Check for compressed insn */
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
                                               ctx->base.pc_next + 2));
          ctx->opcode = opcode32;
 -        for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
 -            if (decoders[i].guard_func(ctx->cfg_ptr) &&
 -                decoders[i].decode_func(ctx, opcode32)) {
 +        for (guint i = 0; i < ctx->decoders->len; ++i) {
 +            riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
 +            if (func(ctx, opcode32)) {
                  return;
              }
          }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
      ctx->zero = tcg_constant_tl(0);
      ctx->virt_inst_excp = false;
 +    ctx->decoders = cpu->decoders;
  }
- #ifndef CONFIG_USER_ONLY
+ static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu)
 -/* The states of mstatus_fs are:
 +/*
 + * The states of mstatus_fs are:
   * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
   * We will have already diagnosed disabled state,
   * and need to turn initial/clean into dirty.
@@ -XXX,XX +XXX,XX @@ static inline void mark_fs_dirty(DisasContext *ctx) { }
  #endif
  #ifndef CONFIG_USER_ONLY
 -/* The states of mstatus_vs are:
 +/*
 + * The states of mstatus_vs are:
   * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
   * We will have already diagnosed disabled state,
   * and need to turn initial/clean into dirty.
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static void vext_set_tail_elems_1s(CPURISCVState *env, target_ulong vl,
  }
  /*
 - *** stride: access vector element from strided memory
 + * stride: access vector element from strided memory
   */
  static void
  vext_ldst_stride(void *vd, void *v0, target_ulong base,
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_STRIDE(vsse32_v, int32_t, ste_w)
  GEN_VEXT_ST_STRIDE(vsse64_v, int64_t, ste_d)
  /*
 - *** unit-stride: access elements stored contiguously in memory
 + * unit-stride: access elements stored contiguously in memory
   */
 -/* unmasked unit-stride load and store operation*/
 +/* unmasked unit-stride load and store operation */
  static void
  vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
               vext_ldst_elem_fn *ldst_elem, uint32_t log2_esz, uint32_t evl,
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_US(vse32_v, int32_t, ste_w)
  GEN_VEXT_ST_US(vse64_v, int64_t, ste_d)
  /*
 - *** unit stride mask load and store, EEW = 1
 + * unit stride mask load and store, EEW = 1
   */
  void HELPER(vlm_v)(void *vd, void *v0, target_ulong base,
                      CPURISCVState *env, uint32_t desc)
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm_v)(void *vd, void *v0, target_ulong base,
  }
  /*
 - *** index: access vector element from indexed memory
 + * index: access vector element from indexed memory
   */
  typedef target_ulong vext_get_index_addr(target_ulong base,
          uint32_t idx, void *vs2);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_INDEX(vsxei64_32_v, int32_t, idx_d, ste_w)
  GEN_VEXT_ST_INDEX(vsxei64_64_v, int64_t, idx_d, ste_d)
  /*
 - *** unit-stride fault-only-fisrt load instructions
 + * unit-stride fault-only-fisrt load instructions
   */
  static inline void
  vext_ldff(void *vd, void *v0, target_ulong base,
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
      uint32_t vma = vext_vma(desc);
      target_ulong addr, offset, remain;
 -    /* probe every access*/
 +    /* probe every access */
      for (i = env->vstart; i < env->vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
              continue;
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_LDFF(vle64ff_v, int64_t, lde_d)
  #define DO_MINU(N, M) DO_MIN((UMTYPE)N, (UMTYPE)M)
  /*
 - *** load and store whole register instructions
 + * load and store whole register instructions
   */
  static void
  vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs4r_v, int8_t, ste_b)
  GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  /*
 - *** Vector Integer Arithmetic Instructions
 + * Vector Integer Arithmetic Instructions
   */
  /* expand macro args before macro */
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
          vext_set_elem_mask(vd, i, DO_OP(s2, s1, carry));      \
      }                                                         \
      env->vstart = 0;                                          \
 -    /* mask destination register are always tail-agnostic */  \
 -    /* set tail elements to 1s */                             \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */                                                       \
      if (vta_all_1s) {                                         \
          for (; i < total_elems; i++) {                        \
              vext_set_elem_mask(vd, i, 1);                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,          \
                  DO_OP(s2, (ETYPE)(target_long)s1, carry));      \
      }                                                           \
      env->vstart = 0;                                            \
 -    /* mask destination register are always tail-agnostic */    \
 -    /* set tail elements to 1s */                               \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */                                                         \
      if (vta_all_1s) {                                           \
          for (; i < total_elems; i++) {                          \
              vext_set_elem_mask(vd, i, 1);                       \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
          vext_set_elem_mask(vd, i, DO_OP(s2, s1));             \
      }                                                         \
      env->vstart = 0;                                          \
 -    /* mask destination register are always tail-agnostic */  \
 -    /* set tail elements to 1s */                             \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */                                                       \
      if (vta_all_1s) {                                         \
          for (; i < total_elems; i++) {                        \
              vext_set_elem_mask(vd, i, 1);                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
                  DO_OP(s2, (ETYPE)(target_long)s1));                 \
      }                                                               \
      env->vstart = 0;                                                \
 -    /* mask destination register are always tail-agnostic */        \
 -    /* set tail elements to 1s */                                   \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */                                                             \
      if (vta_all_1s) {                                               \
          for (; i < total_elems; i++) {                              \
              vext_set_elem_mask(vd, i, 1);                           \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VMERGE_VX(vmerge_vxm_w, int32_t, H4)
  GEN_VEXT_VMERGE_VX(vmerge_vxm_d, int64_t, H8)
  /*
 - *** Vector Fixed-Point Arithmetic Instructions
 + * Vector Fixed-Point Arithmetic Instructions
   */
  /* Vector Single-Width Saturating Add and Subtract */
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX_RM(vnclipu_wx_h, 2)
  GEN_VEXT_VX_RM(vnclipu_wx_w, 4)
  /*
 - *** Vector Float Point Arithmetic Instructions
 + * Vector Float Point Arithmetic Instructions
   */
  /* Vector Single-Width Floating-Point Add/Subtract Instructions */
  #define OPFVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)   \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
                             DO_OP(s2, s1, &env->fp_status));   \
      }                                                         \
      env->vstart = 0;                                          \
 -    /* mask destination register are always tail-agnostic */  \
 -    /* set tail elements to 1s */                             \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */                                                       \
      if (vta_all_1s) {                                         \
          for (; i < total_elems; i++) {                        \
              vext_set_elem_mask(vd, i, 1);                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,       \
                             DO_OP(s2, (ETYPE)s1, &env->fp_status));  \
      }                                                               \
      env->vstart = 0;                                                \
 -    /* mask destination register are always tail-agnostic */        \
 -    /* set tail elements to 1s */                                   \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */                                                             \
      if (vta_all_1s) {                                               \
          for (; i < total_elems; i++) {                              \
              vext_set_elem_mask(vd, i, 1);                           \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfcvt_f_x_v_d, 8)
  #define WOP_UU_B uint16_t, uint8_t,  uint8_t
  #define WOP_UU_H uint32_t, uint16_t, uint16_t
  #define WOP_UU_W uint64_t, uint32_t, uint32_t
 -/* vfwcvt.xu.f.v vd, vs2, vm # Convert float to double-width unsigned integer.*/
 +/*
 + * vfwcvt.xu.f.v vd, vs2, vm # Convert float to double-width unsigned integer.
 + */
  RVVCALL(OPFVV1, vfwcvt_xu_f_v_h, WOP_UU_H, H4, H2, float16_to_uint32)
  RVVCALL(OPFVV1, vfwcvt_xu_f_v_w, WOP_UU_W, H8, H4, float32_to_uint64)
  GEN_VEXT_V_ENV(vfwcvt_xu_f_v_h, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
  GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
  /*
 - *** Vector Reduction Operations
 + * Vector Reduction Operations
   */
  /* Vector Single-Width Integer Reduction Instructions */
  #define GEN_VEXT_RED(NAME, TD, TS2, HD, HS2, OP)          \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_FRED(vfwredosum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
  GEN_VEXT_FRED(vfwredosum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
  /*
 - *** Vector Mask Operations
 + * Vector Mask Operations
   */
  /* Vector Mask-Register Logical Instructions */
  #define GEN_VEXT_MASK_VV(NAME, OP)                        \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
          vext_set_elem_mask(vd, i, OP(b, a));              \
      }                                                     \
      env->vstart = 0;                                      \
 -    /* mask destination register are always tail-         \
 -     * agnostic                                           \
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
       */                                                   \
 -    /* set tail elements to 1s */                         \
      if (vta_all_1s) {                                     \
          for (; i < total_elems; i++) {                    \
              vext_set_elem_mask(vd, i, 1);                 \
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vcpop_m)(void *v0, void *vs2, CPURISCVState *env,
      return cnt;
  }
 -/* vfirst find-first-set mask bit*/
 +/* vfirst find-first-set mask bit */
  target_ulong HELPER(vfirst_m)(void *v0, void *vs2, CPURISCVState *env,
                                uint32_t desc)
  {
@@ -XXX,XX +XXX,XX @@ static void vmsetm(void *vd, void *v0, void *vs2, CPURISCVState *env,
          }
      }
      env->vstart = 0;
 -    /* mask destination register are always tail-agnostic */
 -    /* set tail elements to 1s */
 +    /*
 +     * mask destination register are always tail-agnostic
 +     * set tail elements to 1s
 +     */
      if (vta_all_1s) {
          for (; i < total_elems; i++) {
              vext_set_elem_mask(vd, i, 1);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VID_V(vid_v_w, uint32_t, H4)
  GEN_VEXT_VID_V(vid_v_d, uint64_t, H8)
  /*
 - *** Vector Permutation Instructions
 + * Vector Permutation Instructions
   */
  /* Vector Slide Instructions */
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vfirst_m(DisasContext *s, arg_rmr *a)
      return false;
  }
 -/* vmsbf.m set-before-first mask bit */
 -/* vmsif.m set-includ-first mask bit */
 -/* vmsof.m set-only-first mask bit */
 +/*
 + * vmsbf.m set-before-first mask bit
 + * vmsif.m set-including-first mask bit
 + * vmsof.m set-only-first mask bit
 + */
  #define GEN_M_TRANS(NAME)                                          \
  static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
  {                                                                  \
 --
-.40.0
+.45.1

-[PULL 15/89] target/riscv: add support for Zcmt extension
+[PULL 16/28] riscv: thead: Add th.sxstatus CSR emulation
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-Add encode, trans* functions and helper functions support for Zcmt
+The th.sxstatus CSR can be used to identify available custom extension
-instrutions.
+on T-Head CPUs. The CSR is documented here:
-Add support for jvt csr.
+  https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadsxstatus.adoc
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+An important property of this patch is, that the th.sxstatus MAEE field
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+is not set (indicating that XTheadMae is not available).
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+XTheadMae is a memory attribute extension (similar to Svpbmt) which is
 implemented in many T-Head CPUs (C906, C910, etc.) and utilizes bits
 in PTEs that are marked as reserved. QEMU maintainers prefer to not
 implement XTheadMae, so we need give kernels a mechanism to identify
 if XTheadMae is available in a system or not. And this patch introduces
 this mechanism in QEMU in a way that's compatible with real HW
 (i.e., probing the th.sxstatus.MAEE bit).
 Further context can be found on the list:
 https://lists.gnu.org/archive/html/qemu-devel/2024-02/msg00775.html
 Reviewed-by: LIU Zhiwei <zhiwe_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-8-liweiwei@iscas.ac.cn>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-ID: <20240429073656.2486732-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                        |  4 ++
+ MAINTAINERS              |  1 +
- target/riscv/cpu_bits.h                   |  7 +++
+ target/riscv/cpu.h       |  3 ++
- target/riscv/helper.h                     |  3 ++
+ target/riscv/cpu.c       |  1 +
- target/riscv/insn16.decode                |  7 ++-
+ target/riscv/th_csr.c    | 79 ++++++++++++++++++++++++++++++++++++++++
- target/riscv/csr.c                        | 36 ++++++++++++++-
+ target/riscv/meson.build |  1 +
- target/riscv/machine.c                    | 19 ++++++++
+files changed, 85 insertions(+)
- target/riscv/zce_helper.c                 | 55 +++++++++++++++++++++++
+ create mode 100644 target/riscv/th_csr.c
  target/riscv/insn_trans/trans_rvzce.c.inc | 28 +++++++++++-
  target/riscv/meson.build                  |  3 +-
 files changed, 157 insertions(+), 5 deletions(-)
  create mode 100644 target/riscv/zce_helper.c
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ L: qemu-riscv@nongnu.org
+ S: Supported
+ F: target/riscv/insn_trans/trans_xthead.c.inc
+ F: target/riscv/xthead*.decode
++F: target/riscv/th_*
+ F: disas/riscv-xthead*
+ RISC-V XVentanaCondOps extension
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
-     /* 128-bit helpers upper part return value */
+ uint8_t satp_mode_max_from_map(uint32_t map);
-     target_ulong retxh;
+ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
-+    target_ulong jvt;
++/* Implemented in th_csr.c */
 +void th_register_custom_csrs(RISCVCPU *cpu);
 +
- #ifdef CONFIG_USER_ONLY
+ #endif /* RISCV_CPU_H */
-     uint32_t elf_flags;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
      cpu->cfg.mvendorid = THEAD_VENDOR_ID;
  #ifndef CONFIG_USER_ONLY
      set_satp_mode_max_supported(cpu, VM_1_10_SV39);
 +    th_register_custom_csrs(cpu);
  #endif
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
-                                                  target_ulong new_val,
+     /* inherited from parent obj via riscv_cpu_init() */
-                                                  target_ulong write_mask),
+diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
                                     void *rmw_fn_arg);
 +
 +RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
  #endif
  void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define SMSTATEEN_MAX_COUNT 4
  #define SMSTATEEN0_CS       (1ULL << 0)
  #define SMSTATEEN0_FCSR     (1ULL << 1)
 +#define SMSTATEEN0_JVT      (1ULL << 2)
  #define SMSTATEEN0_HSCONTXT (1ULL << 57)
  #define SMSTATEEN0_IMSIC    (1ULL << 58)
  #define SMSTATEEN0_AIA      (1ULL << 59)
@@ -XXX,XX +XXX,XX @@
  /* Crypto Extension */
  #define CSR_SEED            0x015
 +/* Zcmt Extension */
 +#define CSR_JVT             0x017
 +
  /* mstatus CSR bits */
  #define MSTATUS_UIE         0x00000001
  #define MSTATUS_SIE         0x00000002
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define MHPMEVENT_IDX_MASK                 0xFFFFF
  #define MHPMEVENT_SSCOF_RESVD              16
 +/* JVT CSR bits */
 +#define JVT_MODE                           0x3F
 +#define JVT_BASE                           (~0x3F)
  #endif
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(aes64im, TCG_CALL_NO_RWG_SE, tl, tl)
  DEF_HELPER_FLAGS_3(sm4ed, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
  DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 +
 +/* Zce helper */
 +DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
 diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn16.decode
 +++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@
  %uimm_cl_h  5:1                      !function=ex_shift_1
  %spimm      2:2                      !function=ex_shift_4
  %urlist     4:4
 +%index      2:8
  # Argument sets imported from insn32.decode:
  &empty                  !extern
@@ -XXX,XX +XXX,XX @@
  &r2_s      rs1 rs2      !extern
  &cmpp      urlist spimm
 +&cmjt      index
  # Formats 16:
  @cr        ....  ..... .....  .. &r      rs2=%rs2_5       rs1=%rd     %rd
@@ -XXX,XX +XXX,XX @@
  @cs_h         ... . .. ... .. ... ..  &s  imm=%uimm_cl_h  rs1=%rs1_3 rs2=%rs2_3
  @cm_pp        ... ...  ........   ..  &cmpp  %urlist      %spimm
  @cm_mv        ... ...  ... .. ... ..  &r2_s  rs2=%r2s     rs1=%r1s
 +@cm_jt        ... ...  ........   ..  &cmjt  %index
  # *** RV32/64C Standard Extension (Quadrant 0) ***
  {
@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
    sq              101  ... ... .. ... 10 @c_sqsp
    c_fsd           101   ......  ..... 10 @c_sdsp
 -  # *** RV64 and RV32 Zcmp Extension ***
 +  # *** RV64 and RV32 Zcmp/Zcmt Extension ***
    [
      cm_push         101  11000  .... .. 10 @cm_pp
      cm_pop          101  11010  .... .. 10 @cm_pp
@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
      cm_popretz      101  11100  .... .. 10 @cm_pp
      cm_mva01s       101  011 ... 11 ... 10 @cm_mv
      cm_mvsa01       101  011 ... 01 ... 10 @cm_mv
 +
 +    cm_jalt         101  000   ........ 10 @cm_jt
    ]
  }
  sw                110 .  .....  ..... 10 @c_swsp
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
  /* Predicates */
  #if !defined(CONFIG_USER_ONLY)
 -static RISCVException smstateen_acc_ok(CPURISCVState *env, int index,
 -                                       uint64_t bit)
 +RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
  {
      bool virt = riscv_cpu_virt_enabled(env);
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr32(CPURISCVState *env, int csrno)
      return ctr(env, csrno);
  }
 +static RISCVException zcmt(CPURISCVState *env, int csrno)
 +{
 +    if (!riscv_cpu_cfg(env)->ext_zcmt) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +#endif
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
  #if !defined(CONFIG_USER_ONLY)
  static RISCVException mctr(CPURISCVState *env, int csrno)
  {
@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
      return ret;
  }
 +static RISCVException read_jvt(CPURISCVState *env, int csrno,
 +                               target_ulong *val)
 +{
 +    *val = env->jvt;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException write_jvt(CPURISCVState *env, int csrno,
 +                                target_ulong val)
 +{
 +    env->jvt = val;
 +    return RISCV_EXCP_NONE;
 +}
 +
  /* Control and Status Register function table */
  riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      /* User Floating-Point CSRs */
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      /* Crypto Extension */
      [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
 +    /* Zcmt Extension */
 +    [CSR_JVT] = {"jvt", zcmt, read_jvt, write_jvt},
 +
  #if !defined(CONFIG_USER_ONLY)
      /* Machine Timers and Counters */
      [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmu_ctr_state = {
      }
  };
 +static bool jvt_needed(void *opaque)
 +{
 +    RISCVCPU *cpu = opaque;
 +
 +    return cpu->cfg.ext_zcmt;
 +}
 +
 +static const VMStateDescription vmstate_jvt = {
 +    .name = "cpu/jvt",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = jvt_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINTTL(env.jvt, RISCVCPU),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  const VMStateDescription vmstate_riscv_cpu = {
      .name = "cpu",
      .version_id = 7,
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
          &vmstate_envcfg,
          &vmstate_debug,
          &vmstate_smstateen,
 +        &vmstate_jvt,
          NULL
      }
  };
 diff --git a/target/riscv/zce_helper.c b/target/riscv/zce_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/target/riscv/zce_helper.c
++++ b/target/riscv/th_csr.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V Zcmt Extension Helper for QEMU.
++ * T-Head-specific CSRs.
 + *
-+ * Copyright (c) 2021-2022 PLCT Lab
++ * Copyright (c) 2024 VRULL GmbH
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
-+#include "exec/exec-all.h"
++#include "cpu_vendorid.h"
 +#include "exec/helper-proto.h"
 +#include "exec/cpu_ldst.h"
 +
-+target_ulong HELPER(cm_jalt)(CPURISCVState *env, uint32_t index)
++#define CSR_TH_SXSTATUS 0x5c0
 +
 +/* TH_SXSTATUS bits */
 +#define TH_SXSTATUS_UCME        BIT(16)
 +#define TH_SXSTATUS_MAEE        BIT(21)
 +#define TH_SXSTATUS_THEADISAEE  BIT(22)
 +
 +typedef struct {
 +    int csrno;
 +    int (*insertion_test)(RISCVCPU *cpu);
 +    riscv_csr_operations csr_ops;
 +} riscv_csr;
 +
 +static RISCVException smode(CPURISCVState *env, int csrno)
 +{
-+
++    if (riscv_has_ext(env, RVS)) {
-+#if !defined(CONFIG_USER_ONLY)
++        return RISCV_EXCP_NONE;
 +    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
 +    if (ret != RISCV_EXCP_NONE) {
 +        riscv_raise_exception(env, ret, 0);
 +    }
 +#endif
 +
 +    target_ulong target;
 +    target_ulong val = env->jvt;
 +    int xlen = riscv_cpu_xlen(env);
 +    uint8_t mode = get_field(val, JVT_MODE);
 +    target_ulong base = val & JVT_BASE;
 +    target_ulong t0;
 +
 +    if (mode != 0) {
 +        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, 0);
 +    }
 +
-+    if (xlen == 32) {
++    return RISCV_EXCP_ILLEGAL_INST;
-+        t0 = base + (index << 2);
++}
-+        target = cpu_ldl_code(env, t0);
++
-+    } else {
++static int test_thead_mvendorid(RISCVCPU *cpu)
-+        t0 = base + (index << 3);
++{
-+        target = cpu_ldq_code(env, t0);
++    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
 +        return -1;
 +    }
 +
-+    return target & ~0x1;
++    return 0;
 +}
-diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvzce.c.inc
-+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
-@@ -XXX,XX +XXX,XX @@
- /*
-- * RISC-V translation routines for the Zc[b,mp] Standard Extensions.
-+ * RISC-V translation routines for the Zc[b,mp,mt] Standard Extensions.
-  *
-  * Copyright (c) 2021-2022 PLCT Lab
-  *
-@@ -XXX,XX +XXX,XX @@
-         return false;            \
- } while (0)
-+#define REQUIRE_ZCMT(ctx) do {   \
-+    if (!ctx->cfg_ptr->ext_zcmt) \
-+        return false;            \
-+} while (0)
 +
- static bool trans_c_zext_b(DisasContext *ctx, arg_c_zext_b *a)
++static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
- {
++                                       target_ulong *val)
-     REQUIRE_ZCB(ctx);
++{
-@@ -XXX,XX +XXX,XX @@ static bool trans_cm_mvsa01(DisasContext *ctx, arg_cm_mvsa01 *a)
++    /* We don't set MAEE here, because QEMU does not implement MAEE. */
++    *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
-     return true;
++    return RISCV_EXCP_NONE;
- }
++}
 +
-+static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
++static riscv_csr th_csr_list[] = {
 +    {
 +        .csrno = CSR_TH_SXSTATUS,
 +        .insertion_test = test_thead_mvendorid,
 +        .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
 +    }
 +};
 +
 +void th_register_custom_csrs(RISCVCPU *cpu)
 +{
-+    REQUIRE_ZCMT(ctx);
++    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
-+
++        int csrno = th_csr_list[i].csrno;
-+    /*
++        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
-+     * Update pc to current for the non-unwinding exception
++        if (!th_csr_list[i].insertion_test(cpu)) {
-+     * that might come from cpu_ld*_code() in the helper.
++            riscv_set_csr_ops(csrno, csr_ops);
-+     */
++        }
 +    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
 +    gen_helper_cm_jalt(cpu_pc, cpu_env, tcg_constant_i32(a->index));
 +
 +    /* c.jt vs c.jalt depends on the index. */
 +    if (a->index >= 32) {
 +        gen_set_gpri(ctx, xRA, ctx->pc_succ_insn);
 +    }
-+
-+    tcg_gen_lookup_and_goto_ptr();
-+    ctx->base.is_jmp = DISAS_NORETURN;
-+    return true;
 +}
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
+@@ -XXX,XX +XXX,XX @@ riscv_system_ss.add(files(
-   'bitmanip_helper.c',
+   'monitor.c',
-   'translate.c',
+   'machine.c',
-   'm128_helper.c',
+   'pmu.c',
--  'crypto_helper.c'
++  'th_csr.c',
-+  'crypto_helper.c',
+   'time_helper.c',
-+  'zce_helper.c'
+   'riscv-qmp-cmds.c',
  ))
- riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 --
-.40.0
+.45.1

-[PULL 60/89] target/riscv: Encode the FS and VS on a normal way for tb flags
+[PULL 17/28] target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Max Chou <max.chou@sifive.com>
-Reuse the MSTATUS_FS and MSTATUS_VS for the tb flags positions is not a
+According v spec 18.4, only the vfwcvt.f.f.v and vfncvt.f.f.w
-normal way.
+instructions will be affected by Zvfhmin extension.
 And the vfwcvt.f.f.v and vfncvt.f.f.w instructions only support the
 conversions of
-It will make it hard to change the tb flags layout. And even worse, if we
+* From 1*SEW(16/32) to 2*SEW(32/64)
-want to keep tb flags for a same extension togather without a hole.
+* From 2*SEW(32/64) to 1*SEW(16/32)
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230324143031.1093-4-zhiwei_liu@linux.alibaba.com>
+Message-ID: <20240322092600.1198921-2-max.chou@sifive.com>
 [rth: Adjust trans_rvf.c.inc as well; use the typedef]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230325105429.1142530-4-richard.henderson@linaro.org>
 Message-Id: <20230412114333.118895-4-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                      | 15 ++++++------
+ target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++--
- target/riscv/cpu_helper.c               | 11 +++++----
+file changed, 18 insertions(+), 2 deletions(-)
  target/riscv/translate.c                | 32 +++++++++++--------------
  target/riscv/insn_trans/trans_rvf.c.inc |  2 +-
  target/riscv/insn_trans/trans_rvv.c.inc |  8 +++----
 files changed, 32 insertions(+), 36 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
- #define TB_FLAGS_PRIV_MMU_MASK                3
- #define TB_FLAGS_PRIV_HYP_ACCESS_MASK   (1 << 2)
--#define TB_FLAGS_MSTATUS_FS MSTATUS_FS
--#define TB_FLAGS_MSTATUS_VS MSTATUS_VS
- #include "exec/cpu-all.h"
- FIELD(TB_FLAGS, MEM_IDX, 0, 3)
--FIELD(TB_FLAGS, LMUL, 3, 3)
--FIELD(TB_FLAGS, SEW, 6, 3)
--/* Skip MSTATUS_VS (0x600) bits */
--FIELD(TB_FLAGS, VL_EQ_VLMAX, 11, 1)
--FIELD(TB_FLAGS, VILL, 12, 1)
--/* Skip MSTATUS_FS (0x6000) bits */
-+FIELD(TB_FLAGS, FS, 3, 2)
-+/* Vector flags */
-+FIELD(TB_FLAGS, VS, 5, 2)
-+FIELD(TB_FLAGS, LMUL, 7, 3)
-+FIELD(TB_FLAGS, SEW, 10, 3)
-+FIELD(TB_FLAGS, VL_EQ_VLMAX, 13, 1)
-+FIELD(TB_FLAGS, VILL, 14, 1)
- /* Is a Hypervisor instruction load/store allowed? */
- FIELD(TB_FLAGS, HLSX, 15, 1)
- FIELD(TB_FLAGS, MSTATUS_HS_FS, 16, 2)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-     }
- #ifdef CONFIG_USER_ONLY
--    flags |= TB_FLAGS_MSTATUS_FS;
--    flags |= TB_FLAGS_MSTATUS_VS;
-+    flags = FIELD_DP32(flags, TB_FLAGS, FS, EXT_STATUS_DIRTY);
-+    flags = FIELD_DP32(flags, TB_FLAGS, VS, EXT_STATUS_DIRTY);
- #else
-     flags |= cpu_mmu_index(env, 0);
-     if (riscv_cpu_fp_enabled(env)) {
--        flags |= env->mstatus & MSTATUS_FS;
-+        flags = FIELD_DP32(flags, TB_FLAGS, FS,
-+                           get_field(env->mstatus, MSTATUS_FS));
-     }
--
-     if (riscv_cpu_vector_enabled(env)) {
--        flags |= env->mstatus & MSTATUS_VS;
-+        flags = FIELD_DP32(flags, TB_FLAGS, VS,
-+                           get_field(env->mstatus, MSTATUS_VS));
-     }
-     if (riscv_has_ext(env, RVH)) {
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     RISCVMXL xl;
-     uint32_t misa_ext;
-     uint32_t opcode;
--    uint32_t mstatus_fs;
--    uint32_t mstatus_vs;
--    uint32_t mstatus_hs_fs;
--    uint32_t mstatus_hs_vs;
-+    RISCVExtStatus mstatus_fs;
-+    RISCVExtStatus mstatus_vs;
-+    RISCVExtStatus mstatus_hs_fs;
-+    RISCVExtStatus mstatus_hs_vs;
-     uint32_t mem_idx;
-     /*
-      * Remember the rounding mode encoded in the previous fp instruction,
-@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
- #ifndef CONFIG_USER_ONLY
- /*
-- * The states of mstatus_fs are:
-- * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
-  * We will have already diagnosed disabled state,
-  * and need to turn initial/clean into dirty.
-  */
-@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
-         return;
-     }
--    if (ctx->mstatus_fs != MSTATUS_FS) {
-+    if (ctx->mstatus_fs != EXT_STATUS_DIRTY) {
-         /* Remember the state change for the rest of the TB. */
--        ctx->mstatus_fs = MSTATUS_FS;
-+        ctx->mstatus_fs = EXT_STATUS_DIRTY;
-         tmp = tcg_temp_new();
-         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
-         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-     }
--    if (ctx->virt_enabled && ctx->mstatus_hs_fs != MSTATUS_FS) {
-+    if (ctx->virt_enabled && ctx->mstatus_hs_fs != EXT_STATUS_DIRTY) {
-         /* Remember the stage change for the rest of the TB. */
--        ctx->mstatus_hs_fs = MSTATUS_FS;
-+        ctx->mstatus_hs_fs = EXT_STATUS_DIRTY;
-         tmp = tcg_temp_new();
-         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-@@ -XXX,XX +XXX,XX @@ static inline void mark_fs_dirty(DisasContext *ctx) { }
- #ifndef CONFIG_USER_ONLY
- /*
-- * The states of mstatus_vs are:
-- * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
-  * We will have already diagnosed disabled state,
-  * and need to turn initial/clean into dirty.
-  */
-@@ -XXX,XX +XXX,XX @@ static void mark_vs_dirty(DisasContext *ctx)
- {
-     TCGv tmp;
--    if (ctx->mstatus_vs != MSTATUS_VS) {
-+    if (ctx->mstatus_vs != EXT_STATUS_DIRTY) {
-         /* Remember the state change for the rest of the TB.  */
--        ctx->mstatus_vs = MSTATUS_VS;
-+        ctx->mstatus_vs = EXT_STATUS_DIRTY;
-         tmp = tcg_temp_new();
-         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-@@ -XXX,XX +XXX,XX @@ static void mark_vs_dirty(DisasContext *ctx)
-         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-     }
--    if (ctx->virt_enabled && ctx->mstatus_hs_vs != MSTATUS_VS) {
-+    if (ctx->virt_enabled && ctx->mstatus_hs_vs != EXT_STATUS_DIRTY) {
-         /* Remember the stage change for the rest of the TB. */
--        ctx->mstatus_hs_vs = MSTATUS_VS;
-+        ctx->mstatus_hs_vs = EXT_STATUS_DIRTY;
-         tmp = tcg_temp_new();
-         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     ctx->pc_succ_insn = ctx->base.pc_first;
-     ctx->mem_idx = FIELD_EX32(tb_flags, TB_FLAGS, MEM_IDX);
--    ctx->mstatus_fs = tb_flags & TB_FLAGS_MSTATUS_FS;
--    ctx->mstatus_vs = tb_flags & TB_FLAGS_MSTATUS_VS;
-+    ctx->mstatus_fs = FIELD_EX32(tb_flags, TB_FLAGS, FS);
-+    ctx->mstatus_vs = FIELD_EX32(tb_flags, TB_FLAGS, VS);
-     ctx->priv_ver = env->priv_ver;
-     ctx->virt_enabled = FIELD_EX32(tb_flags, TB_FLAGS, VIRT_ENABLED);
-     ctx->misa_ext = env->misa_ext;
-diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvf.c.inc
-+++ b/target/riscv/insn_trans/trans_rvf.c.inc
-@@ -XXX,XX +XXX,XX @@
-  */
- #define REQUIRE_FPU do {\
--    if (ctx->mstatus_fs == 0) \
-+    if (ctx->mstatus_fs == EXT_STATUS_DISABLED) \
-         if (!ctx->cfg_ptr->ext_zfinx) \
-             return false; \
- } while (0)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline bool is_overlapped(const int8_t astart, int8_t asize,
+@@ -XXX,XX +XXX,XX @@ static bool require_rvf(DisasContext *s)
+     }
  static bool require_rvv(DisasContext *s)
  {
 -    return s->mstatus_vs != 0;
 +    return s->mstatus_vs != EXT_STATUS_DISABLED;
  }
- static bool require_rvf(DisasContext *s)
++static bool require_rvfmin(DisasContext *s)
- {
++{
 -    if (s->mstatus_fs == 0) {
 +    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
-         return false;
++        return false;
-     }
++    }
++
-@@ -XXX,XX +XXX,XX @@ static bool require_rvf(DisasContext *s)
++    switch (s->sew) {
++    case MO_16:
 +        return s->cfg_ptr->ext_zvfhmin;
 +    case MO_32:
 +        return s->cfg_ptr->ext_zve32f;
 +    default:
 +        return false;
 +    }
 +}
 +
  static bool require_scale_rvf(DisasContext *s)
  {
--    if (s->mstatus_fs == 0) {
+     if (s->mstatus_fs == EXT_STATUS_DISABLED) {
-+    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
+@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvfmin(DisasContext *s)
          return false;
      }
-@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvf(DisasContext *s)
+     switch (s->sew) {
+-    case MO_8:
- static bool require_scale_rvfmin(DisasContext *s)
+-        return s->cfg_ptr->ext_zvfhmin;
      case MO_16:
          return s->cfg_ptr->ext_zve32f;
      case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool opxfv_widen_check(DisasContext *s, arg_rmr *a)
  static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
  {
--    if (s->mstatus_fs == 0) {
+     return opfv_widen_check(s, a) &&
-+    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
++           require_rvfmin(s) &&
-         return false;
+            require_scale_rvfmin(s) &&
-     }
+            (s->sew != MO_8);
+ }
@@ -XXX,XX +XXX,XX @@ static bool opfxv_narrow_check(DisasContext *s, arg_rmr *a)
  static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
  {
      return opfv_narrow_check(s, a) &&
 +           require_rvfmin(s) &&
             require_scale_rvfmin(s) &&
             (s->sew != MO_8);
  }
 --
-.40.0
+.45.1

-[PULL 87/89] target/riscv: Fix Guest Physical Address Translation
+[PULL 18/28] target/riscv: rvv: Check single width operator for vector fp widen instructions
-From: Irina Ryapolova <irina.ryapolova@syntacore.com>
+From: Max Chou <max.chou@sifive.com>
-Before changing the flow check for sv39/48/57.
+The require_scale_rvf function only checks the double width operator for
 the vector floating point widen instructions, so most of the widen
 checking functions need to add require_rvf for single width operator.
-According to specification (for Supervisor mode):
+The vfwcvt.f.x.v and vfwcvt.f.xu.v instructions convert single width
-Sv39 implementations support a 39-bit virtual address space, divided into 4 KiB
+integer to double width float, so the opfxv_widen_check function doesn’t
-pages.
+need require_rvf for the single width operator(integer).
 Instruction fetch addresses and load and store effective addresses, which are
 bits,
 must have bits 63–39 all equal to bit 38, or else a page-fault exception will
 occur.
 Likewise for Sv48 and Sv57.
-So the high bits are equal to bit 38 for sv39.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-According to specification (for Hypervisor mode):
+Cc: qemu-stable <qemu-stable@nongnu.org>
-For Sv39x4, address bits of the guest physical address 63:41 must all be zeros,
+Message-ID: <20240322092600.1198921-3-max.chou@sifive.com>
 or else a
 guest-page-fault exception occurs.
 Likewise for Sv48x4 and Sv57x4.
 For Sv48x4 address bits 63:50 must all be zeros, or else a guest-page-fault
 exception occurs.
 For Sv57x4 address bits 63:59 must all be zeros, or else a guest-page-fault
 exception occurs.
 For example we are trying to access address 0xffff_ffff_ff01_0000 with only
 G-translation enabled.
 So expected behavior is to generate exception. But qemu doesn't generate such
 exception.
 For the old check, we get
 va_bits == 41, mask == (1 << 24) - 1, masked_msbs == (0xffff_ffff_ff01_0000 >>
 ) & mask == mask.
 Accordingly, the condition masked_msbs != 0 && masked_msbs != mask is not
 fulfilled
 and the check passes.
 Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230418075423.26217-1-irina.ryapolova@syntacore.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 25 ++++++++++++++++---------
+ target/riscv/insn_trans/trans_rvv.c.inc | 5 +++++
-file changed, 16 insertions(+), 9 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVF_TRANS(vfrsub_vf,  opfvf_check)
+ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
-     CPUState *cs = env_cpu(env);
+ {
-     int va_bits = PGSHIFT + levels * ptidxbits + widened;
+     return require_rvv(s) &&
--    target_ulong mask, masked_msbs;
++           require_rvf(s) &&
+            require_scale_rvf(s) &&
--    if (TARGET_LONG_BITS > (va_bits - 1)) {
+            (s->sew != MO_8) &&
--        mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
+            vext_check_isa_ill(s) &&
--    } else {
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVV_WIDEN_TRANS(vfwsub_vv, opfvv_widen_check)
--        mask = 0;
+ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
--    }
+ {
--    masked_msbs = (addr >> (va_bits - 1)) & mask;
+     return require_rvv(s) &&
-+    if (first_stage == true) {
++           require_rvf(s) &&
-+        target_ulong mask, masked_msbs;
+            require_scale_rvf(s) &&
+            (s->sew != MO_8) &&
--    if (masked_msbs != 0 && masked_msbs != mask) {
+            vext_check_isa_ill(s) &&
--        return TRANSLATE_FAIL;
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVF_WIDEN_TRANS(vfwsub_vf)
-+        if (TARGET_LONG_BITS > (va_bits - 1)) {
+ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
-+            mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
+ {
-+        } else {
+     return require_rvv(s) &&
-+            mask = 0;
++           require_rvf(s) &&
-+        }
+            require_scale_rvf(s) &&
-+        masked_msbs = (addr >> (va_bits - 1)) & mask;
+            (s->sew != MO_8) &&
-+
+            vext_check_isa_ill(s) &&
-+        if (masked_msbs != 0 && masked_msbs != mask) {
+@@ -XXX,XX +XXX,XX @@ GEN_OPFWV_WIDEN_TRANS(vfwsub_wv)
-+            return TRANSLATE_FAIL;
+ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
-+        }
+ {
-+    } else {
+     return require_rvv(s) &&
-+        if (vm != VM_1_10_SV32 && addr >> va_bits != 0) {
++           require_rvf(s) &&
-+            return TRANSLATE_FAIL;
+            require_scale_rvf(s) &&
-+        }
+            (s->sew != MO_8) &&
-     }
+            vext_check_isa_ill(s) &&
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVV_TRANS(vfredmin_vs, freduction_check)
-     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
+ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return reduction_widen_check(s, a) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8);
  }
 --
-.40.0
+.45.1

-[PULL 62/89] target/riscv: Add a tb flags field for vstart
+[PULL 19/28] target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Max Chou <max.chou@sifive.com>
-Once we mistook the vstart directly from the env->vstart. As env->vstart is not
+The opfv_narrow_check needs to check the single width float operator by
-a constant, we should record it in the tb flags if we want to use
+require_rvf.
 it in translation.
-Reported-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Message-ID: <20240322092600.1198921-4-max.chou@sifive.com>
 Message-Id: <20230324143031.1093-5-zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230325105429.1142530-6-richard.henderson@linaro.org>
 Message-Id: <20230412114333.118895-6-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                      |  1 +
+ target/riscv/insn_trans/trans_rvv.c.inc | 1 +
- target/riscv/cpu_helper.c               |  1 +
+file changed, 1 insertion(+)
  target/riscv/translate.c                |  4 ++--
  target/riscv/insn_trans/trans_rvv.c.inc | 14 +++++++-------
 files changed, 11 insertions(+), 9 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VMA, 21, 1)
- FIELD(TB_FLAGS, ITRIGGER, 22, 1)
- /* Virtual mode enabled */
- FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
-+FIELD(TB_FLAGS, VSTART_EQ_ZERO, 24, 1)
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-                            FIELD_EX64(env->vtype, VTYPE, VTA));
-         flags = FIELD_DP32(flags, TB_FLAGS, VMA,
-                            FIELD_EX64(env->vtype, VTYPE, VMA));
-+        flags = FIELD_DP32(flags, TB_FLAGS, VSTART_EQ_ZERO, env->vstart == 0);
-     } else {
-         flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
-     }
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     uint8_t vta;
-     uint8_t vma;
-     bool cfg_vta_all_1s;
--    target_ulong vstart;
-+    bool vstart_eq_zero;
-     bool vl_eq_vlmax;
-     CPUState *cs;
-     TCGv zero;
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     ctx->vta = FIELD_EX32(tb_flags, TB_FLAGS, VTA) && cpu->cfg.rvv_ta_all_1s;
-     ctx->vma = FIELD_EX32(tb_flags, TB_FLAGS, VMA) && cpu->cfg.rvv_ma_all_1s;
-     ctx->cfg_vta_all_1s = cpu->cfg.rvv_ta_all_1s;
--    ctx->vstart = env->vstart;
-+    ctx->vstart_eq_zero = FIELD_EX32(tb_flags, TB_FLAGS, VSTART_EQ_ZERO);
-     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
-     ctx->misa_mxl_max = env->misa_mxl_max;
-     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool vext_check_sds(DisasContext *s, int vd, int vs1, int vs2, int vm)
+@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
-  */
+ static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
  static bool vext_check_reduction(DisasContext *s, int vs2)
  {
--    return require_align(vs2, s->lmul) && (s->vstart == 0);
+     return opfv_narrow_check(s, a) &&
-+    return require_align(vs2, s->lmul) && s->vstart_eq_zero;
++           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8);
  }
- /*
-@@ -XXX,XX +XXX,XX @@ static bool trans_vcpop_m(DisasContext *s, arg_rmr *a)
- {
-     if (require_rvv(s) &&
-         vext_check_isa_ill(s) &&
--        s->vstart == 0) {
-+        s->vstart_eq_zero) {
-         TCGv_ptr src2, mask;
-         TCGv dst;
-         TCGv_i32 desc;
-@@ -XXX,XX +XXX,XX @@ static bool trans_vfirst_m(DisasContext *s, arg_rmr *a)
- {
-     if (require_rvv(s) &&
-         vext_check_isa_ill(s) &&
--        s->vstart == 0) {
-+        s->vstart_eq_zero) {
-         TCGv_ptr src2, mask;
-         TCGv dst;
-         TCGv_i32 desc;
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
-         vext_check_isa_ill(s) &&                                   \
-         require_vm(a->vm, a->rd) &&                                \
-         (a->rd != a->rs2) &&                                       \
--        (s->vstart == 0)) {                                        \
-+        s->vstart_eq_zero) {                                       \
-         uint32_t data = 0;                                         \
-         gen_helper_gvec_3_ptr *fn = gen_helper_##NAME;             \
-         TCGLabel *over = gen_new_label();                          \
-@@ -XXX,XX +XXX,XX @@ static bool trans_viota_m(DisasContext *s, arg_viota_m *a)
-         !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
-         require_vm(a->vm, a->rd) &&
-         require_align(a->rd, s->lmul) &&
--        (s->vstart == 0)) {
-+        s->vstart_eq_zero) {
-         uint32_t data = 0;
-         TCGLabel *over = gen_new_label();
-         tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-@@ -XXX,XX +XXX,XX @@ static bool vcompress_vm_check(DisasContext *s, arg_r *a)
-            require_align(a->rs2, s->lmul) &&
-            (a->rd != a->rs2) &&
-            !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs1, 1) &&
--           (s->vstart == 0);
-+           s->vstart_eq_zero;
- }
- static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
-         QEMU_IS_ALIGNED(a->rd, LEN) &&                                  \
-         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
-         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
--        if (s->vstart == 0) {                                           \
-+        if (s->vstart_eq_zero) {                                        \
-             /* EEW = 8 */                                               \
-             tcg_gen_gvec_mov(MO_8, vreg_ofs(s, a->rd),                  \
-                              vreg_ofs(s, a->rs2), maxsz, maxsz);        \
 --
-.40.0
+.45.1

-[PULL 29/89] target/riscv: Fix format for indentation
+[PULL 20/28] target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Max Chou <max.chou@sifive.com>
-Fix identation problems, and try to use the same indentation strategy
+If the checking functions check both the single and double width
-in the same file.
+operators at the same time, then the single width operator checking
 functions (require_rvf[min]) will check whether the SEW is 8.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
 Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230405085813.40643-3-liweiwei@iscas.ac.cn>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240322092600.1198921-5-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.h                      |   9 +-
+ target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++------------
- target/riscv/arch_dump.c                |   4 +-
+file changed, 4 insertions(+), 12 deletions(-)
  target/riscv/cpu.c                      |  40 +++---
  target/riscv/cpu_helper.c               | 163 ++++++++++++------------
  target/riscv/fpu_helper.c               |  24 ++--
  target/riscv/m128_helper.c              |  16 +--
  target/riscv/machine.c                  |  18 +--
  target/riscv/op_helper.c                |   4 +-
  target/riscv/pmp.c                      |  19 +--
  target/riscv/translate.c                |   4 +-
  target/riscv/vector_helper.c            | 159 +++++++++++------------
  target/riscv/insn_trans/trans_rvv.c.inc |  28 ++--
 files changed, 247 insertions(+), 241 deletions(-)
-diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.h
-+++ b/target/riscv/pmp.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- } pmp_table_t;
- void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
--    target_ulong val);
-+                      target_ulong val);
- target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
- void mseccfg_csr_write(CPURISCVState *env, target_ulong val);
- target_ulong mseccfg_csr_read(CPURISCVState *env);
- void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
--    target_ulong val);
-+                       target_ulong val);
- target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
- int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
--    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
--    target_ulong mode);
-+                       target_ulong size, pmp_priv_t privs,
-+                       pmp_priv_t *allowed_privs,
-+                       target_ulong mode);
- target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
-                               target_ulong tlb_sa, target_ulong tlb_ea);
- void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
-diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/arch_dump.c
-+++ b/target/riscv/arch_dump.c
-@@ -XXX,XX +XXX,XX @@ int cpu_get_dump_info(ArchDumpInfo *info,
-     info->d_class = ELFCLASS32;
- #endif
--    info->d_endian = (env->mstatus & MSTATUS_UBE) != 0
--                     ? ELFDATA2MSB : ELFDATA2LSB;
-+    info->d_endian = (env->mstatus & MSTATUS_UBE) != 0 ?
-+                     ELFDATA2MSB : ELFDATA2LSB;
-     return 0;
- }
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
- };
- #define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
--{#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
-+    {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
- /**
-  * Here are the ordering rules of extension naming defined by RISC-V
-@@ -XXX,XX +XXX,XX @@ static void isa_ext_update_enabled(RISCVCPU *cpu,
- }
- const char * const riscv_int_regnames[] = {
--  "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
--  "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
--  "x14/a4",  "x15/a5", "x16/a6", "x17/a7", "x18/s2", "x19/s3",  "x20/s4",
--  "x21/s5",  "x22/s6", "x23/s7", "x24/s8", "x25/s9", "x26/s10", "x27/s11",
--  "x28/t3",  "x29/t4", "x30/t5", "x31/t6"
-+    "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
-+    "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
-+    "x14/a4",  "x15/a5", "x16/a6", "x17/a7", "x18/s2", "x19/s3",  "x20/s4",
-+    "x21/s5",  "x22/s6", "x23/s7", "x24/s8", "x25/s9", "x26/s10", "x27/s11",
-+    "x28/t3",  "x29/t4", "x30/t5", "x31/t6"
- };
- const char * const riscv_int_regnamesh[] = {
--  "x0h/zeroh", "x1h/rah",  "x2h/sph",   "x3h/gph",   "x4h/tph",  "x5h/t0h",
--  "x6h/t1h",   "x7h/t2h",  "x8h/s0h",   "x9h/s1h",   "x10h/a0h", "x11h/a1h",
--  "x12h/a2h",  "x13h/a3h", "x14h/a4h",  "x15h/a5h",  "x16h/a6h", "x17h/a7h",
--  "x18h/s2h",  "x19h/s3h", "x20h/s4h",  "x21h/s5h",  "x22h/s6h", "x23h/s7h",
--  "x24h/s8h",  "x25h/s9h", "x26h/s10h", "x27h/s11h", "x28h/t3h", "x29h/t4h",
--  "x30h/t5h",  "x31h/t6h"
-+    "x0h/zeroh", "x1h/rah",  "x2h/sph",   "x3h/gph",   "x4h/tph",  "x5h/t0h",
-+    "x6h/t1h",   "x7h/t2h",  "x8h/s0h",   "x9h/s1h",   "x10h/a0h", "x11h/a1h",
-+    "x12h/a2h",  "x13h/a3h", "x14h/a4h",  "x15h/a5h",  "x16h/a6h", "x17h/a7h",
-+    "x18h/s2h",  "x19h/s3h", "x20h/s4h",  "x21h/s5h",  "x22h/s6h", "x23h/s7h",
-+    "x24h/s8h",  "x25h/s9h", "x26h/s10h", "x27h/s11h", "x28h/t3h", "x29h/t4h",
-+    "x30h/t5h",  "x31h/t6h"
- };
- const char * const riscv_fpr_regnames[] = {
--  "f0/ft0",   "f1/ft1",  "f2/ft2",   "f3/ft3",   "f4/ft4",  "f5/ft5",
--  "f6/ft6",   "f7/ft7",  "f8/fs0",   "f9/fs1",   "f10/fa0", "f11/fa1",
--  "f12/fa2",  "f13/fa3", "f14/fa4",  "f15/fa5",  "f16/fa6", "f17/fa7",
--  "f18/fs2",  "f19/fs3", "f20/fs4",  "f21/fs5",  "f22/fs6", "f23/fs7",
--  "f24/fs8",  "f25/fs9", "f26/fs10", "f27/fs11", "f28/ft8", "f29/ft9",
--  "f30/ft10", "f31/ft11"
-+    "f0/ft0",   "f1/ft1",  "f2/ft2",   "f3/ft3",   "f4/ft4",  "f5/ft5",
-+    "f6/ft6",   "f7/ft7",  "f8/fs0",   "f9/fs1",   "f10/fa0", "f11/fa1",
-+    "f12/fa2",  "f13/fa3", "f14/fa4",  "f15/fa5",  "f16/fa6", "f17/fa7",
-+    "f18/fs2",  "f19/fs3", "f20/fs4",  "f21/fs5",  "f22/fs6", "f23/fs7",
-+    "f24/fs8",  "f25/fs9", "f26/fs10", "f27/fs11", "f28/ft8", "f29/ft9",
-+    "f30/ft10", "f31/ft11"
- };
- static const char * const riscv_excp_names[] = {
-@@ -XXX,XX +XXX,XX @@ static void riscv_any_cpu_init(Object *obj)
- #ifndef CONFIG_USER_ONLY
-     set_satp_mode_max_supported(RISCV_CPU(obj),
--            riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
--                                    VM_1_10_SV32 : VM_1_10_SV57);
-+        riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
-+        VM_1_10_SV32 : VM_1_10_SV57);
- #endif
-     set_priv_version(env, PRIV_VERSION_1_12_0);
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-         flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
-         flags = FIELD_DP32(flags, TB_FLAGS, SEW, sew);
-         flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
--                    FIELD_EX64(env->vtype, VTYPE, VLMUL));
-+                           FIELD_EX64(env->vtype, VTYPE, VLMUL));
-         flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
-         flags = FIELD_DP32(flags, TB_FLAGS, VTA,
--                    FIELD_EX64(env->vtype, VTYPE, VTA));
-+                           FIELD_EX64(env->vtype, VTYPE, VTA));
-         flags = FIELD_DP32(flags, TB_FLAGS, VMA,
--                    FIELD_EX64(env->vtype, VTYPE, VMA));
-+                           FIELD_EX64(env->vtype, VTYPE, VMA));
-     } else {
-         flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
-     }
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-         if (env->priv == PRV_M ||
-             (env->priv == PRV_S && !env->virt_enabled) ||
-             (env->priv == PRV_U && !env->virt_enabled &&
--                get_field(env->hstatus, HSTATUS_HU))) {
-+             get_field(env->hstatus, HSTATUS_HU))) {
-             flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
-         }
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_hviprio_index2irq(int index, int *out_irq, int *out_rdzero)
-  * ----------------------------------------------------------------
-  */
- static const uint8_t default_iprio[64] = {
-- /* Custom interrupts 48 to 63 */
-- [63] = IPRIO_MMAXIPRIO,
-- [62] = IPRIO_MMAXIPRIO,
-- [61] = IPRIO_MMAXIPRIO,
-- [60] = IPRIO_MMAXIPRIO,
-- [59] = IPRIO_MMAXIPRIO,
-- [58] = IPRIO_MMAXIPRIO,
-- [57] = IPRIO_MMAXIPRIO,
-- [56] = IPRIO_MMAXIPRIO,
-- [55] = IPRIO_MMAXIPRIO,
-- [54] = IPRIO_MMAXIPRIO,
-- [53] = IPRIO_MMAXIPRIO,
-- [52] = IPRIO_MMAXIPRIO,
-- [51] = IPRIO_MMAXIPRIO,
-- [50] = IPRIO_MMAXIPRIO,
-- [49] = IPRIO_MMAXIPRIO,
-- [48] = IPRIO_MMAXIPRIO,
--
-- /* Custom interrupts 24 to 31 */
-- [31] = IPRIO_MMAXIPRIO,
-- [30] = IPRIO_MMAXIPRIO,
-- [29] = IPRIO_MMAXIPRIO,
-- [28] = IPRIO_MMAXIPRIO,
-- [27] = IPRIO_MMAXIPRIO,
-- [26] = IPRIO_MMAXIPRIO,
-- [25] = IPRIO_MMAXIPRIO,
-- [24] = IPRIO_MMAXIPRIO,
--
-- [47] = IPRIO_DEFAULT_UPPER,
-- [23] = IPRIO_DEFAULT_UPPER + 1,
-- [46] = IPRIO_DEFAULT_UPPER + 2,
-- [45] = IPRIO_DEFAULT_UPPER + 3,
-- [22] = IPRIO_DEFAULT_UPPER + 4,
-- [44] = IPRIO_DEFAULT_UPPER + 5,
--
-- [43] = IPRIO_DEFAULT_UPPER + 6,
-- [21] = IPRIO_DEFAULT_UPPER + 7,
-- [42] = IPRIO_DEFAULT_UPPER + 8,
-- [41] = IPRIO_DEFAULT_UPPER + 9,
-- [20] = IPRIO_DEFAULT_UPPER + 10,
-- [40] = IPRIO_DEFAULT_UPPER + 11,
--
-- [11] = IPRIO_DEFAULT_M,
-- [3]  = IPRIO_DEFAULT_M + 1,
-- [7]  = IPRIO_DEFAULT_M + 2,
--
-- [9]  = IPRIO_DEFAULT_S,
-- [1]  = IPRIO_DEFAULT_S + 1,
-- [5]  = IPRIO_DEFAULT_S + 2,
--
-- [12] = IPRIO_DEFAULT_SGEXT,
--
-- [10] = IPRIO_DEFAULT_VS,
-- [2]  = IPRIO_DEFAULT_VS + 1,
-- [6]  = IPRIO_DEFAULT_VS + 2,
--
-- [39] = IPRIO_DEFAULT_LOWER,
-- [19] = IPRIO_DEFAULT_LOWER + 1,
-- [38] = IPRIO_DEFAULT_LOWER + 2,
-- [37] = IPRIO_DEFAULT_LOWER + 3,
-- [18] = IPRIO_DEFAULT_LOWER + 4,
-- [36] = IPRIO_DEFAULT_LOWER + 5,
--
-- [35] = IPRIO_DEFAULT_LOWER + 6,
-- [17] = IPRIO_DEFAULT_LOWER + 7,
-- [34] = IPRIO_DEFAULT_LOWER + 8,
-- [33] = IPRIO_DEFAULT_LOWER + 9,
-- [16] = IPRIO_DEFAULT_LOWER + 10,
-- [32] = IPRIO_DEFAULT_LOWER + 11,
-+    /* Custom interrupts 48 to 63 */
-+    [63] = IPRIO_MMAXIPRIO,
-+    [62] = IPRIO_MMAXIPRIO,
-+    [61] = IPRIO_MMAXIPRIO,
-+    [60] = IPRIO_MMAXIPRIO,
-+    [59] = IPRIO_MMAXIPRIO,
-+    [58] = IPRIO_MMAXIPRIO,
-+    [57] = IPRIO_MMAXIPRIO,
-+    [56] = IPRIO_MMAXIPRIO,
-+    [55] = IPRIO_MMAXIPRIO,
-+    [54] = IPRIO_MMAXIPRIO,
-+    [53] = IPRIO_MMAXIPRIO,
-+    [52] = IPRIO_MMAXIPRIO,
-+    [51] = IPRIO_MMAXIPRIO,
-+    [50] = IPRIO_MMAXIPRIO,
-+    [49] = IPRIO_MMAXIPRIO,
-+    [48] = IPRIO_MMAXIPRIO,
-+
-+    /* Custom interrupts 24 to 31 */
-+    [31] = IPRIO_MMAXIPRIO,
-+    [30] = IPRIO_MMAXIPRIO,
-+    [29] = IPRIO_MMAXIPRIO,
-+    [28] = IPRIO_MMAXIPRIO,
-+    [27] = IPRIO_MMAXIPRIO,
-+    [26] = IPRIO_MMAXIPRIO,
-+    [25] = IPRIO_MMAXIPRIO,
-+    [24] = IPRIO_MMAXIPRIO,
-+
-+    [47] = IPRIO_DEFAULT_UPPER,
-+    [23] = IPRIO_DEFAULT_UPPER + 1,
-+    [46] = IPRIO_DEFAULT_UPPER + 2,
-+    [45] = IPRIO_DEFAULT_UPPER + 3,
-+    [22] = IPRIO_DEFAULT_UPPER + 4,
-+    [44] = IPRIO_DEFAULT_UPPER + 5,
-+
-+    [43] = IPRIO_DEFAULT_UPPER + 6,
-+    [21] = IPRIO_DEFAULT_UPPER + 7,
-+    [42] = IPRIO_DEFAULT_UPPER + 8,
-+    [41] = IPRIO_DEFAULT_UPPER + 9,
-+    [20] = IPRIO_DEFAULT_UPPER + 10,
-+    [40] = IPRIO_DEFAULT_UPPER + 11,
-+
-+    [11] = IPRIO_DEFAULT_M,
-+    [3]  = IPRIO_DEFAULT_M + 1,
-+    [7]  = IPRIO_DEFAULT_M + 2,
-+
-+    [9]  = IPRIO_DEFAULT_S,
-+    [1]  = IPRIO_DEFAULT_S + 1,
-+    [5]  = IPRIO_DEFAULT_S + 2,
-+
-+    [12] = IPRIO_DEFAULT_SGEXT,
-+
-+    [10] = IPRIO_DEFAULT_VS,
-+    [2]  = IPRIO_DEFAULT_VS + 1,
-+    [6]  = IPRIO_DEFAULT_VS + 2,
-+
-+    [39] = IPRIO_DEFAULT_LOWER,
-+    [19] = IPRIO_DEFAULT_LOWER + 1,
-+    [38] = IPRIO_DEFAULT_LOWER + 2,
-+    [37] = IPRIO_DEFAULT_LOWER + 3,
-+    [18] = IPRIO_DEFAULT_LOWER + 4,
-+    [36] = IPRIO_DEFAULT_LOWER + 5,
-+
-+    [35] = IPRIO_DEFAULT_LOWER + 6,
-+    [17] = IPRIO_DEFAULT_LOWER + 7,
-+    [34] = IPRIO_DEFAULT_LOWER + 8,
-+    [33] = IPRIO_DEFAULT_LOWER + 9,
-+    [16] = IPRIO_DEFAULT_LOWER + 10,
-+    [32] = IPRIO_DEFAULT_LOWER + 11,
- };
- uint8_t riscv_cpu_default_priority(int irq)
-@@ -XXX,XX +XXX,XX @@ restart:
-                  */
-                 MemoryRegion *mr;
-                 hwaddr l = sizeof(target_ulong), addr1;
--                mr = address_space_translate(cs->as, pte_addr,
--                    &addr1, &l, false, MEMTXATTRS_UNSPECIFIED);
-+                mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
-+                                             false, MEMTXATTRS_UNSPECIFIED);
-                 if (memory_region_is_ram(mr)) {
-                     target_ulong *pte_pa =
-                         qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ restart:
-             /* add write permission on stores or if the page is already dirty,
-                so that we TLB miss on later writes to update the dirty bit */
-             if ((pte & PTE_W) &&
--                    (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
-+                (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
-                 *prot |= PAGE_WRITE;
-             }
-             return TRANSLATE_SUCCESS;
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                                        false);
-             qemu_log_mask(CPU_LOG_MMU,
--                    "%s 2nd-stage address=%" VADDR_PRIx " ret %d physical "
--                    HWADDR_FMT_plx " prot %d\n",
--                    __func__, im_address, ret, pa, prot2);
-+                          "%s 2nd-stage address=%" VADDR_PRIx
-+                          " ret %d physical "
-+                          HWADDR_FMT_plx " prot %d\n",
-+                          __func__, im_address, ret, pa, prot2);
-             prot &= prot2;
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-         env->htval = htval;
-         env->htinst = tinst;
-         env->pc = (env->stvec >> 2 << 2) +
--            ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
-+                  ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
-         riscv_cpu_set_mode(env, PRV_S);
-     } else {
-         /* handle the trap in M-mode */
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-         env->mtval2 = mtval2;
-         env->mtinst = tinst;
-         env->pc = (env->mtvec >> 2 << 2) +
--            ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
-+                  ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
-         riscv_cpu_set_mode(env, PRV_M);
-     }
-diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/fpu_helper.c
-+++ b/target/riscv/fpu_helper.c
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-     float32 frs1 = check_nanbox_s(env, rs1);
-     float32 frs2 = check_nanbox_s(env, rs2);
-     return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
--                    float32_minnum(frs1, frs2, &env->fp_status) :
--                    float32_minimum_number(frs1, frs2, &env->fp_status));
-+                         float32_minnum(frs1, frs2, &env->fp_status) :
-+                         float32_minimum_number(frs1, frs2, &env->fp_status));
- }
- uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-     float32 frs1 = check_nanbox_s(env, rs1);
-     float32 frs2 = check_nanbox_s(env, rs2);
-     return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
--                    float32_maxnum(frs1, frs2, &env->fp_status) :
--                    float32_maximum_number(frs1, frs2, &env->fp_status));
-+                         float32_maxnum(frs1, frs2, &env->fp_status) :
-+                         float32_maximum_number(frs1, frs2, &env->fp_status));
- }
- uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fdiv_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
- uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
- {
-     return env->priv_ver < PRIV_VERSION_1_11_0 ?
--            float64_minnum(frs1, frs2, &env->fp_status) :
--            float64_minimum_number(frs1, frs2, &env->fp_status);
-+           float64_minnum(frs1, frs2, &env->fp_status) :
-+           float64_minimum_number(frs1, frs2, &env->fp_status);
- }
- uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
- {
-     return env->priv_ver < PRIV_VERSION_1_11_0 ?
--            float64_maxnum(frs1, frs2, &env->fp_status) :
--            float64_maximum_number(frs1, frs2, &env->fp_status);
-+           float64_maxnum(frs1, frs2, &env->fp_status) :
-+           float64_maximum_number(frs1, frs2, &env->fp_status);
- }
- uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-     float16 frs1 = check_nanbox_h(env, rs1);
-     float16 frs2 = check_nanbox_h(env, rs2);
-     return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
--                    float16_minnum(frs1, frs2, &env->fp_status) :
--                    float16_minimum_number(frs1, frs2, &env->fp_status));
-+                         float16_minnum(frs1, frs2, &env->fp_status) :
-+                         float16_minimum_number(frs1, frs2, &env->fp_status));
- }
- uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-     float16 frs1 = check_nanbox_h(env, rs1);
-     float16 frs2 = check_nanbox_h(env, rs2);
-     return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
--                    float16_maxnum(frs1, frs2, &env->fp_status) :
--                    float16_maximum_number(frs1, frs2, &env->fp_status));
-+                         float16_maxnum(frs1, frs2, &env->fp_status) :
-+                         float16_maximum_number(frs1, frs2, &env->fp_status));
- }
- uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
-diff --git a/target/riscv/m128_helper.c b/target/riscv/m128_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/m128_helper.c
-+++ b/target/riscv/m128_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/helper-proto.h"
- target_ulong HELPER(divu_i128)(CPURISCVState *env,
--                       target_ulong ul, target_ulong uh,
--                       target_ulong vl, target_ulong vh)
-+                               target_ulong ul, target_ulong uh,
-+                               target_ulong vl, target_ulong vh)
- {
-     target_ulong ql, qh;
-     Int128 q;
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(divu_i128)(CPURISCVState *env,
- }
- target_ulong HELPER(remu_i128)(CPURISCVState *env,
--                       target_ulong ul, target_ulong uh,
--                       target_ulong vl, target_ulong vh)
-+                               target_ulong ul, target_ulong uh,
-+                               target_ulong vl, target_ulong vh)
- {
-     target_ulong rl, rh;
-     Int128 r;
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(remu_i128)(CPURISCVState *env,
- }
- target_ulong HELPER(divs_i128)(CPURISCVState *env,
--                       target_ulong ul, target_ulong uh,
--                       target_ulong vl, target_ulong vh)
-+                               target_ulong ul, target_ulong uh,
-+                               target_ulong vl, target_ulong vh)
- {
-     target_ulong qh, ql;
-     Int128 q;
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(divs_i128)(CPURISCVState *env,
- }
- target_ulong HELPER(rems_i128)(CPURISCVState *env,
--                       target_ulong ul, target_ulong uh,
--                       target_ulong vl, target_ulong vh)
-+                               target_ulong ul, target_ulong uh,
-+                               target_ulong vl, target_ulong vh)
- {
-     target_ulong rh, rl;
-     Int128 r;
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/machine.c
-+++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vector = {
-     .minimum_version_id = 2,
-     .needed = vector_needed,
-     .fields = (VMStateField[]) {
--            VMSTATE_UINT64_ARRAY(env.vreg, RISCVCPU, 32 * RV_VLEN_MAX / 64),
--            VMSTATE_UINTTL(env.vxrm, RISCVCPU),
--            VMSTATE_UINTTL(env.vxsat, RISCVCPU),
--            VMSTATE_UINTTL(env.vl, RISCVCPU),
--            VMSTATE_UINTTL(env.vstart, RISCVCPU),
--            VMSTATE_UINTTL(env.vtype, RISCVCPU),
--            VMSTATE_BOOL(env.vill, RISCVCPU),
--            VMSTATE_END_OF_LIST()
--        }
-+        VMSTATE_UINT64_ARRAY(env.vreg, RISCVCPU, 32 * RV_VLEN_MAX / 64),
-+        VMSTATE_UINTTL(env.vxrm, RISCVCPU),
-+        VMSTATE_UINTTL(env.vxsat, RISCVCPU),
-+        VMSTATE_UINTTL(env.vl, RISCVCPU),
-+        VMSTATE_UINTTL(env.vstart, RISCVCPU),
-+        VMSTATE_UINTTL(env.vtype, RISCVCPU),
-+        VMSTATE_BOOL(env.vill, RISCVCPU),
-+        VMSTATE_END_OF_LIST()
-+    }
- };
- static bool pointermasking_needed(void *opaque)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
-     if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) ||
-         (rvs && prv_u && !env->virt_enabled)) {
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
--    } else if (env->virt_enabled && (prv_u ||
--        (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
-+    } else if (env->virt_enabled &&
-+               (prv_u || (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
-         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
-     } else {
-         cs->halted = 1;
-diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.c
-+++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/exec-all.h"
- static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
--    uint8_t val);
-+                          uint8_t val);
- static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
- static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
-@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
- {
-     int result = 0;
--    if ((addr >= env->pmp_state.addr[pmp_index].sa)
--        && (addr <= env->pmp_state.addr[pmp_index].ea)) {
-+    if ((addr >= env->pmp_state.addr[pmp_index].sa) &&
-+        (addr <= env->pmp_state.addr[pmp_index].ea)) {
-         result = 1;
-     } else {
-         result = 0;
-@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
-  * Check if the address has required RWX privs when no PMP entry is matched.
-  */
- static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
--    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
--    target_ulong mode)
-+                                       target_ulong size, pmp_priv_t privs,
-+                                       pmp_priv_t *allowed_privs,
-+                                       target_ulong mode)
- {
-     bool ret;
-@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
-  * Return negtive value if no match
-  */
- int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
--    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
--    target_ulong mode)
-+                       target_ulong size, pmp_priv_t privs,
-+                       pmp_priv_t *allowed_privs, target_ulong mode)
- {
-     int i = 0;
-     int ret = -1;
-@@ -XXX,XX +XXX,XX @@ int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-  * Handle a write to a pmpcfg CSR
-  */
- void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
--    target_ulong val)
-+                      target_ulong val)
- {
-     int i;
-     uint8_t cfg_val;
-@@ -XXX,XX +XXX,XX @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
-  * Handle a write to a pmpaddr CSR
-  */
- void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
--    target_ulong val)
-+                       target_ulong val)
- {
-     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ EX_SH(12)
- } while (0)
- #define REQUIRE_EITHER_EXT(ctx, A, B) do {       \
--    if (!ctx->cfg_ptr->ext_##A &&      \
--        !ctx->cfg_ptr->ext_##B) {      \
-+    if (!ctx->cfg_ptr->ext_##A &&                \
-+        !ctx->cfg_ptr->ext_##B) {                \
-         return false;                            \
-     }                                            \
- } while (0)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
-         }
-     }
--    if ((sew > cpu->cfg.elen)
--        || vill
--        || (ediv != 0)
--        || (reserved != 0)) {
-+    if ((sew > cpu->cfg.elen) || vill || (ediv != 0) || (reserved != 0)) {
-         /* only set vill bit. */
-         env->vill = 1;
-         env->vtype = 0;
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,        \
-                                                                          \
-         *((ETYPE *)vd + H(i)) = DO_OP(s2, (ETYPE)(target_long)s1, carry);\
-     }                                                                    \
--    env->vstart = 0;                                          \
-+    env->vstart = 0;                                                     \
-     /* set tail elements to 1s */                                        \
-     vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);             \
- }
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_SHIFT_VV(vsra_vv_d, uint64_t, int64_t, H8, H8, DO_SRL, 0x3f)
- /* generate the helpers for shift instructions with one vector and one scalar */
- #define GEN_VEXT_SHIFT_VX(NAME, TD, TS2, HD, HS2, OP, MASK) \
- void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
--        void *vs2, CPURISCVState *env, uint32_t desc)       \
-+                  void *vs2, CPURISCVState *env,            \
-+                  uint32_t desc)                            \
- {                                                           \
-     uint32_t vm = vext_vm(desc);                            \
-     uint32_t vl = env->vl;                                  \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX(vmulhsu_vx_d, 8)
- /* Vector Integer Divide Instructions */
- #define DO_DIVU(N, M) (unlikely(M == 0) ? (__typeof(N))(-1) : N / M)
- #define DO_REMU(N, M) (unlikely(M == 0) ? N : N % M)
--#define DO_DIV(N, M)  (unlikely(M == 0) ? (__typeof(N))(-1) :\
-+#define DO_DIV(N, M)  (unlikely(M == 0) ? (__typeof(N))(-1) : \
-         unlikely((N == -N) && (M == (__typeof(N))(-1))) ? N : N / M)
--#define DO_REM(N, M)  (unlikely(M == 0) ? N :\
-+#define DO_REM(N, M)  (unlikely(M == 0) ? N : \
-         unlikely((N == -N) && (M == (__typeof(N))(-1))) ? 0 : N % M)
- RVVCALL(OPIVV2, vdivu_vv_b, OP_UUU_B, H1, H1, H1, DO_DIVU)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX(vwmulsu_vx_h, 4)
- GEN_VEXT_VX(vwmulsu_vx_w, 8)
- /* Vector Single-Width Integer Multiply-Add Instructions */
--#define OPIVV3(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)   \
-+#define OPIVV3(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)       \
- static void do_##NAME(void *vd, void *vs1, void *vs2, int i)       \
- {                                                                  \
-     TX1 s1 = *((T1 *)vs1 + HS1(i));                                \
-@@ -XXX,XX +XXX,XX @@ vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
- /* generate helpers for fixed point instructions with OPIVX format */
- #define GEN_VEXT_VX_RM(NAME, ESZ)                         \
- void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
--        void *vs2, CPURISCVState *env, uint32_t desc)     \
-+                  void *vs2, CPURISCVState *env,          \
-+                  uint32_t desc)                          \
- {                                                         \
-     vext_vx_rm_2(vd, v0, s1, vs2, env, desc,              \
-                  do_##NAME, ESZ);                         \
-@@ -XXX,XX +XXX,XX @@ static inline int8_t vsmul8(CPURISCVState *env, int vxrm, int8_t a, int8_t b)
-     res = (int16_t)a * (int16_t)b;
-     round = get_round(vxrm, res, 7);
--    res   = (res >> 7) + round;
-+    res = (res >> 7) + round;
-     if (res > INT8_MAX) {
-         env->vxsat = 0x1;
-@@ -XXX,XX +XXX,XX @@ static int16_t vsmul16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
-     res = (int32_t)a * (int32_t)b;
-     round = get_round(vxrm, res, 15);
--    res   = (res >> 15) + round;
-+    res = (res >> 15) + round;
-     if (res > INT16_MAX) {
-         env->vxsat = 0x1;
-@@ -XXX,XX +XXX,XX @@ static int32_t vsmul32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
-     res = (int64_t)a * (int64_t)b;
-     round = get_round(vxrm, res, 31);
--    res   = (res >> 31) + round;
-+    res = (res >> 31) + round;
-     if (res > INT32_MAX) {
-         env->vxsat = 0x1;
-@@ -XXX,XX +XXX,XX @@ vssrl8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t b)
-     uint8_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     return res;
- }
- static inline uint16_t
-@@ -XXX,XX +XXX,XX @@ vnclip8(CPURISCVState *env, int vxrm, int16_t a, int8_t b)
-     int16_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     if (res > INT8_MAX) {
-         env->vxsat = 0x1;
-         return INT8_MAX;
-@@ -XXX,XX +XXX,XX @@ vnclip16(CPURISCVState *env, int vxrm, int32_t a, int16_t b)
-     int32_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     if (res > INT16_MAX) {
-         env->vxsat = 0x1;
-         return INT16_MAX;
-@@ -XXX,XX +XXX,XX @@ vnclip32(CPURISCVState *env, int vxrm, int64_t a, int32_t b)
-     int64_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     if (res > INT32_MAX) {
-         env->vxsat = 0x1;
-         return INT32_MAX;
-@@ -XXX,XX +XXX,XX @@ vnclipu8(CPURISCVState *env, int vxrm, uint16_t a, uint8_t b)
-     uint16_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     if (res > UINT8_MAX) {
-         env->vxsat = 0x1;
-         return UINT8_MAX;
-@@ -XXX,XX +XXX,XX @@ vnclipu16(CPURISCVState *env, int vxrm, uint32_t a, uint16_t b)
-     uint32_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     if (res > UINT16_MAX) {
-         env->vxsat = 0x1;
-         return UINT16_MAX;
-@@ -XXX,XX +XXX,XX @@ vnclipu32(CPURISCVState *env, int vxrm, uint64_t a, uint32_t b)
-     uint64_t res;
-     round = get_round(vxrm, a, shift);
--    res   = (a >> shift)  + round;
-+    res = (a >> shift) + round;
-     if (res > UINT32_MAX) {
-         env->vxsat = 0x1;
-         return UINT32_MAX;
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1,        \
-     uint32_t vm = vext_vm(desc);                          \
-     uint32_t vl = env->vl;                                \
-     uint32_t total_elems =                                \
--        vext_get_total_elems(env, desc, ESZ);              \
-+        vext_get_total_elems(env, desc, ESZ);             \
-     uint32_t vta = vext_vta(desc);                        \
-     uint32_t vma = vext_vma(desc);                        \
-     uint32_t i;                                           \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfrsub_vf_d, 8)
- static uint32_t vfwadd16(uint16_t a, uint16_t b, float_status *s)
- {
-     return float32_add(float16_to_float32(a, true, s),
--            float16_to_float32(b, true, s), s);
-+                       float16_to_float32(b, true, s), s);
- }
- static uint64_t vfwadd32(uint32_t a, uint32_t b, float_status *s)
- {
-     return float64_add(float32_to_float64(a, s),
--            float32_to_float64(b, s), s);
-+                       float32_to_float64(b, s), s);
- }
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwadd_vf_w, 8)
- static uint32_t vfwsub16(uint16_t a, uint16_t b, float_status *s)
- {
-     return float32_sub(float16_to_float32(a, true, s),
--            float16_to_float32(b, true, s), s);
-+                       float16_to_float32(b, true, s), s);
- }
- static uint64_t vfwsub32(uint32_t a, uint32_t b, float_status *s)
- {
-     return float64_sub(float32_to_float64(a, s),
--            float32_to_float64(b, s), s);
-+                       float32_to_float64(b, s), s);
- }
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfrdiv_vf_d, 8)
- static uint32_t vfwmul16(uint16_t a, uint16_t b, float_status *s)
- {
-     return float32_mul(float16_to_float32(a, true, s),
--            float16_to_float32(b, true, s), s);
-+                       float16_to_float32(b, true, s), s);
- }
- static uint64_t vfwmul32(uint32_t a, uint32_t b, float_status *s)
- {
-     return float64_mul(float32_to_float64(a, s),
--            float32_to_float64(b, s), s);
-+                       float32_to_float64(b, s), s);
- }
- RVVCALL(OPFVV2, vfwmul_vv_h, WOP_UUU_H, H4, H2, H2, vfwmul16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwmul_vf_w, 8)
- /* Vector Single-Width Floating-Point Fused Multiply-Add Instructions */
- #define OPFVV3(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)       \
- static void do_##NAME(void *vd, void *vs1, void *vs2, int i,       \
--        CPURISCVState *env)                                        \
-+                      CPURISCVState *env)                          \
- {                                                                  \
-     TX1 s1 = *((T1 *)vs1 + HS1(i));                                \
-     TX2 s2 = *((T2 *)vs2 + HS2(i));                                \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV_ENV(vfmacc_vv_d, 8)
- #define OPFVF3(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)           \
- static void do_##NAME(void *vd, uint64_t s1, void *vs2, int i,    \
--        CPURISCVState *env)                                       \
-+                      CPURISCVState *env)                         \
- {                                                                 \
-     TX2 s2 = *((T2 *)vs2 + HS2(i));                               \
-     TD d = *((TD *)vd + HD(i));                                   \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfmacc_vf_d, 8)
- static uint16_t fnmacc16(uint16_t a, uint16_t b, uint16_t d, float_status *s)
- {
--    return float16_muladd(a, b, d,
--            float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float16_muladd(a, b, d, float_muladd_negate_c |
-+                                   float_muladd_negate_product, s);
- }
- static uint32_t fnmacc32(uint32_t a, uint32_t b, uint32_t d, float_status *s)
- {
--    return float32_muladd(a, b, d,
--            float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float32_muladd(a, b, d, float_muladd_negate_c |
-+                                   float_muladd_negate_product, s);
- }
- static uint64_t fnmacc64(uint64_t a, uint64_t b, uint64_t d, float_status *s)
- {
--    return float64_muladd(a, b, d,
--            float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float64_muladd(a, b, d, float_muladd_negate_c |
-+                                   float_muladd_negate_product, s);
- }
- RVVCALL(OPFVV3, vfnmacc_vv_h, OP_UUU_H, H2, H2, H2, fnmacc16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfmadd_vf_d, 8)
- static uint16_t fnmadd16(uint16_t a, uint16_t b, uint16_t d, float_status *s)
- {
--    return float16_muladd(d, b, a,
--            float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float16_muladd(d, b, a, float_muladd_negate_c |
-+                                   float_muladd_negate_product, s);
- }
- static uint32_t fnmadd32(uint32_t a, uint32_t b, uint32_t d, float_status *s)
- {
--    return float32_muladd(d, b, a,
--            float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float32_muladd(d, b, a, float_muladd_negate_c |
-+                                   float_muladd_negate_product, s);
- }
- static uint64_t fnmadd64(uint64_t a, uint64_t b, uint64_t d, float_status *s)
- {
--    return float64_muladd(d, b, a,
--            float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float64_muladd(d, b, a, float_muladd_negate_c |
-+                                   float_muladd_negate_product, s);
- }
- RVVCALL(OPFVV3, vfnmadd_vv_h, OP_UUU_H, H2, H2, H2, fnmadd16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfnmsub_vf_d, 8)
- static uint32_t fwmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
- {
-     return float32_muladd(float16_to_float32(a, true, s),
--                        float16_to_float32(b, true, s), d, 0, s);
-+                          float16_to_float32(b, true, s), d, 0, s);
- }
- static uint64_t fwmacc32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
- {
-     return float64_muladd(float32_to_float64(a, s),
--                        float32_to_float64(b, s), d, 0, s);
-+                          float32_to_float64(b, s), d, 0, s);
- }
- RVVCALL(OPFVV3, vfwmacc_vv_h, WOP_UUU_H, H4, H2, H2, fwmacc16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwmacc_vf_w, 8)
- static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
- {
-     return float32_muladd(float16_to_float32(a, true, s),
--                        float16_to_float32(b, true, s), d,
--                        float_muladd_negate_c | float_muladd_negate_product, s);
-+                          float16_to_float32(b, true, s), d,
-+                          float_muladd_negate_c | float_muladd_negate_product,
-+                          s);
- }
- static uint64_t fwnmacc32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
- {
--    return float64_muladd(float32_to_float64(a, s),
--                        float32_to_float64(b, s), d,
--                        float_muladd_negate_c | float_muladd_negate_product, s);
-+    return float64_muladd(float32_to_float64(a, s), float32_to_float64(b, s),
-+                          d, float_muladd_negate_c |
-+                             float_muladd_negate_product, s);
- }
- RVVCALL(OPFVV3, vfwnmacc_vv_h, WOP_UUU_H, H4, H2, H2, fwnmacc16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmacc_vf_w, 8)
- static uint32_t fwmsac16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
- {
-     return float32_muladd(float16_to_float32(a, true, s),
--                        float16_to_float32(b, true, s), d,
--                        float_muladd_negate_c, s);
-+                          float16_to_float32(b, true, s), d,
-+                          float_muladd_negate_c, s);
- }
- static uint64_t fwmsac32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
- {
-     return float64_muladd(float32_to_float64(a, s),
--                        float32_to_float64(b, s), d,
--                        float_muladd_negate_c, s);
-+                          float32_to_float64(b, s), d,
-+                          float_muladd_negate_c, s);
- }
- RVVCALL(OPFVV3, vfwmsac_vv_h, WOP_UUU_H, H4, H2, H2, fwmsac16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwmsac_vf_w, 8)
- static uint32_t fwnmsac16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
- {
-     return float32_muladd(float16_to_float32(a, true, s),
--                        float16_to_float32(b, true, s), d,
--                        float_muladd_negate_product, s);
-+                          float16_to_float32(b, true, s), d,
-+                          float_muladd_negate_product, s);
- }
- static uint64_t fwnmsac32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
- {
-     return float64_muladd(float32_to_float64(a, s),
--                        float32_to_float64(b, s), d,
--                        float_muladd_negate_product, s);
-+                          float32_to_float64(b, s), d,
-+                          float_muladd_negate_product, s);
- }
- RVVCALL(OPFVV3, vfwnmsac_vv_h, WOP_UUU_H, H4, H2, H2, fwnmsac16)
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_w, 8)
- #define OP_UU_W uint32_t, uint32_t, uint32_t
- #define OP_UU_D uint64_t, uint64_t, uint64_t
--#define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)        \
-+#define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
- static void do_##NAME(void *vd, void *vs2, int i,      \
--        CPURISCVState *env)                            \
-+                      CPURISCVState *env)              \
- {                                                      \
-     TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
-     *((TD *)vd + HD(i)) = OP(s2, &env->fp_status);     \
-@@ -XXX,XX +XXX,XX @@ static void do_##NAME(void *vd, void *vs2, int i,      \
- #define GEN_VEXT_V_ENV(NAME, ESZ)                      \
- void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
--        CPURISCVState *env, uint32_t desc)             \
-+                  CPURISCVState *env, uint32_t desc)   \
- {                                                      \
-     uint32_t vm = vext_vm(desc);                       \
-     uint32_t vl = env->vl;                             \
-@@ -XXX,XX +XXX,XX @@ static uint64_t frsqrt7(uint64_t f, int exp_size, int frac_size)
-     }
-     int idx = ((exp & 1) << (precision - 1)) |
--                (frac >> (frac_size - precision + 1));
-+              (frac >> (frac_size - precision + 1));
-     uint64_t out_frac = (uint64_t)(lookup_table[idx]) <<
--                            (frac_size - precision);
-+                        (frac_size - precision);
-     uint64_t out_exp = (3 * MAKE_64BIT_MASK(0, exp_size - 1) + ~exp) / 2;
-     uint64_t val = 0;
-@@ -XXX,XX +XXX,XX @@ static float16 frsqrt7_h(float16 f, float_status *s)
-      * frsqrt7(-subnormal) = canonical NaN
-      */
-     if (float16_is_signaling_nan(f, s) ||
--            (float16_is_infinity(f) && sign) ||
--            (float16_is_normal(f) && sign) ||
--            (float16_is_zero_or_denormal(f) && !float16_is_zero(f) && sign)) {
-+        (float16_is_infinity(f) && sign) ||
-+        (float16_is_normal(f) && sign) ||
-+        (float16_is_zero_or_denormal(f) && !float16_is_zero(f) && sign)) {
-         s->float_exception_flags |= float_flag_invalid;
-         return float16_default_nan(s);
-     }
-@@ -XXX,XX +XXX,XX @@ static float32 frsqrt7_s(float32 f, float_status *s)
-      * frsqrt7(-subnormal) = canonical NaN
-      */
-     if (float32_is_signaling_nan(f, s) ||
--            (float32_is_infinity(f) && sign) ||
--            (float32_is_normal(f) && sign) ||
--            (float32_is_zero_or_denormal(f) && !float32_is_zero(f) && sign)) {
-+        (float32_is_infinity(f) && sign) ||
-+        (float32_is_normal(f) && sign) ||
-+        (float32_is_zero_or_denormal(f) && !float32_is_zero(f) && sign)) {
-         s->float_exception_flags |= float_flag_invalid;
-         return float32_default_nan(s);
-     }
-@@ -XXX,XX +XXX,XX @@ static float64 frsqrt7_d(float64 f, float_status *s)
-      * frsqrt7(-subnormal) = canonical NaN
-      */
-     if (float64_is_signaling_nan(f, s) ||
--            (float64_is_infinity(f) && sign) ||
--            (float64_is_normal(f) && sign) ||
--            (float64_is_zero_or_denormal(f) && !float64_is_zero(f) && sign)) {
-+        (float64_is_infinity(f) && sign) ||
-+        (float64_is_normal(f) && sign) ||
-+        (float64_is_zero_or_denormal(f) && !float64_is_zero(f) && sign)) {
-         s->float_exception_flags |= float_flag_invalid;
-         return float64_default_nan(s);
-     }
-@@ -XXX,XX +XXX,XX @@ static uint64_t frec7(uint64_t f, int exp_size, int frac_size,
-                 ((s->float_rounding_mode == float_round_up) && sign)) {
-                 /* Return greatest/negative finite value. */
-                 return (sign << (exp_size + frac_size)) |
--                    (MAKE_64BIT_MASK(frac_size, exp_size) - 1);
-+                       (MAKE_64BIT_MASK(frac_size, exp_size) - 1);
-             } else {
-                 /* Return +-inf. */
-                 return (sign << (exp_size + frac_size)) |
--                    MAKE_64BIT_MASK(frac_size, exp_size);
-+                       MAKE_64BIT_MASK(frac_size, exp_size);
-             }
-         }
-     }
-     int idx = frac >> (frac_size - precision);
-     uint64_t out_frac = (uint64_t)(lookup_table[idx]) <<
--                            (frac_size - precision);
-+                        (frac_size - precision);
-     uint64_t out_exp = 2 * MAKE_64BIT_MASK(0, exp_size - 1) + ~exp;
-     if (out_exp == 0 || out_exp == UINT64_MAX) {
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2, \
-                                                               \
-     for (i = env->vstart; i < vl; i++) {                      \
-         ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
--        *((ETYPE *)vd + H(i))                                 \
--          = (!vm && !vext_elem_mask(v0, i) ? s2 : s1);        \
-+        *((ETYPE *)vd + H(i)) =                               \
-+            (!vm && !vext_elem_mask(v0, i) ? s2 : s1);        \
-     }                                                         \
-     env->vstart = 0;                                          \
-     /* set tail elements to 1s */                             \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
- /* Vector Single-Width Integer Reduction Instructions */
- #define GEN_VEXT_RED(NAME, TD, TS2, HD, HS2, OP)          \
- void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
--        void *vs2, CPURISCVState *env, uint32_t desc)     \
-+                  void *vs2, CPURISCVState *env,          \
-+                  uint32_t desc)                          \
- {                                                         \
-     uint32_t vm = vext_vm(desc);                          \
-     uint32_t vl = env->vl;                                \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VSLIDEDOWN_VX(vslidedown_vx_d, uint64_t, H8)
- #define GEN_VEXT_VSLIE1UP(BITWIDTH, H)                                      \
- static void vslide1up_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
--                     void *vs2, CPURISCVState *env, uint32_t desc)          \
-+                                 void *vs2, CPURISCVState *env,             \
-+                                 uint32_t desc)                             \
- {                                                                           \
-     typedef uint##BITWIDTH##_t ETYPE;                                       \
-     uint32_t vm = vext_vm(desc);                                            \
-@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VSLIDE1UP_VX(vslide1up_vx_d, 64)
- #define GEN_VEXT_VSLIDE1DOWN(BITWIDTH, H)                                     \
- static void vslide1down_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
--                       void *vs2, CPURISCVState *env, uint32_t desc)          \
-+                                   void *vs2, CPURISCVState *env,             \
-+                                   uint32_t desc)                             \
- {                                                                             \
-     typedef uint##BITWIDTH##_t ETYPE;                                         \
-     uint32_t vm = vext_vm(desc);                                              \
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool vext_check_store(DisasContext *s, int vd, int nf, uint8_t eew)
+@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
      return require_rvv(s) &&
             require_rvf(s) &&
             require_scale_rvf(s) &&
 -           (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
             vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
  }
@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
      return require_rvv(s) &&
             require_rvf(s) &&
             require_scale_rvf(s) &&
 -           (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
             vext_check_ds(s, a->rd, a->rs2, a->vm);
  }
@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
      return require_rvv(s) &&
             require_rvf(s) &&
             require_scale_rvf(s) &&
 -           (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
             vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
  }
@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
      return require_rvv(s) &&
             require_rvf(s) &&
             require_scale_rvf(s) &&
 -           (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
             vext_check_dd(s, a->rd, a->rs2, a->vm);
  }
@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
  {
-     int8_t emul = eew - s->sew + s->lmul;
+     return opfv_widen_check(s, a) &&
-     return (emul >= -3 && emul <= 3) &&
+            require_rvfmin(s) &&
--            require_align(vd, emul) &&
+-           require_scale_rvfmin(s) &&
--            require_nf(vd, nf, emul);
+-           (s->sew != MO_8);
-+           require_align(vd, emul) &&
++           require_scale_rvfmin(s);
 +           require_nf(vd, nf, emul);
  }
- /*
+ #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
-@@ -XXX,XX +XXX,XX @@ static bool vext_check_ld_index(DisasContext *s, int vd, int vs2,
+@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
      int8_t seg_vd;
      int8_t emul = eew - s->sew + s->lmul;
      bool ret = vext_check_st_index(s, vd, vs2, nf, eew) &&
 -        require_vm(vm, vd);
 +               require_vm(vm, vd);
      /* Each segment register group has to follow overlap rules. */
      for (int i = 0; i < nf; ++i) {
@@ -XXX,XX +XXX,XX @@ static bool vext_check_ld_index(DisasContext *s, int vd, int vs2,
  static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
  {
-     return require_vm(vm, vd) &&
+     return opfv_narrow_check(s, a) &&
--        require_align(vd, s->lmul) &&
+            require_rvfmin(s) &&
--        require_align(vs, s->lmul);
+-           require_scale_rvfmin(s) &&
-+           require_align(vd, s->lmul) &&
+-           (s->sew != MO_8);
-+           require_align(vs, s->lmul);
++           require_scale_rvfmin(s);
  }
- /*
+ static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
@@ -XXX,XX +XXX,XX @@ static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
  static bool vext_check_sss(DisasContext *s, int vd, int vs1, int vs2, int vm)
  {
-     return vext_check_ss(s, vd, vs2, vm) &&
+     return opfv_narrow_check(s, a) &&
--        require_align(vs1, s->lmul);
+            require_rvf(s) &&
-+           require_align(vs1, s->lmul);
+-           require_scale_rvf(s) &&
 -           (s->sew != MO_8);
 +           require_scale_rvf(s);
  }
- static bool vext_check_ms(DisasContext *s, int vd, int vs)
+ #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
-@@ -XXX,XX +XXX,XX @@ static bool vext_check_ms(DisasContext *s, int vd, int vs)
+@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
  static bool vext_check_mss(DisasContext *s, int vd, int vs1, int vs2)
  {
-     bool ret = vext_check_ms(s, vd, vs2) &&
+     return reduction_widen_check(s, a) &&
--        require_align(vs1, s->lmul);
+            require_rvf(s) &&
-+               require_align(vs1, s->lmul);
+-           require_scale_rvf(s) &&
-     if (vd != vs1) {
+-           (s->sew != MO_8);
-         ret &= require_noover(vd, 0, vs1, s->lmul);
++           require_scale_rvf(s);
      }
@@ -XXX,XX +XXX,XX @@ static bool vext_narrow_check_common(DisasContext *s, int vd, int vs2,
  static bool vext_check_ds(DisasContext *s, int vd, int vs, int vm)
  {
      return vext_wide_check_common(s, vd, vm) &&
 -        require_align(vs, s->lmul) &&
 -        require_noover(vd, s->lmul + 1, vs, s->lmul);
 +           require_align(vs, s->lmul) &&
 +           require_noover(vd, s->lmul + 1, vs, s->lmul);
  }
- static bool vext_check_dd(DisasContext *s, int vd, int vs, int vm)
+ GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
  {
      return vext_wide_check_common(s, vd, vm) &&
 -        require_align(vs, s->lmul + 1);
 +           require_align(vs, s->lmul + 1);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static bool vext_check_dd(DisasContext *s, int vd, int vs, int vm)
  static bool vext_check_dss(DisasContext *s, int vd, int vs1, int vs2, int vm)
  {
      return vext_check_ds(s, vd, vs2, vm) &&
 -        require_align(vs1, s->lmul) &&
 -        require_noover(vd, s->lmul + 1, vs1, s->lmul);
 +           require_align(vs1, s->lmul) &&
 +           require_noover(vd, s->lmul + 1, vs1, s->lmul);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static bool vext_check_dss(DisasContext *s, int vd, int vs1, int vs2, int vm)
  static bool vext_check_dds(DisasContext *s, int vd, int vs1, int vs2, int vm)
  {
      return vext_check_ds(s, vd, vs1, vm) &&
 -        require_align(vs2, s->lmul + 1);
 +           require_align(vs2, s->lmul + 1);
  }
  static bool vext_check_sd(DisasContext *s, int vd, int vs, int vm)
@@ -XXX,XX +XXX,XX @@ static bool vext_check_sd(DisasContext *s, int vd, int vs, int vm)
  static bool vext_check_sds(DisasContext *s, int vd, int vs1, int vs2, int vm)
  {
      return vext_check_sd(s, vd, vs2, vm) &&
 -        require_align(vs1, s->lmul);
 +           require_align(vs1, s->lmul);
  }
  /*
 --
-.40.0
+.45.1

-[PULL 28/89] target/riscv: Remove riscv_cpu_virt_enabled()
+[PULL 21/28] target/riscv: prioritize pmp errors in raise_mmu_exception()
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Directly use env->virt_enabled instead.
+raise_mmu_exception(), as is today, is prioritizing guest page faults by
 checking first if virt_enabled && !first_stage, and then considering the
 regular inst/load/store faults.
-Suggested-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+There's no mention in the spec about guest page fault being a higher
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+priority that PMP faults. In fact, privileged spec section 3.7.1 says:
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+"Attempting to fetch an instruction from a PMP region that does not have
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+execute permissions raises an instruction access-fault exception.
 Attempting to execute a load or load-reserved instruction which accesses
 a physical address within a PMP region without read permissions raises a
 load access-fault exception. Attempting to execute a store,
 store-conditional, or AMO instruction which accesses a physical address
 within a PMP region without write permissions raises a store
 access-fault exception."
 So, in fact, we're doing it wrong - PMP faults should always be thrown,
 regardless of also being a first or second stage fault.
 The way riscv_cpu_tlb_fill() and get_physical_address() work is
 adequate: a TRANSLATE_PMP_FAIL error is immediately reported and
 reflected in the 'pmp_violation' flag. What we need is to change
 raise_mmu_exception() to prioritize it.
 Reported-by: Joseph Chan <jchan@ventanamicro.com>
 Fixes: 82d53adfbb ("target/riscv/cpu_helper.c: Invalid exception on MMU translation stage")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20240413105929.7030-1-alexei.filippov@syntacore.com>
-Message-Id: <20230405085813.40643-2-liweiwei@iscas.ac.cn>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  1 -
+ target/riscv/cpu_helper.c | 22 ++++++++++++----------
- target/riscv/cpu.c        |  2 +-
+file changed, 12 insertions(+), 10 deletions(-)
  target/riscv/cpu_helper.c | 51 ++++++++++++++++++---------------------
  target/riscv/csr.c        | 46 +++++++++++++++++------------------
  target/riscv/debug.c      | 10 ++++----
  target/riscv/op_helper.c  | 18 +++++++-------
  target/riscv/pmu.c        |  4 +--
  target/riscv/translate.c  |  2 +-
 files changed, 64 insertions(+), 70 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_fp_enabled(CPURISCVState *env);
- target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
- void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
- bool riscv_cpu_vector_enabled(CPURISCVState *env);
--bool riscv_cpu_virt_enabled(CPURISCVState *env);
- void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
- bool riscv_cpu_two_stage_lookup(int mmu_idx);
- int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
- #if !defined(CONFIG_USER_ONLY)
-     if (riscv_has_ext(env, RVH)) {
--        qemu_fprintf(f, " %s %d\n", "V      =  ", riscv_cpu_virt_enabled(env));
-+        qemu_fprintf(f, " %s %d\n", "V      =  ", env->virt_enabled);
-     }
- #endif
-     qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc      ", env->pc);
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-     if (riscv_has_ext(env, RVH)) {
-         if (env->priv == PRV_M ||
--            (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
--            (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
-+            (env->priv == PRV_S && !env->virt_enabled) ||
-+            (env->priv == PRV_U && !env->virt_enabled &&
-                 get_field(env->hstatus, HSTATUS_HU))) {
-             flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
-         }
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
-     uint64_t irqs, pending, mie, hsie, vsie;
-     /* Determine interrupt enable state of all privilege modes */
--    if (riscv_cpu_virt_enabled(env)) {
-+    if (env->virt_enabled) {
-         mie = 1;
-         hsie = 1;
-         vsie = (env->priv < PRV_S) ||
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- bool riscv_cpu_fp_enabled(CPURISCVState *env)
- {
-     if (env->mstatus & MSTATUS_FS) {
--        if (riscv_cpu_virt_enabled(env) && !(env->mstatus_hs & MSTATUS_FS)) {
-+        if (env->virt_enabled && !(env->mstatus_hs & MSTATUS_FS)) {
-             return false;
-         }
-         return true;
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_fp_enabled(CPURISCVState *env)
- bool riscv_cpu_vector_enabled(CPURISCVState *env)
- {
-     if (env->mstatus & MSTATUS_VS) {
--        if (riscv_cpu_virt_enabled(env) && !(env->mstatus_hs & MSTATUS_VS)) {
-+        if (env->virt_enabled && !(env->mstatus_hs & MSTATUS_VS)) {
-             return false;
-         }
-         return true;
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
-     if (riscv_has_ext(env, RVF)) {
-         mstatus_mask |= MSTATUS_FS;
-     }
--    bool current_virt = riscv_cpu_virt_enabled(env);
-+    bool current_virt = env->virt_enabled;
-     g_assert(riscv_has_ext(env, RVH));
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
-     env->geilen = geilen;
- }
--bool riscv_cpu_virt_enabled(CPURISCVState *env)
--{
--    return env->virt_enabled;
--}
--
- /* This function can only be called to set virt when RVH is enabled */
- void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
- {
-@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
-     CPUState *cs = env_cpu(env);
-     uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
--    if (riscv_cpu_virt_enabled(env)) {
-+    if (env->virt_enabled) {
-         gein = get_field(env->hstatus, HSTATUS_VGEIN);
-         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
-     }
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-      * was called. Background registers will be used if the guest has
-      * forced a two stage translation to be on (in HS or M mode).
-      */
--    if (!riscv_cpu_virt_enabled(env) && two_stage) {
-+    if (!env->virt_enabled && two_stage) {
-         use_background = true;
-     }
-@@ -XXX,XX +XXX,XX @@ restart:
-         bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-         bool hade = env->menvcfg & MENVCFG_HADE;
--        if (first_stage && two_stage && riscv_cpu_virt_enabled(env)) {
-+        if (first_stage && two_stage && env->virt_enabled) {
-             pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-             hade = hade && (env->henvcfg & HENVCFG_HADE);
-         }
 @@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
      switch (access_type) {
      case MMU_INST_FETCH:
--        if (riscv_cpu_virt_enabled(env) && !first_stage) {
+-        if (env->virt_enabled && !first_stage) {
-+        if (env->virt_enabled && !first_stage) {
++        if (pmp_violation) {
 +            cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
 +        } else if (env->virt_enabled && !first_stage) {
              cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
          } else {
-             cs->exception_index = page_fault_exceptions ?
+-            cs->exception_index = pmp_violation ?
-@@ -XXX,XX +XXX,XX @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
+-                RISCV_EXCP_INST_ACCESS_FAULT : RISCV_EXCP_INST_PAGE_FAULT;
-     int mmu_idx = cpu_mmu_index(&cpu->env, false);
++            cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
+         }
-     if (get_physical_address(env, &phys_addr, &prot, addr, NULL, 0, mmu_idx,
+         break;
--                             true, riscv_cpu_virt_enabled(env), true)) {
+     case MMU_DATA_LOAD:
-+                             true, env->virt_enabled, true)) {
+-        if (two_stage && !first_stage) {
-         return -1;
++        if (pmp_violation) {
-     }
++            cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
++        } else if (two_stage && !first_stage) {
--    if (riscv_cpu_virt_enabled(env)) {
+             cs->exception_index = RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT;
 +    if (env->virt_enabled) {
          if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
 , mmu_idx, false, true, true)) {
              return -1;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
      }
      env->badaddr = addr;
 -    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +    env->two_stage_lookup = env->virt_enabled ||
                              riscv_cpu_two_stage_lookup(mmu_idx);
      env->two_stage_indirect_lookup = false;
      cpu_loop_exit_restore(cs, retaddr);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
          g_assert_not_reached();
      }
      env->badaddr = addr;
 -    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +    env->two_stage_lookup = env->virt_enabled ||
                              riscv_cpu_two_stage_lookup(mmu_idx);
      env->two_stage_indirect_lookup = false;
      cpu_loop_exit_restore(cs, retaddr);
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      }
      pmu_tlb_fill_incr_ctr(cpu, access_type);
 -    if (riscv_cpu_virt_enabled(env) ||
 +    if (env->virt_enabled ||
          ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
           access_type != MMU_INST_FETCH)) {
          /* Two stage lookup */
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      } else {
          raise_mmu_exception(env, address, access_type, pmp_violation,
                              first_stage_error,
 -                            riscv_cpu_virt_enabled(env) ||
 +                            env->virt_enabled ||
                                  riscv_cpu_two_stage_lookup(mmu_idx),
                              two_stage_indirect_error);
          cpu_loop_exit_restore(cs, retaddr);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
              if (env->priv == PRV_M) {
                  cause = RISCV_EXCP_M_ECALL;
 -            } else if (env->priv == PRV_S && riscv_cpu_virt_enabled(env)) {
 +            } else if (env->priv == PRV_S && env->virt_enabled) {
                  cause = RISCV_EXCP_VS_ECALL;
 -            } else if (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) {
 +            } else if (env->priv == PRV_S && !env->virt_enabled) {
                  cause = RISCV_EXCP_S_ECALL;
              } else if (env->priv == PRV_U) {
                  cause = RISCV_EXCP_U_ECALL;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          if (riscv_has_ext(env, RVH)) {
              uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
 -            if (riscv_cpu_virt_enabled(env) && ((hdeleg >> cause) & 1)) {
 +            if (env->virt_enabled && ((hdeleg >> cause) & 1)) {
                  /* Trap to VS mode */
                  /*
                   * See if we need to adjust cause. Yes if its VS mode interrupt
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                      cause = cause - 1;
                  }
                  write_gva = false;
 -            } else if (riscv_cpu_virt_enabled(env)) {
 +            } else if (env->virt_enabled) {
                  /* Trap into HS mode, from virt */
                  riscv_cpu_swap_hypervisor_regs(env);
                  env->hstatus = set_field(env->hstatus, HSTATUS_SPVP,
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      } else {
          /* handle the trap in M-mode */
          if (riscv_has_ext(env, RVH)) {
 -            if (riscv_cpu_virt_enabled(env)) {
 +            if (env->virt_enabled) {
                  riscv_cpu_swap_hypervisor_regs(env);
              }
              env->mstatus = set_field(env->mstatus, MSTATUS_MPV,
 -                                     riscv_cpu_virt_enabled(env));
 -            if (riscv_cpu_virt_enabled(env) && tval) {
 +                                     env->virt_enabled);
 +            if (env->virt_enabled && tval) {
                  env->mstatus = set_field(env->mstatus, MSTATUS_GVA, 1);
              }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
  #if !defined(CONFIG_USER_ONLY)
  RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
  {
 -    bool virt = riscv_cpu_virt_enabled(env);
 +    bool virt = env->virt_enabled;
      if (env->priv == PRV_M || !riscv_cpu_cfg(env)->ext_smstateen) {
          return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ skip_ext_pmu_check:
          return RISCV_EXCP_ILLEGAL_INST;
      }
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          if (!get_field(env->hcounteren, ctr_mask) ||
              (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException hstateenh(CPURISCVState *env, int csrno)
  static RISCVException sstateen(CPURISCVState *env, int csrno)
  {
 -    bool virt = riscv_cpu_virt_enabled(env);
 +    bool virt = env->virt_enabled;
      int index = csrno - CSR_SSTATEEN0;
      if (!riscv_cpu_cfg(env)->ext_smstateen) {
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
          return RISCV_EXCP_ILLEGAL_INST;
      }
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
                get_field(env->henvcfg, HENVCFG_STCE))) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException seed(CPURISCVState *env, int csrno)
       */
      if (env->priv == PRV_M) {
          return RISCV_EXCP_NONE;
 -    } else if (riscv_cpu_virt_enabled(env)) {
 +    } else if (env->virt_enabled) {
          if (env->mseccfg & MSECCFG_SSEED) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
          } else {
-@@ -XXX,XX +XXX,XX @@ static int read_scountovf(CPURISCVState *env, int csrno, target_ulong *val)
+-            cs->exception_index = pmp_violation ?
- static RISCVException read_time(CPURISCVState *env, int csrno,
+-                RISCV_EXCP_LOAD_ACCESS_FAULT : RISCV_EXCP_LOAD_PAGE_FAULT;
-                                 target_ulong *val)
++            cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
  {
 -    uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
 +    uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
      if (!env->rdtime_fn) {
          return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_time(CPURISCVState *env, int csrno,
  static RISCVException read_timeh(CPURISCVState *env, int csrno,
                                   target_ulong *val)
  {
 -    uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
 +    uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
      if (!env->rdtime_fn) {
          return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
  static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
                                      target_ulong *val)
  {
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          *val = env->vstimecmp;
      } else {
          *val = env->stimecmp;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
  static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
                                       target_ulong *val)
  {
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          *val = env->vstimecmp >> 32;
      } else {
          *val = env->stimecmp >> 32;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
  static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
                                       target_ulong val)
  {
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          if (env->hvictl & HVICTL_VTI) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
          }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
+         break;
- static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
+     case MMU_DATA_STORE:
-                                       target_ulong val)
+-        if (two_stage && !first_stage) {
- {
++        if (pmp_violation) {
--    if (riscv_cpu_virt_enabled(env)) {
++            cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
-+    if (env->virt_enabled) {
++        } else if (two_stage && !first_stage) {
-         if (env->hvictl & HVICTL_VTI) {
+             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
-             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+         } else {
 -            cs->exception_index = pmp_violation ?
 -                RISCV_EXCP_STORE_AMO_ACCESS_FAULT :
 -                RISCV_EXCP_STORE_PAGE_FAULT;
 +            cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
          }
-@@ -XXX,XX +XXX,XX @@ static int read_mtopi(CPURISCVState *env, int csrno, target_ulong *val)
+         break;
+     default:
  static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
  {
 -    if (!riscv_cpu_virt_enabled(env)) {
 +    if (!env->virt_enabled) {
          return csrno;
      }
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
  done:
      if (ret) {
 -        return (riscv_cpu_virt_enabled(env) && virt) ?
 +        return (env->virt_enabled && virt) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static int rmw_xtopei(CPURISCVState *env, int csrno, target_ulong *val,
  done:
      if (ret) {
 -        return (riscv_cpu_virt_enabled(env) && virt) ?
 +        return (env->virt_enabled && virt) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
  static RISCVException read_sstateen(CPURISCVState *env, int csrno,
                                      target_ulong *val)
  {
 -    bool virt = riscv_cpu_virt_enabled(env);
 +    bool virt = env->virt_enabled;
      int index = csrno - CSR_SSTATEEN0;
      *val = env->sstateen[index] & env->mstateen[index];
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstateen(CPURISCVState *env, int csrno,
  static RISCVException write_sstateen(CPURISCVState *env, int csrno,
                                       uint64_t mask, target_ulong new_val)
  {
 -    bool virt = riscv_cpu_virt_enabled(env);
 +    bool virt = env->virt_enabled;
      int index = csrno - CSR_SSTATEEN0;
      uint64_t wr_mask;
      uint64_t *reg;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
      RISCVException ret;
      uint64_t mask = env->mideleg & S_MODE_INTERRUPTS;
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          if (env->hvictl & HVICTL_VTI) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
          }
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
      RISCVException ret;
      uint64_t mask = env->mideleg & sip_writable_mask;
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          if (env->hvictl & HVICTL_VTI) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
          }
@@ -XXX,XX +XXX,XX @@ static int read_stopi(CPURISCVState *env, int csrno, target_ulong *val)
      int irq;
      uint8_t iprio;
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          return read_vstopi(env, CSR_VSTOPI, val);
      }
@@ -XXX,XX +XXX,XX @@ static int read_hvipriox(CPURISCVState *env, int first_index,
      /* First index has to be a multiple of number of irqs per register */
      if (first_index % num_irqs) {
 -        return (riscv_cpu_virt_enabled(env)) ?
 +        return (env->virt_enabled) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
@@ -XXX,XX +XXX,XX @@ static int write_hvipriox(CPURISCVState *env, int first_index,
      /* First index has to be a multiple of number of irqs per register */
      if (first_index % num_irqs) {
 -        return (riscv_cpu_virt_enabled(env)) ?
 +        return (env->virt_enabled) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
      int csr_priv, effective_priv = env->priv;
      if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
 -        !riscv_cpu_virt_enabled(env)) {
 +        !env->virt_enabled) {
          /*
           * We are in HS mode. Add 1 to the effective privledge level to
           * allow us to access the Hypervisor CSRs.
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
      csr_priv = get_field(csrno, 0x300);
      if (!env->debugger && (effective_priv < csr_priv)) {
 -        if (csr_priv == (PRV_S + 1) && riscv_cpu_virt_enabled(env)) {
 +        if (csr_priv == (PRV_S + 1) && env->virt_enabled) {
              return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
          }
          return RISCV_EXCP_ILLEGAL_INST;
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ itrigger_set_count(CPURISCVState *env, int index, int value)
  static bool check_itrigger_priv(CPURISCVState *env, int index)
  {
      target_ulong tdata1 = env->tdata1[index];
 -    if (riscv_cpu_virt_enabled(env)) {
 +    if (env->virt_enabled) {
          /* check VU/VS bit against current privilege level */
          return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
                 (get_field(tdata1, ITRIGGER_VU) == env->priv);
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
              switch (trigger_type) {
              case TRIGGER_TYPE_AD_MATCH:
                  /* type 2 trigger cannot be fired in VU/VS mode */
 -                if (riscv_cpu_virt_enabled(env)) {
 +                if (env->virt_enabled) {
                      return false;
                  }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                  pc = env->tdata2[i];
                  if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
 -                    if (riscv_cpu_virt_enabled(env)) {
 +                    if (env->virt_enabled) {
                          /* check VU/VS bit against current privilege level */
                          if ((ctrl >> 23) & BIT(env->priv)) {
                              return true;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
          switch (trigger_type) {
          case TRIGGER_TYPE_AD_MATCH:
              /* type 2 trigger cannot be fired in VU/VS mode */
 -            if (riscv_cpu_virt_enabled(env)) {
 +            if (env->virt_enabled) {
                  return false;
              }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
              }
              if ((wp->flags & flags) && (wp->vaddr == addr)) {
 -                if (riscv_cpu_virt_enabled(env)) {
 +                if (env->virt_enabled) {
                      /* check VU/VS bit against current privilege level */
                      if ((ctrl >> 23) & BIT(env->priv)) {
                          return true;
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void check_zicbo_envcfg(CPURISCVState *env, target_ulong envbits,
          riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
      }
 -    if (riscv_cpu_virt_enabled(env) &&
 +    if (env->virt_enabled &&
          (((env->priv < PRV_H) && !get_field(env->henvcfg, envbits)) ||
           ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)))) {
          riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
          riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
      }
 -    if (riscv_cpu_virt_enabled(env) && get_field(env->hstatus, HSTATUS_VTSR)) {
 +    if (env->virt_enabled && get_field(env->hstatus, HSTATUS_VTSR)) {
          riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
      }
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
      }
      env->mstatus = mstatus;
 -    if (riscv_has_ext(env, RVH) && !riscv_cpu_virt_enabled(env)) {
 +    if (riscv_has_ext(env, RVH) && !env->virt_enabled) {
          /* We support Hypervisor extensions and virtulisation is disabled */
          target_ulong hstatus = env->hstatus;
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
      bool prv_s = env->priv == PRV_S;
      if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) ||
 -        (rvs && prv_u && !riscv_cpu_virt_enabled(env))) {
 +        (rvs && prv_u && !env->virt_enabled)) {
          riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 -    } else if (riscv_cpu_virt_enabled(env) && (prv_u ||
 +    } else if (env->virt_enabled && (prv_u ||
          (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
          riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
      } else {
@@ -XXX,XX +XXX,XX @@ void helper_tlb_flush(CPURISCVState *env)
          (env->priv == PRV_S &&
           get_field(env->mstatus, MSTATUS_TVM))) {
          riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 -    } else if (riscv_has_ext(env, RVH) && riscv_cpu_virt_enabled(env) &&
 +    } else if (riscv_has_ext(env, RVH) && env->virt_enabled &&
                 get_field(env->hstatus, HSTATUS_VTVM)) {
          riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
      } else {
@@ -XXX,XX +XXX,XX @@ void helper_hyp_tlb_flush(CPURISCVState *env)
  {
      CPUState *cs = env_cpu(env);
 -    if (env->priv == PRV_S && riscv_cpu_virt_enabled(env)) {
 +    if (env->priv == PRV_S && env->virt_enabled) {
          riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
      }
      if (env->priv == PRV_M ||
 -        (env->priv == PRV_S && !riscv_cpu_virt_enabled(env))) {
 +        (env->priv == PRV_S && !env->virt_enabled)) {
          tlb_flush(cs);
          return;
      }
@@ -XXX,XX +XXX,XX @@ void helper_hyp_tlb_flush(CPURISCVState *env)
  void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
  {
 -    if (env->priv == PRV_S && !riscv_cpu_virt_enabled(env) &&
 +    if (env->priv == PRV_S && !env->virt_enabled &&
          get_field(env->mstatus, MSTATUS_TVM)) {
          riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
      }
 diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmu.c
 +++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv32(RISCVCPU *cpu, uint32_t ctr_idx)
      CPURISCVState *env = &cpu->env;
      target_ulong max_val = UINT32_MAX;
      PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 -    bool virt_on = riscv_cpu_virt_enabled(env);
 +    bool virt_on = env->virt_enabled;
      /* Privilege mode filtering */
      if ((env->priv == PRV_M &&
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv64(RISCVCPU *cpu, uint32_t ctr_idx)
      CPURISCVState *env = &cpu->env;
      PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
      uint64_t max_val = UINT64_MAX;
 -    bool virt_on = riscv_cpu_virt_enabled(env);
 +    bool virt_on = env->virt_enabled;
      /* Privilege mode filtering */
      if ((env->priv == PRV_M &&
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->priv_ver = env->priv_ver;
  #if !defined(CONFIG_USER_ONLY)
      if (riscv_has_ext(env, RVH)) {
 -        ctx->virt_enabled = riscv_cpu_virt_enabled(env);
 +        ctx->virt_enabled = env->virt_enabled;
      } else {
          ctx->virt_enabled = false;
      }
 --
-.40.0
+.45.1

-[PULL 79/89] target/riscv: Merge checks for reserved pte flags
+[PULL 22/28] target/riscv: do not set mtval2 for non guest-page faults
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alexei Filippov <alexei.filippov@syntacore.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Previous patch fixed the PMP priority in raise_mmu_exception() but we're still
 setting mtval2 incorrectly. In riscv_cpu_tlb_fill(), after pmp check in 2 stage
 translation part, mtval2 will be set in case of successes 2 stage translation but
 failed pmp check.
 In this case we gonna set mtval2 via env->guest_phys_fault_addr in context of
 riscv_cpu_tlb_fill(), as this was a guest-page-fault, but it didn't and mtval2
 should be zero, according to RISCV privileged spec sect. 9.4.4: When a guest
 page-fault is taken into M-mode, mtval2 is written with either zero or guest
 physical address that faulted, shifted by 2 bits. *For other traps, mtval2
 is set to zero...*
 Signed-off-by: Alexei Filippov <alexei.filippov@syntacore.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Message-ID: <20240503103052.6819-1-alexei.filippov@syntacore.com>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-Id: <20230325105429.1142530-24-richard.henderson@linaro.org>
 Message-Id: <20230412114333.118895-24-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_helper.c | 12 ++++++------
 file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ restart:
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-         /* Reserved without Svpbmt. */
+                               __func__, pa, ret, prot_pmp, tlb_size);
-         return TRANSLATE_FAIL;
-     }
+                 prot &= prot_pmp;
--    if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
+-            }
--        /* Reserved leaf PTE flags: PTE_W */
+-
--        return TRANSLATE_FAIL;
+-            if (ret != TRANSLATE_SUCCESS) {
--    }
++            } else {
--    if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
+                 /*
--        /* Reserved leaf PTE flags: PTE_W + PTE_X */
+                  * Guest physical address translation failed, this is a HS
-+
+                  * level exception
-+    /* Check for reserved combinations of RWX flags. */
+                  */
-+    switch (pte & (PTE_R | PTE_W | PTE_X)) {
+                 first_stage_error = false;
-+    case PTE_W:
+-                env->guest_phys_fault_addr = (im_address |
-+    case PTE_W | PTE_X:
+-                                              (address &
-         return TRANSLATE_FAIL;
+-                                               (TARGET_PAGE_SIZE - 1))) >> 2;
-     }
++                if (ret != TRANSLATE_PMP_FAIL) {
-+
++                    env->guest_phys_fault_addr = (im_address |
-     if ((pte & PTE_U) &&
++                                                  (address &
-         ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
++                                                   (TARGET_PAGE_SIZE - 1))) >> 2;
-         /*
++                }
              }
          }
      } else {
 --
-.40.0
+.45.1

-[PULL 35/89] target/riscv/cpu.c: remove 'multi_letter' from isa_ext_data
+[PULL 23/28] target/riscv: Remove experimental prefix from "B" extension
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Rob Bradford <rbradford@rivosinc.com>
-We don't have MISA extensions in isa_edata_arr[] anymore. Remove the
+This extension has now been ratified:
-redundant 'multi_letter' field from isa_ext_data.
+https://jira.riscv.org/browse/RVS-2006 so the "x-" prefix can be
 removed.
-Suggested-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Since this is now a ratified extension add it to the list of extensions
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+included in the "max" CPU variant.
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-4-dbarboza@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-ID: <20240514110217.22516-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 132 ++++++++++++++++++++++-----------------------
+ target/riscv/cpu.c         | 2 +-
-file changed, 65 insertions(+), 67 deletions(-)
+ target/riscv/tcg/tcg-cpu.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
+@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
+     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
- struct isa_ext_data {
+     MISA_EXT_INFO(RVV, "v", "Vector operations"),
-     const char *name;
+     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
--    bool multi_letter;
+-    MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
-     int min_version;
++    MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
      int ext_enable_offset;
  };
--#define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
+ static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
--    {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-+#define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
+index XXXXXXX..XXXXXXX 100644
-+    {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+--- a/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/tcg/tcg-cpu.c
- /*
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
-  * Here are the ordering rules of extension naming defined by RISC-V
+     const RISCVCPUMultiExtConfig *prop;
-@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
-  * instead.
+     /* Enable RVG, RVJ and RVV that are disabled by default */
-  */
+-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVG | RVJ | RVV);
- static const struct isa_ext_data isa_edata_arr[] = {
++    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
--    ISA_EXT_DATA_ENTRY(zicbom, true, PRIV_VERSION_1_12_0, ext_icbom),
--    ISA_EXT_DATA_ENTRY(zicboz, true, PRIV_VERSION_1_12_0, ext_icboz),
+     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
--    ISA_EXT_DATA_ENTRY(zicond, true, PRIV_VERSION_1_12_0, ext_zicond),
+         isa_ext_update_enabled(cpu, prop->offset, true);
 -    ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
 -    ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
 -    ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
 -    ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
 -    ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_11_0, ext_zfh),
 -    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_11_0, ext_zfhmin),
 -    ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
 -    ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
 -    ISA_EXT_DATA_ENTRY(zca, true, PRIV_VERSION_1_12_0, ext_zca),
 -    ISA_EXT_DATA_ENTRY(zcb, true, PRIV_VERSION_1_12_0, ext_zcb),
 -    ISA_EXT_DATA_ENTRY(zcf, true, PRIV_VERSION_1_12_0, ext_zcf),
 -    ISA_EXT_DATA_ENTRY(zcd, true, PRIV_VERSION_1_12_0, ext_zcd),
 -    ISA_EXT_DATA_ENTRY(zce, true, PRIV_VERSION_1_12_0, ext_zce),
 -    ISA_EXT_DATA_ENTRY(zcmp, true, PRIV_VERSION_1_12_0, ext_zcmp),
 -    ISA_EXT_DATA_ENTRY(zcmt, true, PRIV_VERSION_1_12_0, ext_zcmt),
 -    ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
 -    ISA_EXT_DATA_ENTRY(zbb, true, PRIV_VERSION_1_12_0, ext_zbb),
 -    ISA_EXT_DATA_ENTRY(zbc, true, PRIV_VERSION_1_12_0, ext_zbc),
 -    ISA_EXT_DATA_ENTRY(zbkb, true, PRIV_VERSION_1_12_0, ext_zbkb),
 -    ISA_EXT_DATA_ENTRY(zbkc, true, PRIV_VERSION_1_12_0, ext_zbkc),
 -    ISA_EXT_DATA_ENTRY(zbkx, true, PRIV_VERSION_1_12_0, ext_zbkx),
 -    ISA_EXT_DATA_ENTRY(zbs, true, PRIV_VERSION_1_12_0, ext_zbs),
 -    ISA_EXT_DATA_ENTRY(zk, true, PRIV_VERSION_1_12_0, ext_zk),
 -    ISA_EXT_DATA_ENTRY(zkn, true, PRIV_VERSION_1_12_0, ext_zkn),
 -    ISA_EXT_DATA_ENTRY(zknd, true, PRIV_VERSION_1_12_0, ext_zknd),
 -    ISA_EXT_DATA_ENTRY(zkne, true, PRIV_VERSION_1_12_0, ext_zkne),
 -    ISA_EXT_DATA_ENTRY(zknh, true, PRIV_VERSION_1_12_0, ext_zknh),
 -    ISA_EXT_DATA_ENTRY(zkr, true, PRIV_VERSION_1_12_0, ext_zkr),
 -    ISA_EXT_DATA_ENTRY(zks, true, PRIV_VERSION_1_12_0, ext_zks),
 -    ISA_EXT_DATA_ENTRY(zksed, true, PRIV_VERSION_1_12_0, ext_zksed),
 -    ISA_EXT_DATA_ENTRY(zksh, true, PRIV_VERSION_1_12_0, ext_zksh),
 -    ISA_EXT_DATA_ENTRY(zkt, true, PRIV_VERSION_1_12_0, ext_zkt),
 -    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_10_0, ext_zve32f),
 -    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_10_0, ext_zve64f),
 -    ISA_EXT_DATA_ENTRY(zve64d, true, PRIV_VERSION_1_10_0, ext_zve64d),
 -    ISA_EXT_DATA_ENTRY(zvfh, true, PRIV_VERSION_1_12_0, ext_zvfh),
 -    ISA_EXT_DATA_ENTRY(zvfhmin, true, PRIV_VERSION_1_12_0, ext_zvfhmin),
 -    ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
 -    ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
 -    ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
 -    ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
 -    ISA_EXT_DATA_ENTRY(sscofpmf, true, PRIV_VERSION_1_12_0, ext_sscofpmf),
 -    ISA_EXT_DATA_ENTRY(sstc, true, PRIV_VERSION_1_12_0, ext_sstc),
 -    ISA_EXT_DATA_ENTRY(svadu, true, PRIV_VERSION_1_12_0, ext_svadu),
 -    ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
 -    ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
 -    ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
 -    ISA_EXT_DATA_ENTRY(xtheadba, true, PRIV_VERSION_1_11_0, ext_xtheadba),
 -    ISA_EXT_DATA_ENTRY(xtheadbb, true, PRIV_VERSION_1_11_0, ext_xtheadbb),
 -    ISA_EXT_DATA_ENTRY(xtheadbs, true, PRIV_VERSION_1_11_0, ext_xtheadbs),
 -    ISA_EXT_DATA_ENTRY(xtheadcmo, true, PRIV_VERSION_1_11_0, ext_xtheadcmo),
 -    ISA_EXT_DATA_ENTRY(xtheadcondmov, true, PRIV_VERSION_1_11_0, ext_xtheadcondmov),
 -    ISA_EXT_DATA_ENTRY(xtheadfmemidx, true, PRIV_VERSION_1_11_0, ext_xtheadfmemidx),
 -    ISA_EXT_DATA_ENTRY(xtheadfmv, true, PRIV_VERSION_1_11_0, ext_xtheadfmv),
 -    ISA_EXT_DATA_ENTRY(xtheadmac, true, PRIV_VERSION_1_11_0, ext_xtheadmac),
 -    ISA_EXT_DATA_ENTRY(xtheadmemidx, true, PRIV_VERSION_1_11_0, ext_xtheadmemidx),
 -    ISA_EXT_DATA_ENTRY(xtheadmempair, true, PRIV_VERSION_1_11_0, ext_xtheadmempair),
 -    ISA_EXT_DATA_ENTRY(xtheadsync, true, PRIV_VERSION_1_11_0, ext_xtheadsync),
 -    ISA_EXT_DATA_ENTRY(xventanacondops, true, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
 +    ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_icbom),
 +    ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_icboz),
 +    ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
 +    ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
 +    ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
 +    ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
 +    ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
 +    ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
 +    ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
 +    ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
 +    ISA_EXT_DATA_ENTRY(zdinx, PRIV_VERSION_1_12_0, ext_zdinx),
 +    ISA_EXT_DATA_ENTRY(zca, PRIV_VERSION_1_12_0, ext_zca),
 +    ISA_EXT_DATA_ENTRY(zcb, PRIV_VERSION_1_12_0, ext_zcb),
 +    ISA_EXT_DATA_ENTRY(zcf, PRIV_VERSION_1_12_0, ext_zcf),
 +    ISA_EXT_DATA_ENTRY(zcd, PRIV_VERSION_1_12_0, ext_zcd),
 +    ISA_EXT_DATA_ENTRY(zce, PRIV_VERSION_1_12_0, ext_zce),
 +    ISA_EXT_DATA_ENTRY(zcmp, PRIV_VERSION_1_12_0, ext_zcmp),
 +    ISA_EXT_DATA_ENTRY(zcmt, PRIV_VERSION_1_12_0, ext_zcmt),
 +    ISA_EXT_DATA_ENTRY(zba, PRIV_VERSION_1_12_0, ext_zba),
 +    ISA_EXT_DATA_ENTRY(zbb, PRIV_VERSION_1_12_0, ext_zbb),
 +    ISA_EXT_DATA_ENTRY(zbc, PRIV_VERSION_1_12_0, ext_zbc),
 +    ISA_EXT_DATA_ENTRY(zbkb, PRIV_VERSION_1_12_0, ext_zbkb),
 +    ISA_EXT_DATA_ENTRY(zbkc, PRIV_VERSION_1_12_0, ext_zbkc),
 +    ISA_EXT_DATA_ENTRY(zbkx, PRIV_VERSION_1_12_0, ext_zbkx),
 +    ISA_EXT_DATA_ENTRY(zbs, PRIV_VERSION_1_12_0, ext_zbs),
 +    ISA_EXT_DATA_ENTRY(zk, PRIV_VERSION_1_12_0, ext_zk),
 +    ISA_EXT_DATA_ENTRY(zkn, PRIV_VERSION_1_12_0, ext_zkn),
 +    ISA_EXT_DATA_ENTRY(zknd, PRIV_VERSION_1_12_0, ext_zknd),
 +    ISA_EXT_DATA_ENTRY(zkne, PRIV_VERSION_1_12_0, ext_zkne),
 +    ISA_EXT_DATA_ENTRY(zknh, PRIV_VERSION_1_12_0, ext_zknh),
 +    ISA_EXT_DATA_ENTRY(zkr, PRIV_VERSION_1_12_0, ext_zkr),
 +    ISA_EXT_DATA_ENTRY(zks, PRIV_VERSION_1_12_0, ext_zks),
 +    ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
 +    ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
 +    ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
 +    ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
 +    ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
 +    ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
 +    ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
 +    ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
 +    ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
 +    ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
 +    ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
 +    ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
 +    ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
 +    ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
 +    ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
 +    ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
 +    ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
 +    ISA_EXT_DATA_ENTRY(svpbmt, PRIV_VERSION_1_12_0, ext_svpbmt),
 +    ISA_EXT_DATA_ENTRY(xtheadba, PRIV_VERSION_1_11_0, ext_xtheadba),
 +    ISA_EXT_DATA_ENTRY(xtheadbb, PRIV_VERSION_1_11_0, ext_xtheadbb),
 +    ISA_EXT_DATA_ENTRY(xtheadbs, PRIV_VERSION_1_11_0, ext_xtheadbs),
 +    ISA_EXT_DATA_ENTRY(xtheadcmo, PRIV_VERSION_1_11_0, ext_xtheadcmo),
 +    ISA_EXT_DATA_ENTRY(xtheadcondmov, PRIV_VERSION_1_11_0, ext_xtheadcondmov),
 +    ISA_EXT_DATA_ENTRY(xtheadfmemidx, PRIV_VERSION_1_11_0, ext_xtheadfmemidx),
 +    ISA_EXT_DATA_ENTRY(xtheadfmv, PRIV_VERSION_1_11_0, ext_xtheadfmv),
 +    ISA_EXT_DATA_ENTRY(xtheadmac, PRIV_VERSION_1_11_0, ext_xtheadmac),
 +    ISA_EXT_DATA_ENTRY(xtheadmemidx, PRIV_VERSION_1_11_0, ext_xtheadmemidx),
 +    ISA_EXT_DATA_ENTRY(xtheadmempair, PRIV_VERSION_1_11_0, ext_xtheadmempair),
 +    ISA_EXT_DATA_ENTRY(xtheadsync, PRIV_VERSION_1_11_0, ext_xtheadsync),
 +    ISA_EXT_DATA_ENTRY(xventanacondops, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
  };
  static bool isa_ext_is_enabled(RISCVCPU *cpu,
@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
      int i;
      for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
 -        if (isa_edata_arr[i].multi_letter &&
 -            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
 +        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
              new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
              g_free(old);
              old = new;
 --
-.40.0
+.45.1

-[PULL 65/89] target/riscv: Use cpu_ld*_code_mmu for HLVX
+[PULL 24/28] target/riscv: rvzicbo: Fixup CBO extension register calculation
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alistair Francis <alistair23@gmail.com>
-Use the new functions to properly check execute permission
+When running the instruction
 for the read rather than read permission.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+```
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+    cbo.flush 0(x0)
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+```
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-10-richard.henderson@linaro.org>
+QEMU would segfault.
-Message-Id: <20230412114333.118895-10-richard.henderson@linaro.org>
 The issue was in cpu_gpr[a->rs1] as QEMU does not have cpu_gpr[0]
 allocated.
 In order to fix this let's use the existing get_address()
 helper. This also has the benefit of performing pointer mask
 calculations on the address specified in rs1.
 The pointer masking specificiation specifically states:
 """
 Cache Management Operations: All instructions in Zicbom, Zicbop and Zicboz
 """
 So this is the correct behaviour and we previously have been incorrectly
 not masking the address.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reported-by: Fabian Thomas <fabian.thomas@cispa.de>
 Fixes: e05da09b7cfd ("target/riscv: implement Zicbom extension")
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240514023910.301766-1-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/op_helper.c | 13 +++++++++++--
+ target/riscv/insn_trans/trans_rvzicbo.c.inc | 16 ++++++++++++----
-file changed, 11 insertions(+), 2 deletions(-)
+file changed, 12 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/insn_trans/trans_rvzicbo.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
+--- a/target/riscv/insn_trans/trans_rvzicbo.c.inc
-+++ b/target/riscv/op_helper.c
++++ b/target/riscv/insn_trans/trans_rvzicbo.c.inc
-@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@
-     helper_hyp_tlb_flush(env);
+ static bool trans_cbo_clean(DisasContext *ctx, arg_cbo_clean *a)
  {
      REQUIRE_ZICBOM(ctx);
 -    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
 +    TCGv src = get_address(ctx, a->rs1, 0);
 +
 +    gen_helper_cbo_clean_flush(tcg_env, src);
      return true;
  }
-+/*
+ static bool trans_cbo_flush(DisasContext *ctx, arg_cbo_flush *a)
 + * TODO: These implementations are not quite correct.  They perform the
 + * access using execute permission just fine, but the final PMP check
 + * is supposed to have read permission as well.  Without replicating
 + * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx
 + * which would imply that exact check in tlb_fill.
 + */
  target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong address)
  {
-     int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+     REQUIRE_ZICBOM(ctx);
-+    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
+-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
++    TCGv src = get_address(ctx, a->rs1, 0);
--    return cpu_lduw_mmuidx_ra(env, address, mmu_idx, GETPC());
++
-+    return cpu_ldw_code_mmu(env, address, oi, GETPC());
++    gen_helper_cbo_clean_flush(tcg_env, src);
      return true;
  }
- target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong address)
+ static bool trans_cbo_inval(DisasContext *ctx, arg_cbo_inval *a)
  {
-     int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+     REQUIRE_ZICBOM(ctx);
-+    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
+-    gen_helper_cbo_inval(tcg_env, cpu_gpr[a->rs1]);
++    TCGv src = get_address(ctx, a->rs1, 0);
--    return cpu_ldl_mmuidx_ra(env, address, mmu_idx, GETPC());
++
-+    return cpu_ldl_code_mmu(env, address, oi, GETPC());
++    gen_helper_cbo_inval(tcg_env, src);
      return true;
  }
- #endif /* !CONFIG_USER_ONLY */
+ static bool trans_cbo_zero(DisasContext *ctx, arg_cbo_zero *a)
  {
      REQUIRE_ZICBOZ(ctx);
 -    gen_helper_cbo_zero(tcg_env, cpu_gpr[a->rs1]);
 +    TCGv src = get_address(ctx, a->rs1, 0);
 +
 +    gen_helper_cbo_zero(tcg_env, src);
      return true;
  }
 --
-.40.0
+.45.1

-[PULL 18/89] target/riscv: Add support for Zce
+[PULL 25/28] target/riscv/kvm.c: Fix the hart bit setting of AIA
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Add and expose property for Zce:
+In AIA spec, each hart (or each hart within a group) has a unique hart
-* Specifying Zce without F includes Zca, Zcb, Zcmp, Zcmt.
+number to locate the memory pages of interrupt files in the address
-* Specifying Zce with F includes Zca, Zcb, Zcmp, Zcmt and Zcf.
+space. The number of bits required to represent any hart number is equal
 to ceil(log2(hmax + 1)), where hmax is the largest hart number among
 groups.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+However, if the largest hart number among groups is a power of 2, QEMU
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+will pass an inaccurate hart-index-bit setting to Linux. For example, when
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+the guest OS has 4 harts, only ceil(log2(3 + 1)) = 2 bits are sufficient
-Message-Id: <20230307081403.61950-11-liweiwei@iscas.ac.cn>
+to represent 4 harts, but we passes 3 to Linux. The code needs to be
 updated to ensure accurate hart-index-bit settings.
 Additionally, a Linux patch[1] is necessary to correctly recover the hart
 index when the guest OS has only 1 hart, where the hart-index-bit is 0.
 [1] https://lore.kernel.org/lkml/20240415064905.25184-1-yongxuan.wang@sifive.com/t/
 Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240515091129.28116-1-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |  1 +
+ target/riscv/kvm/kvm-cpu.c | 9 ++++++++-
- target/riscv/cpu.c | 12 ++++++++++++
+file changed, 8 insertions(+), 1 deletion(-)
 files changed, 13 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
      bool ext_zca;
      bool ext_zcb;
      bool ext_zcd;
 +    bool ext_zce;
      bool ext_zcf;
      bool ext_zcmp;
      bool ext_zcmt;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zcb, true, PRIV_VERSION_1_12_0, ext_zcb),
      ISA_EXT_DATA_ENTRY(zcf, true, PRIV_VERSION_1_12_0, ext_zcf),
      ISA_EXT_DATA_ENTRY(zcd, true, PRIV_VERSION_1_12_0, ext_zcd),
 +    ISA_EXT_DATA_ENTRY(zce, true, PRIV_VERSION_1_12_0, ext_zce),
      ISA_EXT_DATA_ENTRY(zcmp, true, PRIV_VERSION_1_12_0, ext_zcmp),
      ISA_EXT_DATA_ENTRY(zcmt, true, PRIV_VERSION_1_12_0, ext_zcmt),
      ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          }
      }
-+    if (cpu->cfg.ext_zce) {
+-    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
-+        cpu->cfg.ext_zca = true;
++
-+        cpu->cfg.ext_zcb = true;
++    if (max_hart_per_socket > 1) {
-+        cpu->cfg.ext_zcmp = true;
++        max_hart_per_socket--;
-+        cpu->cfg.ext_zcmt = true;
++        hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
-+        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
++    } else {
-+            cpu->cfg.ext_zcf = true;
++        hart_bits = 0;
 +        }
 +    }
 +
-     if (cpu->cfg.ext_c) {
+     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-         cpu->cfg.ext_zca = true;
+                             KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
-         if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
+                             &hart_bits, true, NULL);
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zca", RISCVCPU, cfg.ext_zca, false),
      DEFINE_PROP_BOOL("x-zcb", RISCVCPU, cfg.ext_zcb, false),
      DEFINE_PROP_BOOL("x-zcd", RISCVCPU, cfg.ext_zcd, false),
 +    DEFINE_PROP_BOOL("x-zce", RISCVCPU, cfg.ext_zce, false),
      DEFINE_PROP_BOOL("x-zcf", RISCVCPU, cfg.ext_zcf, false),
      DEFINE_PROP_BOOL("x-zcmp", RISCVCPU, cfg.ext_zcmp, false),
      DEFINE_PROP_BOOL("x-zcmt", RISCVCPU, cfg.ext_zcmt, false),
 --
-.40.0
+.45.1

-[PULL 54/89] target/riscv: Use PRV_RESERVED instead of PRV_H
+[PULL 26/28] riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-PRV_H has no real meaning, but just a reserved privilege mode currently.
+Commit 33a24910ae changed 'reg_width' to use 'vlenb', i.e. vector length
 in bytes, when in this context we want 'reg_width' as the length in
 bits.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Fix 'reg_width' back to the value in bits like 7cb59921c05a
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+("target/riscv/gdbstub.c: use 'vlenb' instead of shifting 'vlen'") set
 beforehand.
 While we're at it, rename 'reg_width' to 'bitsize' to provide a bit more
 clarity about what the variable represents. 'bitsize' is also used in
 riscv_gen_dynamic_csr_feature() with the same purpose, i.e. as an input to
 gdb_feature_builder_append_reg().
 Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
 Cc: Alex Bennée <alex.bennee@linaro.org>
 Reported-by: Robin Dapp <rdapp.gcc@gmail.com>
 Fixes: 33a24910ae ("target/riscv: Use GDBFeature for dynamic XML")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230407014743.18779-3-liweiwei@iscas.ac.cn>
+Message-ID: <20240517203054.880861-2-dbarboza@ventanamicro.com>
 [ Changes by AF:
  - Convert one missing use of PRV_H
 ]
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        | 2 +-
+ target/riscv/gdbstub.c | 6 +++---
- target/riscv/cpu_bits.h   | 2 +-
+file changed, 3 insertions(+), 3 deletions(-)
  target/riscv/cpu_helper.c | 2 +-
  target/riscv/gdbstub.c    | 2 +-
  target/riscv/op_helper.c  | 2 +-
 files changed, 5 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
-         case PRV_U:
-             xl = get_field(env->mstatus, MSTATUS64_UXL);
-             break;
--        default: /* PRV_S | PRV_H */
-+        default: /* PRV_S */
-             xl = get_field(env->mstatus, MSTATUS64_SXL);
-             break;
-         }
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- /* Privilege modes */
- #define PRV_U 0
- #define PRV_S 1
--#define PRV_H 2 /* Reserved */
-+#define PRV_RESERVED 2
- #define PRV_M 3
- /* RV32 satp CSR field masks */
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
-     if (newpriv > PRV_M) {
-         g_assert_not_reached();
-     }
--    if (newpriv == PRV_H) {
-+    if (newpriv == PRV_RESERVED) {
-         newpriv = PRV_U;
-     }
-     if (icount_enabled() && newpriv != env->priv) {
 diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/gdbstub.c
 +++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_virtual(CPURISCVState *cs, uint8_t *mem_buf, int n)
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
-     if (n == 0) {
+ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
- #ifndef CONFIG_USER_ONLY
+ {
-         cs->priv = ldtul_p(mem_buf) & 0x3;
+     RISCVCPU *cpu = RISCV_CPU(cs);
--        if (cs->priv == PRV_H) {
+-    int reg_width = cpu->cfg.vlenb;
-+        if (cs->priv == PRV_RESERVED) {
++    int bitsize = cpu->cfg.vlenb << 3;
-             cs->priv = PRV_S;
+     GDBFeatureBuilder builder;
-         }
+     int i;
- #endif
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
+     /* First define types and totals in a whole VL */
-+++ b/target/riscv/op_helper.c
+     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-@@ -XXX,XX +XXX,XX @@ static void check_zicbo_envcfg(CPURISCVState *env, target_ulong envbits,
+-        int count = reg_width / vec_lanes[i].size;
 +        int count = bitsize / vec_lanes[i].size;
          gdb_feature_builder_append_tag(
              &builder, "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
              vec_lanes[i].id, vec_lanes[i].gdb_type, count);
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
      /* Define vector registers */
      for (i = 0; i < 32; i++) {
          gdb_feature_builder_append_reg(&builder, g_strdup_printf("v%d", i),
 -                                       reg_width, i, "riscv_vector", "vector");
 +                                       bitsize, i, "riscv_vector", "vector");
      }
-     if (env->virt_enabled &&
+     gdb_feature_builder_end(&builder);
 -        (((env->priv < PRV_H) && !get_field(env->henvcfg, envbits)) ||
 +        (((env->priv <= PRV_S) && !get_field(env->henvcfg, envbits)) ||
           ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)))) {
          riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra);
      }
 --
-.40.0
+.45.1

-[PULL 17/89] disas/riscv.c: add disasm support for Zc*
+[PULL 27/28] disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Alistair Francis <alistair23@gmail.com>
-Zcmp/Zcmt instructions will override disasm for c.fld*/c.fsd*
+Previously we only listed a single pmpcfg CSR and the first 16 pmpaddr
-instructions currently.
+CSRs. This patch fixes this to list all 16 pmpcfg and all 64 pmpaddr
 CSRs are part of the disassembly.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reported-by: Eric DeVolder <eric_devolder@yahoo.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Fixes: ea10325917 ("RISC-V Disassembler")
-Message-Id: <20230307081403.61950-10-liweiwei@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240514051615.330979-1-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.c | 228 +++++++++++++++++++++++++++++++++++++++++++++++++-
+ disas/riscv.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++-
-file changed, 227 insertions(+), 1 deletion(-)
+file changed, 64 insertions(+), 1 deletion(-)
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_codec_v_i,
-     rv_codec_vsetvli,
-     rv_codec_vsetivli,
-+    rv_codec_zcb_ext,
-+    rv_codec_zcb_mul,
-+    rv_codec_zcb_lb,
-+    rv_codec_zcb_lh,
-+    rv_codec_zcmp_cm_pushpop,
-+    rv_codec_zcmp_cm_mv,
-+    rv_codec_zcmt_jt,
- } rv_codec;
- typedef enum {
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_op_vsetvli = 766,
-     rv_op_vsetivli = 767,
-     rv_op_vsetvl = 768,
-+    rv_op_c_zext_b = 769,
-+    rv_op_c_sext_b = 770,
-+    rv_op_c_zext_h = 771,
-+    rv_op_c_sext_h = 772,
-+    rv_op_c_zext_w = 773,
-+    rv_op_c_not = 774,
-+    rv_op_c_mul = 775,
-+    rv_op_c_lbu = 776,
-+    rv_op_c_lhu = 777,
-+    rv_op_c_lh = 778,
-+    rv_op_c_sb = 779,
-+    rv_op_c_sh = 780,
-+    rv_op_cm_push = 781,
-+    rv_op_cm_pop = 782,
-+    rv_op_cm_popret = 783,
-+    rv_op_cm_popretz = 784,
-+    rv_op_cm_mva01s = 785,
-+    rv_op_cm_mvsa01 = 786,
-+    rv_op_cm_jt = 787,
-+    rv_op_cm_jalt = 788,
- } rv_op;
- /* structures */
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint8_t   rnum;
-     uint8_t   vm;
-     uint32_t  vzimm;
-+    uint8_t   rlist;
- } rv_decode;
- typedef struct {
-@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
- #define rv_fmt_vd_vm                  "O\tDm"
- #define rv_fmt_vsetvli                "O\t0,1,v"
- #define rv_fmt_vsetivli               "O\t0,u,v"
-+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-+#define rv_fmt_push_rlist             "O\tx,-i"
-+#define rv_fmt_pop_rlist              "O\tx,i"
-+#define rv_fmt_zcmt_index             "O\ti"
- /* pseudo-instruction constraints */
-@@ -XXX,XX +XXX,XX @@ const rv_opcode_data opcode_data[] = {
-     { "vsext.vf8", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, rv_op_vsext_vf8, rv_op_vsext_vf8, 0 },
-     { "vsetvli", rv_codec_vsetvli, rv_fmt_vsetvli, NULL, rv_op_vsetvli, rv_op_vsetvli, 0 },
-     { "vsetivli", rv_codec_vsetivli, rv_fmt_vsetivli, NULL, rv_op_vsetivli, rv_op_vsetivli, 0 },
--    { "vsetvl", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, rv_op_vsetvl, rv_op_vsetvl, 0 }
-+    { "vsetvl", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, rv_op_vsetvl, rv_op_vsetvl, 0 },
-+    { "c.zext.b", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
-+    { "c.sext.b", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
-+    { "c.zext.h", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
-+    { "c.sext.h", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
-+    { "c.zext.w", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
-+    { "c.not", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
-+    { "c.mul", rv_codec_zcb_mul, rv_fmt_rd_rs2, NULL, 0, 0 },
-+    { "c.lbu", rv_codec_zcb_lb, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
-+    { "c.lhu", rv_codec_zcb_lh, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
-+    { "c.lh", rv_codec_zcb_lh, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
-+    { "c.sb", rv_codec_zcb_lb, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
-+    { "c.sh", rv_codec_zcb_lh, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
-+    { "cm.push", rv_codec_zcmp_cm_pushpop, rv_fmt_push_rlist, NULL, 0, 0 },
-+    { "cm.pop", rv_codec_zcmp_cm_pushpop, rv_fmt_pop_rlist, NULL, 0, 0 },
-+    { "cm.popret", rv_codec_zcmp_cm_pushpop, rv_fmt_pop_rlist, NULL, 0, 0, 0 },
-+    { "cm.popretz", rv_codec_zcmp_cm_pushpop, rv_fmt_pop_rlist, NULL, 0, 0 },
-+    { "cm.mva01s", rv_codec_zcmp_cm_mv, rv_fmt_rd_rs2, NULL, 0, 0, 0 },
-+    { "cm.mvsa01", rv_codec_zcmp_cm_mv, rv_fmt_rd_rs2, NULL, 0, 0, 0 },
-+    { "cm.jt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
-+    { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
- };
- /* CSR names */
 @@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
-     case 0x000a: return "vxrm";
+     case 0x0383: return "mibound";
-     case 0x000f: return "vcsr";
+     case 0x0384: return "mdbase";
-     case 0x0015: return "seed";
+     case 0x0385: return "mdbound";
-+    case 0x0017: return "jvt";
+-    case 0x03a0: return "pmpcfg3";
-     case 0x0040: return "uscratch";
++    case 0x03a0: return "pmpcfg0";
-     case 0x0041: return "uepc";
++    case 0x03a1: return "pmpcfg1";
-     case 0x0042: return "ucause";
++    case 0x03a2: return "pmpcfg2";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03a3: return "pmpcfg3";
-                 op = rv_op_c_ld;
++    case 0x03a4: return "pmpcfg4";
-             }
++    case 0x03a5: return "pmpcfg5";
-             break;
++    case 0x03a6: return "pmpcfg6";
-+        case 4:
++    case 0x03a7: return "pmpcfg7";
-+            switch ((inst >> 10) & 0b111) {
++    case 0x03a8: return "pmpcfg8";
-+            case 0: op = rv_op_c_lbu; break;
++    case 0x03a9: return "pmpcfg9";
-+            case 1:
++    case 0x03aa: return "pmpcfg10";
-+                if (((inst >> 6) & 1) == 0) {
++    case 0x03ab: return "pmpcfg11";
-+                    op = rv_op_c_lhu;
++    case 0x03ac: return "pmpcfg12";
-+                } else {
++    case 0x03ad: return "pmpcfg13";
-+                    op = rv_op_c_lh;
++    case 0x03ae: return "pmpcfg14";
-+                }
++    case 0x03af: return "pmpcfg15";
-+                break;
+     case 0x03b0: return "pmpaddr0";
-+            case 2: op = rv_op_c_sb; break;
+     case 0x03b1: return "pmpaddr1";
-+            case 3:
+     case 0x03b2: return "pmpaddr2";
-+                if (((inst >> 6) & 1) == 0) {
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
-+                    op = rv_op_c_sh;
+     case 0x03bd: return "pmpaddr13";
-+                }
+     case 0x03be: return "pmpaddr14";
-+                break;
+     case 0x03bf: return "pmpaddr15";
-+            }
++    case 0x03c0: return "pmpaddr16";
-+            break;
++    case 0x03c1: return "pmpaddr17";
-         case 5:
++    case 0x03c2: return "pmpaddr18";
-             if (isa == rv128) {
++    case 0x03c3: return "pmpaddr19";
-                 op = rv_op_c_sq;
++    case 0x03c4: return "pmpaddr20";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03c5: return "pmpaddr21";
-                 case 3: op = rv_op_c_and; break;
++    case 0x03c6: return "pmpaddr22";
-                 case 4: op = rv_op_c_subw; break;
++    case 0x03c7: return "pmpaddr23";
-                 case 5: op = rv_op_c_addw; break;
++    case 0x03c8: return "pmpaddr24";
-+                case 6: op = rv_op_c_mul; break;
++    case 0x03c9: return "pmpaddr25";
-+                case 7:
++    case 0x03ca: return "pmpaddr26";
-+                    switch ((inst >> 2) & 0b111) {
++    case 0x03cb: return "pmpaddr27";
-+                    case 0: op = rv_op_c_zext_b; break;
++    case 0x03cc: return "pmpaddr28";
-+                    case 1: op = rv_op_c_sext_b; break;
++    case 0x03cd: return "pmpaddr29";
-+                    case 2: op = rv_op_c_zext_h; break;
++    case 0x03ce: return "pmpaddr30";
-+                    case 3: op = rv_op_c_sext_h; break;
++    case 0x03cf: return "pmpaddr31";
-+                    case 4: op = rv_op_c_zext_w; break;
++    case 0x03d0: return "pmpaddr32";
-+                    case 5: op = rv_op_c_not; break;
++    case 0x03d1: return "pmpaddr33";
-+                    }
++    case 0x03d2: return "pmpaddr34";
-+                    break;
++    case 0x03d3: return "pmpaddr35";
-                 }
++    case 0x03d4: return "pmpaddr36";
-                 break;
++    case 0x03d5: return "pmpaddr37";
-             }
++    case 0x03d6: return "pmpaddr38";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03d7: return "pmpaddr39";
-                 op = rv_op_c_sqsp;
++    case 0x03d8: return "pmpaddr40";
-             } else {
++    case 0x03d9: return "pmpaddr41";
-                 op = rv_op_c_fsdsp;
++    case 0x03da: return "pmpaddr42";
-+                if (((inst >> 12) & 0b01)) {
++    case 0x03db: return "pmpaddr43";
-+                    switch ((inst >> 8) & 0b01111) {
++    case 0x03dc: return "pmpaddr44";
-+                    case 8:
++    case 0x03dd: return "pmpaddr45";
-+                        if (((inst >> 4) & 0b01111) >= 4) {
++    case 0x03de: return "pmpaddr46";
-+                            op = rv_op_cm_push;
++    case 0x03df: return "pmpaddr47";
-+                        }
++    case 0x03e0: return "pmpaddr48";
-+                        break;
++    case 0x03e1: return "pmpaddr49";
-+                    case 10:
++    case 0x03e2: return "pmpaddr50";
-+                        if (((inst >> 4) & 0b01111) >= 4) {
++    case 0x03e3: return "pmpaddr51";
-+                            op = rv_op_cm_pop;
++    case 0x03e4: return "pmpaddr52";
-+                        }
++    case 0x03e5: return "pmpaddr53";
-+                        break;
++    case 0x03e6: return "pmpaddr54";
-+                    case 12:
++    case 0x03e7: return "pmpaddr55";
-+                        if (((inst >> 4) & 0b01111) >= 4) {
++    case 0x03e8: return "pmpaddr56";
-+                            op = rv_op_cm_popretz;
++    case 0x03e9: return "pmpaddr57";
-+                        }
++    case 0x03ea: return "pmpaddr58";
-+                        break;
++    case 0x03eb: return "pmpaddr59";
-+                    case 14:
++    case 0x03ec: return "pmpaddr60";
-+                        if (((inst >> 4) & 0b01111) >= 4) {
++    case 0x03ed: return "pmpaddr61";
-+                            op = rv_op_cm_popret;
++    case 0x03ee: return "pmpaddr62";
-+                        }
++    case 0x03ef: return "pmpaddr63";
-+                        break;
+     case 0x0780: return "mtohost";
-+                    }
+     case 0x0781: return "mfromhost";
-+                } else {
+     case 0x0782: return "mreset";
 +                    switch ((inst >> 10) & 0b011) {
 +                    case 0:
 +                        if (((inst >> 2) & 0xFF) >= 32) {
 +                            op = rv_op_cm_jalt;
 +                        } else {
 +                            op = rv_op_cm_jt;
 +                        }
 +                        break;
 +                    case 3:
 +                        switch ((inst >> 5) & 0b011) {
 +                        case 1: op = rv_op_cm_mvsa01; break;
 +                        case 3: op = rv_op_cm_mva01s; break;
 +                        }
 +                        break;
 +                    }
 +                }
              }
              break;
          case 6: op = rv_op_c_swsp; break;
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_crs2q(rv_inst inst)
      return (inst << 59) >> 61;
  }
 +static uint32_t calculate_xreg(uint32_t sreg)
 +{
 +    return sreg < 2 ? sreg + 8 : sreg + 16;
 +}
 +
 +static uint32_t operand_sreg1(rv_inst inst)
 +{
 +    return calculate_xreg((inst << 54) >> 61);
 +}
 +
 +static uint32_t operand_sreg2(rv_inst inst)
 +{
 +    return calculate_xreg((inst << 59) >> 61);
 +}
 +
  static uint32_t operand_crd(rv_inst inst)
  {
      return (inst << 52) >> 59;
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_vm(rv_inst inst)
      return (inst << 38) >> 63;
  }
 +static uint32_t operand_uimm_c_lb(rv_inst inst)
 +{
 +    return (((inst << 58) >> 63) << 1) |
 +        ((inst << 57) >> 63);
 +}
 +
 +static uint32_t operand_uimm_c_lh(rv_inst inst)
 +{
 +    return (((inst << 58) >> 63) << 1);
 +}
 +
 +static uint32_t operand_zcmp_spimm(rv_inst inst)
 +{
 +    return ((inst << 60) >> 62) << 4;
 +}
 +
 +static uint32_t operand_zcmp_rlist(rv_inst inst)
 +{
 +    return ((inst << 56) >> 60);
 +}
 +
 +static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
 +{
 +    int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
 +    int regs = rlist == 15 ? 13 : rlist - 3;
 +    uint32_t stack_adj_base = ROUND_UP(regs << xlen_bytes_log2, 16);
 +    return stack_adj_base + spimm;
 +}
 +
 +static uint32_t operand_zcmp_stack_adj(rv_inst inst, rv_isa isa)
 +{
 +    return calculate_stack_adj(isa, operand_zcmp_rlist(inst),
 +                               operand_zcmp_spimm(inst));
 +}
 +
 +static uint32_t operand_tbl_index(rv_inst inst)
 +{
 +    return ((inst << 54) >> 56);
 +}
 +
  /* decode operands */
  static void decode_inst_operands(rv_decode *dec, rv_isa isa)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
          dec->imm = operand_vimm(inst);
          dec->vzimm = operand_vzimm10(inst);
          break;
 +    case rv_codec_zcb_lb:
 +        dec->rs1 = operand_crs1q(inst) + 8;
 +        dec->rs2 = operand_crs2q(inst) + 8;
 +        dec->imm = operand_uimm_c_lb(inst);
 +        break;
 +    case rv_codec_zcb_lh:
 +        dec->rs1 = operand_crs1q(inst) + 8;
 +        dec->rs2 = operand_crs2q(inst) + 8;
 +        dec->imm = operand_uimm_c_lh(inst);
 +        break;
 +    case rv_codec_zcb_ext:
 +        dec->rd = operand_crs1q(inst) + 8;
 +        break;
 +    case rv_codec_zcb_mul:
 +        dec->rd = operand_crs1rdq(inst) + 8;
 +        dec->rs2 = operand_crs2q(inst) + 8;
 +        break;
 +    case rv_codec_zcmp_cm_pushpop:
 +        dec->imm = operand_zcmp_stack_adj(inst, isa);
 +        dec->rlist = operand_zcmp_rlist(inst);
 +        break;
 +    case rv_codec_zcmp_cm_mv:
 +        dec->rd = operand_sreg1(inst);
 +        dec->rs2 = operand_sreg2(inst);
 +        break;
 +    case rv_codec_zcmt_jt:
 +        dec->imm = operand_tbl_index(inst);
 +        break;
      };
  }
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
          case ')':
              append(buf, ")", buflen);
              break;
 +        case '-':
 +            append(buf, "-", buflen);
 +            break;
          case 'b':
              snprintf(tmp, sizeof(tmp), "%d", dec->bs);
              append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
              append(buf, vma, buflen);
              break;
          }
 +        case 'x': {
 +            switch (dec->rlist) {
 +            case 4:
 +                snprintf(tmp, sizeof(tmp), "{ra}");
 +                break;
 +            case 5:
 +                snprintf(tmp, sizeof(tmp), "{ra, s0}");
 +                break;
 +            case 15:
 +                snprintf(tmp, sizeof(tmp), "{ra, s0-s11}");
 +                break;
 +            default:
 +                snprintf(tmp, sizeof(tmp), "{ra, s0-s%d}", dec->rlist - 5);
 +                break;
 +            }
 +            append(buf, tmp, buflen);
 +            break;
 +        }
          default:
              break;
          }
 --
-.40.0
+.45.1

-[PULL 05/89] target/riscv: Simplify arguments for riscv_csrrw_check
+[PULL 28/28] target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Yu-Ming Chang <yumin686@andestech.com>
-Remove RISCVCPU argument, and get cfg infomation from CPURISCVState
+Both CSRRS and CSRRC always read the addressed CSR and cause any read side
-directly.
+effects regardless of rs1 and rd fields. Note that if rs1 specifies a register
 holding a zero value other than x0, the instruction will still attempt to write
 the unmodified value back to the CSR and will cause any attendant side effects.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+So if CSRRS or CSRRC tries to write a read-only CSR with rs1 which specifies
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+a register holding a zero value, an illegal instruction exception should be
 raised.
 Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20240403070823.80897-1-yumin686@andestech.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230309071329.45932-5-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 12 ++++--------
+ target/riscv/cpu.h       |  4 ++++
-file changed, 4 insertions(+), 8 deletions(-)
+ target/riscv/csr.c       | 51 ++++++++++++++++++++++++++++++++++++----
  target/riscv/op_helper.c |  6 ++---
 files changed, 53 insertions(+), 8 deletions(-)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+ void riscv_cpu_update_mask(CPURISCVState *env);
+ bool riscv_cpu_is_32bit(RISCVCPU *cpu);
++RISCVException riscv_csrr(CPURISCVState *env, int csrno,
++                          target_ulong *ret_value);
+ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
+                            target_ulong *ret_value,
+                            target_ulong new_value, target_ulong write_mask);
+@@ -XXX,XX +XXX,XX @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
+                                           target_ulong new_value,
+                                           target_ulong write_mask);
++RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
++                               Int128 *ret_value);
+ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
+                                 Int128 *ret_value,
+                                 Int128 new_value, Int128 write_mask);
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
 @@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
  static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                 int csrno,
--                                               bool write_mask,
+-                                               bool write_mask)
--                                               RISCVCPU *cpu)
++                                               bool write)
 +                                               bool write_mask)
  {
      /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
      bool read_only = get_field(csrno, 0xC00) == 3;
-     int csr_min_priv = csr_ops[csrno].min_priv_ver;
+@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
+     }
-     /* ensure the CSR extension is enabled */
--    if (!cpu->cfg.ext_icsr) {
+     /* read / write check */
-+    if (!riscv_cpu_cfg(env)->ext_icsr) {
+-    if (write_mask && read_only) {
 +    if (write && read_only) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
-@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 +                           target_ulong *ret_value)
 +{
 +    RISCVException ret = riscv_csrrw_check(env, csrno, false);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
 +    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
 +}
 +
  RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                             target_ulong *ret_value,
                             target_ulong new_value, target_ulong write_mask)
  {
--    RISCVCPU *cpu = env_archcpu(env);
+-    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
--
++    RISCVException ret = riscv_csrrw_check(env, csrno, true);
 -    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask, cpu);
 +    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
      if (ret != RISCV_EXCP_NONE) {
          return ret;
      }
-@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
 +                               Int128 *ret_value)
 +{
 +    RISCVException ret;
 +
 +    ret = riscv_csrrw_check(env, csrno, false);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
 +    if (csr_ops[csrno].read128) {
 +        return riscv_csrrw_do128(env, csrno, ret_value,
 +                                 int128_zero(), int128_zero());
 +    }
 +
 +    /*
 +     * Fall back to 64-bit version for now, if the 128-bit alternative isn't
 +     * at all defined.
 +     * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
 +     * significant), for those, this fallback is correctly handling the
 +     * accesses
 +     */
 +    target_ulong old_value;
 +    ret = riscv_csrrw_do64(env, csrno, &old_value,
 +                           (target_ulong)0,
 +                           (target_ulong)0);
 +    if (ret == RISCV_EXCP_NONE && ret_value) {
 +        *ret_value = int128_make64(old_value);
 +    }
 +    return ret;
 +}
 +
  RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                  Int128 *ret_value,
                                  Int128 new_value, Int128 write_mask)
  {
      RISCVException ret;
--    RISCVCPU *cpu = env_archcpu(env);
+-    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
--    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask), cpu);
++    ret = riscv_csrrw_check(env, csrno, true);
 +    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
      if (ret != RISCV_EXCP_NONE) {
          return ret;
      }
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/op_helper.c
++++ b/target/riscv/op_helper.c
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
+     }
+     target_ulong val = 0;
+-    RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
++    RISCVException ret = riscv_csrr(env, csr, &val);
+     if (ret != RISCV_EXCP_NONE) {
+         riscv_raise_exception(env, ret, GETPC());
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
+ target_ulong helper_csrr_i128(CPURISCVState *env, int csr)
+ {
+     Int128 rv = int128_zero();
+-    RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
+-                                          int128_zero(),
+-                                          int128_zero());
++    RISCVException ret = riscv_csrr_i128(env, csr, &rv);
+     if (ret != RISCV_EXCP_NONE) {
+         riscv_raise_exception(env, ret, GETPC());
 --
-.40.0
+.45.1

-[PULL 06/89] target/riscv: refactor Zicond support
+Deleted patch
-From: Philipp Tomsich <philipp.tomsich@vrull.eu>
-After the original Zicond support was stuck/fell through the cracks on
-the mailing list at v3 (and a different implementation was merged in
-the meanwhile), we need to refactor Zicond to prepare it to be reused
-by XVentanaCondOps.
-This commit lifts the common logic out into gen_czero and uses this
-via gen_logic and 2 helper functions (effectively partial closures).
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307180708.302867-2-philipp.tomsich@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvzicond.c.inc | 36 ++++++++++++--------
-file changed, 21 insertions(+), 15 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvzicond.c.inc b/target/riscv/insn_trans/trans_rvzicond.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvzicond.c.inc
-+++ b/target/riscv/insn_trans/trans_rvzicond.c.inc
-@@ -XXX,XX +XXX,XX @@
-  * RISC-V translation routines for the Zicond Standard Extension.
-  *
-  * Copyright (c) 2020-2023 PLCT Lab
-+ * Copyright (c) 2022 VRULL GmbH.
-  *
-  * This program is free software; you can redistribute it and/or modify it
-  * under the terms and conditions of the GNU General Public License,
-@@ -XXX,XX +XXX,XX @@
-     }                                     \
- } while (0)
--static bool trans_czero_eqz(DisasContext *ctx, arg_czero_eqz *a)
-+/* Emits "$rd = ($rs2 <cond> $zero) ? $zero : $rs1" */
-+static void gen_czero(TCGv dest, TCGv src1, TCGv src2, TCGCond cond)
- {
--    REQUIRE_ZICOND(ctx);
-+    TCGv zero = tcg_constant_tl(0);
-+    tcg_gen_movcond_tl(cond, dest, src2, zero, zero, src1);
-+}
--    TCGv dest = dest_gpr(ctx, a->rd);
--    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
--    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
-+static void gen_czero_eqz(TCGv dest, TCGv src1, TCGv src2)
-+{
-+    gen_czero(dest, src1, src2, TCG_COND_EQ);
-+}
--    tcg_gen_movcond_tl(TCG_COND_EQ, dest, src2, ctx->zero, ctx->zero, src1);
--    gen_set_gpr(ctx, a->rd, dest);
--    return true;
-+static void gen_czero_nez(TCGv dest, TCGv src1, TCGv src2)
-+{
-+    gen_czero(dest, src1, src2, TCG_COND_NE);
- }
--static bool trans_czero_nez(DisasContext *ctx, arg_czero_nez *a)
-+static bool trans_czero_eqz(DisasContext *ctx, arg_r *a)
- {
-     REQUIRE_ZICOND(ctx);
--    TCGv dest = dest_gpr(ctx, a->rd);
--    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
--    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
-+    return gen_logic(ctx, a, gen_czero_eqz);
-+}
-+
-+static bool trans_czero_nez(DisasContext *ctx, arg_r *a)
-+{
-+    REQUIRE_ZICOND(ctx);
--    tcg_gen_movcond_tl(TCG_COND_NE, dest, src2, ctx->zero, ctx->zero, src1);
--    gen_set_gpr(ctx, a->rd, dest);
--    return true;
-+    return gen_logic(ctx, a, gen_czero_nez);
- }
---
-.40.0

-[PULL 07/89] target/riscv: redirect XVentanaCondOps to use the Zicond functions
+Deleted patch
-From: Philipp Tomsich <philipp.tomsich@vrull.eu>
-The Zicond standard extension implements the same instruction
-semantics as XVentanaCondOps, although using different mnemonics and
-opcodes.
-Point XVentanaCondOps to the (newly implemented) Zicond implementation
-to reduce the future maintenance burden.
-Also updating MAINTAINERS as trans_xventanacondops.c.inc.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307180708.302867-3-philipp.tomsich@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- MAINTAINERS                                    |  2 +-
- .../insn_trans/trans_xventanacondops.c.inc     | 18 +++---------------
-files changed, 4 insertions(+), 16 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: target/riscv/xthead*.decode
- RISC-V XVentanaCondOps extension
- M: Philipp Tomsich <philipp.tomsich@vrull.eu>
- L: qemu-riscv@nongnu.org
--S: Supported
-+S: Maintained
- F: target/riscv/XVentanaCondOps.decode
- F: target/riscv/insn_trans/trans_xventanacondops.c.inc
-diff --git a/target/riscv/insn_trans/trans_xventanacondops.c.inc b/target/riscv/insn_trans/trans_xventanacondops.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_xventanacondops.c.inc
-+++ b/target/riscv/insn_trans/trans_xventanacondops.c.inc
-@@ -XXX,XX +XXX,XX @@
- /*
-  * RISC-V translation routines for the XVentanaCondOps extension.
-  *
-- * Copyright (c) 2021-2022 VRULL GmbH.
-+ * Copyright (c) 2021-2023 VRULL GmbH.
-  *
-  * This program is free software; you can redistribute it and/or modify it
-  * under the terms and conditions of the GNU General Public License,
-@@ -XXX,XX +XXX,XX @@
-  * this program.  If not, see <http://www.gnu.org/licenses/>.
-  */
--static bool gen_vt_condmask(DisasContext *ctx, arg_r *a, TCGCond cond)
--{
--    TCGv dest = dest_gpr(ctx, a->rd);
--    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
--    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
--
--    tcg_gen_movcond_tl(cond, dest, src2, ctx->zero, src1, ctx->zero);
--
--    gen_set_gpr(ctx, a->rd, dest);
--    return true;
--}
--
- static bool trans_vt_maskc(DisasContext *ctx, arg_r *a)
- {
--    return gen_vt_condmask(ctx, a, TCG_COND_NE);
-+    return gen_logic(ctx, a, gen_czero_eqz);
- }
- static bool trans_vt_maskcn(DisasContext *ctx, arg_r *a)
- {
--    return gen_vt_condmask(ctx, a, TCG_COND_EQ);
-+    return gen_logic(ctx, a, gen_czero_nez);
- }
---
-.40.0

-[PULL 08/89] target/riscv: fix invalid riscv, event-to-mhpmcounters entry
+Deleted patch
-From: Conor Dooley <conor.dooley@microchip.com>
-dt-validate complains:
-> soc: pmu: {'riscv,event-to-mhpmcounters':
-> [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280],
-> [65563, 65563, 524280], [65569, 65569, 524280], [0, 0, 0], [0, 0]],
-> pmu: riscv,event-to-mhpmcounters:6: [0, 0] is too short
-There are bogus 0 entries added at the end, of which one is of
-insufficient length. This happens because only 15 of
-fdt_event_ctr_map[]'s 20 elements are populated & qemu_fdt_setprop() is
-called using the size of the array.
-Reduce the array to 15 elements to make the error go away.
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230404173333.35179-1-conor@kernel.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/pmu.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmu.c
-+++ b/target/riscv/pmu.c
-@@ -XXX,XX +XXX,XX @@
-  */
- void riscv_pmu_generate_fdt_node(void *fdt, int num_ctrs, char *pmu_name)
- {
--    uint32_t fdt_event_ctr_map[20] = {};
-+    uint32_t fdt_event_ctr_map[15] = {};
-     uint32_t cmask;
-     /* All the programmable counters can map to any event */
---
-.40.0

-[PULL 09/89] target/riscv: add cfg properties for Zc* extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add properties for Zca,Zcb,Zcf,Zcd,Zcmp,Zcmt extension.
-Add check for these properties.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-2-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  6 ++++++
- target/riscv/cpu.c | 43 +++++++++++++++++++++++++++++++++++++++++++
-files changed, 49 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zbkc;
-     bool ext_zbkx;
-     bool ext_zbs;
-+    bool ext_zca;
-+    bool ext_zcb;
-+    bool ext_zcd;
-+    bool ext_zcf;
-+    bool ext_zcmp;
-+    bool ext_zcmt;
-     bool ext_zk;
-     bool ext_zkn;
-     bool ext_zknd;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         }
-     }
-+    if (cpu->cfg.ext_c) {
-+        cpu->cfg.ext_zca = true;
-+        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
-+            cpu->cfg.ext_zcf = true;
-+        }
-+        if (cpu->cfg.ext_d) {
-+            cpu->cfg.ext_zcd = true;
-+        }
-+    }
-+
-+    if (env->misa_mxl_max != MXL_RV32 && cpu->cfg.ext_zcf) {
-+        error_setg(errp, "Zcf extension is only relevant to RV32");
-+        return;
-+    }
-+
-+    if (!cpu->cfg.ext_f && cpu->cfg.ext_zcf) {
-+        error_setg(errp, "Zcf extension requires F extension");
-+        return;
-+    }
-+
-+    if (!cpu->cfg.ext_d && cpu->cfg.ext_zcd) {
-+        error_setg(errp, "Zcd extension requires D extension");
-+        return;
-+    }
-+
-+    if ((cpu->cfg.ext_zcf || cpu->cfg.ext_zcd || cpu->cfg.ext_zcb ||
-+         cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt) && !cpu->cfg.ext_zca) {
-+        error_setg(errp, "Zcf/Zcd/Zcb/Zcmp/Zcmt extensions require Zca "
-+                         "extension");
-+        return;
-+    }
-+
-+    if (cpu->cfg.ext_zcd && (cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt)) {
-+        error_setg(errp, "Zcmp/Zcmt extensions are incompatible with "
-+                         "Zcd extension");
-+        return;
-+    }
-+
-+    if (cpu->cfg.ext_zcmt && !cpu->cfg.ext_icsr) {
-+        error_setg(errp, "Zcmt extension requires Zicsr extension");
-+        return;
-+    }
-+
-     if (cpu->cfg.ext_zk) {
-         cpu->cfg.ext_zkn = true;
-         cpu->cfg.ext_zkr = true;
---
-.40.0

-[PULL 10/89] target/riscv: add support for Zca extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Modify the check for C extension to Zca (C implies Zca).
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-Message-Id: <20230307081403.61950-3-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/translate.c                | 8 ++++++--
- target/riscv/insn_trans/trans_rvi.c.inc | 4 ++--
-files changed, 8 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
-     /* check misaligned: */
-     next_pc = ctx->base.pc_next + imm;
--    if (!has_ext(ctx, RVC)) {
-+    if (!ctx->cfg_ptr->ext_zca) {
-         if ((next_pc & 0x3) != 0) {
-             gen_exception_inst_addr_mis(ctx);
-             return;
-@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
-     if (insn_len(opcode) == 2) {
-         ctx->opcode = opcode;
-         ctx->pc_succ_insn = ctx->base.pc_next + 2;
--        if (has_ext(ctx, RVC) && decode_insn16(ctx, opcode)) {
-+        /*
-+         * The Zca extension is added as way to refer to instructions in the C
-+         * extension that do not include the floating-point loads and stores
-+         */
-+        if (ctx->cfg_ptr->ext_zca && decode_insn16(ctx, opcode)) {
-             return;
-         }
-     } else {
-diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvi.c.inc
-+++ b/target/riscv/insn_trans/trans_rvi.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
-     tcg_gen_andi_tl(cpu_pc, cpu_pc, (target_ulong)-2);
-     gen_set_pc(ctx, cpu_pc);
--    if (!has_ext(ctx, RVC)) {
-+    if (!ctx->cfg_ptr->ext_zca) {
-         TCGv t0 = tcg_temp_new();
-         misaligned = gen_new_label();
-@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
-     gen_set_label(l); /* branch taken */
--    if (!has_ext(ctx, RVC) && ((ctx->base.pc_next + a->imm) & 0x3)) {
-+    if (!ctx->cfg_ptr->ext_zca && ((ctx->base.pc_next + a->imm) & 0x3)) {
-         /* misaligned */
-         gen_exception_inst_addr_mis(ctx);
-     } else {
---
-.40.0

-[PULL 11/89] target/riscv: add support for Zcf extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Separate c_flw/c_fsw from flw/fsw to add check for Zcf extension.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn16.decode              |  8 ++++----
- target/riscv/insn_trans/trans_rvf.c.inc | 18 ++++++++++++++++++
-files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn16.decode
-+++ b/target/riscv/insn16.decode
-@@ -XXX,XX +XXX,XX @@ sw                110  ... ... .. ... 00 @cs_w
- # *** RV32C and RV64C specific Standard Extension (Quadrant 0) ***
- {
-   ld              011  ... ... .. ... 00 @cl_d
--  flw             011  ... ... .. ... 00 @cl_w
-+  c_flw           011  ... ... .. ... 00 @cl_w
- }
- {
-   sd              111  ... ... .. ... 00 @cs_d
--  fsw             111  ... ... .. ... 00 @cs_w
-+  c_fsw           111  ... ... .. ... 00 @cs_w
- }
- # *** RV32/64C Standard Extension (Quadrant 1) ***
-@@ -XXX,XX +XXX,XX @@ sw                110 .  .....  ..... 10 @c_swsp
- {
-   c64_illegal     011 -  00000  ----- 10 # c.ldsp, RES rd=0
-   ld              011 .  .....  ..... 10 @c_ldsp
--  flw             011 .  .....  ..... 10 @c_lwsp
-+  c_flw           011 .  .....  ..... 10 @c_lwsp
- }
- {
-   sd              111 .  .....  ..... 10 @c_sdsp
--  fsw             111 .  .....  ..... 10 @c_swsp
-+  c_fsw           111 .  .....  ..... 10 @c_swsp
- }
-diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvf.c.inc
-+++ b/target/riscv/insn_trans/trans_rvf.c.inc
-@@ -XXX,XX +XXX,XX @@
-     } \
- } while (0)
-+#define REQUIRE_ZCF(ctx) do {                  \
-+    if (!ctx->cfg_ptr->ext_zcf) {              \
-+        return false;                          \
-+    }                                          \
-+} while (0)
-+
- static bool trans_flw(DisasContext *ctx, arg_flw *a)
- {
-     TCGv_i64 dest;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
-     return true;
- }
-+static bool trans_c_flw(DisasContext *ctx, arg_flw *a)
-+{
-+    REQUIRE_ZCF(ctx);
-+    return trans_flw(ctx, a);
-+}
-+
-+static bool trans_c_fsw(DisasContext *ctx, arg_fsw *a)
-+{
-+    REQUIRE_ZCF(ctx);
-+    return trans_fsw(ctx, a);
-+}
-+
- static bool trans_fmadd_s(DisasContext *ctx, arg_fmadd_s *a)
- {
-     REQUIRE_FPU;
---
-.40.0

-[PULL 12/89] target/riscv: add support for Zcd extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Separate c_fld/c_fsd from fld/fsd to add additional check for
-c.fld{sp}/c.fsd{sp} which is useful for zcmp/zcmt to reuse
-their encodings.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-5-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn16.decode              |  8 ++++----
- target/riscv/insn_trans/trans_rvd.c.inc | 18 ++++++++++++++++++
-files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn16.decode
-+++ b/target/riscv/insn16.decode
-@@ -XXX,XX +XXX,XX @@
- }
- {
-   lq              001  ... ... .. ... 00 @cl_q
--  fld             001  ... ... .. ... 00 @cl_d
-+  c_fld           001  ... ... .. ... 00 @cl_d
- }
- lw                010  ... ... .. ... 00 @cl_w
- {
-   sq              101  ... ... .. ... 00 @cs_q
--  fsd             101  ... ... .. ... 00 @cs_d
-+  c_fsd           101  ... ... .. ... 00 @cs_d
- }
- sw                110  ... ... .. ... 00 @cs_w
-@@ -XXX,XX +XXX,XX @@ addw              100 1 11 ... 01 ... 01 @cs_2
- slli              000 .  .....  ..... 10 @c_shift2
- {
-   lq              001  ... ... .. ... 10 @c_lqsp
--  fld             001 .  .....  ..... 10 @c_ldsp
-+  c_fld           001 .  .....  ..... 10 @c_ldsp
- }
- {
-   illegal         010 -  00000  ----- 10 # c.lwsp, RES rd=0
-@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
- }
- {
-   sq              101  ... ... .. ... 10 @c_sqsp
--  fsd             101   ......  ..... 10 @c_sdsp
-+  c_fsd           101   ......  ..... 10 @c_sdsp
- }
- sw                110 .  .....  ..... 10 @c_swsp
-diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvd.c.inc
-+++ b/target/riscv/insn_trans/trans_rvd.c.inc
-@@ -XXX,XX +XXX,XX @@
-     } \
- } while (0)
-+#define REQUIRE_ZCD(ctx) do { \
-+    if (!ctx->cfg_ptr->ext_zcd) {  \
-+        return false;     \
-+    } \
-+} while (0)
-+
- static bool trans_fld(DisasContext *ctx, arg_fld *a)
- {
-     TCGv addr;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
-     return true;
- }
-+static bool trans_c_fld(DisasContext *ctx, arg_fld *a)
-+{
-+    REQUIRE_ZCD(ctx);
-+    return trans_fld(ctx, a);
-+}
-+
-+static bool trans_c_fsd(DisasContext *ctx, arg_fsd *a)
-+{
-+    REQUIRE_ZCD(ctx);
-+    return trans_fsd(ctx, a);
-+}
-+
- static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
- {
-     REQUIRE_FPU;
---
-.40.0

-[PULL 13/89] target/riscv: add support for Zcb extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add encode and trans* functions support for Zcb instructions.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-6-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn16.decode                |  23 +++++
- target/riscv/translate.c                  |   2 +
- target/riscv/insn_trans/trans_rvzce.c.inc | 100 ++++++++++++++++++++++
-files changed, 125 insertions(+)
- create mode 100644 target/riscv/insn_trans/trans_rvzce.c.inc
-diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn16.decode
-+++ b/target/riscv/insn16.decode
-@@ -XXX,XX +XXX,XX @@
- %imm_addi16sp  12:s1 3:2 5:1 2:1 6:1 !function=ex_shift_4
- %imm_lui       12:s1 2:5             !function=ex_shift_12
-+%uimm_cl_b  5:1 6:1
-+%uimm_cl_h  5:1                      !function=ex_shift_1
- # Argument sets imported from insn32.decode:
- &empty                  !extern
-@@ -XXX,XX +XXX,XX @@
- &b         imm rs2 rs1  !extern
- &u         imm rd       !extern
- &shift     shamt rs1 rd !extern
-+&r2        rd rs1       !extern
- # Formats 16:
-@@ -XXX,XX +XXX,XX @@
- @c_andi         ... . .. ... ..... .. &i imm=%imm_ci rs1=%rs1_3 rd=%rs1_3
-+@cu           ... ...  ... .. ... ..  &r2                 rs1=%rs1_3 rd=%rs1_3
-+@cl_b         ... . .. ... .. ... ..  &i  imm=%uimm_cl_b  rs1=%rs1_3 rd=%rs2_3
-+@cl_h         ... . .. ... .. ... ..  &i  imm=%uimm_cl_h  rs1=%rs1_3 rd=%rs2_3
-+@cs_b         ... . .. ... .. ... ..  &s  imm=%uimm_cl_b  rs1=%rs1_3 rs2=%rs2_3
-+@cs_h         ... . .. ... .. ... ..  &s  imm=%uimm_cl_h  rs1=%rs1_3 rs2=%rs2_3
-+
- # *** RV32/64C Standard Extension (Quadrant 0) ***
- {
-   # Opcode of all zeros is illegal; rd != 0, nzuimm == 0 is reserved.
-@@ -XXX,XX +XXX,XX @@ sw                110 .  .....  ..... 10 @c_swsp
-   sd              111 .  .....  ..... 10 @c_sdsp
-   c_fsw           111 .  .....  ..... 10 @c_swsp
- }
-+
-+# *** RV64 and RV32 Zcb Extension ***
-+c_zext_b          100 111  ... 11 000 01 @cu
-+c_sext_b          100 111  ... 11 001 01 @cu
-+c_zext_h          100 111  ... 11 010 01 @cu
-+c_sext_h          100 111  ... 11 011 01 @cu
-+c_zext_w          100 111  ... 11 100 01 @cu
-+c_not             100 111  ... 11 101 01 @cu
-+c_mul             100 111  ... 10 ... 01 @cs_2
-+c_lbu             100 000  ... .. ... 00 @cl_b
-+c_lhu             100 001  ... 0. ... 00 @cl_h
-+c_lh              100 001  ... 1. ... 00 @cl_h
-+c_sb              100 010  ... .. ... 00 @cs_b
-+c_sh              100 011  ... 0. ... 00 @cs_h
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
- /* Include the auto-generated decoder for 16 bit insn */
- #include "decode-insn16.c.inc"
-+#include "insn_trans/trans_rvzce.c.inc"
-+
- /* Include decoders for factored-out extensions */
- #include "decode-XVentanaCondOps.c.inc"
-diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * RISC-V translation routines for the Zcb Standard Extension.
-+ *
-+ * Copyright (c) 2021-2022 PLCT Lab
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2 or later, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#define REQUIRE_ZCB(ctx) do {   \
-+    if (!ctx->cfg_ptr->ext_zcb) \
-+        return false;           \
-+} while (0)
-+
-+static bool trans_c_zext_b(DisasContext *ctx, arg_c_zext_b *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext8u_tl);
-+}
-+
-+static bool trans_c_zext_h(DisasContext *ctx, arg_c_zext_h *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    REQUIRE_ZBB(ctx);
-+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext16u_tl);
-+}
-+
-+static bool trans_c_sext_b(DisasContext *ctx, arg_c_sext_b *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    REQUIRE_ZBB(ctx);
-+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext8s_tl);
-+}
-+
-+static bool trans_c_sext_h(DisasContext *ctx, arg_c_sext_h *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    REQUIRE_ZBB(ctx);
-+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext16s_tl);
-+}
-+
-+static bool trans_c_zext_w(DisasContext *ctx, arg_c_zext_w *a)
-+{
-+    REQUIRE_64BIT(ctx);
-+    REQUIRE_ZCB(ctx);
-+    REQUIRE_ZBA(ctx);
-+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext32u_tl);
-+}
-+
-+static bool trans_c_not(DisasContext *ctx, arg_c_not *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_not_tl);
-+}
-+
-+static bool trans_c_mul(DisasContext *ctx, arg_c_mul *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    REQUIRE_M_OR_ZMMUL(ctx);
-+    return gen_arith(ctx, a, EXT_NONE, tcg_gen_mul_tl, NULL);
-+}
-+
-+static bool trans_c_lbu(DisasContext *ctx, arg_c_lbu *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_load(ctx, a, MO_UB);
-+}
-+
-+static bool trans_c_lhu(DisasContext *ctx, arg_c_lhu *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_load(ctx, a, MO_UW);
-+}
-+
-+static bool trans_c_lh(DisasContext *ctx, arg_c_lh *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_load(ctx, a, MO_SW);
-+}
-+
-+static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_store(ctx, a, MO_UB);
-+}
-+
-+static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
-+{
-+    REQUIRE_ZCB(ctx);
-+    return gen_store(ctx, a, MO_UW);
-+}
---
-.40.0

-[PULL 14/89] target/riscv: add support for Zcmp extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add encode, trans* functions for Zcmp instructions.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230307081403.61950-7-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn16.decode                |  18 +++
- target/riscv/translate.c                  |   5 +
- target/riscv/insn_trans/trans_rvzce.c.inc | 187 +++++++++++++++++++++-
-files changed, 209 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn16.decode
-+++ b/target/riscv/insn16.decode
-@@ -XXX,XX +XXX,XX @@
- %rs1_3     7:3                !function=ex_rvc_register
- %rs2_3     2:3                !function=ex_rvc_register
- %rs2_5     2:5
-+%r1s       7:3                !function=ex_sreg_register
-+%r2s       2:3                !function=ex_sreg_register
- # Immediates:
- %imm_ci        12:s1 2:5
-@@ -XXX,XX +XXX,XX @@
- %uimm_cl_b  5:1 6:1
- %uimm_cl_h  5:1                      !function=ex_shift_1
-+%spimm      2:2                      !function=ex_shift_4
-+%urlist     4:4
- # Argument sets imported from insn32.decode:
- &empty                  !extern
-@@ -XXX,XX +XXX,XX @@
- &u         imm rd       !extern
- &shift     shamt rs1 rd !extern
- &r2        rd rs1       !extern
-+&r2_s      rs1 rs2      !extern
-+&cmpp      urlist spimm
- # Formats 16:
- @cr        ....  ..... .....  .. &r      rs2=%rs2_5       rs1=%rd     %rd
-@@ -XXX,XX +XXX,XX @@
- @cl_h         ... . .. ... .. ... ..  &i  imm=%uimm_cl_h  rs1=%rs1_3 rd=%rs2_3
- @cs_b         ... . .. ... .. ... ..  &s  imm=%uimm_cl_b  rs1=%rs1_3 rs2=%rs2_3
- @cs_h         ... . .. ... .. ... ..  &s  imm=%uimm_cl_h  rs1=%rs1_3 rs2=%rs2_3
-+@cm_pp        ... ...  ........   ..  &cmpp  %urlist      %spimm
-+@cm_mv        ... ...  ... .. ... ..  &r2_s  rs2=%r2s     rs1=%r1s
- # *** RV32/64C Standard Extension (Quadrant 0) ***
- {
-@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
- {
-   sq              101  ... ... .. ... 10 @c_sqsp
-   c_fsd           101   ......  ..... 10 @c_sdsp
-+
-+  # *** RV64 and RV32 Zcmp Extension ***
-+  [
-+    cm_push         101  11000  .... .. 10 @cm_pp
-+    cm_pop          101  11010  .... .. 10 @cm_pp
-+    cm_popret       101  11110  .... .. 10 @cm_pp
-+    cm_popretz      101  11100  .... .. 10 @cm_pp
-+    cm_mva01s       101  011 ... 11 ... 10 @cm_mv
-+    cm_mvsa01       101  011 ... 01 ... 10 @cm_mv
-+  ]
- }
- sw                110 .  .....  ..... 10 @c_swsp
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static int ex_rvc_register(DisasContext *ctx, int reg)
-     return 8 + reg;
- }
-+static int ex_sreg_register(DisasContext *ctx, int reg)
-+{
-+    return reg < 2 ? reg + 8 : reg + 16;
-+}
-+
- static int ex_rvc_shiftli(DisasContext *ctx, int imm)
- {
-     /* For RV128 a shamt of 0 means a shift by 64. */
-diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvzce.c.inc
-+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
-@@ -XXX,XX +XXX,XX @@
- /*
-- * RISC-V translation routines for the Zcb Standard Extension.
-+ * RISC-V translation routines for the Zc[b,mp] Standard Extensions.
-  *
-  * Copyright (c) 2021-2022 PLCT Lab
-  *
-@@ -XXX,XX +XXX,XX @@
-         return false;           \
- } while (0)
-+#define REQUIRE_ZCMP(ctx) do {   \
-+    if (!ctx->cfg_ptr->ext_zcmp) \
-+        return false;            \
-+} while (0)
-+
- static bool trans_c_zext_b(DisasContext *ctx, arg_c_zext_b *a)
- {
-     REQUIRE_ZCB(ctx);
-@@ -XXX,XX +XXX,XX @@ static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
-     REQUIRE_ZCB(ctx);
-     return gen_store(ctx, a, MO_UW);
- }
-+
-+#define X_S0    8
-+#define X_S1    9
-+#define X_Sn    16
-+
-+static uint32_t decode_push_pop_list(DisasContext *ctx, target_ulong rlist)
-+{
-+    uint32_t reg_bitmap = 0;
-+
-+    if (ctx->cfg_ptr->ext_e && rlist > 6) {
-+        return 0;
-+    }
-+
-+    switch (rlist) {
-+    case 15:
-+        reg_bitmap |=  1 << (X_Sn + 11) ;
-+        reg_bitmap |=  1 << (X_Sn + 10) ;
-+        /* FALL THROUGH */
-+    case 14:
-+        reg_bitmap |=  1 << (X_Sn + 9) ;
-+        /* FALL THROUGH */
-+    case 13:
-+        reg_bitmap |=  1 << (X_Sn + 8) ;
-+        /* FALL THROUGH */
-+    case 12:
-+        reg_bitmap |=  1 << (X_Sn + 7) ;
-+        /* FALL THROUGH */
-+    case 11:
-+        reg_bitmap |=  1 << (X_Sn + 6) ;
-+        /* FALL THROUGH */
-+    case 10:
-+        reg_bitmap |=  1 << (X_Sn + 5) ;
-+        /* FALL THROUGH */
-+    case 9:
-+        reg_bitmap |=  1 << (X_Sn + 4) ;
-+        /* FALL THROUGH */
-+    case 8:
-+        reg_bitmap |=  1 << (X_Sn + 3) ;
-+        /* FALL THROUGH */
-+    case 7:
-+        reg_bitmap |=  1 << (X_Sn + 2) ;
-+        /* FALL THROUGH */
-+    case 6:
-+        reg_bitmap |=  1 << X_S1 ;
-+        /* FALL THROUGH */
-+    case 5:
-+        reg_bitmap |= 1 << X_S0;
-+        /* FALL THROUGH */
-+    case 4:
-+        reg_bitmap |= 1 << xRA;
-+        break;
-+    default:
-+        break;
-+    }
-+
-+    return reg_bitmap;
-+}
-+
-+static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
-+{
-+    REQUIRE_ZCMP(ctx);
-+
-+    uint32_t reg_bitmap = decode_push_pop_list(ctx, a->urlist);
-+    if (reg_bitmap == 0) {
-+        return false;
-+    }
-+
-+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TEUL : MO_TEUQ;
-+    int reg_size = memop_size(memop);
-+    target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
-+                             a->spimm;
-+    TCGv sp = dest_gpr(ctx, xSP);
-+    TCGv addr = tcg_temp_new();
-+    int i;
-+
-+    tcg_gen_addi_tl(addr, sp, stack_adj - reg_size);
-+
-+    for (i = X_Sn + 11; i >= 0; i--) {
-+        if (reg_bitmap & (1 << i)) {
-+            TCGv dest = dest_gpr(ctx, i);
-+            tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, memop);
-+            gen_set_gpr(ctx, i, dest);
-+            tcg_gen_subi_tl(addr, addr, reg_size);
-+        }
-+    }
-+
-+    tcg_gen_addi_tl(sp, sp, stack_adj);
-+    gen_set_gpr(ctx, xSP, sp);
-+
-+    if (ret_val) {
-+        gen_set_gpr(ctx, xA0, ctx->zero);
-+    }
-+
-+    if (ret) {
-+        TCGv ret_addr = get_gpr(ctx, xRA, EXT_NONE);
-+        gen_set_pc(ctx, ret_addr);
-+        tcg_gen_lookup_and_goto_ptr();
-+        ctx->base.is_jmp = DISAS_NORETURN;
-+    }
-+
-+    return true;
-+}
-+
-+static bool trans_cm_push(DisasContext *ctx, arg_cm_push *a)
-+{
-+    REQUIRE_ZCMP(ctx);
-+
-+    uint32_t reg_bitmap = decode_push_pop_list(ctx, a->urlist);
-+    if (reg_bitmap == 0) {
-+        return false;
-+    }
-+
-+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TEUL : MO_TEUQ;
-+    int reg_size = memop_size(memop);
-+    target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
-+                             a->spimm;
-+    TCGv sp = dest_gpr(ctx, xSP);
-+    TCGv addr = tcg_temp_new();
-+    int i;
-+
-+    tcg_gen_subi_tl(addr, sp, reg_size);
-+
-+    for (i = X_Sn + 11; i >= 0; i--) {
-+        if (reg_bitmap & (1 << i)) {
-+            TCGv val = get_gpr(ctx, i, EXT_NONE);
-+            tcg_gen_qemu_st_tl(val, addr, ctx->mem_idx, memop);
-+            tcg_gen_subi_tl(addr, addr, reg_size);
-+        }
-+    }
-+
-+    tcg_gen_subi_tl(sp, sp, stack_adj);
-+    gen_set_gpr(ctx, xSP, sp);
-+
-+    return true;
-+}
-+
-+static bool trans_cm_pop(DisasContext *ctx, arg_cm_pop *a)
-+{
-+    return gen_pop(ctx, a, false, false);
-+}
-+
-+static bool trans_cm_popret(DisasContext *ctx, arg_cm_popret *a)
-+{
-+    return gen_pop(ctx, a, true, false);
-+}
-+
-+static bool trans_cm_popretz(DisasContext *ctx, arg_cm_popret *a)
-+{
-+    return gen_pop(ctx, a, true, true);
-+}
-+
-+static bool trans_cm_mva01s(DisasContext *ctx, arg_cm_mva01s *a)
-+{
-+    REQUIRE_ZCMP(ctx);
-+
-+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
-+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
-+
-+    gen_set_gpr(ctx, xA0, src1);
-+    gen_set_gpr(ctx, xA1, src2);
-+
-+    return true;
-+}
-+
-+static bool trans_cm_mvsa01(DisasContext *ctx, arg_cm_mvsa01 *a)
-+{
-+    REQUIRE_ZCMP(ctx);
-+
-+    if (a->rs1 == a->rs2) {
-+        return false;
-+    }
-+
-+    TCGv a0 = get_gpr(ctx, xA0, EXT_NONE);
-+    TCGv a1 = get_gpr(ctx, xA1, EXT_NONE);
-+
-+    gen_set_gpr(ctx, a->rs1, a0);
-+    gen_set_gpr(ctx, a->rs2, a1);
-+
-+    return true;
-+}
---
-.40.0

-[PULL 19/89] target/riscv: Fix itrigger when icount is used
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-When I boot a ubuntu image, QEMU output a "Bad icount read" message and exit.
-The reason is that when execute helper_mret or helper_sret, it will
-cause a call to icount_get_raw_locked (), which needs set can_do_io flag
-on cpustate.
-Thus we setting this flag when execute these two instructions.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230324064011.976-1-zhiwei_liu@linux.alibaba.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_privileged.c.inc | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
- #ifndef CONFIG_USER_ONLY
-     if (has_ext(ctx, RVS)) {
-         decode_save_opc(ctx);
-+        if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
-+            gen_io_start();
-+        }
-         gen_helper_sret(cpu_pc, cpu_env);
-         exit_tb(ctx); /* no chaining */
-         ctx->base.is_jmp = DISAS_NORETURN;
-@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
- {
- #ifndef CONFIG_USER_ONLY
-     decode_save_opc(ctx);
-+    if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
-+        gen_io_start();
-+    }
-     gen_helper_mret(cpu_pc, cpu_env);
-     exit_tb(ctx); /* no chaining */
-     ctx->base.is_jmp = DISAS_NORETURN;
---
-.40.0

-[PULL 21/89] target/riscv: Remove redundant check on RVH
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Check on riscv_cpu_virt_enabled contains the check on RVH.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230327080858.39703-3-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/op_helper.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-     }
--    if (riscv_has_ext(env, RVH) && riscv_cpu_virt_enabled(env) &&
--        get_field(env->hstatus, HSTATUS_VTSR)) {
-+    if (riscv_cpu_virt_enabled(env) && get_field(env->hstatus, HSTATUS_VTSR)) {
-         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
-     }
---
-.40.0

-[PULL 22/89] target/riscv: Remove check on RVH for riscv_cpu_virt_enabled
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Since env->virt.VIRT_ONOFF is initialized as false, and will not be set
-to true when RVH is disabled, so we can just return this bit(false) when
-RVH is not disabled.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230327080858.39703-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 4 ----
-file changed, 4 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
- bool riscv_cpu_virt_enabled(CPURISCVState *env)
- {
--    if (!riscv_has_ext(env, RVH)) {
--        return false;
--    }
--
-     return get_field(env->virt, VIRT_ONOFF);
- }
---
-.40.0

-[PULL 23/89] target/riscv: Remove check on RVH for riscv_cpu_set_virt_enabled
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-In current implementation, riscv_cpu_set_virt_enabled is only called when
-RVH is enabled.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230327080858.39703-5-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 5 +----
-file changed, 1 insertion(+), 4 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_virt_enabled(CPURISCVState *env)
-     return get_field(env->virt, VIRT_ONOFF);
- }
-+/* This function can only be called to set virt when RVH is enabled */
- void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
- {
--    if (!riscv_has_ext(env, RVH)) {
--        return;
--    }
--
-     /* Flush the TLB on all virt mode changes. */
-     if (get_field(env->virt, VIRT_ONOFF) != enable) {
-         tlb_flush(env_cpu(env));
---
-.40.0

-[PULL 24/89] target/riscv: Convert env->virt to a bool env->virt_enabled
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Currently we only use the env->virt to encode the virtual mode enabled
-status. Let's make it a bool type.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-ID: <20230325145348.1208-1-zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230327080858.39703-6-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h        | 2 +-
- target/riscv/cpu_bits.h   | 3 ---
- target/riscv/cpu_helper.c | 6 +++---
- target/riscv/machine.c    | 6 +++---
- target/riscv/translate.c  | 4 ++--
-files changed, 9 insertions(+), 12 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
- #ifndef CONFIG_USER_ONLY
-     target_ulong priv;
-     /* This contains QEMU specific information about the virt state. */
--    target_ulong virt;
-+    bool virt_enabled;
-     target_ulong geilen;
-     uint64_t resetvec;
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define PRV_H 2 /* Reserved */
- #define PRV_M 3
--/* Virtulisation Register Fields */
--#define VIRT_ONOFF          1
--
- /* RV32 satp CSR field masks */
- #define SATP32_MODE         0x80000000
- #define SATP32_ASID         0x7fc00000
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
- bool riscv_cpu_virt_enabled(CPURISCVState *env)
- {
--    return get_field(env->virt, VIRT_ONOFF);
-+    return env->virt_enabled;
- }
- /* This function can only be called to set virt when RVH is enabled */
- void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
- {
-     /* Flush the TLB on all virt mode changes. */
--    if (get_field(env->virt, VIRT_ONOFF) != enable) {
-+    if (env->virt_enabled != enable) {
-         tlb_flush(env_cpu(env));
-     }
--    env->virt = set_field(env->virt, VIRT_ONOFF, enable);
-+    env->virt_enabled = enable;
-     if (enable) {
-         /*
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/machine.c
-+++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_jvt = {
- const VMStateDescription vmstate_riscv_cpu = {
-     .name = "cpu",
--    .version_id = 7,
--    .minimum_version_id = 7,
-+    .version_id = 8,
-+    .minimum_version_id = 8,
-     .post_load = riscv_cpu_post_load,
-     .fields = (VMStateField[]) {
-         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
-         VMSTATE_UINT32(env.misa_mxl_max, RISCVCPU),
-         VMSTATE_UINT32(env.misa_ext_mask, RISCVCPU),
-         VMSTATE_UINTTL(env.priv, RISCVCPU),
--        VMSTATE_UINTTL(env.virt, RISCVCPU),
-+        VMSTATE_BOOL(env.virt_enabled, RISCVCPU),
-         VMSTATE_UINT64(env.resetvec, RISCVCPU),
-         VMSTATE_UINTTL(env.mhartid, RISCVCPU),
-         VMSTATE_UINT64(env.mstatus, RISCVCPU),
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_disas_log(const DisasContextBase *dcbase,
-     fprintf(logfile, "IN: %s\n", lookup_symbol(dcbase->pc_first));
- #ifndef CONFIG_USER_ONLY
--    fprintf(logfile, "Priv: "TARGET_FMT_ld"; Virt: "TARGET_FMT_ld"\n",
--            env->priv, env->virt);
-+    fprintf(logfile, "Priv: "TARGET_FMT_ld"; Virt: %d\n",
-+            env->priv, env->virt_enabled);
- #endif
-     target_disas(logfile, cpu, dcbase->pc_first, dcbase->tb->size);
- }
---
-.40.0

-[PULL 25/89] target/riscv: Remove redundant parentheses
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Remove redundant parentheses in get_physical_address.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230327080858.39703-8-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ restart:
-             if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
-                 *prot |= PAGE_READ;
-             }
--            if ((pte & PTE_X)) {
-+            if (pte & PTE_X) {
-                 *prot |= PAGE_EXEC;
-             }
-             /* add write permission on stores or if the page is already dirty,
---
-.40.0

-[PULL 26/89] target/riscv: Fix addr type for get_physical_address
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Function get_physical_address() translates both virtual address and
-guest physical address, and the latter is 34-bits for Sv32x4. So we
-should use vaddr type for 'addr' parameter.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230329101928.83856-1-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
-  * @env: CPURISCVState
-  * @physical: This will be set to the calculated physical address
-  * @prot: The returned protection attributes
-- * @addr: The virtual address to be translated
-+ * @addr: The virtual address or guest physical address to be translated
-  * @fault_pte_addr: If not NULL, this will be set to fault pte address
-  *                  when a error occurs on pte address translation.
-  *                  This will already be shifted to match htval.
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
-  * @is_debug: Is this access from a debugger or the monitor?
-  */
- static int get_physical_address(CPURISCVState *env, hwaddr *physical,
--                                int *prot, target_ulong addr,
-+                                int *prot, vaddr addr,
-                                 target_ulong *fault_pte_addr,
-                                 int access_type, int mmu_idx,
-                                 bool first_stage, bool two_stage,
---
-.40.0

-[PULL 27/89] target/riscv: Set opcode to env->bins for illegal/virtual instruction fault
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-decode_save_opc() will not work for generate_exception(), since 0 is passed
-to riscv_raise_exception() as pc in helper_raise_exception(), and bins will
-not be restored in this case.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230330034636.44585-1-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvh.c.inc | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/insn_trans/trans_rvh.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvh.c.inc
-+++ b/target/riscv/insn_trans/trans_rvh.c.inc
-@@ -XXX,XX +XXX,XX @@
- static bool check_access(DisasContext *ctx)
- {
-     if (!ctx->hlsx) {
-+        tcg_gen_st_i32(tcg_constant_i32(ctx->opcode), cpu_env,
-+                       offsetof(CPURISCVState, bins));
-         if (ctx->virt_enabled) {
-             generate_exception(ctx, RISCV_EXCP_VIRT_INSTRUCTION_FAULT);
-         } else {
---
-.40.0

-[PULL 32/89] hw/riscv: Add signature dump function for spike to run ACT tests
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add signature and signature-granularity properties in spike to specify the target
-signatrue file and the line size for signature data.
-Recgonize the signature section between begin_signature and end_signature symbols
-when loading elf of ACT tests. Then dump signature data in signature section just
-before the ACT tests exit.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230405095720.75848-2-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/char/riscv_htif.h |  3 +++
- hw/char/riscv_htif.c         | 44 +++++++++++++++++++++++++++++++++++-
- hw/riscv/spike.c             | 13 +++++++++++
-files changed, 59 insertions(+), 1 deletion(-)
-diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/riscv_htif.h
-+++ b/include/hw/char/riscv_htif.h
-@@ -XXX,XX +XXX,XX @@ typedef struct HTIFState {
-     uint64_t pending_read;
- } HTIFState;
-+extern const char *sig_file;
-+extern uint8_t line_size;
-+
- /* HTIF symbol callback */
- void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
-     uint64_t st_size);
-diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/riscv_htif.c
-+++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@
- #include "chardev/char-fe.h"
- #include "qemu/timer.h"
- #include "qemu/error-report.h"
-+#include "exec/address-spaces.h"
-+#include "sysemu/dma.h"
- #define RISCV_DEBUG_HTIF 0
- #define HTIF_DEBUG(fmt, ...)                                                   \
-@@ -XXX,XX +XXX,XX @@
- /* PK system call number */
- #define PK_SYS_WRITE            64
--static uint64_t fromhost_addr, tohost_addr;
-+const char *sig_file;
-+uint8_t line_size = 16;
-+
-+static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr;
- void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
-                           uint64_t st_size)
-@@ -XXX,XX +XXX,XX @@ void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
-             error_report("HTIF tohost must be 8 bytes");
-             exit(1);
-         }
-+    } else if (strcmp("begin_signature", st_name) == 0) {
-+        begin_sig_addr = st_value;
-+    } else if (strcmp("end_signature", st_name) == 0) {
-+        end_sig_addr = st_value;
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-             if (payload & 0x1) {
-                 /* exit code */
-                 int exit_code = payload >> 1;
-+
-+                /*
-+                 * Dump signature data if sig_file is specified and
-+                 * begin/end_signature symbols exist.
-+                 */
-+                if (sig_file && begin_sig_addr && end_sig_addr) {
-+                    uint64_t sig_len = end_sig_addr - begin_sig_addr;
-+                    char *sig_data = g_malloc(sig_len);
-+                    dma_memory_read(&address_space_memory, begin_sig_addr,
-+                                    sig_data, sig_len, MEMTXATTRS_UNSPECIFIED);
-+                    FILE *signature = fopen(sig_file, "w");
-+                    if (signature == NULL) {
-+                        error_report("Unable to open %s with error %s",
-+                                     sig_file, strerror(errno));
-+                        exit(1);
-+                    }
-+
-+                    for (int i = 0; i < sig_len; i += line_size) {
-+                        for (int j = line_size; j > 0; j--) {
-+                            if (i + j <= sig_len) {
-+                                fprintf(signature, "%02x",
-+                                        sig_data[i + j - 1] & 0xff);
-+                            } else {
-+                                fprintf(signature, "%02x", 0);
-+                            }
-+                        }
-+                        fprintf(signature, "\n");
-+                    }
-+
-+                    fclose(signature);
-+                    g_free(sig_data);
-+                }
-+
-                 exit(exit_code);
-             } else {
-                 uint64_t syscall[8];
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
-                  htif_custom_base);
- }
-+static void spike_set_signature(Object *obj, const char *val, Error **errp)
-+{
-+    sig_file = g_strdup(val);
-+}
-+
- static void spike_machine_instance_init(Object *obj)
- {
- }
-@@ -XXX,XX +XXX,XX @@ static void spike_machine_class_init(ObjectClass *oc, void *data)
-     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
-     mc->numa_mem_supported = true;
-     mc->default_ram_id = "riscv.spike.ram";
-+    object_class_property_add_str(oc, "signature", NULL, spike_set_signature);
-+    object_class_property_set_description(oc, "signature",
-+                                          "File to write ACT test signature");
-+    object_class_property_add_uint8_ptr(oc, "signature-granularity",
-+                                        &line_size, OBJ_PROP_FLAG_WRITE);
-+    object_class_property_set_description(oc, "signature-granularity",
-+                                          "Size of each line in ACT signature "
-+                                          "file");
- }
- static const TypeInfo spike_machine_typeinfo = {
---
-.40.0

-[PULL 33/89] target/riscv: sync env->misa_ext* with cpu->cfg in realize()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-When riscv_cpu_realize() starts we're guaranteed to have cpu->cfg.ext_N
-properties updated. The same can't be said about env->misa_ext*, since
-the user might enable/disable MISA extensions in the command line, and
-env->misa_ext* won't caught these changes. The current solution is to
-sync everything at the end of validate_set_extensions(), checking every
-cpu->cfg.ext_N value to do a set_misa() in the end.
-The last change we're making in the MISA cfg flags are in the G
-extension logic, enabling IMAFG if cpu->cfg_ext.g is enabled. Otherwise
-we're not making any changes in MISA bits ever since realize() starts.
-There's no reason to postpone misa_ext updates until the end of the
-validation. Let's do it earlier, during realize(), in a new helper
-called riscv_cpu_sync_misa_cfg(). If cpu->cfg.ext_g is enabled, do it
-again by updating env->misa_ext* directly.
-This is a pre-requisite to allow riscv_cpu_validate_set_extensions() to
-use riscv_has_ext() instead of cpu->cfg.ext_N to validate the MISA
-extensions, which is our end goal here.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-2-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 94 +++++++++++++++++++++++++++-------------------
-file changed, 56 insertions(+), 38 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
- /*
-  * Check consistency between chosen extensions while setting
-- * cpu->cfg accordingly, doing a set_misa() in the end.
-+ * cpu->cfg accordingly.
-  */
- static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
- {
-     CPURISCVState *env = &cpu->env;
--    uint32_t ext = 0;
-     /* Do some ISA extension error checking */
-     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_d = true;
-         cpu->cfg.ext_icsr = true;
-         cpu->cfg.ext_ifencei = true;
-+
-+        env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
-+        env->misa_ext_mask = env->misa_ext;
-     }
-     if (cpu->cfg.ext_i && cpu->cfg.ext_e) {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_zksh = true;
-     }
--    if (cpu->cfg.ext_i) {
--        ext |= RVI;
--    }
--    if (cpu->cfg.ext_e) {
--        ext |= RVE;
--    }
--    if (cpu->cfg.ext_m) {
--        ext |= RVM;
--    }
--    if (cpu->cfg.ext_a) {
--        ext |= RVA;
--    }
--    if (cpu->cfg.ext_f) {
--        ext |= RVF;
--    }
--    if (cpu->cfg.ext_d) {
--        ext |= RVD;
--    }
--    if (cpu->cfg.ext_c) {
--        ext |= RVC;
--    }
--    if (cpu->cfg.ext_s) {
--        ext |= RVS;
--    }
--    if (cpu->cfg.ext_u) {
--        ext |= RVU;
--    }
--    if (cpu->cfg.ext_h) {
--        ext |= RVH;
--    }
-     if (cpu->cfg.ext_v) {
-         int vext_version = VEXT_VERSION_1_00_0;
--        ext |= RVV;
-         if (!is_power_of_2(cpu->cfg.vlen)) {
-             error_setg(errp,
-                        "Vector extension VLEN must be power of 2");
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         }
-         set_vext_version(env, vext_version);
-     }
--    if (cpu->cfg.ext_j) {
--        ext |= RVJ;
--    }
--
--    set_misa(env, env->misa_mxl, ext);
- }
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
- #endif
- }
-+static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-+{
-+    uint32_t ext = 0;
-+
-+    if (riscv_cpu_cfg(env)->ext_i) {
-+        ext |= RVI;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_e) {
-+        ext |= RVE;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_m) {
-+        ext |= RVM;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_a) {
-+        ext |= RVA;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_f) {
-+        ext |= RVF;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_d) {
-+        ext |= RVD;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_c) {
-+        ext |= RVC;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_s) {
-+        ext |= RVS;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_u) {
-+        ext |= RVU;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_h) {
-+        ext |= RVH;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_v) {
-+        ext |= RVV;
-+    }
-+    if (riscv_cpu_cfg(env)->ext_j) {
-+        ext |= RVJ;
-+    }
-+
-+    env->misa_ext = env->misa_ext_mask = ext;
-+}
-+
- static void riscv_cpu_realize(DeviceState *dev, Error **errp)
- {
-     CPUState *cs = CPU(dev);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-         set_priv_version(env, priv_version);
-     }
-+    /*
-+     * We can't be sure of whether we set defaults during cpu_init()
-+     * or whether the user enabled/disabled some bits via cpu->cfg
-+     * flags. Sync env->misa_ext with cpu->cfg now to allow us to
-+     * use just env->misa_ext later.
-+     */
-+    riscv_cpu_sync_misa_cfg(env);
-+
-     /* Force disable extensions if priv spec version does not match */
-     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-         if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
---
-.40.0

-[PULL 34/89] target/riscv: remove MISA properties from isa_edata_arr[]
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The code that disables extensions if there's a priv version mismatch
-uses cpu->cfg.ext_N properties to do its job.
-We're aiming to not rely on cpu->cfg.ext_N props for MISA bits. Split
-the MISA related verifications in a new function, removing it from
-isa_edata_arr[].
-We're also erroring it out instead of disabling, making the cpu_init()
-function responsible for running an adequate priv spec for the MISA
-extensions it wants to use.
-Note that the RVV verification is being ignored since we're always have
-at least PRIV_VERSION_1_10_0.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-3-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 19 +++++++++++++++++--
-file changed, 17 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
-  * 4. Non-standard extensions (starts with 'X') must be listed after all
-  *    standard extensions. They must be separated from other multi-letter
-  *    extensions by an underscore.
-+ *
-+ * Single letter extensions are checked in riscv_cpu_validate_misa_priv()
-+ * instead.
-  */
- static const struct isa_ext_data isa_edata_arr[] = {
--    ISA_EXT_DATA_ENTRY(h, false, PRIV_VERSION_1_12_0, ext_h),
--    ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_10_0, ext_v),
-     ISA_EXT_DATA_ENTRY(zicbom, true, PRIV_VERSION_1_12_0, ext_icbom),
-     ISA_EXT_DATA_ENTRY(zicboz, true, PRIV_VERSION_1_12_0, ext_icboz),
-     ISA_EXT_DATA_ENTRY(zicond, true, PRIV_VERSION_1_12_0, ext_zicond),
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     env->misa_ext = env->misa_ext_mask = ext;
- }
-+static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
-+{
-+    if (riscv_has_ext(env, RVH) && env->priv_ver < PRIV_VERSION_1_12_0) {
-+        error_setg(errp, "H extension requires priv spec 1.12.0");
-+        return;
-+    }
-+}
-+
- static void riscv_cpu_realize(DeviceState *dev, Error **errp)
- {
-     CPUState *cs = CPU(dev);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-      */
-     riscv_cpu_sync_misa_cfg(env);
-+    riscv_cpu_validate_misa_priv(env, &local_err);
-+    if (local_err != NULL) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+
-     /* Force disable extensions if priv spec version does not match */
-     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-         if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
---
-.40.0

-[PULL 37/89] target/riscv: remove cpu->cfg.ext_a
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "a" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVA. Instances of cpu->cfg.ext_a and similar are
-replaced with riscv_has_ext(env, RVA).
-Remove the old "a" property and 'ext_a' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-6-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 16 ++++++++--------
-files changed, 8 insertions(+), 9 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_e;
-     bool ext_g;
-     bool ext_m;
--    bool ext_a;
-     bool ext_f;
-     bool ext_d;
-     bool ext_c;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     /* Do some ISA extension error checking */
-     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
--                            cpu->cfg.ext_a && cpu->cfg.ext_f &&
--                            cpu->cfg.ext_d &&
-+                            riscv_has_ext(env, RVA) &&
-+                            cpu->cfg.ext_f && cpu->cfg.ext_d &&
-                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
-         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-         cpu->cfg.ext_i = true;
-         cpu->cfg.ext_m = true;
--        cpu->cfg.ext_a = true;
-         cpu->cfg.ext_f = true;
-         cpu->cfg.ext_d = true;
-         cpu->cfg.ext_icsr = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if ((cpu->cfg.ext_zawrs) && !cpu->cfg.ext_a) {
-+    if ((cpu->cfg.ext_zawrs) && !riscv_has_ext(env, RVA)) {
-         error_setg(errp, "Zawrs extension requires A extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_cpu_cfg(env)->ext_m) {
-         ext |= RVM;
-     }
--    if (riscv_cpu_cfg(env)->ext_a) {
-+    if (riscv_has_ext(env, RVA)) {
-         ext |= RVA;
-     }
-     if (riscv_cpu_cfg(env)->ext_f) {
-@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
-     visit_type_bool(v, name, &value, errp);
- }
--static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {};
-+static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-+    {.name = "a", .description = "Atomic instructions",
-+     .misa_bit = RVA, .enabled = true},
-+};
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- {
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
--    DEFINE_PROP_BOOL("a", RISCVCPU, cfg.ext_a, true),
-     DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
-     DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
-     DEFINE_PROP_BOOL("c", RISCVCPU, cfg.ext_c, true),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-         cpu->cfg.ext_i = misa_ext & RVI;
-         cpu->cfg.ext_e = misa_ext & RVE;
-         cpu->cfg.ext_m = misa_ext & RVM;
--        cpu->cfg.ext_a = misa_ext & RVA;
-         cpu->cfg.ext_f = misa_ext & RVF;
-         cpu->cfg.ext_d = misa_ext & RVD;
-         cpu->cfg.ext_v = misa_ext & RVV;
---
-.40.0

-[PULL 39/89] target/riscv: remove cpu->cfg.ext_d
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "d" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVD. Instances of cpu->cfg.ext_d and similar are
-replaced with riscv_has_ext(env, RVD).
-Remove the old "d" property and 'ext_d' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-8-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 17 ++++++++---------
-files changed, 8 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_g;
-     bool ext_m;
-     bool ext_f;
--    bool ext_d;
-     bool ext_s;
-     bool ext_u;
-     bool ext_h;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     /* Do some ISA extension error checking */
-     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
-                             riscv_has_ext(env, RVA) &&
--                            cpu->cfg.ext_f && cpu->cfg.ext_d &&
-+                            cpu->cfg.ext_f && riscv_has_ext(env, RVD) &&
-                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
-         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-         cpu->cfg.ext_i = true;
-         cpu->cfg.ext_m = true;
-         cpu->cfg.ext_f = true;
--        cpu->cfg.ext_d = true;
-         cpu->cfg.ext_icsr = true;
-         cpu->cfg.ext_ifencei = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (cpu->cfg.ext_d && !cpu->cfg.ext_f) {
-+    if (riscv_has_ext(env, RVD) && !cpu->cfg.ext_f) {
-         error_setg(errp, "D extension requires F extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_zve32f = true;
-     }
--    if (cpu->cfg.ext_zve64d && !cpu->cfg.ext_d) {
-+    if (cpu->cfg.ext_zve64d && !riscv_has_ext(env, RVD)) {
-         error_setg(errp, "Zve64d/V extensions require D extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
-             cpu->cfg.ext_zcf = true;
-         }
--        if (cpu->cfg.ext_d) {
-+        if (riscv_has_ext(env, RVD)) {
-             cpu->cfg.ext_zcd = true;
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (!cpu->cfg.ext_d && cpu->cfg.ext_zcd) {
-+    if (!riscv_has_ext(env, RVD) && cpu->cfg.ext_zcd) {
-         error_setg(errp, "Zcd extension requires D extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_cpu_cfg(env)->ext_f) {
-         ext |= RVF;
-     }
--    if (riscv_cpu_cfg(env)->ext_d) {
-+    if (riscv_has_ext(env, RVD)) {
-         ext |= RVD;
-     }
-     if (riscv_has_ext(env, RVC)) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVA, .enabled = true},
-     {.name = "c", .description = "Compressed instructions",
-      .misa_bit = RVC, .enabled = true},
-+    {.name = "d", .description = "Double-precision float point",
-+     .misa_bit = RVD, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-     DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
--    DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
-     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
-     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
-     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-         cpu->cfg.ext_e = misa_ext & RVE;
-         cpu->cfg.ext_m = misa_ext & RVM;
-         cpu->cfg.ext_f = misa_ext & RVF;
--        cpu->cfg.ext_d = misa_ext & RVD;
-         cpu->cfg.ext_v = misa_ext & RVV;
-         cpu->cfg.ext_s = misa_ext & RVS;
-         cpu->cfg.ext_u = misa_ext & RVU;
---
-.40.0

-[PULL 40/89] target/riscv: remove cpu->cfg.ext_f
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "f" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVF. Instances of cpu->cfg.ext_f and similar are
-replaced with riscv_has_ext(env, RVF).
-Remove the old "f" property and 'ext_f' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-9-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 26 +++++++++++++-------------
-files changed, 13 insertions(+), 14 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_e;
-     bool ext_g;
-     bool ext_m;
--    bool ext_f;
-     bool ext_s;
-     bool ext_u;
-     bool ext_h;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     /* Do some ISA extension error checking */
-     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
-                             riscv_has_ext(env, RVA) &&
--                            cpu->cfg.ext_f && riscv_has_ext(env, RVD) &&
-+                            riscv_has_ext(env, RVF) &&
-+                            riscv_has_ext(env, RVD) &&
-                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
-         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-         cpu->cfg.ext_i = true;
-         cpu->cfg.ext_m = true;
--        cpu->cfg.ext_f = true;
-         cpu->cfg.ext_icsr = true;
-         cpu->cfg.ext_ifencei = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
-+    if (riscv_has_ext(env, RVF) && !cpu->cfg.ext_icsr) {
-         error_setg(errp, "F extension requires Zicsr");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_zfhmin = true;
-     }
--    if (cpu->cfg.ext_zfhmin && !cpu->cfg.ext_f) {
-+    if (cpu->cfg.ext_zfhmin && !riscv_has_ext(env, RVF)) {
-         error_setg(errp, "Zfh/Zfhmin extensions require F extension");
-         return;
-     }
--    if (riscv_has_ext(env, RVD) && !cpu->cfg.ext_f) {
-+    if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
-         error_setg(errp, "D extension requires F extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (cpu->cfg.ext_zve32f && !cpu->cfg.ext_f) {
-+    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
-         error_setg(errp, "Zve32f/Zve64f extensions require F extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-             error_setg(errp, "Zfinx extension requires Zicsr");
-             return;
-         }
--        if (cpu->cfg.ext_f) {
-+        if (riscv_has_ext(env, RVF)) {
-             error_setg(errp,
-                        "Zfinx cannot be supported together with F extension");
-             return;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_zcb = true;
-         cpu->cfg.ext_zcmp = true;
-         cpu->cfg.ext_zcmt = true;
--        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
-+        if (riscv_has_ext(env, RVF) && env->misa_mxl_max == MXL_RV32) {
-             cpu->cfg.ext_zcf = true;
-         }
-     }
-     if (riscv_has_ext(env, RVC)) {
-         cpu->cfg.ext_zca = true;
--        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
-+        if (riscv_has_ext(env, RVF) && env->misa_mxl_max == MXL_RV32) {
-             cpu->cfg.ext_zcf = true;
-         }
-         if (riscv_has_ext(env, RVD)) {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (!cpu->cfg.ext_f && cpu->cfg.ext_zcf) {
-+    if (!riscv_has_ext(env, RVF) && cpu->cfg.ext_zcf) {
-         error_setg(errp, "Zcf extension requires F extension");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVA)) {
-         ext |= RVA;
-     }
--    if (riscv_cpu_cfg(env)->ext_f) {
-+    if (riscv_has_ext(env, RVF)) {
-         ext |= RVF;
-     }
-     if (riscv_has_ext(env, RVD)) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVC, .enabled = true},
-     {.name = "d", .description = "Double-precision float point",
-      .misa_bit = RVD, .enabled = true},
-+    {.name = "f", .description = "Single-precision float point",
-+     .misa_bit = RVF, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
--    DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
-     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
-     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
-     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-         cpu->cfg.ext_i = misa_ext & RVI;
-         cpu->cfg.ext_e = misa_ext & RVE;
-         cpu->cfg.ext_m = misa_ext & RVM;
--        cpu->cfg.ext_f = misa_ext & RVF;
-         cpu->cfg.ext_v = misa_ext & RVV;
-         cpu->cfg.ext_s = misa_ext & RVS;
-         cpu->cfg.ext_u = misa_ext & RVU;
---
-.40.0

-[PULL 42/89] target/riscv: remove cpu->cfg.ext_e
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "e" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVE. Instances of cpu->cfg.ext_e and similar are
-replaced with riscv_has_ext(env, RVE).
-Remove the old "e" property and 'ext_e' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-11-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h                        |  1 -
- target/riscv/cpu.c                        | 10 +++++-----
- target/riscv/insn_trans/trans_rvzce.c.inc |  2 +-
-files changed, 6 insertions(+), 7 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- } RISCVSATPMap;
- struct RISCVCPUConfig {
--    bool ext_e;
-     bool ext_g;
-     bool ext_m;
-     bool ext_s;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         env->misa_ext_mask = env->misa_ext;
-     }
--    if (riscv_has_ext(env, RVI) && cpu->cfg.ext_e) {
-+    if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
-         error_setg(errp,
-                    "I and E extensions are incompatible");
-         return;
-     }
--    if (!riscv_has_ext(env, RVI) && !cpu->cfg.ext_e) {
-+    if (!riscv_has_ext(env, RVI) && !riscv_has_ext(env, RVE)) {
-         error_setg(errp,
-                    "Either I or E extension must be set");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVI)) {
-         ext |= RVI;
-     }
--    if (riscv_cpu_cfg(env)->ext_e) {
-+    if (riscv_has_ext(env, RVE)) {
-         ext |= RVE;
-     }
-     if (riscv_cpu_cfg(env)->ext_m) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVF, .enabled = true},
-     {.name = "i", .description = "Base integer instruction set",
-      .misa_bit = RVI, .enabled = true},
-+    {.name = "e", .description = "Base integer instruction set (embedded)",
-+     .misa_bit = RVE, .enabled = false},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
--    DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      * later on.
-      */
-     if (cpu->env.misa_ext != 0) {
--        cpu->cfg.ext_e = misa_ext & RVE;
-         cpu->cfg.ext_m = misa_ext & RVM;
-         cpu->cfg.ext_v = misa_ext & RVV;
-         cpu->cfg.ext_s = misa_ext & RVS;
-diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvzce.c.inc
-+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
-@@ -XXX,XX +XXX,XX @@ static uint32_t decode_push_pop_list(DisasContext *ctx, target_ulong rlist)
- {
-     uint32_t reg_bitmap = 0;
--    if (ctx->cfg_ptr->ext_e && rlist > 6) {
-+    if (has_ext(ctx, RVE) && rlist > 6) {
-         return 0;
-     }
---
-.40.0

-[PULL 43/89] target/riscv: remove cpu->cfg.ext_m
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "m" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVM. Instances of cpu->cfg.ext_m and similar are
-replaced with riscv_has_ext(env, RVM).
-Remove the old "m" property and 'ext_m' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-12-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 10 +++++-----
-files changed, 5 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- struct RISCVCPUConfig {
-     bool ext_g;
--    bool ext_m;
-     bool ext_s;
-     bool ext_u;
-     bool ext_h;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     CPURISCVState *env = &cpu->env;
-     /* Do some ISA extension error checking */
--    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) && cpu->cfg.ext_m &&
-+    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) &&
-+                            riscv_has_ext(env, RVM) &&
-                             riscv_has_ext(env, RVA) &&
-                             riscv_has_ext(env, RVF) &&
-                             riscv_has_ext(env, RVD) &&
-                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
-         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
--        cpu->cfg.ext_m = true;
-         cpu->cfg.ext_icsr = true;
-         cpu->cfg.ext_ifencei = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVE)) {
-         ext |= RVE;
-     }
--    if (riscv_cpu_cfg(env)->ext_m) {
-+    if (riscv_has_ext(env, RVM)) {
-         ext |= RVM;
-     }
-     if (riscv_has_ext(env, RVA)) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVI, .enabled = true},
-     {.name = "e", .description = "Base integer instruction set (embedded)",
-      .misa_bit = RVE, .enabled = false},
-+    {.name = "m", .description = "Integer multiplication and division",
-+     .misa_bit = RVM, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
--    DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
-     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
-     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      * later on.
-      */
-     if (cpu->env.misa_ext != 0) {
--        cpu->cfg.ext_m = misa_ext & RVM;
-         cpu->cfg.ext_v = misa_ext & RVV;
-         cpu->cfg.ext_s = misa_ext & RVS;
-         cpu->cfg.ext_u = misa_ext & RVU;
---
-.40.0

-[PULL 44/89] target/riscv: remove cpu->cfg.ext_s
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "s" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVS. Instances of cpu->cfg.ext_s and similar are
-replaced with riscv_has_ext(env, RVS).
-Remove the old "s" property and 'ext_s' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-13-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 11 +++++------
-files changed, 5 insertions(+), 7 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- struct RISCVCPUConfig {
-     bool ext_g;
--    bool ext_s;
-     bool ext_u;
-     bool ext_h;
-     bool ext_j;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
-     cpu->cfg.ext_g = true;
-     cpu->cfg.ext_u = true;
--    cpu->cfg.ext_s = true;
-     cpu->cfg.ext_icsr = true;
-     cpu->cfg.ext_zfh = true;
-     cpu->cfg.mmu = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (cpu->cfg.ext_s && !cpu->cfg.ext_u) {
-+    if (riscv_has_ext(env, RVS) && !cpu->cfg.ext_u) {
-         error_setg(errp,
-                    "Setting S extension without U extension is illegal");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (cpu->cfg.ext_h && !cpu->cfg.ext_s) {
-+    if (cpu->cfg.ext_h && !riscv_has_ext(env, RVS)) {
-         error_setg(errp, "H extension implicitly requires S-mode");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVC)) {
-         ext |= RVC;
-     }
--    if (riscv_cpu_cfg(env)->ext_s) {
-+    if (riscv_has_ext(env, RVS)) {
-         ext |= RVS;
-     }
-     if (riscv_cpu_cfg(env)->ext_u) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVE, .enabled = false},
-     {.name = "m", .description = "Integer multiplication and division",
-      .misa_bit = RVM, .enabled = true},
-+    {.name = "s", .description = "Supervisor-level instructions",
-+     .misa_bit = RVS, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
--    DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
-     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
-     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-     DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      */
-     if (cpu->env.misa_ext != 0) {
-         cpu->cfg.ext_v = misa_ext & RVV;
--        cpu->cfg.ext_s = misa_ext & RVS;
-         cpu->cfg.ext_u = misa_ext & RVU;
-         cpu->cfg.ext_h = misa_ext & RVH;
-         cpu->cfg.ext_j = misa_ext & RVJ;
---
-.40.0

-[PULL 45/89] target/riscv: remove cpu->cfg.ext_u
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "u" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVU. Instances of cpu->cfg.ext_u and similar are
-replaced with riscv_has_ext(env, RVU).
-Remove the old "u" property and 'ext_u' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-14-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h | 1 -
- target/riscv/cpu.c | 9 ++++-----
-files changed, 4 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- struct RISCVCPUConfig {
-     bool ext_g;
--    bool ext_u;
-     bool ext_h;
-     bool ext_j;
-     bool ext_v;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
-     set_priv_version(env, PRIV_VERSION_1_11_0);
-     cpu->cfg.ext_g = true;
--    cpu->cfg.ext_u = true;
-     cpu->cfg.ext_icsr = true;
-     cpu->cfg.ext_zfh = true;
-     cpu->cfg.mmu = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (riscv_has_ext(env, RVS) && !cpu->cfg.ext_u) {
-+    if (riscv_has_ext(env, RVS) && !riscv_has_ext(env, RVU)) {
-         error_setg(errp,
-                    "Setting S extension without U extension is illegal");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVS)) {
-         ext |= RVS;
-     }
--    if (riscv_cpu_cfg(env)->ext_u) {
-+    if (riscv_has_ext(env, RVU)) {
-         ext |= RVU;
-     }
-     if (riscv_cpu_cfg(env)->ext_h) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVM, .enabled = true},
-     {.name = "s", .description = "Supervisor-level instructions",
-      .misa_bit = RVS, .enabled = true},
-+    {.name = "u", .description = "User-level instructions",
-+     .misa_bit = RVU, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
--    DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
-     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-     DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
-     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      */
-     if (cpu->env.misa_ext != 0) {
-         cpu->cfg.ext_v = misa_ext & RVV;
--        cpu->cfg.ext_u = misa_ext & RVU;
-         cpu->cfg.ext_h = misa_ext & RVH;
-         cpu->cfg.ext_j = misa_ext & RVJ;
---
-.40.0

-[PULL 46/89] target/riscv: remove cpu->cfg.ext_h
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "h" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVH. Instances of cpu->cfg.ext_h and similar are
-replaced with riscv_has_ext(env, RVH).
-Remove the old "h" property and 'ext_h' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-15-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 10 +++++-----
-files changed, 5 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- struct RISCVCPUConfig {
-     bool ext_g;
--    bool ext_h;
-     bool ext_j;
-     bool ext_v;
-     bool ext_zba;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         return;
-     }
--    if (cpu->cfg.ext_h && !riscv_has_ext(env, RVI)) {
-+    if (riscv_has_ext(env, RVH) && !riscv_has_ext(env, RVI)) {
-         error_setg(errp,
-                    "H depends on an I base integer ISA with 32 x registers");
-         return;
-     }
--    if (cpu->cfg.ext_h && !riscv_has_ext(env, RVS)) {
-+    if (riscv_has_ext(env, RVH) && !riscv_has_ext(env, RVS)) {
-         error_setg(errp, "H extension implicitly requires S-mode");
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVU)) {
-         ext |= RVU;
-     }
--    if (riscv_cpu_cfg(env)->ext_h) {
-+    if (riscv_has_ext(env, RVH)) {
-         ext |= RVH;
-     }
-     if (riscv_cpu_cfg(env)->ext_v) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVS, .enabled = true},
-     {.name = "u", .description = "User-level instructions",
-      .misa_bit = RVU, .enabled = true},
-+    {.name = "h", .description = "Hypervisor",
-+     .misa_bit = RVH, .enabled = true},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
--    DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
-     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
-     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
-     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      */
-     if (cpu->env.misa_ext != 0) {
-         cpu->cfg.ext_v = misa_ext & RVV;
--        cpu->cfg.ext_h = misa_ext & RVH;
-         cpu->cfg.ext_j = misa_ext & RVJ;
-         /*
---
-.40.0

-[PULL 47/89] target/riscv: remove cpu->cfg.ext_j
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "j" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVJ. Instances of cpu->cfg.ext_j and similar are
-replaced with riscv_has_ext(env, RVJ).
-Remove the old "j" property and 'ext_j' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-16-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h | 1 -
- target/riscv/cpu.c | 6 +++---
-files changed, 3 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- struct RISCVCPUConfig {
-     bool ext_g;
--    bool ext_j;
-     bool ext_v;
-     bool ext_zba;
-     bool ext_zbb;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_cpu_cfg(env)->ext_v) {
-         ext |= RVV;
-     }
--    if (riscv_cpu_cfg(env)->ext_j) {
-+    if (riscv_has_ext(env, RVJ)) {
-         ext |= RVJ;
-     }
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVU, .enabled = true},
-     {.name = "h", .description = "Hypervisor",
-      .misa_bit = RVH, .enabled = true},
-+    {.name = "x-j", .description = "Dynamic translated languages",
-+     .misa_bit = RVJ, .enabled = false},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     /* These are experimental so mark with 'x-' */
-     DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
--    DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
-     DEFINE_PROP_BOOL("x-zca", RISCVCPU, cfg.ext_zca, false),
-     DEFINE_PROP_BOOL("x-zcb", RISCVCPU, cfg.ext_zcb, false),
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      */
-     if (cpu->env.misa_ext != 0) {
-         cpu->cfg.ext_v = misa_ext & RVV;
--        cpu->cfg.ext_j = misa_ext & RVJ;
-         /*
-          * We don't want to set the default riscv_cpu_extensions
---
-.40.0

-[PULL 48/89] target/riscv: remove cpu->cfg.ext_v
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a new "v" RISCVCPUMisaExtConfig property that will update
-env->misa_ext* with RVV. Instances of cpu->cfg.ext_v and similar are
-replaced with riscv_has_ext(env, RVV).
-Remove the old "v" property and 'ext_v' from RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-17-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  1 -
- target/riscv/cpu.c | 12 +++++-------
-files changed, 5 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- struct RISCVCPUConfig {
-     bool ext_g;
--    bool ext_v;
-     bool ext_zba;
-     bool ext_zbb;
-     bool ext_zbc;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     }
-     /* The V vector extension depends on the Zve64d extension */
--    if (cpu->cfg.ext_v) {
-+    if (riscv_has_ext(env, RVV)) {
-         cpu->cfg.ext_zve64d = true;
-     }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_zksh = true;
-     }
--    if (cpu->cfg.ext_v) {
-+    if (riscv_has_ext(env, RVV)) {
-         int vext_version = VEXT_VERSION_1_00_0;
-         if (!is_power_of_2(cpu->cfg.vlen)) {
-             error_setg(errp,
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-     if (riscv_has_ext(env, RVH)) {
-         ext |= RVH;
-     }
--    if (riscv_cpu_cfg(env)->ext_v) {
-+    if (riscv_has_ext(env, RVV)) {
-         ext |= RVV;
-     }
-     if (riscv_has_ext(env, RVJ)) {
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVH, .enabled = true},
-     {.name = "x-j", .description = "Dynamic translated languages",
-      .misa_bit = RVJ, .enabled = false},
-+    {.name = "v", .description = "Vector operations",
-+     .misa_bit = RVV, .enabled = false},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
-     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
--    DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
-     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
-     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
- static void register_cpu_props(Object *obj)
- {
-     RISCVCPU *cpu = RISCV_CPU(obj);
--    uint32_t misa_ext = cpu->env.misa_ext;
-     Property *prop;
-     DeviceState *dev = DEVICE(obj);
-@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
-      * later on.
-      */
-     if (cpu->env.misa_ext != 0) {
--        cpu->cfg.ext_v = misa_ext & RVV;
--
-         /*
-          * We don't want to set the default riscv_cpu_extensions
-          * in this case.
---
-.40.0

-[PULL 49/89] target/riscv: remove riscv_cpu_sync_misa_cfg()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This function was created to move the sync between cpu->cfg.ext_N bit
-changes to env->misa_ext* from the validation step to an ealier step,
-giving us a guarantee that we could use either cpu->cfg.ext_N or
-riscv_has_ext(env,N) in the validation.
-We don't have any cpu->cfg.ext_N left that has an existing MISA bit
-(cfg.ext_g will be handled shortly). The function is now a no-op, simply
-copying the existing values of misa_ext* back to misa_ext*.
-Remove it.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-18-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 52 ----------------------------------------------
-file changed, 52 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
- #endif
- }
--static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
--{
--    uint32_t ext = 0;
--
--    if (riscv_has_ext(env, RVI)) {
--        ext |= RVI;
--    }
--    if (riscv_has_ext(env, RVE)) {
--        ext |= RVE;
--    }
--    if (riscv_has_ext(env, RVM)) {
--        ext |= RVM;
--    }
--    if (riscv_has_ext(env, RVA)) {
--        ext |= RVA;
--    }
--    if (riscv_has_ext(env, RVF)) {
--        ext |= RVF;
--    }
--    if (riscv_has_ext(env, RVD)) {
--        ext |= RVD;
--    }
--    if (riscv_has_ext(env, RVC)) {
--        ext |= RVC;
--    }
--    if (riscv_has_ext(env, RVS)) {
--        ext |= RVS;
--    }
--    if (riscv_has_ext(env, RVU)) {
--        ext |= RVU;
--    }
--    if (riscv_has_ext(env, RVH)) {
--        ext |= RVH;
--    }
--    if (riscv_has_ext(env, RVV)) {
--        ext |= RVV;
--    }
--    if (riscv_has_ext(env, RVJ)) {
--        ext |= RVJ;
--    }
--
--    env->misa_ext = env->misa_ext_mask = ext;
--}
--
- static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
- {
-     if (riscv_has_ext(env, RVH) && env->priv_ver < PRIV_VERSION_1_12_0) {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-         set_priv_version(env, priv_version);
-     }
--    /*
--     * We can't be sure of whether we set defaults during cpu_init()
--     * or whether the user enabled/disabled some bits via cpu->cfg
--     * flags. Sync env->misa_ext with cpu->cfg now to allow us to
--     * use just env->misa_ext later.
--     */
--    riscv_cpu_sync_misa_cfg(env);
--
-     riscv_cpu_validate_misa_priv(env, &local_err);
-     if (local_err != NULL) {
-         error_propagate(errp, local_err);
---
-.40.0

-[PULL 50/89] target/riscv: remove cfg.ext_g setup from rv64_thead_c906_cpu_init()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This CPU is enabling G via cfg.ext_g and, at the same time, setting
-IMAFD in set_misa() and cfg.ext_icsr.
-riscv_cpu_validate_set_extensions() is already doing that, so there's no
-need for cpu_init() setups to worry about setting G and its extensions.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-19-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     RISCVCPU *cpu = RISCV_CPU(obj);
--    set_misa(env, MXL_RV64, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-+    set_misa(env, MXL_RV64, RVC | RVS | RVU);
-     set_priv_version(env, PRIV_VERSION_1_11_0);
-     cpu->cfg.ext_g = true;
--    cpu->cfg.ext_icsr = true;
-     cpu->cfg.ext_zfh = true;
-     cpu->cfg.mmu = true;
-     cpu->cfg.ext_xtheadba = true;
---
-.40.0

-[PULL 51/89] target/riscv: add RVG and remove cpu->cfg.ext_g
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We're still have one RISCVCPUConfig MISA flag, 'ext_g'. We'll remove it
-the same way we did with the others: create a "g" RISCVCPUMisaExtConfig
-property, remove the old "g" property, remove all instances of 'cfg.ext_g'
-and use riscv_has_ext(env, RVG).
-The caveat is that we don't have RVG, so add it. RVG will be used right
-off the bat in set_misa() of rv64_thead_c906_cpu_init() because the CPU is
-enabling G via the now removed 'ext_g' flag.
-After this patch, there are no more MISA extensions represented by flags
-in RISCVCPUConfig.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-20-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  2 +-
- target/riscv/cpu.c | 17 ++++++++---------
-files changed, 9 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@
- #define RVU RV('U')
- #define RVH RV('H')
- #define RVJ RV('J')
-+#define RVG RV('G')
- /* Privileged specification version */
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- } RISCVSATPMap;
- struct RISCVCPUConfig {
--    bool ext_g;
-     bool ext_zba;
-     bool ext_zbb;
-     bool ext_zbc;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     RISCVCPU *cpu = RISCV_CPU(obj);
--    set_misa(env, MXL_RV64, RVC | RVS | RVU);
-+    set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
-     set_priv_version(env, PRIV_VERSION_1_11_0);
--    cpu->cfg.ext_g = true;
-     cpu->cfg.ext_zfh = true;
-     cpu->cfg.mmu = true;
-     cpu->cfg.ext_xtheadba = true;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     CPURISCVState *env = &cpu->env;
-     /* Do some ISA extension error checking */
--    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) &&
--                            riscv_has_ext(env, RVM) &&
--                            riscv_has_ext(env, RVA) &&
--                            riscv_has_ext(env, RVF) &&
--                            riscv_has_ext(env, RVD) &&
--                            cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
-+    if (riscv_has_ext(env, RVG) &&
-+        !(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
-+          riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
-+          riscv_has_ext(env, RVD) &&
-+          cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
-         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-         cpu->cfg.ext_icsr = true;
-         cpu->cfg.ext_ifencei = true;
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-      .misa_bit = RVJ, .enabled = false},
-     {.name = "v", .description = "Vector operations",
-      .misa_bit = RVV, .enabled = false},
-+    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
-+     .misa_bit = RVG, .enabled = false},
- };
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
- static Property riscv_cpu_extensions[] = {
-     /* Defaults for standard extensions */
--    DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
-     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
-     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
---
-.40.0

-[PULL 52/89] target/riscv/cpu.c: redesign register_cpu_props()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The function is now a no-op for all cpu_init() callers that are setting
-a non-zero misa value in set_misa(), since it's no longer used to sync
-cpu->cfg props with env->misa_ext bits. Remove it in those cases.
-While we're at it, rename the function to match what it's actually
-doing: create user properties to set/remove CPU extensions. Make a note
-that it will overwrite env->misa_ext with the defaults set by each user
-property.
-Update the MISA bits comment in cpu.h as well.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406180351.570807-21-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h |  5 +----
- target/riscv/cpu.c | 41 ++++++++++-------------------------------
-files changed, 11 insertions(+), 35 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@
- #define RV(x) ((target_ulong)1 << (x - 'A'))
--/*
-- * Consider updating register_cpu_props() when adding
-- * new MISA bits here.
-- */
-+/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
- #define RVI RV('I')
- #define RVE RV('E') /* E and I are mutually exclusive */
- #define RVM RV('M')
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const char * const riscv_intr_names[] = {
-     "reserved"
- };
--static void register_cpu_props(Object *obj);
-+static void riscv_cpu_add_user_properties(Object *obj);
- const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
- {
-@@ -XXX,XX +XXX,XX @@ static void riscv_any_cpu_init(Object *obj)
- #endif
-     set_priv_version(env, PRIV_VERSION_1_12_0);
--    register_cpu_props(obj);
- }
- #if defined(TARGET_RISCV64)
-@@ -XXX,XX +XXX,XX @@ static void rv64_base_cpu_init(Object *obj)
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     /* We set this in the realise function */
-     set_misa(env, MXL_RV64, 0);
--    register_cpu_props(obj);
-+    riscv_cpu_add_user_properties(obj);
-     /* Set latest version of privileged specification */
-     set_priv_version(env, PRIV_VERSION_1_12_0);
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void rv64_sifive_u_cpu_init(Object *obj)
- {
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     set_misa(env, MXL_RV64, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
--    register_cpu_props(obj);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
- #ifndef CONFIG_USER_ONLY
-     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV39);
-@@ -XXX,XX +XXX,XX @@ static void rv64_sifive_e_cpu_init(Object *obj)
-     RISCVCPU *cpu = RISCV_CPU(obj);
-     set_misa(env, MXL_RV64, RVI | RVM | RVA | RVC | RVU);
--    register_cpu_props(obj);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
-     cpu->cfg.mmu = false;
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void rv128_base_cpu_init(Object *obj)
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     /* We set this in the realise function */
-     set_misa(env, MXL_RV128, 0);
--    register_cpu_props(obj);
-+    riscv_cpu_add_user_properties(obj);
-     /* Set latest version of privileged specification */
-     set_priv_version(env, PRIV_VERSION_1_12_0);
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void rv32_base_cpu_init(Object *obj)
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     /* We set this in the realise function */
-     set_misa(env, MXL_RV32, 0);
--    register_cpu_props(obj);
-+    riscv_cpu_add_user_properties(obj);
-     /* Set latest version of privileged specification */
-     set_priv_version(env, PRIV_VERSION_1_12_0);
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void rv32_sifive_u_cpu_init(Object *obj)
- {
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
-     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
--    register_cpu_props(obj);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
- #ifndef CONFIG_USER_ONLY
-     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
-@@ -XXX,XX +XXX,XX @@ static void rv32_sifive_e_cpu_init(Object *obj)
-     RISCVCPU *cpu = RISCV_CPU(obj);
-     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVC | RVU);
--    register_cpu_props(obj);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
-     cpu->cfg.mmu = false;
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void rv32_ibex_cpu_init(Object *obj)
-     RISCVCPU *cpu = RISCV_CPU(obj);
-     set_misa(env, MXL_RV32, RVI | RVM | RVC | RVU);
--    register_cpu_props(obj);
-     set_priv_version(env, PRIV_VERSION_1_11_0);
-     cpu->cfg.mmu = false;
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
-     RISCVCPU *cpu = RISCV_CPU(obj);
-     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVC | RVU);
--    register_cpu_props(obj);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
-     cpu->cfg.mmu = false;
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void riscv_host_cpu_init(Object *obj)
- #elif defined(TARGET_RISCV64)
-     set_misa(env, MXL_RV64, 0);
- #endif
--    register_cpu_props(obj);
-+    riscv_cpu_add_user_properties(obj);
- }
- #endif
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
- };
- /*
-- * Register CPU props based on env.misa_ext. If a non-zero
-- * value was set, register only the required cpu->cfg.ext_*
-- * properties and leave. env.misa_ext = 0 means that we want
-- * all the default properties to be registered.
-+ * Add CPU properties with user-facing flags.
-+ *
-+ * This will overwrite existing env->misa_ext values with the
-+ * defaults set via riscv_cpu_add_misa_properties().
-  */
--static void register_cpu_props(Object *obj)
-+static void riscv_cpu_add_user_properties(Object *obj)
- {
--    RISCVCPU *cpu = RISCV_CPU(obj);
-     Property *prop;
-     DeviceState *dev = DEVICE(obj);
--    /*
--     * If misa_ext is not zero, set cfg properties now to
--     * allow them to be read during riscv_cpu_realize()
--     * later on.
--     */
--    if (cpu->env.misa_ext != 0) {
--        /*
--         * We don't want to set the default riscv_cpu_extensions
--         * in this case.
--         */
--        return;
--    }
--
-     riscv_cpu_add_misa_properties(obj);
-     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
---
-.40.0

-[PULL 53/89] target/riscv: Fix the mstatus.MPP value after executing MRET
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-The MPP will be set to the least-privileged supported mode (U if
-U-mode is implemented, else M).
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230407014743.18779-2-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/op_helper.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
-     mstatus = set_field(mstatus, MSTATUS_MIE,
-                         get_field(mstatus, MSTATUS_MPIE));
-     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
--    mstatus = set_field(mstatus, MSTATUS_MPP, PRV_U);
-+    mstatus = set_field(mstatus, MSTATUS_MPP,
-+                        riscv_has_ext(env, RVU) ? PRV_U : PRV_M);
-     mstatus = set_field(mstatus, MSTATUS_MPV, 0);
-     if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) {
-         mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
---
-.40.0

-[PULL 55/89] target/riscv: Legalize MPP value in write_mstatus
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-mstatus.MPP field is a WARL field since priv version 1.11, so we
-remain it unchanged if an invalid value is written into it. And
-after this, RVH shouldn't be passed to riscv_cpu_set_mode().
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230407014743.18779-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c |  8 ++------
- target/riscv/csr.c        | 32 ++++++++++++++++++++++++++++++++
-files changed, 34 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
- void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
- {
--    if (newpriv > PRV_M) {
--        g_assert_not_reached();
--    }
--    if (newpriv == PRV_RESERVED) {
--        newpriv = PRV_U;
--    }
-+    g_assert(newpriv <= PRV_M && newpriv != PRV_RESERVED);
-+
-     if (icount_enabled() && newpriv != env->priv) {
-         riscv_itrigger_update_priv(env);
-     }
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static bool validate_vm(CPURISCVState *env, target_ulong vm)
-            satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
- }
-+static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
-+                                 target_ulong val)
-+{
-+    bool valid = false;
-+    target_ulong new_mpp = get_field(val, MSTATUS_MPP);
-+
-+    switch (new_mpp) {
-+    case PRV_M:
-+        valid = true;
-+        break;
-+    case PRV_S:
-+        valid = riscv_has_ext(env, RVS);
-+        break;
-+    case PRV_U:
-+        valid = riscv_has_ext(env, RVU);
-+        break;
-+    }
-+
-+    /* Remain field unchanged if new_mpp value is invalid */
-+    if (!valid) {
-+        val = set_field(val, MSTATUS_MPP, old_mpp);
-+    }
-+
-+    return val;
-+}
-+
- static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-                                     target_ulong val)
- {
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-     uint64_t mask = 0;
-     RISCVMXL xl = riscv_cpu_mxl(env);
-+    /*
-+     * MPP field have been made WARL since priv version 1.11. However,
-+     * legalization for it will not break any software running on 1.10.
-+     */
-+    val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
-+
-     /* flush tlb on mstatus fields that affect VM */
-     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
-             MSTATUS_MPRV | MSTATUS_SUM)) {
---
-.40.0

-[PULL 56/89] target/riscv: Use check for relationship between Zdinx/Zhinx{min} and Zfinx
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Zdinx/Zhinx{min} require Zfinx. And require relationship is usually done
-by check currently.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230408135908.25269-1-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-         cpu->cfg.ext_zhinxmin = true;
-     }
--    if (cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinxmin) {
--        cpu->cfg.ext_zfinx = true;
-+    if ((cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinxmin) && !cpu->cfg.ext_zfinx) {
-+        error_setg(errp, "Zdinx/Zhinx/Zhinxmin extensions require Zfinx");
-+        return;
-     }
-     if (cpu->cfg.ext_zfinx) {
---
-.40.0

-[PULL 57/89] target/riscv: fix H extension TVM trap
+Deleted patch
-From: Yi Chen <chenyi2000@zju.edu.cn>
-- Trap satp/hgatp accesses from HS-mode when MSTATUS.TVM is enabled.
-- Trap satp accesses from VS-mode when HSTATUS.VTVM is enabled.
-- Raise RISCV_EXCP_ILLEGAL_INST when U-mode executes SFENCE.VMA/SINVAL.VMA.
-- Raise RISCV_EXCP_VIRT_INSTRUCTION_FAULT when VU-mode executes
-  SFENCE.VMA/SINVAL.VMA or VS-mode executes SFENCE.VMA/SINVAL.VMA with
-  HSTATUS.VTVM enabled.
-- Raise RISCV_EXCP_VIRT_INSTRUCTION_FAULT when VU-mode executes
-  HFENCE.GVMA/HFENCE.VVMA/HINVAL.GVMA/HINVAL.VVMA.
-Signed-off-by: Yi Chen <chenyi2000@zju.edu.cn>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230406101559.39632-1-chenyi2000@zju.edu.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c       | 56 +++++++++++++++++++++++++---------------
- target/riscv/op_helper.c | 12 ++++-----
-files changed, 41 insertions(+), 27 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException sstc_32(CPURISCVState *env, int csrno)
-     return sstc(env, csrno);
- }
-+static RISCVException satp(CPURISCVState *env, int csrno)
-+{
-+    if (env->priv == PRV_S && !env->virt_enabled &&
-+        get_field(env->mstatus, MSTATUS_TVM)) {
-+        return RISCV_EXCP_ILLEGAL_INST;
-+    }
-+    if (env->priv == PRV_S && env->virt_enabled &&
-+        get_field(env->hstatus, HSTATUS_VTVM)) {
-+        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-+    }
-+
-+    return smode(env, csrno);
-+}
-+
-+static RISCVException hgatp(CPURISCVState *env, int csrno)
-+{
-+    if (env->priv == PRV_S && !env->virt_enabled &&
-+        get_field(env->mstatus, MSTATUS_TVM)) {
-+        return RISCV_EXCP_ILLEGAL_INST;
-+    }
-+
-+    return hmode(env, csrno);
-+}
-+
- /* Checks if PointerMasking registers could be accessed */
- static RISCVException pointer_masking(CPURISCVState *env, int csrno)
- {
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
-         *val = 0;
-         return RISCV_EXCP_NONE;
-     }
--
--    if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
--        return RISCV_EXCP_ILLEGAL_INST;
--    } else {
--        *val = env->satp;
--    }
--
-+    *val = env->satp;
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_satp(CPURISCVState *env, int csrno,
-     }
-     if (vm && mask) {
--        if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
--            return RISCV_EXCP_ILLEGAL_INST;
--        } else {
--            /*
--             * The ISA defines SATP.MODE=Bare as "no translation", but we still
--             * pass these through QEMU's TLB emulation as it improves
--             * performance.  Flushing the TLB on SATP writes with paging
--             * enabled avoids leaking those invalid cached mappings.
--             */
--            tlb_flush(env_cpu(env));
--            env->satp = val;
--        }
-+        /*
-+         * The ISA defines SATP.MODE=Bare as "no translation", but we still
-+         * pass these through QEMU's TLB emulation as it improves
-+         * performance.  Flushing the TLB on SATP writes with paging
-+         * enabled avoids leaking those invalid cached mappings.
-+         */
-+        tlb_flush(env_cpu(env));
-+        env->satp = val;
-     }
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-     /* Supervisor Protection and Translation */
--    [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
-+    [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
-     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
-     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-                           .min_priv_ver = PRIV_VERSION_1_12_0                },
-     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
-                           .min_priv_ver = PRIV_VERSION_1_12_0                },
--    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,   write_hgatp,
-+    [CSR_HGATP]       = { "hgatp",       hgatp,   read_hgatp,   write_hgatp,
-                           .min_priv_ver = PRIV_VERSION_1_12_0                },
-     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
-                           write_htimedelta,
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
- void helper_tlb_flush(CPURISCVState *env)
- {
-     CPUState *cs = env_cpu(env);
--    if (!(env->priv >= PRV_S) ||
--        (env->priv == PRV_S &&
--         get_field(env->mstatus, MSTATUS_TVM))) {
-+    if (!env->virt_enabled &&
-+        (env->priv == PRV_U ||
-+         (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)))) {
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
--    } else if (riscv_has_ext(env, RVH) && env->virt_enabled &&
--               get_field(env->hstatus, HSTATUS_VTVM)) {
-+    } else if (env->virt_enabled &&
-+               (env->priv == PRV_U || get_field(env->hstatus, HSTATUS_VTVM))) {
-         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
-     } else {
-         tlb_flush(cs);
-@@ -XXX,XX +XXX,XX @@ void helper_hyp_tlb_flush(CPURISCVState *env)
- {
-     CPUState *cs = env_cpu(env);
--    if (env->priv == PRV_S && env->virt_enabled) {
-+    if (env->virt_enabled) {
-         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
-     }
---
-.40.0

-[PULL 58/89] target/riscv: Extract virt enabled state from tb flags
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Virt enabled state is not a constant, so we should put it into tb flags.
-Thus we can use it like a constant condition at translation phase.
-Reported-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-Id: <20230324143031.1093-2-zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-2-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-2-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h        |  2 ++
- target/riscv/cpu_helper.c |  1 +
- target/riscv/translate.c  | 10 +---------
-files changed, 4 insertions(+), 9 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VTA, 24, 1)
- FIELD(TB_FLAGS, VMA, 25, 1)
- /* Native debug itrigger */
- FIELD(TB_FLAGS, ITRIGGER, 26, 1)
-+/* Virtual mode enabled */
-+FIELD(TB_FLAGS, VIRT_ENABLED, 27, 1)
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-         flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
-                            get_field(env->mstatus_hs, MSTATUS_VS));
-+        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, env->virt_enabled);
-     }
-     if (cpu->cfg.debug && !icount_enabled()) {
-         flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     ctx->mstatus_fs = tb_flags & TB_FLAGS_MSTATUS_FS;
-     ctx->mstatus_vs = tb_flags & TB_FLAGS_MSTATUS_VS;
-     ctx->priv_ver = env->priv_ver;
--#if !defined(CONFIG_USER_ONLY)
--    if (riscv_has_ext(env, RVH)) {
--        ctx->virt_enabled = env->virt_enabled;
--    } else {
--        ctx->virt_enabled = false;
--    }
--#else
--    ctx->virt_enabled = false;
--#endif
-+    ctx->virt_enabled = FIELD_EX32(tb_flags, TB_FLAGS, VIRT_ENABLED);
-     ctx->misa_ext = env->misa_ext;
-     ctx->frm = -1;  /* unknown rounding mode */
-     ctx->cfg_ptr = &(cpu->cfg);
---
-.40.0

-[PULL 59/89] target/riscv: Add a general status enum for extensions
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-The pointer masking is the only extension that directly use status.
-The vector or float extension uses the status in an indirect way.
-Replace the pointer masking extension special status fields with
-the general status.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Message-Id: <20230324143031.1093-3-zhiwei_liu@linux.alibaba.com>
-[rth: Add a typedef for the enum]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-3-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-3-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h      |  8 ++++++++
- target/riscv/cpu_bits.h | 12 ++++--------
- target/riscv/cpu.c      |  2 +-
- target/riscv/csr.c      | 14 +++++++-------
-files changed, 20 insertions(+), 16 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ enum {
-     TRANSLATE_G_STAGE_FAIL
- };
-+/* Extension context status */
-+typedef enum {
-+    EXT_STATUS_DISABLED = 0,
-+    EXT_STATUS_INITIAL,
-+    EXT_STATUS_CLEAN,
-+    EXT_STATUS_DIRTY,
-+} RISCVExtStatus;
-+
- #define MMU_USER_IDX 3
- #define MAX_RISCV_PMPS (16)
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@
-                  (((uint64_t)(val) * ((mask) & ~((mask) << 1))) & \
-                  (uint64_t)(mask)))
-+/* Extension context status mask */
-+#define EXT_STATUS_MASK     0x3ULL
-+
- /* Floating point round mode */
- #define FSR_RD_SHIFT        5
- #define FSR_RD              (0x7 << FSR_RD_SHIFT)
-@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
- #define PM_ENABLE       0x00000001ULL
- #define PM_CURRENT      0x00000002ULL
- #define PM_INSN         0x00000004ULL
--#define PM_XS_MASK      0x00000003ULL
--
--/* PointerMasking XS bits values */
--#define PM_EXT_DISABLE  0x00000000ULL
--#define PM_EXT_INITIAL  0x00000001ULL
--#define PM_EXT_CLEAN    0x00000002ULL
--#define PM_EXT_DIRTY    0x00000003ULL
- /* Execution enviornment configuration bits */
- #define MENVCFG_FIOM                       BIT(0)
-@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
- #define S_OFFSET     5ULL
- #define M_OFFSET     8ULL
--#define PM_XS_BITS   (PM_XS_MASK << XS_OFFSET)
-+#define PM_XS_BITS   (EXT_STATUS_MASK << XS_OFFSET)
- #define U_PM_ENABLE  (PM_ENABLE  << U_OFFSET)
- #define U_PM_CURRENT (PM_CURRENT << U_OFFSET)
- #define U_PM_INSN    (PM_INSN    << U_OFFSET)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
-         i++;
-     }
-     /* mmte is supposed to have pm.current hardwired to 1 */
--    env->mmte |= (PM_EXT_INITIAL | MMTE_M_PM_CURRENT);
-+    env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
- #endif
-     env->xl = riscv_cpu_mxl(env);
-     riscv_cpu_update_mask(env);
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mmte(CPURISCVState *env, int csrno,
-     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
-     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
--    env->mmte = wpri_val | PM_EXT_DIRTY;
-+    env->mmte = wpri_val | EXT_STATUS_DIRTY;
-     riscv_cpu_update_mask(env);
-     /* Set XS and SD bits, since PM CSRs are dirty */
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
-     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
-         env->cur_pmmask = val;
-     }
--    env->mmte |= PM_EXT_DIRTY;
-+    env->mmte |= EXT_STATUS_DIRTY;
-     /* Set XS and SD bits, since PM CSRs are dirty */
-     mstatus = env->mstatus | MSTATUS_XS;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
-     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
-         env->cur_pmmask = val;
-     }
--    env->mmte |= PM_EXT_DIRTY;
-+    env->mmte |= EXT_STATUS_DIRTY;
-     /* Set XS and SD bits, since PM CSRs are dirty */
-     mstatus = env->mstatus | MSTATUS_XS;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
-     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
-         env->cur_pmmask = val;
-     }
--    env->mmte |= PM_EXT_DIRTY;
-+    env->mmte |= EXT_STATUS_DIRTY;
-     /* Set XS and SD bits, since PM CSRs are dirty */
-     mstatus = env->mstatus | MSTATUS_XS;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
-     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
-         env->cur_pmbase = val;
-     }
--    env->mmte |= PM_EXT_DIRTY;
-+    env->mmte |= EXT_STATUS_DIRTY;
-     /* Set XS and SD bits, since PM CSRs are dirty */
-     mstatus = env->mstatus | MSTATUS_XS;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
-     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
-         env->cur_pmbase = val;
-     }
--    env->mmte |= PM_EXT_DIRTY;
-+    env->mmte |= EXT_STATUS_DIRTY;
-     /* Set XS and SD bits, since PM CSRs are dirty */
-     mstatus = env->mstatus | MSTATUS_XS;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
-     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
-         env->cur_pmbase = val;
-     }
--    env->mmte |= PM_EXT_DIRTY;
-+    env->mmte |= EXT_STATUS_DIRTY;
-     /* Set XS and SD bits, since PM CSRs are dirty */
-     mstatus = env->mstatus | MSTATUS_XS;
---
-.40.0

-[PULL 61/89] target/riscv: Remove mstatus_hs_{fs, vs} from tb_flags
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Merge with mstatus_{fs,vs}.  We might perform a redundant
-assignment to one or the other field, but it's a trivial
-and saves 4 bits from TB_FLAGS.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-5-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-5-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h        | 16 +++++++---------
- target/riscv/cpu_helper.c | 33 ++++++++++++++++-----------------
- target/riscv/translate.c  | 32 ++++++++++----------------------
-files changed, 33 insertions(+), 48 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VL_EQ_VLMAX, 13, 1)
- FIELD(TB_FLAGS, VILL, 14, 1)
- /* Is a Hypervisor instruction load/store allowed? */
- FIELD(TB_FLAGS, HLSX, 15, 1)
--FIELD(TB_FLAGS, MSTATUS_HS_FS, 16, 2)
--FIELD(TB_FLAGS, MSTATUS_HS_VS, 18, 2)
- /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
--FIELD(TB_FLAGS, XL, 20, 2)
-+FIELD(TB_FLAGS, XL, 16, 2)
- /* If PointerMasking should be applied */
--FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
--FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
--FIELD(TB_FLAGS, VTA, 24, 1)
--FIELD(TB_FLAGS, VMA, 25, 1)
-+FIELD(TB_FLAGS, PM_MASK_ENABLED, 18, 1)
-+FIELD(TB_FLAGS, PM_BASE_ENABLED, 19, 1)
-+FIELD(TB_FLAGS, VTA, 20, 1)
-+FIELD(TB_FLAGS, VMA, 21, 1)
- /* Native debug itrigger */
--FIELD(TB_FLAGS, ITRIGGER, 26, 1)
-+FIELD(TB_FLAGS, ITRIGGER, 22, 1)
- /* Virtual mode enabled */
--FIELD(TB_FLAGS, VIRT_ENABLED, 27, 1)
-+FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
- {
-     CPUState *cs = env_cpu(env);
-     RISCVCPU *cpu = RISCV_CPU(cs);
--
-+    RISCVExtStatus fs, vs;
-     uint32_t flags = 0;
-     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-     }
- #ifdef CONFIG_USER_ONLY
--    flags = FIELD_DP32(flags, TB_FLAGS, FS, EXT_STATUS_DIRTY);
--    flags = FIELD_DP32(flags, TB_FLAGS, VS, EXT_STATUS_DIRTY);
-+    fs = EXT_STATUS_DIRTY;
-+    vs = EXT_STATUS_DIRTY;
- #else
-     flags |= cpu_mmu_index(env, 0);
--    if (riscv_cpu_fp_enabled(env)) {
--        flags = FIELD_DP32(flags, TB_FLAGS, FS,
--                           get_field(env->mstatus, MSTATUS_FS));
--    }
--    if (riscv_cpu_vector_enabled(env)) {
--        flags = FIELD_DP32(flags, TB_FLAGS, VS,
--                           get_field(env->mstatus, MSTATUS_VS));
--    }
-+    fs = get_field(env->mstatus, MSTATUS_FS);
-+    vs = get_field(env->mstatus, MSTATUS_VS);
-     if (riscv_has_ext(env, RVH)) {
-         if (env->priv == PRV_M ||
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-             flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
-         }
--        flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_FS,
--                           get_field(env->mstatus_hs, MSTATUS_FS));
--
--        flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
--                           get_field(env->mstatus_hs, MSTATUS_VS));
--        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, env->virt_enabled);
-+        if (env->virt_enabled) {
-+            flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
-+            /*
-+             * Merge DISABLED and !DIRTY states using MIN.
-+             * We will set both fields when dirtying.
-+             */
-+            fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
-+            vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
-+        }
-     }
-     if (cpu->cfg.debug && !icount_enabled()) {
-         flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
-     }
- #endif
-+    flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
-+    flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
-     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
-     if (env->cur_pmmask < (env->xl == MXL_RV32 ? UINT32_MAX : UINT64_MAX)) {
-         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     uint32_t opcode;
-     RISCVExtStatus mstatus_fs;
-     RISCVExtStatus mstatus_vs;
--    RISCVExtStatus mstatus_hs_fs;
--    RISCVExtStatus mstatus_hs_vs;
-     uint32_t mem_idx;
-     /*
-      * Remember the rounding mode encoded in the previous fp instruction,
-@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
-         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-         tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
-         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
--    }
--
--    if (ctx->virt_enabled && ctx->mstatus_hs_fs != EXT_STATUS_DIRTY) {
--        /* Remember the stage change for the rest of the TB. */
--        ctx->mstatus_hs_fs = EXT_STATUS_DIRTY;
--        tmp = tcg_temp_new();
--        tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
--        tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
--        tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-+        if (ctx->virt_enabled) {
-+            tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-+            tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
-+            tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-+        }
-     }
- }
- #else
-@@ -XXX,XX +XXX,XX @@ static void mark_vs_dirty(DisasContext *ctx)
-         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-         tcg_gen_ori_tl(tmp, tmp, MSTATUS_VS);
-         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
--    }
--
--    if (ctx->virt_enabled && ctx->mstatus_hs_vs != EXT_STATUS_DIRTY) {
--        /* Remember the stage change for the rest of the TB. */
--        ctx->mstatus_hs_vs = EXT_STATUS_DIRTY;
--        tmp = tcg_temp_new();
--        tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
--        tcg_gen_ori_tl(tmp, tmp, MSTATUS_VS);
--        tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-+        if (ctx->virt_enabled) {
-+            tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-+            tcg_gen_ori_tl(tmp, tmp, MSTATUS_VS);
-+            tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-+        }
-     }
- }
- #else
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     ctx->misa_ext = env->misa_ext;
-     ctx->frm = -1;  /* unknown rounding mode */
-     ctx->cfg_ptr = &(cpu->cfg);
--    ctx->mstatus_hs_fs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_FS);
--    ctx->mstatus_hs_vs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_VS);
-     ctx->hlsx = FIELD_EX32(tb_flags, TB_FLAGS, HLSX);
-     ctx->vill = FIELD_EX32(tb_flags, TB_FLAGS, VILL);
-     ctx->sew = FIELD_EX32(tb_flags, TB_FLAGS, SEW);
---
-.40.0

-[PULL 64/89] target/riscv: Reduce overhead of MSTATUS_SUM change
+Deleted patch
-From: Fei Wu <fei2.wu@intel.com>
-Kernel needs to access user mode memory e.g. during syscalls, the window
-is usually opened up for a very limited time through MSTATUS.SUM, the
-overhead is too much if tlb_flush() gets called for every SUM change.
-This patch creates a separate MMU index for S+SUM, so that it's not
-necessary to flush tlb anymore when SUM changes. This is similar to how
-ARM handles Privileged Access Never (PAN).
-Result of 'pipe 10' from unixbench boosts from 223656 to 1705006. Many
-other syscalls benefit a lot from this too.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Fei Wu <fei2.wu@intel.com>
-Message-Id: <20230324054154.414846-3-fei2.wu@intel.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-8-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-8-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h                      |  2 --
- target/riscv/internals.h                | 14 ++++++++++++++
- target/riscv/cpu_helper.c               | 17 +++++++++++++++--
- target/riscv/csr.c                      |  3 +--
- target/riscv/op_helper.c                |  5 +++--
- target/riscv/insn_trans/trans_rvh.c.inc |  4 ++--
-files changed, 35 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
- target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
- void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
--#define TB_FLAGS_PRIV_HYP_ACCESS_MASK   (1 << 2)
--
- #include "exec/cpu-all.h"
- FIELD(TB_FLAGS, MEM_IDX, 0, 3)
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
-+++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/registerfields.h"
-+/*
-+ * The current MMU Modes are:
-+ *  - U                 0b000
-+ *  - S                 0b001
-+ *  - S+SUM             0b010
-+ *  - M                 0b011
-+ *  - HLV/HLVX/HSV adds 0b100
-+ */
-+#define MMUIdx_U            0
-+#define MMUIdx_S            1
-+#define MMUIdx_S_SUM        2
-+#define MMUIdx_M            3
-+#define MMU_HYP_ACCESS_BIT  (1 << 2)
-+
- /* share data between vector helpers and decode code */
- FIELD(VDATA, VM, 0, 1)
- FIELD(VDATA, LMUL, 1, 3)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- #include "qemu/main-loop.h"
- #include "cpu.h"
-+#include "internals.h"
- #include "pmu.h"
- #include "exec/exec-all.h"
- #include "instmap.h"
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
- #ifdef CONFIG_USER_ONLY
-     return 0;
- #else
--    return env->priv;
-+    if (ifetch) {
-+        return env->priv;
-+    }
-+
-+    /* All priv -> mmu_idx mapping are here */
-+    int mode = env->priv;
-+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
-+        mode = get_field(env->mstatus, MSTATUS_MPP);
-+    }
-+    if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
-+        return MMUIdx_S_SUM;
-+    }
-+    return mode;
- #endif
- }
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
- bool riscv_cpu_two_stage_lookup(int mmu_idx)
- {
--    return mmu_idx & TB_FLAGS_PRIV_HYP_ACCESS_MASK;
-+    return mmu_idx & MMU_HYP_ACCESS_BIT;
- }
- int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
-     /* flush tlb on mstatus fields that affect VM */
--    if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
--            MSTATUS_MPRV | MSTATUS_SUM)) {
-+    if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPV)) {
-         tlb_flush(env_cpu(env));
-     }
-     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "cpu.h"
-+#include "internals.h"
- #include "qemu/main-loop.h"
- #include "exec/exec-all.h"
- #include "exec/helper-proto.h"
-@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
- target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong address)
- {
--    int mmu_idx = cpu_mmu_index(env, true) | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
-+    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
-     return cpu_lduw_mmuidx_ra(env, address, mmu_idx, GETPC());
- }
- target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong address)
- {
--    int mmu_idx = cpu_mmu_index(env, true) | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
-+    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
-     return cpu_ldl_mmuidx_ra(env, address, mmu_idx, GETPC());
- }
-diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/insn_trans/trans_rvh.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvh.c.inc
-+++ b/target/riscv/insn_trans/trans_rvh.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool do_hlv(DisasContext *ctx, arg_r2 *a, MemOp mop)
-     if (check_access(ctx)) {
-         TCGv dest = dest_gpr(ctx, a->rd);
-         TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
--        int mem_idx = ctx->mem_idx | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
-+        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
-         tcg_gen_qemu_ld_tl(dest, addr, mem_idx, mop);
-         gen_set_gpr(ctx, a->rd, dest);
-     }
-@@ -XXX,XX +XXX,XX @@ static bool do_hsv(DisasContext *ctx, arg_r2_s *a, MemOp mop)
-     if (check_access(ctx)) {
-         TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-         TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
--        int mem_idx = ctx->mem_idx | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
-+        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
-         tcg_gen_qemu_st_tl(data, addr, mem_idx, mop);
-     }
-     return true;
---
-.40.0

-[PULL 67/89] target/riscv: Rename MMU_HYP_ACCESS_BIT to MMU_2STAGE_BIT
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-We will enable more uses of this bit in the future.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-12-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-12-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/internals.h  | 6 ++++--
- target/riscv/cpu_helper.c | 2 +-
- target/riscv/op_helper.c  | 2 +-
-files changed, 6 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
-+++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@
-  *  - S                 0b001
-  *  - S+SUM             0b010
-  *  - M                 0b011
-- *  - HLV/HLVX/HSV adds 0b100
-+ *  - U+2STAGE          0b100
-+ *  - S+2STAGE          0b101
-+ *  - S+SUM+2STAGE      0b110
-  */
- #define MMUIdx_U            0
- #define MMUIdx_S            1
- #define MMUIdx_S_SUM        2
- #define MMUIdx_M            3
--#define MMU_HYP_ACCESS_BIT  (1 << 2)
-+#define MMU_2STAGE_BIT      (1 << 2)
- /* share data between vector helpers and decode code */
- FIELD(VDATA, VM, 0, 1)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
- bool riscv_cpu_two_stage_lookup(int mmu_idx)
- {
--    return mmu_idx & MMU_HYP_ACCESS_BIT;
-+    return mmu_idx & MMU_2STAGE_BIT;
- }
- int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
-     }
--    return cpu_mmu_index(env, x) | MMU_HYP_ACCESS_BIT;
-+    return cpu_mmu_index(env, x) | MMU_2STAGE_BIT;
- }
- target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
---
-.40.0

-[PULL 68/89] target/riscv: Introduce mmuidx_sum
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-In get_physical_address, we should use the setting passed
-via mmu_idx rather than checking env->mstatus directly.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-13-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-13-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/internals.h  | 5 +++++
- target/riscv/cpu_helper.c | 2 +-
-files changed, 6 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
-+++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@
- #define MMUIdx_M            3
- #define MMU_2STAGE_BIT      (1 << 2)
-+static inline bool mmuidx_sum(int mmu_idx)
-+{
-+    return (mmu_idx & 3) == MMUIdx_S_SUM;
-+}
-+
- /* share data between vector helpers and decode code */
- FIELD(VDATA, VM, 0, 1)
- FIELD(VDATA, LMUL, 1, 3)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         widened = 2;
-     }
-     /* status.SUM will be ignored if execute on background */
--    sum = get_field(env->mstatus, MSTATUS_SUM) || use_background || is_debug;
-+    sum = mmuidx_sum(mmu_idx) || use_background || is_debug;
-     switch (vm) {
-     case VM_1_10_SV32:
-       levels = 2; ptidxbits = 10; ptesize = 4; break;
---
-.40.0

-[PULL 69/89] target/riscv: Introduce mmuidx_priv
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Use the priv level encoded into the mmu_idx, rather than
-starting from env->priv.  We have already checked MPRV+MPP
-in riscv_cpu_mmu_index -- no need to repeat that.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-14-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-14-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/internals.h  | 9 +++++++++
- target/riscv/cpu_helper.c | 6 +-----
-files changed, 10 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
-+++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@
- #define MMUIdx_M            3
- #define MMU_2STAGE_BIT      (1 << 2)
-+static inline int mmuidx_priv(int mmu_idx)
-+{
-+    int ret = mmu_idx & 3;
-+    if (ret == MMUIdx_S_SUM) {
-+        ret = PRV_S;
-+    }
-+    return ret;
-+}
-+
- static inline bool mmuidx_sum(int mmu_idx)
- {
-     return (mmu_idx & 3) == MMUIdx_S_SUM;
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-      */
-     MemTxResult res;
-     MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
--    int mode = env->priv;
-+    int mode = mmuidx_priv(mmu_idx);
-     bool use_background = false;
-     hwaddr ppn;
-     int napot_bits = 0;
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-      */
-     if (riscv_cpu_two_stage_lookup(mmu_idx)) {
-         mode = get_field(env->hstatus, HSTATUS_SPVP);
--    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
--        if (get_field(env->mstatus, MSTATUS_MPRV)) {
--            mode = get_field(env->mstatus, MSTATUS_MPP);
--        }
-     }
-     if (first_stage == false) {
---
-.40.0

-[PULL 70/89] target/riscv: Introduce mmuidx_2stage
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Move and rename riscv_cpu_two_stage_lookup, to match
-the other mmuidx_* functions.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-15-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-15-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h        |  1 -
- target/riscv/internals.h  |  5 +++++
- target/riscv/cpu_helper.c | 20 ++++++--------------
-files changed, 11 insertions(+), 15 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
- void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
- bool riscv_cpu_vector_enabled(CPURISCVState *env);
- void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
--bool riscv_cpu_two_stage_lookup(int mmu_idx);
- int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
- G_NORETURN void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-                                                MMUAccessType access_type,
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
-+++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline bool mmuidx_sum(int mmu_idx)
-     return (mmu_idx & 3) == MMUIdx_S_SUM;
- }
-+static inline bool mmuidx_2stage(int mmu_idx)
-+{
-+    return mmu_idx & MMU_2STAGE_BIT;
-+}
-+
- /* share data between vector helpers and decode code */
- FIELD(VDATA, VM, 0, 1)
- FIELD(VDATA, LMUL, 1, 3)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
-     }
- }
--bool riscv_cpu_two_stage_lookup(int mmu_idx)
--{
--    return mmu_idx & MMU_2STAGE_BIT;
--}
--
- int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
- {
-     CPURISCVState *env = &cpu->env;
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-      * MPRV does not affect the virtual-machine load/store
-      * instructions, HLV, HLVX, and HSV.
-      */
--    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
-+    if (mmuidx_2stage(mmu_idx)) {
-         mode = get_field(env->hstatus, HSTATUS_SPVP);
-     }
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
-     }
-     env->badaddr = addr;
--    env->two_stage_lookup = env->virt_enabled ||
--                            riscv_cpu_two_stage_lookup(mmu_idx);
-+    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
-     env->two_stage_indirect_lookup = false;
-     cpu_loop_exit_restore(cs, retaddr);
- }
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-         g_assert_not_reached();
-     }
-     env->badaddr = addr;
--    env->two_stage_lookup = env->virt_enabled ||
--                            riscv_cpu_two_stage_lookup(mmu_idx);
-+    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
-     env->two_stage_indirect_lookup = false;
-     cpu_loop_exit_restore(cs, retaddr);
- }
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-      * MPRV does not affect the virtual-machine load/store
-      * instructions, HLV, HLVX, and HSV.
-      */
--    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
-+    if (mmuidx_2stage(mmu_idx)) {
-         mode = get_field(env->hstatus, HSTATUS_SPVP);
-     } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
-                get_field(env->mstatus, MSTATUS_MPRV)) {
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     pmu_tlb_fill_incr_ctr(cpu, access_type);
-     if (env->virt_enabled ||
--        ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
-+        ((mmuidx_2stage(mmu_idx) || two_stage_lookup) &&
-          access_type != MMU_INST_FETCH)) {
-         /* Two stage lookup */
-         ret = get_physical_address(env, &pa, &prot, address,
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     } else {
-         raise_mmu_exception(env, address, access_type, pmp_violation,
-                             first_stage_error,
--                            env->virt_enabled ||
--                                riscv_cpu_two_stage_lookup(mmu_idx),
-+                            env->virt_enabled || mmuidx_2stage(mmu_idx),
-                             two_stage_indirect_error);
-         cpu_loop_exit_restore(cs, retaddr);
-     }
---
-.40.0

-[PULL 71/89] target/riscv: Move hstatus.spvp check to check_access_hlsv
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The current cpu_mmu_index value is really irrelevant to
-the HLV/HSV lookup.  Provide the correct priv level directly.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-16-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-16-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 10 +---------
- target/riscv/op_helper.c  |  2 +-
-files changed, 2 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         use_background = true;
-     }
--    /*
--     * MPRV does not affect the virtual-machine load/store
--     * instructions, HLV, HLVX, and HSV.
--     */
--    if (mmuidx_2stage(mmu_idx)) {
--        mode = get_field(env->hstatus, HSTATUS_SPVP);
--    }
--
-     if (first_stage == false) {
-         /*
-          * We are in stage 2 translation, this is similar to stage 1.
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-      * instructions, HLV, HLVX, and HSV.
-      */
-     if (mmuidx_2stage(mmu_idx)) {
--        mode = get_field(env->hstatus, HSTATUS_SPVP);
-+        ;
-     } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
-                get_field(env->mstatus, MSTATUS_MPRV)) {
-         mode = get_field(env->mstatus, MSTATUS_MPP);
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
-     }
--    return cpu_mmu_index(env, x) | MMU_2STAGE_BIT;
-+    return get_field(env->hstatus, HSTATUS_SPVP) | MMU_2STAGE_BIT;
- }
- target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
---
-.40.0

-[PULL 72/89] target/riscv: Set MMU_2STAGE_BIT in riscv_cpu_mmu_index
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Incorporate the virt_enabled and MPV checks into the cpu_mmu_index
-function, so we don't have to keep doing it within tlb_fill and
-subroutines.  This also elides a flush on changes to MPV.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-17-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-17-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 49 ++++++++++++++-------------------------
- target/riscv/csr.c        |  6 +----
-files changed, 18 insertions(+), 37 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
- #ifdef CONFIG_USER_ONLY
-     return 0;
- #else
--    if (ifetch) {
--        return env->priv;
--    }
-+    bool virt = env->virt_enabled;
-+    int mode = env->priv;
-     /* All priv -> mmu_idx mapping are here */
--    int mode = env->priv;
--    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
--        mode = get_field(env->mstatus, MSTATUS_MPP);
--    }
--    if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
--        return MMUIdx_S_SUM;
-+    if (!ifetch) {
-+        if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
-+            mode = get_field(env->mstatus, MSTATUS_MPP);
-+            virt = get_field(env->mstatus, MSTATUS_MPV);
-+        }
-+        if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
-+            mode = MMUIdx_S_SUM;
-+        }
-     }
--    return mode;
-+
-+    return mode | (virt ? MMU_2STAGE_BIT : 0);
- #endif
- }
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
-     }
-     env->badaddr = addr;
--    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
-+    env->two_stage_lookup = mmuidx_2stage(mmu_idx);
-     env->two_stage_indirect_lookup = false;
-     cpu_loop_exit_restore(cs, retaddr);
- }
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-         g_assert_not_reached();
-     }
-     env->badaddr = addr;
--    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
-+    env->two_stage_lookup = mmuidx_2stage(mmu_idx);
-     env->two_stage_indirect_lookup = false;
-     cpu_loop_exit_restore(cs, retaddr);
- }
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     int prot, prot2, prot_pmp;
-     bool pmp_violation = false;
-     bool first_stage_error = true;
--    bool two_stage_lookup = false;
-+    bool two_stage_lookup = mmuidx_2stage(mmu_idx);
-     bool two_stage_indirect_error = false;
-     int ret = TRANSLATE_FAIL;
-     int mode = mmu_idx;
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
-                   __func__, address, access_type, mmu_idx);
--    /*
--     * MPRV does not affect the virtual-machine load/store
--     * instructions, HLV, HLVX, and HSV.
--     */
--    if (mmuidx_2stage(mmu_idx)) {
--        ;
--    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
--               get_field(env->mstatus, MSTATUS_MPRV)) {
--        mode = get_field(env->mstatus, MSTATUS_MPP);
--        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
--            two_stage_lookup = true;
--        }
--    }
--
-     pmu_tlb_fill_incr_ctr(cpu, access_type);
--    if (env->virt_enabled ||
--        ((mmuidx_2stage(mmu_idx) || two_stage_lookup) &&
--         access_type != MMU_INST_FETCH)) {
-+    if (two_stage_lookup) {
-         /* Two stage lookup */
-         ret = get_physical_address(env, &pa, &prot, address,
-                                    &env->guest_phys_fault_addr, access_type,
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-         return false;
-     } else {
-         raise_mmu_exception(env, address, access_type, pmp_violation,
--                            first_stage_error,
--                            env->virt_enabled || mmuidx_2stage(mmu_idx),
-+                            first_stage_error, two_stage_lookup,
-                             two_stage_indirect_error);
-         cpu_loop_exit_restore(cs, retaddr);
-     }
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
-     /* flush tlb on mstatus fields that affect VM */
--    if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPV)) {
-+    if ((val ^ mstatus) & MSTATUS_MXR) {
-         tlb_flush(env_cpu(env));
-     }
-     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
-     uint64_t valh = (uint64_t)val << 32;
-     uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
--    if ((valh ^ env->mstatus) & (MSTATUS_MPV)) {
--        tlb_flush(env_cpu(env));
--    }
--
-     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
-     return RISCV_EXCP_NONE;
---
-.40.0

-[PULL 73/89] target/riscv: Check SUM in the correct register
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Table 9.5 "Effect of MPRV..." specifies that MPV=1 uses VS-level
-vsstatus.SUM instead of HS-level sstatus.SUM.
-For HLV/HSV instructions, the HS-level register does not apply, but
-the VS-level register presumably does, though this is not mentioned
-explicitly in the manual.  However, it matches the behavior for MPV.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-18-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-18-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 12 ++++++++----
- target/riscv/op_helper.c  |  6 +++++-
-files changed, 13 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
-     /* All priv -> mmu_idx mapping are here */
-     if (!ifetch) {
--        if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
-+        uint64_t status = env->mstatus;
-+
-+        if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
-             mode = get_field(env->mstatus, MSTATUS_MPP);
-             virt = get_field(env->mstatus, MSTATUS_MPV);
-+            if (virt) {
-+                status = env->vsstatus;
-+            }
-         }
--        if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
-+        if (mode == PRV_S && get_field(status, MSTATUS_SUM)) {
-             mode = MMUIdx_S_SUM;
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         }
-         widened = 2;
-     }
--    /* status.SUM will be ignored if execute on background */
--    sum = mmuidx_sum(mmu_idx) || use_background || is_debug;
-+    sum = mmuidx_sum(mmu_idx) || is_debug;
-     switch (vm) {
-     case VM_1_10_SV32:
-       levels = 2; ptidxbits = 10; ptesize = 4; break;
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
-     }
--    return get_field(env->hstatus, HSTATUS_SPVP) | MMU_2STAGE_BIT;
-+    int mode = get_field(env->hstatus, HSTATUS_SPVP);
-+    if (!x && mode == PRV_S && get_field(env->vsstatus, MSTATUS_SUM)) {
-+        mode = MMUIdx_S_SUM;
-+    }
-+    return mode | MMU_2STAGE_BIT;
- }
- target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
---
-.40.0

-[PULL 74/89] target/riscv: Hoist second stage mode change to callers
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Move the check from the top of get_physical_address to
-the two callers, where passing mmu_idx makes no sense.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-19-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-19-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 12 ++----------
-file changed, 2 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         use_background = true;
-     }
--    if (first_stage == false) {
--        /*
--         * We are in stage 2 translation, this is similar to stage 1.
--         * Stage 2 is always taken as U-mode
--         */
--        mode = PRV_U;
--    }
--
-     if (mode == PRV_M || !riscv_cpu_cfg(env)->mmu) {
-         *physical = addr;
-         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
-@@ -XXX,XX +XXX,XX @@ restart:
-             /* Do the second stage translation on the base PTE address. */
-             int vbase_ret = get_physical_address(env, &vbase, &vbase_prot,
-                                                  base, NULL, MMU_DATA_LOAD,
--                                                 mmu_idx, false, true,
-+                                                 MMUIdx_U, false, true,
-                                                  is_debug);
-             if (vbase_ret != TRANSLATE_SUCCESS) {
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-             im_address = pa;
-             ret = get_physical_address(env, &pa, &prot2, im_address, NULL,
--                                       access_type, mmu_idx, false, true,
-+                                       access_type, MMUIdx_U, false, true,
-                                        false);
-             qemu_log_mask(CPU_LOG_MMU,
---
-.40.0

-[PULL 75/89] target/riscv: Hoist pbmte and hade out of the level loop
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-These values are constant for every level of pte lookup.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-20-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-20-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 16 ++++++++--------
-file changed, 8 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         return TRANSLATE_FAIL;
-     }
-+    bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-+    bool hade = env->menvcfg & MENVCFG_HADE;
-+
-+    if (first_stage && two_stage && env->virt_enabled) {
-+        pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-+        hade = hade && (env->henvcfg & HENVCFG_HADE);
-+    }
-+
-     int ptshift = (levels - 1) * ptidxbits;
-     int i;
-@@ -XXX,XX +XXX,XX @@ restart:
-             return TRANSLATE_FAIL;
-         }
--        bool pbmte = env->menvcfg & MENVCFG_PBMTE;
--        bool hade = env->menvcfg & MENVCFG_HADE;
--
--        if (first_stage && two_stage && env->virt_enabled) {
--            pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
--            hade = hade && (env->henvcfg & HENVCFG_HADE);
--        }
--
-         if (riscv_cpu_sxl(env) == MXL_RV32) {
-             ppn = pte >> PTE_PPN_SHIFT;
-         } else if (pbmte || riscv_cpu_cfg(env)->ext_svnapot) {
---
-.40.0

-[PULL 76/89] target/riscv: Move leaf pte processing out of level loop
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Move the code that never loops outside of the loop.
-Unchain the if-return-else statements.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-21-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-21-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 234 ++++++++++++++++++++------------------
-file changed, 123 insertions(+), 111 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-     }
-     int ptshift = (levels - 1) * ptidxbits;
-+    target_ulong pte;
-+    hwaddr pte_addr;
-     int i;
- #if !TCG_OVERSIZED_GUEST
-@@ -XXX,XX +XXX,XX @@ restart:
-         }
-         /* check that physical address of PTE is legal */
--        hwaddr pte_addr;
-         if (two_stage && first_stage) {
-             int vbase_prot;
-@@ -XXX,XX +XXX,XX @@ restart:
-             return TRANSLATE_PMP_FAIL;
-         }
--        target_ulong pte;
-         if (riscv_cpu_mxl(env) == MXL_RV32) {
-             pte = address_space_ldl(cs->as, pte_addr, attrs, &res);
-         } else {
-@@ -XXX,XX +XXX,XX @@ restart:
-         if (!(pte & PTE_V)) {
-             /* Invalid PTE */
-             return TRANSLATE_FAIL;
--        } else if (!pbmte && (pte & PTE_PBMT)) {
--            return TRANSLATE_FAIL;
--        } else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
--            /* Inner PTE, continue walking */
--            if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
--                return TRANSLATE_FAIL;
--            }
--            base = ppn << PGSHIFT;
--        } else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
--            /* Reserved leaf PTE flags: PTE_W */
--            return TRANSLATE_FAIL;
--        } else if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
--            /* Reserved leaf PTE flags: PTE_W + PTE_X */
--            return TRANSLATE_FAIL;
--        } else if ((pte & PTE_U) && ((mode != PRV_U) &&
--                   (!sum || access_type == MMU_INST_FETCH))) {
--            /* User PTE flags when not U mode and mstatus.SUM is not set,
--               or the access type is an instruction fetch */
--            return TRANSLATE_FAIL;
--        } else if (!(pte & PTE_U) && (mode != PRV_S)) {
--            /* Supervisor PTE flags when not S mode */
--            return TRANSLATE_FAIL;
--        } else if (ppn & ((1ULL << ptshift) - 1)) {
--            /* Misaligned PPN */
--            return TRANSLATE_FAIL;
--        } else if (access_type == MMU_DATA_LOAD && !((pte & PTE_R) ||
--                   ((pte & PTE_X) && mxr))) {
--            /* Read access check failed */
--            return TRANSLATE_FAIL;
--        } else if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
--            /* Write access check failed */
--            return TRANSLATE_FAIL;
--        } else if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
--            /* Fetch access check failed */
-+        }
-+        if (pte & (PTE_R | PTE_W | PTE_X)) {
-+            goto leaf;
-+        }
-+
-+        /* Inner PTE, continue walking */
-+        if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
-             return TRANSLATE_FAIL;
--        } else {
--            /* if necessary, set accessed and dirty bits. */
--            target_ulong updated_pte = pte | PTE_A |
-+        }
-+        base = ppn << PGSHIFT;
-+    }
-+
-+    /* No leaf pte at any translation level. */
-+    return TRANSLATE_FAIL;
-+
-+ leaf:
-+    if (ppn & ((1ULL << ptshift) - 1)) {
-+        /* Misaligned PPN */
-+        return TRANSLATE_FAIL;
-+    }
-+    if (!pbmte && (pte & PTE_PBMT)) {
-+        /* Reserved without Svpbmt. */
-+        return TRANSLATE_FAIL;
-+    }
-+    if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
-+        /* Reserved leaf PTE flags: PTE_W */
-+        return TRANSLATE_FAIL;
-+    }
-+    if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
-+        /* Reserved leaf PTE flags: PTE_W + PTE_X */
-+        return TRANSLATE_FAIL;
-+    }
-+    if ((pte & PTE_U) &&
-+        ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
-+        /*
-+         * User PTE flags when not U mode and mstatus.SUM is not set,
-+         * or the access type is an instruction fetch.
-+         */
-+        return TRANSLATE_FAIL;
-+    }
-+    if (!(pte & PTE_U) && (mode != PRV_S)) {
-+        /* Supervisor PTE flags when not S mode */
-+        return TRANSLATE_FAIL;
-+    }
-+    if (access_type == MMU_DATA_LOAD &&
-+        !((pte & PTE_R) || ((pte & PTE_X) && mxr))) {
-+        /* Read access check failed */
-+        return TRANSLATE_FAIL;
-+    }
-+    if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
-+        /* Write access check failed */
-+        return TRANSLATE_FAIL;
-+    }
-+    if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
-+        /* Fetch access check failed */
-+        return TRANSLATE_FAIL;
-+    }
-+
-+    /* If necessary, set accessed and dirty bits. */
-+    target_ulong updated_pte = pte | PTE_A |
-                 (access_type == MMU_DATA_STORE ? PTE_D : 0);
--            /* Page table updates need to be atomic with MTTCG enabled */
--            if (updated_pte != pte) {
--                if (!hade) {
--                    return TRANSLATE_FAIL;
--                }
-+    /* Page table updates need to be atomic with MTTCG enabled */
-+    if (updated_pte != pte) {
-+        if (!hade) {
-+            return TRANSLATE_FAIL;
-+        }
--                /*
--                 * - if accessed or dirty bits need updating, and the PTE is
--                 *   in RAM, then we do so atomically with a compare and swap.
--                 * - if the PTE is in IO space or ROM, then it can't be updated
--                 *   and we return TRANSLATE_FAIL.
--                 * - if the PTE changed by the time we went to update it, then
--                 *   it is no longer valid and we must re-walk the page table.
--                 */
--                MemoryRegion *mr;
--                hwaddr l = sizeof(target_ulong), addr1;
--                mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
--                                             false, MEMTXATTRS_UNSPECIFIED);
--                if (memory_region_is_ram(mr)) {
--                    target_ulong *pte_pa =
--                        qemu_map_ram_ptr(mr->ram_block, addr1);
-+        /*
-+         * - if accessed or dirty bits need updating, and the PTE is
-+         *   in RAM, then we do so atomically with a compare and swap.
-+         * - if the PTE is in IO space or ROM, then it can't be updated
-+         *   and we return TRANSLATE_FAIL.
-+         * - if the PTE changed by the time we went to update it, then
-+         *   it is no longer valid and we must re-walk the page table.
-+         */
-+        MemoryRegion *mr;
-+        hwaddr l = sizeof(target_ulong), addr1;
-+        mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
-+                                     false, MEMTXATTRS_UNSPECIFIED);
-+        if (memory_region_is_ram(mr)) {
-+            target_ulong *pte_pa = qemu_map_ram_ptr(mr->ram_block, addr1);
- #if TCG_OVERSIZED_GUEST
--                    /*
--                     * MTTCG is not enabled on oversized TCG guests so
--                     * page table updates do not need to be atomic
--                     */
--                    *pte_pa = pte = updated_pte;
-+            /*
-+             * MTTCG is not enabled on oversized TCG guests so
-+             * page table updates do not need to be atomic
-+             */
-+            *pte_pa = pte = updated_pte;
- #else
--                    target_ulong old_pte =
--                        qatomic_cmpxchg(pte_pa, pte, updated_pte);
--                    if (old_pte != pte) {
--                        goto restart;
--                    } else {
--                        pte = updated_pte;
--                    }
--#endif
--                } else {
--                    /*
--                     * misconfigured PTE in ROM (AD bits are not preset) or
--                     * PTE is in IO space and can't be updated atomically
--                     */
--                    return TRANSLATE_FAIL;
--                }
-+            target_ulong old_pte = qatomic_cmpxchg(pte_pa, pte, updated_pte);
-+            if (old_pte != pte) {
-+                goto restart;
-             }
--
-+            pte = updated_pte;
-+#endif
-+        } else {
-             /*
--             * for superpage mappings, make a fake leaf PTE for the TLB's
--             * benefit.
-+             * Misconfigured PTE in ROM (AD bits are not preset) or
-+             * PTE is in IO space and can't be updated atomically.
-              */
--            target_ulong vpn = addr >> PGSHIFT;
--
--            if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
--                napot_bits = ctzl(ppn) + 1;
--                if ((i != (levels - 1)) || (napot_bits != 4)) {
--                    return TRANSLATE_FAIL;
--                }
--            }
-+            return TRANSLATE_FAIL;
-+        }
-+    }
--            napot_mask = (1 << napot_bits) - 1;
--            *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
--                          (vpn & (((target_ulong)1 << ptshift) - 1))
--                         ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
-+    /* For superpage mappings, make a fake leaf PTE for the TLB's benefit. */
-+    target_ulong vpn = addr >> PGSHIFT;
--            /* set permissions on the TLB entry */
--            if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
--                *prot |= PAGE_READ;
--            }
--            if (pte & PTE_X) {
--                *prot |= PAGE_EXEC;
--            }
--            /*
--             * add write permission on stores or if the page is already dirty,
--             * so that we TLB miss on later writes to update the dirty bit
--             */
--            if ((pte & PTE_W) &&
--                (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
--                *prot |= PAGE_WRITE;
--            }
--            return TRANSLATE_SUCCESS;
-+    if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
-+        napot_bits = ctzl(ppn) + 1;
-+        if ((i != (levels - 1)) || (napot_bits != 4)) {
-+            return TRANSLATE_FAIL;
-         }
-     }
--    return TRANSLATE_FAIL;
-+
-+    napot_mask = (1 << napot_bits) - 1;
-+    *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
-+                  (vpn & (((target_ulong)1 << ptshift) - 1))
-+                 ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
-+
-+    /* set permissions on the TLB entry */
-+    if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
-+        *prot |= PAGE_READ;
-+    }
-+    if (pte & PTE_X) {
-+        *prot |= PAGE_EXEC;
-+    }
-+    /*
-+     * Add write permission on stores or if the page is already dirty,
-+     * so that we TLB miss on later writes to update the dirty bit.
-+     */
-+    if ((pte & PTE_W) && (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
-+        *prot |= PAGE_WRITE;
-+    }
-+    return TRANSLATE_SUCCESS;
- }
- static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
---
-.40.0

-[PULL 77/89] target/riscv: Suppress pte update with is_debug
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The debugger should not modify PTE_A or PTE_D.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-22-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-22-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ restart:
-                 (access_type == MMU_DATA_STORE ? PTE_D : 0);
-     /* Page table updates need to be atomic with MTTCG enabled */
--    if (updated_pte != pte) {
-+    if (updated_pte != pte && !is_debug) {
-         if (!hade) {
-             return TRANSLATE_FAIL;
-         }
---
-.40.0

-[PULL 78/89] target/riscv: Don't modify SUM with is_debug
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-If we want to give the debugger a greater view of memory than
-the cpu, we should simply disable the access check entirely,
-not simply for this one corner case.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-23-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-23-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         }
-         widened = 2;
-     }
--    sum = mmuidx_sum(mmu_idx) || is_debug;
-+    sum = mmuidx_sum(mmu_idx);
-     switch (vm) {
-     case VM_1_10_SV32:
-       levels = 2; ptidxbits = 10; ptesize = 4; break;
---
-.40.0

-[PULL 81/89] target/riscv: Reorg sum check in get_physical_address
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Implement this by adjusting prot, which reduces the set of
-checks required.  This prevents exec to be set for U pages
-in MMUIdx_S_SUM.  While it had been technically incorrect,
-it did not manifest as a bug, because we will never attempt
-to execute from MMUIdx_S_SUM.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230325105429.1142530-26-richard.henderson@linaro.org>
-Message-Id: <20230412114333.118895-26-richard.henderson@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 22 +++++++++++-----------
-file changed, 11 insertions(+), 11 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-     *ret_prot = 0;
-     hwaddr base;
--    int levels, ptidxbits, ptesize, vm, sum, widened;
-+    int levels, ptidxbits, ptesize, vm, widened;
-     if (first_stage == true) {
-         if (use_background) {
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         }
-         widened = 2;
-     }
--    sum = mmuidx_sum(mmu_idx);
-+
-     switch (vm) {
-     case VM_1_10_SV32:
-       levels = 2; ptidxbits = 10; ptesize = 4; break;
-@@ -XXX,XX +XXX,XX @@ restart:
-         prot |= PAGE_EXEC;
-     }
--    if ((pte & PTE_U) &&
--        ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
--        /*
--         * User PTE flags when not U mode and mstatus.SUM is not set,
--         * or the access type is an instruction fetch.
--         */
--        return TRANSLATE_FAIL;
--    }
--    if (!(pte & PTE_U) && (mode != PRV_S)) {
-+    if (pte & PTE_U) {
-+        if (mode != PRV_U) {
-+            if (!mmuidx_sum(mmu_idx)) {
-+                return TRANSLATE_FAIL;
-+            }
-+            /* SUM allows only read+write, not execute. */
-+            prot &= PAGE_READ | PAGE_WRITE;
-+        }
-+    } else if (mode != PRV_S) {
-         /* Supervisor PTE flags when not S mode */
-         return TRANSLATE_FAIL;
-     }
---
-.40.0

-[PULL 83/89] target/riscv: add CPU QOM header
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-QMP CPU commands are usually implemented by a separated file,
-<arch>-qmp-cmds.c, to allow them to be build only for softmmu targets.
-This file uses a CPU QOM header with basic QOM declarations for the
-arch.
-We'll introduce query-cpu-definitions for RISC-V CPUs in the next patch,
-but first we need a cpu-qom.h header with the definitions of
-TYPE_RISCV_CPU and RISCVCPUClass declarations. These were moved from
-cpu.h to the new file, and cpu.h now includes "cpu-qom.h".
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230411183511.189632-2-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu-qom.h | 70 ++++++++++++++++++++++++++++++++++++++++++
- target/riscv/cpu.h     | 46 +--------------------------
-files changed, 71 insertions(+), 45 deletions(-)
- create mode 100644 target/riscv/cpu-qom.h
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/target/riscv/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU RISC-V CPU QOM header
-+ *
-+ * Copyright (c) 2023 Ventana Micro Systems Inc.
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2 or later, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#ifndef RISCV_CPU_QOM_H
-+#define RISCV_CPU_QOM_H
-+
-+#include "hw/core/cpu.h"
-+#include "qom/object.h"
-+
-+#define TYPE_RISCV_CPU "riscv-cpu"
-+
-+#define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
-+#define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
-+#define CPU_RESOLVING_TYPE TYPE_RISCV_CPU
-+
-+#define TYPE_RISCV_CPU_ANY              RISCV_CPU_TYPE_NAME("any")
-+#define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
-+#define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
-+#define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
-+#define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
-+#define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
-+#define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
-+#define TYPE_RISCV_CPU_SIFIVE_E34       RISCV_CPU_TYPE_NAME("sifive-e34")
-+#define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
-+#define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
-+#define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
-+#define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
-+#define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
-+
-+#if defined(TARGET_RISCV32)
-+# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE32
-+#elif defined(TARGET_RISCV64)
-+# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE64
-+#endif
-+
-+typedef struct CPUArchState CPURISCVState;
-+
-+OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
-+
-+/**
-+ * RISCVCPUClass:
-+ * @parent_realize: The parent class' realize handler.
-+ * @parent_phases: The parent class' reset phase handlers.
-+ *
-+ * A RISCV CPU model.
-+ */
-+struct RISCVCPUClass {
-+    /*< private >*/
-+    CPUClass parent_class;
-+    /*< public >*/
-+    DeviceRealize parent_realize;
-+    ResettablePhases parent_phases;
-+};
-+
-+#endif /* RISCV_CPU_QOM_H */
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/int128.h"
- #include "cpu_bits.h"
- #include "qapi/qapi-types-common.h"
-+#include "cpu-qom.h"
- #define TCG_GUEST_DEFAULT_MO 0
-@@ -XXX,XX +XXX,XX @@
-  */
- #define TARGET_INSN_START_EXTRA_WORDS 1
--#define TYPE_RISCV_CPU "riscv-cpu"
--
--#define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
--#define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
--#define CPU_RESOLVING_TYPE TYPE_RISCV_CPU
--
--#define TYPE_RISCV_CPU_ANY              RISCV_CPU_TYPE_NAME("any")
--#define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
--#define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
--#define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
--#define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
--#define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
--#define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
--#define TYPE_RISCV_CPU_SIFIVE_E34       RISCV_CPU_TYPE_NAME("sifive-e34")
--#define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
--#define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
--#define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
--#define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
--#define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
--
--#if defined(TARGET_RISCV32)
--# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE32
--#elif defined(TARGET_RISCV64)
--# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE64
--#endif
--
- #define RV(x) ((target_ulong)1 << (x - 'A'))
- /* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define MAX_RISCV_PMPS (16)
--typedef struct CPUArchState CPURISCVState;
--
- #if !defined(CONFIG_USER_ONLY)
- #include "pmp.h"
- #include "debug.h"
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-     uint64_t kvm_timer_frequency;
- };
--OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
--
--/*
-- * RISCVCPUClass:
-- * @parent_realize: The parent class' realize handler.
-- * @parent_phases: The parent class' reset phase handlers.
-- *
-- * A RISCV CPU model.
-- */
--struct RISCVCPUClass {
--    /* < private > */
--    CPUClass parent_class;
--    /* < public > */
--    DeviceRealize parent_realize;
--    ResettablePhases parent_phases;
--};
--
- /*
-  * map is a 16-bit bitmap: the most significant set bit in map is the maximum
-  * satp mode that is supported. It may be chosen by the user and must respect
---
-.40.0

-[PULL 84/89] target/riscv: add query-cpy-definitions support
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This command is used by tooling like libvirt to retrieve a list of
-supported CPUs. Each entry returns a CpuDefinitionInfo object that
-contains more information about each CPU.
-This initial support includes only the name of the CPU and its typename.
-Here's what the command produces for the riscv64 target:
-$ ./build/qemu-system-riscv64 -S -M virt -display none -qmp stdio
-{"QMP": {"version": (...)}
-{"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
-{"return": {}}
-{"execute": "query-cpu-definitions"}
-{"return": [
-{"name": "rv64", "typename": "rv64-riscv-cpu", "static": false, "deprecated": false},
-{"name": "sifive-e51", "typename": "sifive-e51-riscv-cpu", "static": false, "deprecated": false},
-{"name": "any", "typename": "any-riscv-cpu", "static": false, "deprecated": false},
-{"name": "x-rv128", "typename": "x-rv128-riscv-cpu", "static": false, "deprecated": false},
-{"name": "shakti-c", "typename": "shakti-c-riscv-cpu", "static": false, "deprecated": false},
-{"name": "thead-c906", "typename": "thead-c906-riscv-cpu", "static": false, "deprecated": false},
-{"name": "sifive-u54", "typename": "sifive-u54-riscv-cpu", "static": false, "deprecated": false}]
-}
-Next patch will introduce a way to tell whether a given CPU is static or
-not.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230411183511.189632-3-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- qapi/machine-target.json      |  6 ++--
- target/riscv/riscv-qmp-cmds.c | 53 +++++++++++++++++++++++++++++++++++
- target/riscv/meson.build      |  3 +-
-files changed, 59 insertions(+), 3 deletions(-)
- create mode 100644 target/riscv/riscv-qmp-cmds.c
-diff --git a/qapi/machine-target.json b/qapi/machine-target.json
-index XXXXXXX..XXXXXXX 100644
---- a/qapi/machine-target.json
-+++ b/qapi/machine-target.json
-@@ -XXX,XX +XXX,XX @@
-                    'TARGET_I386',
-                    'TARGET_S390X',
-                    'TARGET_MIPS',
--                   'TARGET_LOONGARCH64' ] } }
-+                   'TARGET_LOONGARCH64',
-+                   'TARGET_RISCV' ] } }
- ##
- # @query-cpu-definitions:
-@@ -XXX,XX +XXX,XX @@
-                    'TARGET_I386',
-                    'TARGET_S390X',
-                    'TARGET_MIPS',
--                   'TARGET_LOONGARCH64' ] } }
-+                   'TARGET_LOONGARCH64',
-+                   'TARGET_RISCV' ] } }
-diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/target/riscv/riscv-qmp-cmds.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU CPU QMP commands for RISC-V
-+ *
-+ * Copyright (c) 2023 Ventana Micro Systems Inc.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+
-+#include "qapi/qapi-commands-machine-target.h"
-+#include "cpu-qom.h"
-+
-+static void riscv_cpu_add_definition(gpointer data, gpointer user_data)
-+{
-+    ObjectClass *oc = data;
-+    CpuDefinitionInfoList **cpu_list = user_data;
-+    CpuDefinitionInfo *info = g_malloc0(sizeof(*info));
-+    const char *typename = object_class_get_name(oc);
-+
-+    info->name = g_strndup(typename,
-+                           strlen(typename) - strlen("-" TYPE_RISCV_CPU));
-+    info->q_typename = g_strdup(typename);
-+
-+    QAPI_LIST_PREPEND(*cpu_list, info);
-+}
-+
-+CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
-+{
-+    CpuDefinitionInfoList *cpu_list = NULL;
-+    GSList *list = object_class_get_list(TYPE_RISCV_CPU, false);
-+
-+    g_slist_foreach(list, riscv_cpu_add_definition, &cpu_list);
-+    g_slist_free(list);
-+
-+    return cpu_list;
-+}
-diff --git a/target/riscv/meson.build b/target/riscv/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/meson.build
-+++ b/target/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ riscv_softmmu_ss.add(files(
-   'monitor.c',
-   'machine.c',
-   'pmu.c',
--  'time_helper.c'
-+  'time_helper.c',
-+  'riscv-qmp-cmds.c',
- ))
- target_arch += {'riscv': riscv_ss}
---
-.40.0

-[PULL 86/89] target/riscv: Restore the predicate() NULL check behavior
+Deleted patch
-From: Bin Meng <bmeng@tinylab.org>
-When reading a non-existent CSR QEMU should raise illegal instruction
-exception, but currently it just exits due to the g_assert() check.
-This actually reverts commit 0ee342256af9205e7388efdf193a6d8f1ba1a617.
-Some comments are also added to indicate that predicate() must be
-provided for an implemented CSR.
-Reported-by: Fei Wu <fei2.wu@intel.com>
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Message-Id: <20230417043054.3125614-1-bmeng@tinylab.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c | 11 +++++++++--
-file changed, 9 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
-         return RISCV_EXCP_ILLEGAL_INST;
-     }
-+    /* ensure CSR is implemented by checking predicate */
-+    if (!csr_ops[csrno].predicate) {
-+        return RISCV_EXCP_ILLEGAL_INST;
-+    }
-+
-     /* privileged spec version check */
-     if (env->priv_ver < csr_min_priv) {
-         return RISCV_EXCP_ILLEGAL_INST;
-@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
-      * illegal instruction exception should be triggered instead of virtual
-      * instruction exception. Hence this comes after the read / write check.
-      */
--    g_assert(csr_ops[csrno].predicate != NULL);
-     RISCVException ret = csr_ops[csrno].predicate(env, csrno);
-     if (ret != RISCV_EXCP_NONE) {
-         return ret;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_jvt(CPURISCVState *env, int csrno,
-     return RISCV_EXCP_NONE;
- }
--/* Control and Status Register function table */
-+/*
-+ * Control and Status Register function table
-+ * riscv_csr_operations::predicate() must be provided for an implemented CSR
-+ */
- riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     /* User Floating-Point CSRs */
-     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
---
-.40.0

-[PULL 89/89] target/riscv: add Ventana's Veyron V1 CPU
+Deleted patch
-From: Rahul Pathak <rpathak@ventanamicro.com>
-Add a virtual CPU for Ventana's first CPU named veyron-v1. It runs
-exclusively for the rv64 target. It's tested with the 'virt' board.
-CPU specs and general information can be found here:
-https://www.nextplatform.com/2023/02/02/the-first-risc-v-shot-across-the-datacenter-bow/
-Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
-Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230418123624.16414-1-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu-qom.h      |  1 +
- target/riscv/cpu_vendorid.h |  4 ++++
- target/riscv/cpu.c          | 38 +++++++++++++++++++++++++++++++++++++
-files changed, 43 insertions(+)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
-+++ b/target/riscv/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
- #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
- #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
-+#define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
- #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
- #if defined(TARGET_RISCV32)
-diff --git a/target/riscv/cpu_vendorid.h b/target/riscv/cpu_vendorid.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_vendorid.h
-+++ b/target/riscv/cpu_vendorid.h
-@@ -XXX,XX +XXX,XX @@
- #define THEAD_VENDOR_ID         0x5b7
-+#define VEYRON_V1_MARCHID       0x8000000000010000
-+#define VEYRON_V1_MIMPID        0x111
-+#define VEYRON_V1_MVENDORID     0x61f
-+
- #endif /*  TARGET_RISCV_CPU_VENDORID_H */
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
- #endif
- }
-+static void rv64_veyron_v1_cpu_init(Object *obj)
-+{
-+    CPURISCVState *env = &RISCV_CPU(obj)->env;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
-+
-+    set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU | RVH);
-+    env->priv_ver = PRIV_VERSION_1_12_0;
-+
-+    /* Enable ISA extensions */
-+    cpu->cfg.mmu = true;
-+    cpu->cfg.ext_icbom = true;
-+    cpu->cfg.cbom_blocksize = 64;
-+    cpu->cfg.cboz_blocksize = 64;
-+    cpu->cfg.ext_icboz = true;
-+    cpu->cfg.ext_smaia = true;
-+    cpu->cfg.ext_ssaia = true;
-+    cpu->cfg.ext_sscofpmf = true;
-+    cpu->cfg.ext_sstc = true;
-+    cpu->cfg.ext_svinval = true;
-+    cpu->cfg.ext_svnapot = true;
-+    cpu->cfg.ext_svpbmt = true;
-+    cpu->cfg.ext_smstateen = true;
-+    cpu->cfg.ext_zba = true;
-+    cpu->cfg.ext_zbb = true;
-+    cpu->cfg.ext_zbc = true;
-+    cpu->cfg.ext_zbs = true;
-+    cpu->cfg.ext_XVentanaCondOps = true;
-+
-+    cpu->cfg.mvendorid = VEYRON_V1_MVENDORID;
-+    cpu->cfg.marchid = VEYRON_V1_MARCHID;
-+    cpu->cfg.mimpid = VEYRON_V1_MIMPID;
-+
-+#ifndef CONFIG_USER_ONLY
-+    set_satp_mode_max_supported(cpu, VM_1_10_SV48);
-+#endif
-+}
-+
- static void rv128_base_cpu_init(Object *obj)
- {
-     if (qemu_tcg_mttcg_enabled()) {
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
-     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
-     DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
-+    DEFINE_CPU(TYPE_RISCV_CPU_VEYRON_V1,        rv64_veyron_v1_cpu_init),
-     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
- #endif
- };
---
-.40.0

The following changes since commit f6b761bdbd8ba63cee7428d52fb6b46e4224ddab:

Merge tag 'qga-pull-2023-05-04' of https://github.com/kostyanf14/qemu into staging (2023-05-04 12:08:00 +0100)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230505-1

for you to fetch changes up to e1d084a8524a9225a46d485e2d164bb258f326f7:

target/riscv: add Ventana's Veyron V1 CPU (2023-05-05 10:49:50 +1000)

----------------------------------------------------------------
First RISC-V PR for 8.1

* CPURISCVState related cleanup and simplification
* Refactor Zicond and reuse in XVentanaCondOps
* Fix invalid riscv,event-to-mhpmcounters entry
* Support subsets of code size reduction extension
* Fix itrigger when icount is used
* Simplification for RVH related check and code style fix
* Add signature dump function for spike to run ACT tests
* Rework MISA writing
* Fix mstatus.MPP related support
* Use check for relationship between Zdinx/Zhinx{min} and Zfinx
* Fix the H extension TVM trap
* A large collection of mstatus sum changes and cleanups
* Zero init APLIC internal state
* Implement query-cpu-definitions
* Restore the predicate() NULL check behavior
* Fix Guest Physical Address Translation
* Make sure an exception is raised if a pte is malformed
* Add Ventana's Veyron V1 CPU

----------------------------------------------------------------
Alexandre Ghiti (1):
      riscv: Make sure an exception is raised if a pte is malformed

Bin Meng (1):
      target/riscv: Restore the predicate() NULL check behavior

Conor Dooley (1):
      target/riscv: fix invalid riscv,event-to-mhpmcounters entry

Daniel Henrique Barboza (23):
      target/riscv: sync env->misa_ext* with cpu->cfg in realize()
      target/riscv: remove MISA properties from isa_edata_arr[]
      target/riscv/cpu.c: remove 'multi_letter' from isa_ext_data
      target/riscv: introduce riscv_cpu_add_misa_properties()
      target/riscv: remove cpu->cfg.ext_a
      target/riscv: remove cpu->cfg.ext_c
      target/riscv: remove cpu->cfg.ext_d
      target/riscv: remove cpu->cfg.ext_f
      target/riscv: remove cpu->cfg.ext_i
      target/riscv: remove cpu->cfg.ext_e
      target/riscv: remove cpu->cfg.ext_m
      target/riscv: remove cpu->cfg.ext_s
      target/riscv: remove cpu->cfg.ext_u
      target/riscv: remove cpu->cfg.ext_h
      target/riscv: remove cpu->cfg.ext_j
      target/riscv: remove cpu->cfg.ext_v
      target/riscv: remove riscv_cpu_sync_misa_cfg()
      target/riscv: remove cfg.ext_g setup from rv64_thead_c906_cpu_init()
      target/riscv: add RVG and remove cpu->cfg.ext_g
      target/riscv/cpu.c: redesign register_cpu_props()
      target/riscv: add CPU QOM header
      target/riscv: add query-cpy-definitions support
      target/riscv: add TYPE_RISCV_DYNAMIC_CPU

Fei Wu (2):
      target/riscv: Separate priv from mmu_idx
      target/riscv: Reduce overhead of MSTATUS_SUM change

Irina Ryapolova (1):
      target/riscv: Fix Guest Physical Address Translation

Ivan Klokov (1):
      hw/intc/riscv_aplic: Zero init APLIC internal state

LIU Zhiwei (7):
      target/riscv: Fix priv version dependency for vector and zfh
      target/riscv: Fix itrigger when icount is used
      target/riscv: Convert env->virt to a bool env->virt_enabled
      target/riscv: Extract virt enabled state from tb flags
      target/riscv: Add a general status enum for extensions
      target/riscv: Encode the FS and VS on a normal way for tb flags
      target/riscv: Add a tb flags field for vstart

Philipp Tomsich (2):
      target/riscv: refactor Zicond support
      target/riscv: redirect XVentanaCondOps to use the Zicond functions

Rahul Pathak (1):
      target/riscv: add Ventana's Veyron V1 CPU

Richard Henderson (18):
      target/riscv: Remove mstatus_hs_{fs, vs} from tb_flags
      target/riscv: Use cpu_ld*_code_mmu for HLVX
      target/riscv: Handle HLV, HSV via helpers
      target/riscv: Rename MMU_HYP_ACCESS_BIT to MMU_2STAGE_BIT
      target/riscv: Introduce mmuidx_sum
      target/riscv: Introduce mmuidx_priv
      target/riscv: Introduce mmuidx_2stage
      target/riscv: Move hstatus.spvp check to check_access_hlsv
      target/riscv: Set MMU_2STAGE_BIT in riscv_cpu_mmu_index
      target/riscv: Check SUM in the correct register
      target/riscv: Hoist second stage mode change to callers
      target/riscv: Hoist pbmte and hade out of the level loop
      target/riscv: Move leaf pte processing out of level loop
      target/riscv: Suppress pte update with is_debug
      target/riscv: Don't modify SUM with is_debug
      target/riscv: Merge checks for reserved pte flags
      target/riscv: Reorg access check in get_physical_address
      target/riscv: Reorg sum check in get_physical_address

Weiwei Li (30):
      target/riscv: Avoid env_archcpu() when reading RISCVCPUConfig
      target/riscv: Simplify getting RISCVCPU pointer from env
      target/riscv: Simplify type conversion for CPURISCVState
      target/riscv: Simplify arguments for riscv_csrrw_check
      target/riscv: add cfg properties for Zc* extension
      target/riscv: add support for Zca extension
      target/riscv: add support for Zcf extension
      target/riscv: add support for Zcd extension
      target/riscv: add support for Zcb extension
      target/riscv: add support for Zcmp extension
      target/riscv: add support for Zcmt extension
      target/riscv: expose properties for Zc* extension
      disas/riscv.c: add disasm support for Zc*
      target/riscv: Add support for Zce
      target/riscv: Remove redundant call to riscv_cpu_virt_enabled
      target/riscv: Remove redundant check on RVH
      target/riscv: Remove check on RVH for riscv_cpu_virt_enabled
      target/riscv: Remove check on RVH for riscv_cpu_set_virt_enabled
      target/riscv: Remove redundant parentheses
      target/riscv: Fix addr type for get_physical_address
      target/riscv: Set opcode to env->bins for illegal/virtual instruction fault
      target/riscv: Remove riscv_cpu_virt_enabled()
      target/riscv: Fix format for indentation
      target/riscv: Fix format for comments
      target/riscv: Fix lines with over 80 characters
      hw/riscv: Add signature dump function for spike to run ACT tests
      target/riscv: Fix the mstatus.MPP value after executing MRET
      target/riscv: Use PRV_RESERVED instead of PRV_H
      target/riscv: Legalize MPP value in write_mstatus
      target/riscv: Use check for relationship between Zdinx/Zhinx{min} and Zfinx

Yi Chen (1):
      target/riscv: fix H extension TVM trap

From: Weiwei Li <liweiwei@iscas.ac.cn>

Use riscv_cpu_cfg(env) instead of env_archcpu().cfg.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230309071329.45932-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  9 ++++-----
 target/riscv/csr.c        | 40 ++++++++++++---------------------------
 target/riscv/gdbstub.c    |  4 ++--
 3 files changed, 18 insertions(+), 35 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
                                     int extirq, unsigned int extirq_def_prio,
                                     uint64_t pending, uint8_t *iprio)
 {
-    RISCVCPU *cpu = env_archcpu(env);
     int irq, best_irq = RISCV_EXCP_NONE;
     unsigned int prio, best_prio = UINT_MAX;
 
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
     }
 
     irq = ctz64(pending);
-    if (!((extirq == IRQ_M_EXT) ? cpu->cfg.ext_smaia : cpu->cfg.ext_ssaia)) {
+    if (!((extirq == IRQ_M_EXT) ? riscv_cpu_cfg(env)->ext_smaia :
+                                  riscv_cpu_cfg(env)->ext_ssaia)) {
         return irq;
     }
 
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     int mode = mmu_idx & TB_FLAGS_PRIV_MMU_MASK;
     bool use_background = false;
     hwaddr ppn;
-    RISCVCPU *cpu = env_archcpu(env);
     int napot_bits = 0;
     target_ulong napot_mask;
 
@@ -XXX,XX +XXX,XX @@ restart:
 
         if (riscv_cpu_sxl(env) == MXL_RV32) {
             ppn = pte >> PTE_PPN_SHIFT;
-        } else if (pbmte || cpu->cfg.ext_svnapot) {
+        } else if (pbmte || riscv_cpu_cfg(env)->ext_svnapot) {
             ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
         } else {
             ppn = pte >> PTE_PPN_SHIFT;
@@ -XXX,XX +XXX,XX @@ restart:
                benefit. */
             target_ulong vpn = addr >> PGSHIFT;
 
-            if (cpu->cfg.ext_svnapot && (pte & PTE_N)) {
+            if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
                 napot_bits = ctzl(ppn) + 1;
                 if ((i != (levels - 1)) || (napot_bits != 4)) {
                     return TRANSLATE_FAIL;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
 
 static RISCVException vs(CPURISCVState *env, int csrno)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    if (cpu->cfg.ext_zve32f) {
+    if (riscv_cpu_cfg(env)->ext_zve32f) {
 #if !defined(CONFIG_USER_ONLY)
         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
             return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr32(CPURISCVState *env, int csrno)
 
 static RISCVException sscofpmf(CPURISCVState *env, int csrno)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    if (!cpu->cfg.ext_sscofpmf) {
+    if (!riscv_cpu_cfg(env)->ext_sscofpmf) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException umode32(CPURISCVState *env, int csrno)
 
 static RISCVException mstateen(CPURISCVState *env, int csrno)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    if (!cpu->cfg.ext_smstateen) {
+    if (!riscv_cpu_cfg(env)->ext_smstateen) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException mstateen(CPURISCVState *env, int csrno)
 
 static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    if (!cpu->cfg.ext_smstateen) {
+    if (!riscv_cpu_cfg(env)->ext_smstateen) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException sstateen(CPURISCVState *env, int csrno)
 
 static RISCVException sstc(CPURISCVState *env, int csrno)
 {
-    RISCVCPU *cpu = env_archcpu(env);
     bool hmode_check = false;
 
-    if (!cpu->cfg.ext_sstc || !env->rdtime_fn) {
+    if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_ignore(CPURISCVState *env, int csrno,
 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
                                      target_ulong *val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    *val = cpu->cfg.mvendorid;
+    *val = riscv_cpu_cfg(env)->mvendorid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_marchid(CPURISCVState *env, int csrno,
                                    target_ulong *val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    *val = cpu->cfg.marchid;
+    *val = riscv_cpu_cfg(env)->marchid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
                                   target_ulong *val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    *val = cpu->cfg.mimpid;
+    *val = riscv_cpu_cfg(env)->mimpid;
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mstatus(CPURISCVState *env, int csrno,
 
 static bool validate_vm(CPURISCVState *env, target_ulong vm)
 {
-    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
-
-    return (vm & 0xf) <= satp_mode_max_from_map(cpu->cfg.satp_mode.map);
+    return (vm & 0xf) <=
+           satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
 }
 
 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
@@ -XXX,XX +XXX,XX @@ static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
                                     target_ulong val)
 {
-    RISCVCPUConfig *cfg = &env_archcpu(env)->cfg;
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
-    RISCVCPUConfig *cfg = &env_archcpu(env)->cfg;
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
                     (cfg->ext_svadu ? MENVCFG_HADE : 0);
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_fpu(CPURISCVState *env, uint8_t *mem_buf, int n)
 
 static int riscv_gdb_get_vector(CPURISCVState *env, GByteArray *buf, int n)
 {
-    uint16_t vlenb = env_archcpu(env)->cfg.vlen >> 3;
+    uint16_t vlenb = riscv_cpu_cfg(env)->vlen >> 3;
     if (n < 32) {
         int i;
         int cnt = 0;
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_vector(CPURISCVState *env, GByteArray *buf, int n)
 
 static int riscv_gdb_set_vector(CPURISCVState *env, uint8_t *mem_buf, int n)
 {
-    uint16_t vlenb = env_archcpu(env)->cfg.vlen >> 3;
+    uint16_t vlenb = riscv_cpu_cfg(env)->vlen >> 3;
     if (n < 32) {
         int i;
         for (i = 0; i < vlenb; i += 8) {
-- 
2.40.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Vector implicitly enables zve64d, zve64f, zve32f sub extensions. As vector
only requires PRIV_1_10_0, these sub extensions should not require priv version
higher than that.

The same for Zfh.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230321043415.754-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_11_0, ext_zfh),
-    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
+    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_11_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
     ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
     ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zksed, true, PRIV_VERSION_1_12_0, ext_zksed),
     ISA_EXT_DATA_ENTRY(zksh, true, PRIV_VERSION_1_12_0, ext_zksh),
     ISA_EXT_DATA_ENTRY(zkt, true, PRIV_VERSION_1_12_0, ext_zkt),
-    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_12_0, ext_zve32f),
-    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_12_0, ext_zve64f),
-    ISA_EXT_DATA_ENTRY(zve64d, true, PRIV_VERSION_1_12_0, ext_zve64d),
+    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_10_0, ext_zve32f),
+    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_10_0, ext_zve64f),
+    ISA_EXT_DATA_ENTRY(zve64d, true, PRIV_VERSION_1_10_0, ext_zve64d),
     ISA_EXT_DATA_ENTRY(zvfh, true, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, true, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Use env_archcpu() to get RISCVCPU pointer from env directly.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230309071329.45932-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
         return true;
     }
 
-    cpu = RISCV_CPU(env_cpu(env));
+    cpu = env_archcpu(env);
     if (!cpu->pmu_event_ctr_map) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ bool riscv_pmu_ctr_monitor_cycles(CPURISCVState *env, uint32_t target_ctr)
         return true;
     }
 
-    cpu = RISCV_CPU(env_cpu(env));
+    cpu = env_archcpu(env);
     if (!cpu->pmu_event_ctr_map) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
                                uint32_t ctr_idx)
 {
     uint32_t event_idx;
-    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
+    RISCVCPU *cpu = env_archcpu(env);
 
     if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->pmu_event_ctr_map) {
         return -1;
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value, uint32_t ctr_idx)
 {
     uint64_t overflow_delta, overflow_at;
     int64_t overflow_ns, overflow_left = 0;
-    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
+    RISCVCPU *cpu = env_archcpu(env);
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 
     if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->cfg.ext_sscofpmf) {
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Use CPURISCVState as argument directly in riscv_cpu_update_mip and
riscv_timer_write_timecmp, since type converts from CPURISCVState to
RISCVCPU in many caller of them and then back to CPURISCVState in them.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230309071329.45932-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  3 ++-
 target/riscv/time_helper.h |  2 +-
 target/riscv/cpu.c         |  6 +++---
 target/riscv/cpu_helper.c  |  8 ++++----
 target/riscv/csr.c         | 35 +++++++++++------------------------
 target/riscv/pmu.c         |  6 +++---
 target/riscv/time_helper.c | 15 +++++++--------
 7 files changed, 31 insertions(+), 44 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
 void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
-uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value);
+uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
+                              uint64_t value);
 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
 void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
                              void *arg);
diff --git a/target/riscv/time_helper.h b/target/riscv/time_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/time_helper.h
+++ b/target/riscv/time_helper.h
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "qemu/timer.h"
 
-void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
+void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
                                uint64_t timecmp, uint64_t delta,
                                uint32_t timer_irq);
 void riscv_timer_init(RISCVCPU *cpu);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
             if (kvm_enabled()) {
                 kvm_riscv_set_irq(cpu, irq, level);
             } else {
-                riscv_cpu_update_mip(cpu, 1 << irq, BOOL_TO_MASK(level));
+                riscv_cpu_update_mip(env, 1 << irq, BOOL_TO_MASK(level));
             }
              break;
         case IRQ_S_EXT:
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
                 kvm_riscv_set_irq(cpu, irq, level);
             } else {
                 env->external_seip = level;
-                riscv_cpu_update_mip(cpu, 1 << irq,
+                riscv_cpu_update_mip(env, 1 << irq,
                                      BOOL_TO_MASK(level | env->software_seip));
             }
             break;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
         }
 
         /* Update mip.SGEIP bit */
-        riscv_cpu_update_mip(cpu, MIP_SGEIP,
+        riscv_cpu_update_mip(env, MIP_SGEIP,
                              BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
     } else {
         g_assert_not_reached();
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
          *
          * To solve this, we check and inject interrupt after setting V=1.
          */
-        riscv_cpu_update_mip(env_archcpu(env), 0, 0);
+        riscv_cpu_update_mip(env, 0, 0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
     }
 }
 
-uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
+uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
+                              uint64_t value)
 {
-    CPURISCVState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
+    CPUState *cs = env_cpu(env);
     uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
 
     if (riscv_cpu_virt_enabled(env)) {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
                                       target_ulong val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
     } else {
         env->vstimecmp = val;
     }
 
-    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+    riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
                               env->htimedelta, MIP_VSTIP);
 
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
-    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+    riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
                               env->htimedelta, MIP_VSTIP);
 
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
     if (riscv_cpu_virt_enabled(env)) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
         env->stimecmp = val;
     }
 
-    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
+    riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
 
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
                                       target_ulong val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
     if (riscv_cpu_virt_enabled(env)) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
     }
 
     env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
-    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
+    riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
 
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
                                 uint64_t *ret_val,
                                 uint64_t new_val, uint64_t wr_mask)
 {
-    RISCVCPU *cpu = env_archcpu(env);
     uint64_t old_mip, mask = wr_mask & delegable_ints;
     uint32_t gin;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
         new_val |= env->external_seip * MIP_SEIP;
     }
 
-    if (cpu->cfg.ext_sstc && (env->priv == PRV_M) &&
+    if (riscv_cpu_cfg(env)->ext_sstc && (env->priv == PRV_M) &&
         get_field(env->menvcfg, MENVCFG_STCE)) {
         /* sstc extension forbids STIP & VSTIP to be writeable in mip */
         mask = mask & ~(MIP_STIP | MIP_VSTIP);
     }
 
     if (mask) {
-        old_mip = riscv_cpu_update_mip(cpu, mask, (new_val & mask));
+        old_mip = riscv_cpu_update_mip(env, mask, (new_val & mask));
     } else {
         old_mip = env->mip;
     }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hgeie(CPURISCVState *env, int csrno,
     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
     env->hgeie = val;
     /* Update mip.SGEIP bit */
-    riscv_cpu_update_mip(env_archcpu(env), MIP_SGEIP,
+    riscv_cpu_update_mip(env, MIP_SGEIP,
                          BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
         env->htimedelta = val;
     }
 
-    if (cpu->cfg.ext_sstc && env->rdtime_fn) {
-        riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+    if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
+        riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
                                   env->htimedelta, MIP_VSTIP);
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
                                         target_ulong val)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
     env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
 
-    if (cpu->cfg.ext_sstc && env->rdtime_fn) {
-        riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+    if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
+        riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
                                   env->htimedelta, MIP_VSTIP);
     }
 
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv32(RISCVCPU *cpu, uint32_t ctr_idx)
             /* Generate interrupt only if OF bit is clear */
             if (!(env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_OF)) {
                 env->mhpmeventh_val[ctr_idx] |= MHPMEVENTH_BIT_OF;
-                riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
+                riscv_cpu_update_mip(env, MIP_LCOFIP, BOOL_TO_MASK(1));
             }
         } else {
             counter->mhpmcounterh_val++;
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv64(RISCVCPU *cpu, uint32_t ctr_idx)
         /* Generate interrupt only if OF bit is clear */
         if (!(env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_OF)) {
             env->mhpmevent_val[ctr_idx] |= MHPMEVENT_BIT_OF;
-            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
+            riscv_cpu_update_mip(env, MIP_LCOFIP, BOOL_TO_MASK(1));
         }
     } else {
         counter->mhpmcounter_val++;
@@ -XXX,XX +XXX,XX @@ static void pmu_timer_trigger_irq(RISCVCPU *cpu,
         /* Generate interrupt only if OF bit is clear */
         if (!(*mhpmevent_val & of_bit_mask)) {
             *mhpmevent_val |= of_bit_mask;
-            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
+            riscv_cpu_update_mip(env, MIP_LCOFIP, BOOL_TO_MASK(1));
         }
     }
 }
diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/time_helper.c
+++ b/target/riscv/time_helper.c
@@ -XXX,XX +XXX,XX @@ static void riscv_vstimer_cb(void *opaque)
     RISCVCPU *cpu = opaque;
     CPURISCVState *env = &cpu->env;
     env->vstime_irq = 1;
-    riscv_cpu_update_mip(cpu, 0, BOOL_TO_MASK(1));
+    riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(1));
 }
 
 static void riscv_stimer_cb(void *opaque)
 {
     RISCVCPU *cpu = opaque;
-    riscv_cpu_update_mip(cpu, MIP_STIP, BOOL_TO_MASK(1));
+    riscv_cpu_update_mip(&cpu->env, MIP_STIP, BOOL_TO_MASK(1));
 }
 
 /*
  * Called when timecmp is written to update the QEMU timer or immediately
  * trigger timer interrupt if mtimecmp <= current timer value.
  */
-void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
+void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
                                uint64_t timecmp, uint64_t delta,
                                uint32_t timer_irq)
 {
     uint64_t diff, ns_diff, next;
-    CPURISCVState *env = &cpu->env;
     RISCVAclintMTimerState *mtimer = env->rdtime_fn_arg;
     uint32_t timebase_freq = mtimer->timebase_freq;
     uint64_t rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
@@ -XXX,XX +XXX,XX @@ void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
          */
         if (timer_irq == MIP_VSTIP) {
             env->vstime_irq = 1;
-            riscv_cpu_update_mip(cpu, 0, BOOL_TO_MASK(1));
+            riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(1));
         } else {
-            riscv_cpu_update_mip(cpu, MIP_STIP, BOOL_TO_MASK(1));
+            riscv_cpu_update_mip(env, MIP_STIP, BOOL_TO_MASK(1));
         }
         return;
     }
@@ -XXX,XX +XXX,XX @@ void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
     /* Clear the [VS|S]TIP bit in mip */
     if (timer_irq == MIP_VSTIP) {
         env->vstime_irq = 0;
-        riscv_cpu_update_mip(cpu, 0, BOOL_TO_MASK(0));
+        riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(0));
     } else {
-        riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(0));
+        riscv_cpu_update_mip(env, timer_irq, BOOL_TO_MASK(0));
     }
 
     /*
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Remove RISCVCPU argument, and get cfg infomation from CPURISCVState
directly.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230309071329.45932-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
 
 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                int csrno,
-                                               bool write_mask,
-                                               RISCVCPU *cpu)
+                                               bool write_mask)
 {
     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
     bool read_only = get_field(csrno, 0xC00) == 3;
     int csr_min_priv = csr_ops[csrno].min_priv_ver;
 
     /* ensure the CSR extension is enabled */
-    if (!cpu->cfg.ext_icsr) {
+    if (!riscv_cpu_cfg(env)->ext_icsr) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask)
 {
-    RISCVCPU *cpu = env_archcpu(env);
-
-    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask, cpu);
+    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 new_value, Int128 write_mask)
 {
     RISCVException ret;
-    RISCVCPU *cpu = env_archcpu(env);
 
-    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask), cpu);
+    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
-- 
2.40.0

From: Philipp Tomsich <philipp.tomsich@vrull.eu>

After the original Zicond support was stuck/fell through the cracks on
the mailing list at v3 (and a different implementation was merged in
the meanwhile), we need to refactor Zicond to prepare it to be reused
by XVentanaCondOps.

This commit lifts the common logic out into gen_czero and uses this
via gen_logic and 2 helper functions (effectively partial closures).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230307180708.302867-2-philipp.tomsich@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzicond.c.inc | 36 ++++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzicond.c.inc b/target/riscv/insn_trans/trans_rvzicond.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzicond.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicond.c.inc
@@ -XXX,XX +XXX,XX @@
  * RISC-V translation routines for the Zicond Standard Extension.
  *
  * Copyright (c) 2020-2023 PLCT Lab
+ * Copyright (c) 2022 VRULL GmbH.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -XXX,XX +XXX,XX @@
     }                                     \
 } while (0)
 
-static bool trans_czero_eqz(DisasContext *ctx, arg_czero_eqz *a)
+/* Emits "$rd = ($rs2 <cond> $zero) ? $zero : $rs1" */
+static void gen_czero(TCGv dest, TCGv src1, TCGv src2, TCGCond cond)
 {
-    REQUIRE_ZICOND(ctx);
+    TCGv zero = tcg_constant_tl(0);
+    tcg_gen_movcond_tl(cond, dest, src2, zero, zero, src1);
+}
 
-    TCGv dest = dest_gpr(ctx, a->rd);
-    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
-    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+static void gen_czero_eqz(TCGv dest, TCGv src1, TCGv src2)
+{
+    gen_czero(dest, src1, src2, TCG_COND_EQ);
+}
 
-    tcg_gen_movcond_tl(TCG_COND_EQ, dest, src2, ctx->zero, ctx->zero, src1);
-    gen_set_gpr(ctx, a->rd, dest);
-    return true;
+static void gen_czero_nez(TCGv dest, TCGv src1, TCGv src2)
+{
+    gen_czero(dest, src1, src2, TCG_COND_NE);
 }
 
-static bool trans_czero_nez(DisasContext *ctx, arg_czero_nez *a)
+static bool trans_czero_eqz(DisasContext *ctx, arg_r *a)
 {
     REQUIRE_ZICOND(ctx);
 
-    TCGv dest = dest_gpr(ctx, a->rd);
-    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
-    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    return gen_logic(ctx, a, gen_czero_eqz);
+}
+
+static bool trans_czero_nez(DisasContext *ctx, arg_r *a)
+{
+    REQUIRE_ZICOND(ctx);
 
-    tcg_gen_movcond_tl(TCG_COND_NE, dest, src2, ctx->zero, ctx->zero, src1);
-    gen_set_gpr(ctx, a->rd, dest);
-    return true;
+    return gen_logic(ctx, a, gen_czero_nez);
 }
-- 
2.40.0

From: Philipp Tomsich <philipp.tomsich@vrull.eu>

The Zicond standard extension implements the same instruction
semantics as XVentanaCondOps, although using different mnemonics and
opcodes.

Point XVentanaCondOps to the (newly implemented) Zicond implementation
to reduce the future maintenance burden.

Also updating MAINTAINERS as trans_xventanacondops.c.inc.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230307180708.302867-3-philipp.tomsich@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS                                    |  2 +-
 .../insn_trans/trans_xventanacondops.c.inc     | 18 +++---------------
 2 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: target/riscv/xthead*.decode
 RISC-V XVentanaCondOps extension
 M: Philipp Tomsich <philipp.tomsich@vrull.eu>
 L: qemu-riscv@nongnu.org
-S: Supported
+S: Maintained
 F: target/riscv/XVentanaCondOps.decode
 F: target/riscv/insn_trans/trans_xventanacondops.c.inc
 
diff --git a/target/riscv/insn_trans/trans_xventanacondops.c.inc b/target/riscv/insn_trans/trans_xventanacondops.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_xventanacondops.c.inc
+++ b/target/riscv/insn_trans/trans_xventanacondops.c.inc
@@ -XXX,XX +XXX,XX @@
 /*
  * RISC-V translation routines for the XVentanaCondOps extension.
  *
- * Copyright (c) 2021-2022 VRULL GmbH.
+ * Copyright (c) 2021-2023 VRULL GmbH.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-static bool gen_vt_condmask(DisasContext *ctx, arg_r *a, TCGCond cond)
-{
-    TCGv dest = dest_gpr(ctx, a->rd);
-    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
-    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
-
-    tcg_gen_movcond_tl(cond, dest, src2, ctx->zero, src1, ctx->zero);
-
-    gen_set_gpr(ctx, a->rd, dest);
-    return true;
-}
-
 static bool trans_vt_maskc(DisasContext *ctx, arg_r *a)
 {
-    return gen_vt_condmask(ctx, a, TCG_COND_NE);
+    return gen_logic(ctx, a, gen_czero_eqz);
 }
 
 static bool trans_vt_maskcn(DisasContext *ctx, arg_r *a)
 {
-    return gen_vt_condmask(ctx, a, TCG_COND_EQ);
+    return gen_logic(ctx, a, gen_czero_nez);
 }
-- 
2.40.0

From: Conor Dooley <conor.dooley@microchip.com>

dt-validate complains:
> soc: pmu: {'riscv,event-to-mhpmcounters':
> [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280],
> [65563, 65563, 524280], [65569, 65569, 524280], [0, 0, 0], [0, 0]],
> pmu: riscv,event-to-mhpmcounters:6: [0, 0] is too short

There are bogus 0 entries added at the end, of which one is of
insufficient length. This happens because only 15 of
fdt_event_ctr_map[]'s 20 elements are populated & qemu_fdt_setprop() is
called using the size of the array.
Reduce the array to 15 elements to make the error go away.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230404173333.35179-1-conor@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@
  */
 void riscv_pmu_generate_fdt_node(void *fdt, int num_ctrs, char *pmu_name)
 {
-    uint32_t fdt_event_ctr_map[20] = {};
+    uint32_t fdt_event_ctr_map[15] = {};
     uint32_t cmask;
 
     /* All the programmable counters can map to any event */
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add properties for Zca,Zcb,Zcf,Zcd,Zcmp,Zcmt extension.
Add check for these properties.

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zbkc;
     bool ext_zbkx;
     bool ext_zbs;
+    bool ext_zca;
+    bool ext_zcb;
+    bool ext_zcd;
+    bool ext_zcf;
+    bool ext_zcmp;
+    bool ext_zcmt;
     bool ext_zk;
     bool ext_zkn;
     bool ext_zknd;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         }
     }
 
+    if (cpu->cfg.ext_c) {
+        cpu->cfg.ext_zca = true;
+        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
+            cpu->cfg.ext_zcf = true;
+        }
+        if (cpu->cfg.ext_d) {
+            cpu->cfg.ext_zcd = true;
+        }
+    }
+
+    if (env->misa_mxl_max != MXL_RV32 && cpu->cfg.ext_zcf) {
+        error_setg(errp, "Zcf extension is only relevant to RV32");
+        return;
+    }
+
+    if (!cpu->cfg.ext_f && cpu->cfg.ext_zcf) {
+        error_setg(errp, "Zcf extension requires F extension");
+        return;
+    }
+
+    if (!cpu->cfg.ext_d && cpu->cfg.ext_zcd) {
+        error_setg(errp, "Zcd extension requires D extension");
+        return;
+    }
+
+    if ((cpu->cfg.ext_zcf || cpu->cfg.ext_zcd || cpu->cfg.ext_zcb ||
+         cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt) && !cpu->cfg.ext_zca) {
+        error_setg(errp, "Zcf/Zcd/Zcb/Zcmp/Zcmt extensions require Zca "
+                         "extension");
+        return;
+    }
+
+    if (cpu->cfg.ext_zcd && (cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt)) {
+        error_setg(errp, "Zcmp/Zcmt extensions are incompatible with "
+                         "Zcd extension");
+        return;
+    }
+
+    if (cpu->cfg.ext_zcmt && !cpu->cfg.ext_icsr) {
+        error_setg(errp, "Zcmt extension requires Zicsr extension");
+        return;
+    }
+
     if (cpu->cfg.ext_zk) {
         cpu->cfg.ext_zkn = true;
         cpu->cfg.ext_zkr = true;
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Modify the check for C extension to Zca (C implies Zca).

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Message-Id: <20230307081403.61950-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c                | 8 ++++++--
 target/riscv/insn_trans/trans_rvi.c.inc | 4 ++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
 
     /* check misaligned: */
     next_pc = ctx->base.pc_next + imm;
-    if (!has_ext(ctx, RVC)) {
+    if (!ctx->cfg_ptr->ext_zca) {
         if ((next_pc & 0x3) != 0) {
             gen_exception_inst_addr_mis(ctx);
             return;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     if (insn_len(opcode) == 2) {
         ctx->opcode = opcode;
         ctx->pc_succ_insn = ctx->base.pc_next + 2;
-        if (has_ext(ctx, RVC) && decode_insn16(ctx, opcode)) {
+        /*
+         * The Zca extension is added as way to refer to instructions in the C
+         * extension that do not include the floating-point loads and stores
+         */
+        if (ctx->cfg_ptr->ext_zca && decode_insn16(ctx, opcode)) {
             return;
         }
     } else {
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
     tcg_gen_andi_tl(cpu_pc, cpu_pc, (target_ulong)-2);
 
     gen_set_pc(ctx, cpu_pc);
-    if (!has_ext(ctx, RVC)) {
+    if (!ctx->cfg_ptr->ext_zca) {
         TCGv t0 = tcg_temp_new();
 
         misaligned = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
 
     gen_set_label(l); /* branch taken */
 
-    if (!has_ext(ctx, RVC) && ((ctx->base.pc_next + a->imm) & 0x3)) {
+    if (!ctx->cfg_ptr->ext_zca && ((ctx->base.pc_next + a->imm) & 0x3)) {
         /* misaligned */
         gen_exception_inst_addr_mis(ctx);
     } else {
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Separate c_flw/c_fsw from flw/fsw to add check for Zcf extension.

diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@ sw                110  ... ... .. ... 00 @cs_w
 # *** RV32C and RV64C specific Standard Extension (Quadrant 0) ***
 {
   ld              011  ... ... .. ... 00 @cl_d
-  flw             011  ... ... .. ... 00 @cl_w
+  c_flw           011  ... ... .. ... 00 @cl_w
 }
 {
   sd              111  ... ... .. ... 00 @cs_d
-  fsw             111  ... ... .. ... 00 @cs_w
+  c_fsw           111  ... ... .. ... 00 @cs_w
 }
 
 # *** RV32/64C Standard Extension (Quadrant 1) ***
@@ -XXX,XX +XXX,XX @@ sw                110 .  .....  ..... 10 @c_swsp
 {
   c64_illegal     011 -  00000  ----- 10 # c.ldsp, RES rd=0
   ld              011 .  .....  ..... 10 @c_ldsp
-  flw             011 .  .....  ..... 10 @c_lwsp
+  c_flw           011 .  .....  ..... 10 @c_lwsp
 }
 {
   sd              111 .  .....  ..... 10 @c_sdsp
-  fsw             111 .  .....  ..... 10 @c_swsp
+  c_fsw           111 .  .....  ..... 10 @c_swsp
 }
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZCF(ctx) do {                  \
+    if (!ctx->cfg_ptr->ext_zcf) {              \
+        return false;                          \
+    }                                          \
+} while (0)
+
 static bool trans_flw(DisasContext *ctx, arg_flw *a)
 {
     TCGv_i64 dest;
@@ -XXX,XX +XXX,XX @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
     return true;
 }
 
+static bool trans_c_flw(DisasContext *ctx, arg_flw *a)
+{
+    REQUIRE_ZCF(ctx);
+    return trans_flw(ctx, a);
+}
+
+static bool trans_c_fsw(DisasContext *ctx, arg_fsw *a)
+{
+    REQUIRE_ZCF(ctx);
+    return trans_fsw(ctx, a);
+}
+
 static bool trans_fmadd_s(DisasContext *ctx, arg_fmadd_s *a)
 {
     REQUIRE_FPU;
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Separate c_fld/c_fsd from fld/fsd to add additional check for
c.fld{sp}/c.fsd{sp} which is useful for zcmp/zcmt to reuse
their encodings.

diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@
 }
 {
   lq              001  ... ... .. ... 00 @cl_q
-  fld             001  ... ... .. ... 00 @cl_d
+  c_fld           001  ... ... .. ... 00 @cl_d
 }
 lw                010  ... ... .. ... 00 @cl_w
 {
   sq              101  ... ... .. ... 00 @cs_q
-  fsd             101  ... ... .. ... 00 @cs_d
+  c_fsd           101  ... ... .. ... 00 @cs_d
 }
 sw                110  ... ... .. ... 00 @cs_w
 
@@ -XXX,XX +XXX,XX @@ addw              100 1 11 ... 01 ... 01 @cs_2
 slli              000 .  .....  ..... 10 @c_shift2
 {
   lq              001  ... ... .. ... 10 @c_lqsp
-  fld             001 .  .....  ..... 10 @c_ldsp
+  c_fld           001 .  .....  ..... 10 @c_ldsp
 }
 {
   illegal         010 -  00000  ----- 10 # c.lwsp, RES rd=0
@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
 }
 {
   sq              101  ... ... .. ... 10 @c_sqsp
-  fsd             101   ......  ..... 10 @c_sdsp
+  c_fsd           101   ......  ..... 10 @c_sdsp
 }
 sw                110 .  .....  ..... 10 @c_swsp
 
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZCD(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zcd) {  \
+        return false;     \
+    } \
+} while (0)
+
 static bool trans_fld(DisasContext *ctx, arg_fld *a)
 {
     TCGv addr;
@@ -XXX,XX +XXX,XX @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     return true;
 }
 
+static bool trans_c_fld(DisasContext *ctx, arg_fld *a)
+{
+    REQUIRE_ZCD(ctx);
+    return trans_fld(ctx, a);
+}
+
+static bool trans_c_fsd(DisasContext *ctx, arg_fsd *a)
+{
+    REQUIRE_ZCD(ctx);
+    return trans_fsd(ctx, a);
+}
+
 static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
 {
     REQUIRE_FPU;
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add encode and trans* functions support for Zcb instructions.

diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@
 %imm_addi16sp  12:s1 3:2 5:1 2:1 6:1 !function=ex_shift_4
 %imm_lui       12:s1 2:5             !function=ex_shift_12
 
+%uimm_cl_b  5:1 6:1
+%uimm_cl_h  5:1                      !function=ex_shift_1
 
 # Argument sets imported from insn32.decode:
 &empty                  !extern
@@ -XXX,XX +XXX,XX @@
 &b         imm rs2 rs1  !extern
 &u         imm rd       !extern
 &shift     shamt rs1 rd !extern
+&r2        rd rs1       !extern
 
 
 # Formats 16:
@@ -XXX,XX +XXX,XX @@
 
 @c_andi         ... . .. ... ..... .. &i imm=%imm_ci rs1=%rs1_3 rd=%rs1_3
 
+@cu           ... ...  ... .. ... ..  &r2                 rs1=%rs1_3 rd=%rs1_3
+@cl_b         ... . .. ... .. ... ..  &i  imm=%uimm_cl_b  rs1=%rs1_3 rd=%rs2_3
+@cl_h         ... . .. ... .. ... ..  &i  imm=%uimm_cl_h  rs1=%rs1_3 rd=%rs2_3
+@cs_b         ... . .. ... .. ... ..  &s  imm=%uimm_cl_b  rs1=%rs1_3 rs2=%rs2_3
+@cs_h         ... . .. ... .. ... ..  &s  imm=%uimm_cl_h  rs1=%rs1_3 rs2=%rs2_3
+
 # *** RV32/64C Standard Extension (Quadrant 0) ***
 {
   # Opcode of all zeros is illegal; rd != 0, nzuimm == 0 is reserved.
@@ -XXX,XX +XXX,XX @@ sw                110 .  .....  ..... 10 @c_swsp
   sd              111 .  .....  ..... 10 @c_sdsp
   c_fsw           111 .  .....  ..... 10 @c_swsp
 }
+
+# *** RV64 and RV32 Zcb Extension ***
+c_zext_b          100 111  ... 11 000 01 @cu
+c_sext_b          100 111  ... 11 001 01 @cu
+c_zext_h          100 111  ... 11 010 01 @cu
+c_sext_h          100 111  ... 11 011 01 @cu
+c_zext_w          100 111  ... 11 100 01 @cu
+c_not             100 111  ... 11 101 01 @cu
+c_mul             100 111  ... 10 ... 01 @cs_2
+c_lbu             100 000  ... .. ... 00 @cl_b
+c_lhu             100 001  ... 0. ... 00 @cl_h
+c_lh              100 001  ... 1. ... 00 @cl_h
+c_sb              100 010  ... .. ... 00 @cs_b
+c_sh              100 011  ... 0. ... 00 @cs_h
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 
 /* Include the auto-generated decoder for 16 bit insn */
 #include "decode-insn16.c.inc"
+#include "insn_trans/trans_rvzce.c.inc"
+
 /* Include decoders for factored-out extensions */
 #include "decode-XVentanaCondOps.c.inc"
 
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the Zcb Standard Extension.
+ *
+ * Copyright (c) 2021-2022 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZCB(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zcb) \
+        return false;           \
+} while (0)
+
+static bool trans_c_zext_b(DisasContext *ctx, arg_c_zext_b *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext8u_tl);
+}
+
+static bool trans_c_zext_h(DisasContext *ctx, arg_c_zext_h *a)
+{
+    REQUIRE_ZCB(ctx);
+    REQUIRE_ZBB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext16u_tl);
+}
+
+static bool trans_c_sext_b(DisasContext *ctx, arg_c_sext_b *a)
+{
+    REQUIRE_ZCB(ctx);
+    REQUIRE_ZBB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext8s_tl);
+}
+
+static bool trans_c_sext_h(DisasContext *ctx, arg_c_sext_h *a)
+{
+    REQUIRE_ZCB(ctx);
+    REQUIRE_ZBB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext16s_tl);
+}
+
+static bool trans_c_zext_w(DisasContext *ctx, arg_c_zext_w *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZCB(ctx);
+    REQUIRE_ZBA(ctx);
+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_ext32u_tl);
+}
+
+static bool trans_c_not(DisasContext *ctx, arg_c_not *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, tcg_gen_not_tl);
+}
+
+static bool trans_c_mul(DisasContext *ctx, arg_c_mul *a)
+{
+    REQUIRE_ZCB(ctx);
+    REQUIRE_M_OR_ZMMUL(ctx);
+    return gen_arith(ctx, a, EXT_NONE, tcg_gen_mul_tl, NULL);
+}
+
+static bool trans_c_lbu(DisasContext *ctx, arg_c_lbu *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_load(ctx, a, MO_UB);
+}
+
+static bool trans_c_lhu(DisasContext *ctx, arg_c_lhu *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_load(ctx, a, MO_UW);
+}
+
+static bool trans_c_lh(DisasContext *ctx, arg_c_lh *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_load(ctx, a, MO_SW);
+}
+
+static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_store(ctx, a, MO_UB);
+}
+
+static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
+{
+    REQUIRE_ZCB(ctx);
+    return gen_store(ctx, a, MO_UW);
+}
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add encode, trans* functions for Zcmp instructions.

diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@
 %rs1_3     7:3                !function=ex_rvc_register
 %rs2_3     2:3                !function=ex_rvc_register
 %rs2_5     2:5
+%r1s       7:3                !function=ex_sreg_register
+%r2s       2:3                !function=ex_sreg_register
 
 # Immediates:
 %imm_ci        12:s1 2:5
@@ -XXX,XX +XXX,XX @@
 
 %uimm_cl_b  5:1 6:1
 %uimm_cl_h  5:1                      !function=ex_shift_1
+%spimm      2:2                      !function=ex_shift_4
+%urlist     4:4
 
 # Argument sets imported from insn32.decode:
 &empty                  !extern
@@ -XXX,XX +XXX,XX @@
 &u         imm rd       !extern
 &shift     shamt rs1 rd !extern
 &r2        rd rs1       !extern
+&r2_s      rs1 rs2      !extern
 
+&cmpp      urlist spimm
 
 # Formats 16:
 @cr        ....  ..... .....  .. &r      rs2=%rs2_5       rs1=%rd     %rd
@@ -XXX,XX +XXX,XX @@
 @cl_h         ... . .. ... .. ... ..  &i  imm=%uimm_cl_h  rs1=%rs1_3 rd=%rs2_3
 @cs_b         ... . .. ... .. ... ..  &s  imm=%uimm_cl_b  rs1=%rs1_3 rs2=%rs2_3
 @cs_h         ... . .. ... .. ... ..  &s  imm=%uimm_cl_h  rs1=%rs1_3 rs2=%rs2_3
+@cm_pp        ... ...  ........   ..  &cmpp  %urlist      %spimm
+@cm_mv        ... ...  ... .. ... ..  &r2_s  rs2=%r2s     rs1=%r1s
 
 # *** RV32/64C Standard Extension (Quadrant 0) ***
 {
@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
 {
   sq              101  ... ... .. ... 10 @c_sqsp
   c_fsd           101   ......  ..... 10 @c_sdsp
+
+  # *** RV64 and RV32 Zcmp Extension ***
+  [
+    cm_push         101  11000  .... .. 10 @cm_pp
+    cm_pop          101  11010  .... .. 10 @cm_pp
+    cm_popret       101  11110  .... .. 10 @cm_pp
+    cm_popretz      101  11100  .... .. 10 @cm_pp
+    cm_mva01s       101  011 ... 11 ... 10 @cm_mv
+    cm_mvsa01       101  011 ... 01 ... 10 @cm_mv
+  ]
 }
 sw                110 .  .....  ..... 10 @c_swsp
 
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static int ex_rvc_register(DisasContext *ctx, int reg)
     return 8 + reg;
 }
 
+static int ex_sreg_register(DisasContext *ctx, int reg)
+{
+    return reg < 2 ? reg + 8 : reg + 16;
+}
+
 static int ex_rvc_shiftli(DisasContext *ctx, int imm)
 {
     /* For RV128 a shamt of 0 means a shift by 64. */
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -XXX,XX +XXX,XX @@
 /*
- * RISC-V translation routines for the Zcb Standard Extension.
+ * RISC-V translation routines for the Zc[b,mp] Standard Extensions.
  *
  * Copyright (c) 2021-2022 PLCT Lab
  *
@@ -XXX,XX +XXX,XX @@
         return false;           \
 } while (0)
 
+#define REQUIRE_ZCMP(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zcmp) \
+        return false;            \
+} while (0)
+
 static bool trans_c_zext_b(DisasContext *ctx, arg_c_zext_b *a)
 {
     REQUIRE_ZCB(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
     REQUIRE_ZCB(ctx);
     return gen_store(ctx, a, MO_UW);
 }
+
+#define X_S0    8
+#define X_S1    9
+#define X_Sn    16
+
+static uint32_t decode_push_pop_list(DisasContext *ctx, target_ulong rlist)
+{
+    uint32_t reg_bitmap = 0;
+
+    if (ctx->cfg_ptr->ext_e && rlist > 6) {
+        return 0;
+    }
+
+    switch (rlist) {
+    case 15:
+        reg_bitmap |=  1 << (X_Sn + 11) ;
+        reg_bitmap |=  1 << (X_Sn + 10) ;
+        /* FALL THROUGH */
+    case 14:
+        reg_bitmap |=  1 << (X_Sn + 9) ;
+        /* FALL THROUGH */
+    case 13:
+        reg_bitmap |=  1 << (X_Sn + 8) ;
+        /* FALL THROUGH */
+    case 12:
+        reg_bitmap |=  1 << (X_Sn + 7) ;
+        /* FALL THROUGH */
+    case 11:
+        reg_bitmap |=  1 << (X_Sn + 6) ;
+        /* FALL THROUGH */
+    case 10:
+        reg_bitmap |=  1 << (X_Sn + 5) ;
+        /* FALL THROUGH */
+    case 9:
+        reg_bitmap |=  1 << (X_Sn + 4) ;
+        /* FALL THROUGH */
+    case 8:
+        reg_bitmap |=  1 << (X_Sn + 3) ;
+        /* FALL THROUGH */
+    case 7:
+        reg_bitmap |=  1 << (X_Sn + 2) ;
+        /* FALL THROUGH */
+    case 6:
+        reg_bitmap |=  1 << X_S1 ;
+        /* FALL THROUGH */
+    case 5:
+        reg_bitmap |= 1 << X_S0;
+        /* FALL THROUGH */
+    case 4:
+        reg_bitmap |= 1 << xRA;
+        break;
+    default:
+        break;
+    }
+
+    return reg_bitmap;
+}
+
+static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
+{
+    REQUIRE_ZCMP(ctx);
+
+    uint32_t reg_bitmap = decode_push_pop_list(ctx, a->urlist);
+    if (reg_bitmap == 0) {
+        return false;
+    }
+
+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TEUL : MO_TEUQ;
+    int reg_size = memop_size(memop);
+    target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
+                             a->spimm;
+    TCGv sp = dest_gpr(ctx, xSP);
+    TCGv addr = tcg_temp_new();
+    int i;
+
+    tcg_gen_addi_tl(addr, sp, stack_adj - reg_size);
+
+    for (i = X_Sn + 11; i >= 0; i--) {
+        if (reg_bitmap & (1 << i)) {
+            TCGv dest = dest_gpr(ctx, i);
+            tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, memop);
+            gen_set_gpr(ctx, i, dest);
+            tcg_gen_subi_tl(addr, addr, reg_size);
+        }
+    }
+
+    tcg_gen_addi_tl(sp, sp, stack_adj);
+    gen_set_gpr(ctx, xSP, sp);
+
+    if (ret_val) {
+        gen_set_gpr(ctx, xA0, ctx->zero);
+    }
+
+    if (ret) {
+        TCGv ret_addr = get_gpr(ctx, xRA, EXT_NONE);
+        gen_set_pc(ctx, ret_addr);
+        tcg_gen_lookup_and_goto_ptr();
+        ctx->base.is_jmp = DISAS_NORETURN;
+    }
+
+    return true;
+}
+
+static bool trans_cm_push(DisasContext *ctx, arg_cm_push *a)
+{
+    REQUIRE_ZCMP(ctx);
+
+    uint32_t reg_bitmap = decode_push_pop_list(ctx, a->urlist);
+    if (reg_bitmap == 0) {
+        return false;
+    }
+
+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TEUL : MO_TEUQ;
+    int reg_size = memop_size(memop);
+    target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
+                             a->spimm;
+    TCGv sp = dest_gpr(ctx, xSP);
+    TCGv addr = tcg_temp_new();
+    int i;
+
+    tcg_gen_subi_tl(addr, sp, reg_size);
+
+    for (i = X_Sn + 11; i >= 0; i--) {
+        if (reg_bitmap & (1 << i)) {
+            TCGv val = get_gpr(ctx, i, EXT_NONE);
+            tcg_gen_qemu_st_tl(val, addr, ctx->mem_idx, memop);
+            tcg_gen_subi_tl(addr, addr, reg_size);
+        }
+    }
+
+    tcg_gen_subi_tl(sp, sp, stack_adj);
+    gen_set_gpr(ctx, xSP, sp);
+
+    return true;
+}
+
+static bool trans_cm_pop(DisasContext *ctx, arg_cm_pop *a)
+{
+    return gen_pop(ctx, a, false, false);
+}
+
+static bool trans_cm_popret(DisasContext *ctx, arg_cm_popret *a)
+{
+    return gen_pop(ctx, a, true, false);
+}
+
+static bool trans_cm_popretz(DisasContext *ctx, arg_cm_popret *a)
+{
+    return gen_pop(ctx, a, true, true);
+}
+
+static bool trans_cm_mva01s(DisasContext *ctx, arg_cm_mva01s *a)
+{
+    REQUIRE_ZCMP(ctx);
+
+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+
+    gen_set_gpr(ctx, xA0, src1);
+    gen_set_gpr(ctx, xA1, src2);
+
+    return true;
+}
+
+static bool trans_cm_mvsa01(DisasContext *ctx, arg_cm_mvsa01 *a)
+{
+    REQUIRE_ZCMP(ctx);
+
+    if (a->rs1 == a->rs2) {
+        return false;
+    }
+
+    TCGv a0 = get_gpr(ctx, xA0, EXT_NONE);
+    TCGv a1 = get_gpr(ctx, xA1, EXT_NONE);
+
+    gen_set_gpr(ctx, a->rs1, a0);
+    gen_set_gpr(ctx, a->rs2, a1);
+
+    return true;
+}
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add encode, trans* functions and helper functions support for Zcmt
instrutions.
Add support for jvt csr.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230307081403.61950-8-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                        |  4 ++
 target/riscv/cpu_bits.h                   |  7 +++
 target/riscv/helper.h                     |  3 ++
 target/riscv/insn16.decode                |  7 ++-
 target/riscv/csr.c                        | 36 ++++++++++++++-
 target/riscv/machine.c                    | 19 ++++++++
 target/riscv/zce_helper.c                 | 55 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvzce.c.inc | 28 +++++++++++-
 target/riscv/meson.build                  |  3 +-
 9 files changed, 157 insertions(+), 5 deletions(-)
 create mode 100644 target/riscv/zce_helper.c

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* 128-bit helpers upper part return value */
     target_ulong retxh;
 
+    target_ulong jvt;
+
 #ifdef CONFIG_USER_ONLY
     uint32_t elf_flags;
 #endif
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
                                                  target_ulong new_val,
                                                  target_ulong write_mask),
                                    void *rmw_fn_arg);
+
+RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
 #endif
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define SMSTATEEN_MAX_COUNT 4
 #define SMSTATEEN0_CS       (1ULL << 0)
 #define SMSTATEEN0_FCSR     (1ULL << 1)
+#define SMSTATEEN0_JVT      (1ULL << 2)
 #define SMSTATEEN0_HSCONTXT (1ULL << 57)
 #define SMSTATEEN0_IMSIC    (1ULL << 58)
 #define SMSTATEEN0_AIA      (1ULL << 59)
@@ -XXX,XX +XXX,XX @@
 /* Crypto Extension */
 #define CSR_SEED            0x015
 
+/* Zcmt Extension */
+#define CSR_JVT             0x017
+
 /* mstatus CSR bits */
 #define MSTATUS_UIE         0x00000001
 #define MSTATUS_SIE         0x00000002
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MHPMEVENT_IDX_MASK                 0xFFFFF
 #define MHPMEVENT_SSCOF_RESVD              16
 
+/* JVT CSR bits */
+#define JVT_MODE                           0x3F
+#define JVT_BASE                           (~0x3F)
 #endif
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(aes64im, TCG_CALL_NO_RWG_SE, tl, tl)
 
 DEF_HELPER_FLAGS_3(sm4ed, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+
+/* Zce helper */
+DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@
 %uimm_cl_h  5:1                      !function=ex_shift_1
 %spimm      2:2                      !function=ex_shift_4
 %urlist     4:4
+%index      2:8
 
 # Argument sets imported from insn32.decode:
 &empty                  !extern
@@ -XXX,XX +XXX,XX @@
 &r2_s      rs1 rs2      !extern
 
 &cmpp      urlist spimm
+&cmjt      index
 
 # Formats 16:
 @cr        ....  ..... .....  .. &r      rs2=%rs2_5       rs1=%rd     %rd
@@ -XXX,XX +XXX,XX @@
 @cs_h         ... . .. ... .. ... ..  &s  imm=%uimm_cl_h  rs1=%rs1_3 rs2=%rs2_3
 @cm_pp        ... ...  ........   ..  &cmpp  %urlist      %spimm
 @cm_mv        ... ...  ... .. ... ..  &r2_s  rs2=%r2s     rs1=%r1s
+@cm_jt        ... ...  ........   ..  &cmjt  %index
 
 # *** RV32/64C Standard Extension (Quadrant 0) ***
 {
@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
   sq              101  ... ... .. ... 10 @c_sqsp
   c_fsd           101   ......  ..... 10 @c_sdsp
 
-  # *** RV64 and RV32 Zcmp Extension ***
+  # *** RV64 and RV32 Zcmp/Zcmt Extension ***
   [
     cm_push         101  11000  .... .. 10 @cm_pp
     cm_pop          101  11010  .... .. 10 @cm_pp
@@ -XXX,XX +XXX,XX @@ slli              000 .  .....  ..... 10 @c_shift2
     cm_popretz      101  11100  .... .. 10 @cm_pp
     cm_mva01s       101  011 ... 11 ... 10 @cm_mv
     cm_mvsa01       101  011 ... 01 ... 10 @cm_mv
+
+    cm_jalt         101  000   ........ 10 @cm_jt
   ]
 }
 sw                110 .  .....  ..... 10 @c_swsp
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
 
 /* Predicates */
 #if !defined(CONFIG_USER_ONLY)
-static RISCVException smstateen_acc_ok(CPURISCVState *env, int index,
-                                       uint64_t bit)
+RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
 {
     bool virt = riscv_cpu_virt_enabled(env);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr32(CPURISCVState *env, int csrno)
     return ctr(env, csrno);
 }
 
+static RISCVException zcmt(CPURISCVState *env, int csrno)
+{
+    if (!riscv_cpu_cfg(env)->ext_zcmt) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+#if !defined(CONFIG_USER_ONLY)
+    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+#endif
+
+    return RISCV_EXCP_NONE;
+}
+
 #if !defined(CONFIG_USER_ONLY)
 static RISCVException mctr(CPURISCVState *env, int csrno)
 {
@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
     return ret;
 }
 
+static RISCVException read_jvt(CPURISCVState *env, int csrno,
+                               target_ulong *val)
+{
+    *val = env->jvt;
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_jvt(CPURISCVState *env, int csrno,
+                                target_ulong val)
+{
+    env->jvt = val;
+    return RISCV_EXCP_NONE;
+}
+
 /* Control and Status Register function table */
 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     /* User Floating-Point CSRs */
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     /* Crypto Extension */
     [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
 
+    /* Zcmt Extension */
+    [CSR_JVT] = {"jvt", zcmt, read_jvt, write_jvt},
+
 #if !defined(CONFIG_USER_ONLY)
     /* Machine Timers and Counters */
     [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmu_ctr_state = {
     }
 };
 
+static bool jvt_needed(void *opaque)
+{
+    RISCVCPU *cpu = opaque;
+
+    return cpu->cfg.ext_zcmt;
+}
+
+static const VMStateDescription vmstate_jvt = {
+    .name = "cpu/jvt",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = jvt_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINTTL(env.jvt, RISCVCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
     .version_id = 7,
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_envcfg,
         &vmstate_debug,
         &vmstate_smstateen,
+        &vmstate_jvt,
         NULL
     }
 };
diff --git a/target/riscv/zce_helper.c b/target/riscv/zce_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/zce_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Zcmt Extension Helper for QEMU.
+ *
+ * Copyright (c) 2021-2022 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "exec/exec-all.h"
+#include "exec/helper-proto.h"
+#include "exec/cpu_ldst.h"
+
+target_ulong HELPER(cm_jalt)(CPURISCVState *env, uint32_t index)
+{
+
+#if !defined(CONFIG_USER_ONLY)
+    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
+    if (ret != RISCV_EXCP_NONE) {
+        riscv_raise_exception(env, ret, 0);
+    }
+#endif
+
+    target_ulong target;
+    target_ulong val = env->jvt;
+    int xlen = riscv_cpu_xlen(env);
+    uint8_t mode = get_field(val, JVT_MODE);
+    target_ulong base = val & JVT_BASE;
+    target_ulong t0;
+
+    if (mode != 0) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, 0);
+    }
+
+    if (xlen == 32) {
+        t0 = base + (index << 2);
+        target = cpu_ldl_code(env, t0);
+    } else {
+        t0 = base + (index << 3);
+        target = cpu_ldq_code(env, t0);
+    }
+
+    return target & ~0x1;
+}
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -XXX,XX +XXX,XX @@
 /*
- * RISC-V translation routines for the Zc[b,mp] Standard Extensions.
+ * RISC-V translation routines for the Zc[b,mp,mt] Standard Extensions.
  *
  * Copyright (c) 2021-2022 PLCT Lab
  *
@@ -XXX,XX +XXX,XX @@
         return false;            \
 } while (0)
 
+#define REQUIRE_ZCMT(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zcmt) \
+        return false;            \
+} while (0)
+
 static bool trans_c_zext_b(DisasContext *ctx, arg_c_zext_b *a)
 {
     REQUIRE_ZCB(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_cm_mvsa01(DisasContext *ctx, arg_cm_mvsa01 *a)
 
     return true;
 }
+
+static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
+{
+    REQUIRE_ZCMT(ctx);
+
+    /*
+     * Update pc to current for the non-unwinding exception
+     * that might come from cpu_ld*_code() in the helper.
+     */
+    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
+    gen_helper_cm_jalt(cpu_pc, cpu_env, tcg_constant_i32(a->index));
+
+    /* c.jt vs c.jalt depends on the index. */
+    if (a->index >= 32) {
+        gen_set_gpri(ctx, xRA, ctx->pc_succ_insn);
+    }
+
+    tcg_gen_lookup_and_goto_ptr();
+    ctx->base.is_jmp = DISAS_NORETURN;
+    return true;
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'bitmanip_helper.c',
   'translate.c',
   'm128_helper.c',
-  'crypto_helper.c'
+  'crypto_helper.c',
+  'zce_helper.c'
 ))
 riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Expose zca,zcb,zcf,zcd,zcmp,zcmt properties.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230307081403.61950-9-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_11_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
     ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
+    ISA_EXT_DATA_ENTRY(zca, true, PRIV_VERSION_1_12_0, ext_zca),
+    ISA_EXT_DATA_ENTRY(zcb, true, PRIV_VERSION_1_12_0, ext_zcb),
+    ISA_EXT_DATA_ENTRY(zcf, true, PRIV_VERSION_1_12_0, ext_zcf),
+    ISA_EXT_DATA_ENTRY(zcd, true, PRIV_VERSION_1_12_0, ext_zcd),
+    ISA_EXT_DATA_ENTRY(zcmp, true, PRIV_VERSION_1_12_0, ext_zcmp),
+    ISA_EXT_DATA_ENTRY(zcmt, true, PRIV_VERSION_1_12_0, ext_zcmt),
     ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
     ISA_EXT_DATA_ENTRY(zbb, true, PRIV_VERSION_1_12_0, ext_zbb),
     ISA_EXT_DATA_ENTRY(zbc, true, PRIV_VERSION_1_12_0, ext_zbc),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     /* These are experimental so mark with 'x-' */
     DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
     DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
+
+    DEFINE_PROP_BOOL("x-zca", RISCVCPU, cfg.ext_zca, false),
+    DEFINE_PROP_BOOL("x-zcb", RISCVCPU, cfg.ext_zcb, false),
+    DEFINE_PROP_BOOL("x-zcd", RISCVCPU, cfg.ext_zcd, false),
+    DEFINE_PROP_BOOL("x-zcf", RISCVCPU, cfg.ext_zcf, false),
+    DEFINE_PROP_BOOL("x-zcmp", RISCVCPU, cfg.ext_zcmp, false),
+    DEFINE_PROP_BOOL("x-zcmt", RISCVCPU, cfg.ext_zcmt, false),
+
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
     DEFINE_PROP_BOOL("x-smaia", RISCVCPU, cfg.ext_smaia, false),
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Zcmp/Zcmt instructions will override disasm for c.fld*/c.fsd*
instructions currently.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230307081403.61950-10-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 228 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 227 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_v_i,
     rv_codec_vsetvli,
     rv_codec_vsetivli,
+    rv_codec_zcb_ext,
+    rv_codec_zcb_mul,
+    rv_codec_zcb_lb,
+    rv_codec_zcb_lh,
+    rv_codec_zcmp_cm_pushpop,
+    rv_codec_zcmp_cm_mv,
+    rv_codec_zcmt_jt,
 } rv_codec;
 
 typedef enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_vsetvli = 766,
     rv_op_vsetivli = 767,
     rv_op_vsetvl = 768,
+    rv_op_c_zext_b = 769,
+    rv_op_c_sext_b = 770,
+    rv_op_c_zext_h = 771,
+    rv_op_c_sext_h = 772,
+    rv_op_c_zext_w = 773,
+    rv_op_c_not = 774,
+    rv_op_c_mul = 775,
+    rv_op_c_lbu = 776,
+    rv_op_c_lhu = 777,
+    rv_op_c_lh = 778,
+    rv_op_c_sb = 779,
+    rv_op_c_sh = 780,
+    rv_op_cm_push = 781,
+    rv_op_cm_pop = 782,
+    rv_op_cm_popret = 783,
+    rv_op_cm_popretz = 784,
+    rv_op_cm_mva01s = 785,
+    rv_op_cm_mvsa01 = 786,
+    rv_op_cm_jt = 787,
+    rv_op_cm_jalt = 788,
 } rv_op;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint8_t   rnum;
     uint8_t   vm;
     uint32_t  vzimm;
+    uint8_t   rlist;
 } rv_decode;
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
 #define rv_fmt_vd_vm                  "O\tDm"
 #define rv_fmt_vsetvli                "O\t0,1,v"
 #define rv_fmt_vsetivli               "O\t0,u,v"
+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
+#define rv_fmt_push_rlist             "O\tx,-i"
+#define rv_fmt_pop_rlist              "O\tx,i"
+#define rv_fmt_zcmt_index             "O\ti"
 
 /* pseudo-instruction constraints */
 
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data opcode_data[] = {
     { "vsext.vf8", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, rv_op_vsext_vf8, rv_op_vsext_vf8, 0 },
     { "vsetvli", rv_codec_vsetvli, rv_fmt_vsetvli, NULL, rv_op_vsetvli, rv_op_vsetvli, 0 },
     { "vsetivli", rv_codec_vsetivli, rv_fmt_vsetivli, NULL, rv_op_vsetivli, rv_op_vsetivli, 0 },
-    { "vsetvl", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, rv_op_vsetvl, rv_op_vsetvl, 0 }
+    { "vsetvl", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, rv_op_vsetvl, rv_op_vsetvl, 0 },
+    { "c.zext.b", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
+    { "c.sext.b", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
+    { "c.zext.h", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
+    { "c.sext.h", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
+    { "c.zext.w", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
+    { "c.not", rv_codec_zcb_ext, rv_fmt_rd, NULL, 0 },
+    { "c.mul", rv_codec_zcb_mul, rv_fmt_rd_rs2, NULL, 0, 0 },
+    { "c.lbu", rv_codec_zcb_lb, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
+    { "c.lhu", rv_codec_zcb_lh, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
+    { "c.lh", rv_codec_zcb_lh, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
+    { "c.sb", rv_codec_zcb_lb, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
+    { "c.sh", rv_codec_zcb_lh, rv_fmt_rs1_rs2_zce_ldst, NULL, 0, 0, 0 },
+    { "cm.push", rv_codec_zcmp_cm_pushpop, rv_fmt_push_rlist, NULL, 0, 0 },
+    { "cm.pop", rv_codec_zcmp_cm_pushpop, rv_fmt_pop_rlist, NULL, 0, 0 },
+    { "cm.popret", rv_codec_zcmp_cm_pushpop, rv_fmt_pop_rlist, NULL, 0, 0, 0 },
+    { "cm.popretz", rv_codec_zcmp_cm_pushpop, rv_fmt_pop_rlist, NULL, 0, 0 },
+    { "cm.mva01s", rv_codec_zcmp_cm_mv, rv_fmt_rd_rs2, NULL, 0, 0, 0 },
+    { "cm.mvsa01", rv_codec_zcmp_cm_mv, rv_fmt_rd_rs2, NULL, 0, 0, 0 },
+    { "cm.jt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
+    { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x000a: return "vxrm";
     case 0x000f: return "vcsr";
     case 0x0015: return "seed";
+    case 0x0017: return "jvt";
     case 0x0040: return "uscratch";
     case 0x0041: return "uepc";
     case 0x0042: return "ucause";
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 op = rv_op_c_ld;
             }
             break;
+        case 4:
+            switch ((inst >> 10) & 0b111) {
+            case 0: op = rv_op_c_lbu; break;
+            case 1:
+                if (((inst >> 6) & 1) == 0) {
+                    op = rv_op_c_lhu;
+                } else {
+                    op = rv_op_c_lh;
+                }
+                break;
+            case 2: op = rv_op_c_sb; break;
+            case 3:
+                if (((inst >> 6) & 1) == 0) {
+                    op = rv_op_c_sh;
+                }
+                break;
+            }
+            break;
         case 5:
             if (isa == rv128) {
                 op = rv_op_c_sq;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_c_and; break;
                 case 4: op = rv_op_c_subw; break;
                 case 5: op = rv_op_c_addw; break;
+                case 6: op = rv_op_c_mul; break;
+                case 7:
+                    switch ((inst >> 2) & 0b111) {
+                    case 0: op = rv_op_c_zext_b; break;
+                    case 1: op = rv_op_c_sext_b; break;
+                    case 2: op = rv_op_c_zext_h; break;
+                    case 3: op = rv_op_c_sext_h; break;
+                    case 4: op = rv_op_c_zext_w; break;
+                    case 5: op = rv_op_c_not; break;
+                    }
+                    break;
                 }
                 break;
             }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 op = rv_op_c_sqsp;
             } else {
                 op = rv_op_c_fsdsp;
+                if (((inst >> 12) & 0b01)) {
+                    switch ((inst >> 8) & 0b01111) {
+                    case 8:
+                        if (((inst >> 4) & 0b01111) >= 4) {
+                            op = rv_op_cm_push;
+                        }
+                        break;
+                    case 10:
+                        if (((inst >> 4) & 0b01111) >= 4) {
+                            op = rv_op_cm_pop;
+                        }
+                        break;
+                    case 12:
+                        if (((inst >> 4) & 0b01111) >= 4) {
+                            op = rv_op_cm_popretz;
+                        }
+                        break;
+                    case 14:
+                        if (((inst >> 4) & 0b01111) >= 4) {
+                            op = rv_op_cm_popret;
+                        }
+                        break;
+                    }
+                } else {
+                    switch ((inst >> 10) & 0b011) {
+                    case 0:
+                        if (((inst >> 2) & 0xFF) >= 32) {
+                            op = rv_op_cm_jalt;
+                        } else {
+                            op = rv_op_cm_jt;
+                        }
+                        break;
+                    case 3:
+                        switch ((inst >> 5) & 0b011) {
+                        case 1: op = rv_op_cm_mvsa01; break;
+                        case 3: op = rv_op_cm_mva01s; break;
+                        }
+                        break;
+                    }
+                }
             }
             break;
         case 6: op = rv_op_c_swsp; break;
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_crs2q(rv_inst inst)
     return (inst << 59) >> 61;
 }
 
+static uint32_t calculate_xreg(uint32_t sreg)
+{
+    return sreg < 2 ? sreg + 8 : sreg + 16;
+}
+
+static uint32_t operand_sreg1(rv_inst inst)
+{
+    return calculate_xreg((inst << 54) >> 61);
+}
+
+static uint32_t operand_sreg2(rv_inst inst)
+{
+    return calculate_xreg((inst << 59) >> 61);
+}
+
 static uint32_t operand_crd(rv_inst inst)
 {
     return (inst << 52) >> 59;
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_vm(rv_inst inst)
     return (inst << 38) >> 63;
 }
 
+static uint32_t operand_uimm_c_lb(rv_inst inst)
+{
+    return (((inst << 58) >> 63) << 1) |
+        ((inst << 57) >> 63);
+}
+
+static uint32_t operand_uimm_c_lh(rv_inst inst)
+{
+    return (((inst << 58) >> 63) << 1);
+}
+
+static uint32_t operand_zcmp_spimm(rv_inst inst)
+{
+    return ((inst << 60) >> 62) << 4;
+}
+
+static uint32_t operand_zcmp_rlist(rv_inst inst)
+{
+    return ((inst << 56) >> 60);
+}
+
+static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
+{
+    int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
+    int regs = rlist == 15 ? 13 : rlist - 3;
+    uint32_t stack_adj_base = ROUND_UP(regs << xlen_bytes_log2, 16);
+    return stack_adj_base + spimm;
+}
+
+static uint32_t operand_zcmp_stack_adj(rv_inst inst, rv_isa isa)
+{
+    return calculate_stack_adj(isa, operand_zcmp_rlist(inst),
+                               operand_zcmp_spimm(inst));
+}
+
+static uint32_t operand_tbl_index(rv_inst inst)
+{
+    return ((inst << 54) >> 56);
+}
+
 /* decode operands */
 
 static void decode_inst_operands(rv_decode *dec, rv_isa isa)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
         dec->imm = operand_vimm(inst);
         dec->vzimm = operand_vzimm10(inst);
         break;
+    case rv_codec_zcb_lb:
+        dec->rs1 = operand_crs1q(inst) + 8;
+        dec->rs2 = operand_crs2q(inst) + 8;
+        dec->imm = operand_uimm_c_lb(inst);
+        break;
+    case rv_codec_zcb_lh:
+        dec->rs1 = operand_crs1q(inst) + 8;
+        dec->rs2 = operand_crs2q(inst) + 8;
+        dec->imm = operand_uimm_c_lh(inst);
+        break;
+    case rv_codec_zcb_ext:
+        dec->rd = operand_crs1q(inst) + 8;
+        break;
+    case rv_codec_zcb_mul:
+        dec->rd = operand_crs1rdq(inst) + 8;
+        dec->rs2 = operand_crs2q(inst) + 8;
+        break;
+    case rv_codec_zcmp_cm_pushpop:
+        dec->imm = operand_zcmp_stack_adj(inst, isa);
+        dec->rlist = operand_zcmp_rlist(inst);
+        break;
+    case rv_codec_zcmp_cm_mv:
+        dec->rd = operand_sreg1(inst);
+        dec->rs2 = operand_sreg2(inst);
+        break;
+    case rv_codec_zcmt_jt:
+        dec->imm = operand_tbl_index(inst);
+        break;
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
         case ')':
             append(buf, ")", buflen);
             break;
+        case '-':
+            append(buf, "-", buflen);
+            break;
         case 'b':
             snprintf(tmp, sizeof(tmp), "%d", dec->bs);
             append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             append(buf, vma, buflen);
             break;
         }
+        case 'x': {
+            switch (dec->rlist) {
+            case 4:
+                snprintf(tmp, sizeof(tmp), "{ra}");
+                break;
+            case 5:
+                snprintf(tmp, sizeof(tmp), "{ra, s0}");
+                break;
+            case 15:
+                snprintf(tmp, sizeof(tmp), "{ra, s0-s11}");
+                break;
+            default:
+                snprintf(tmp, sizeof(tmp), "{ra, s0-s%d}", dec->rlist - 5);
+                break;
+            }
+            append(buf, tmp, buflen);
+            break;
+        }
         default:
             break;
         }
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add and expose property for Zce:
* Specifying Zce without F includes Zca, Zcb, Zcmp, Zcmt.
* Specifying Zce with F includes Zca, Zcb, Zcmp, Zcmt and Zcf.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230307081403.61950-11-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 +
 target/riscv/cpu.c | 12 ++++++++++++
 2 files changed, 13 insertions(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

When I boot a ubuntu image, QEMU output a "Bad icount read" message and exit.
The reason is that when execute helper_mret or helper_sret, it will
cause a call to icount_get_raw_locked (), which needs set can_do_io flag
on cpustate.

Thus we setting this flag when execute these two instructions.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230324064011.976-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_privileged.c.inc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
 #ifndef CONFIG_USER_ONLY
     if (has_ext(ctx, RVS)) {
         decode_save_opc(ctx);
+        if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
+            gen_io_start();
+        }
         gen_helper_sret(cpu_pc, cpu_env);
         exit_tb(ctx); /* no chaining */
         ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 {
 #ifndef CONFIG_USER_ONLY
     decode_save_opc(ctx);
+    if (tb_cflags(ctx->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
     gen_helper_mret(cpu_pc, cpu_env);
     exit_tb(ctx); /* no chaining */
     ctx->base.is_jmp = DISAS_NORETURN;
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The assignment is done under the condition riscv_cpu_virt_enabled()=true.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230327080858.39703-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                 riscv_cpu_swap_hypervisor_regs(env);
                 env->hstatus = set_field(env->hstatus, HSTATUS_SPVP,
                                          env->priv);
-                env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
-                                         riscv_cpu_virt_enabled(env));
-
+                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, true);
 
                 htval = env->guest_phys_fault_addr;
 
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Check on riscv_cpu_virt_enabled contains the check on RVH.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230327080858.39703-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    if (riscv_has_ext(env, RVH) && riscv_cpu_virt_enabled(env) &&
-        get_field(env->hstatus, HSTATUS_VTSR)) {
+    if (riscv_cpu_virt_enabled(env) && get_field(env->hstatus, HSTATUS_VTSR)) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     }
 
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Since env->virt.VIRT_ONOFF is initialized as false, and will not be set
to true when RVH is disabled, so we can just return this bit(false) when
RVH is not disabled.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230327080858.39703-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
 
 bool riscv_cpu_virt_enabled(CPURISCVState *env)
 {
-    if (!riscv_has_ext(env, RVH)) {
-        return false;
-    }
-
     return get_field(env->virt, VIRT_ONOFF);
 }
 
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

In current implementation, riscv_cpu_set_virt_enabled is only called when
RVH is enabled.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230327080858.39703-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_virt_enabled(CPURISCVState *env)
     return get_field(env->virt, VIRT_ONOFF);
 }
 
+/* This function can only be called to set virt when RVH is enabled */
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 {
-    if (!riscv_has_ext(env, RVH)) {
-        return;
-    }
-
     /* Flush the TLB on all virt mode changes. */
     if (get_field(env->virt, VIRT_ONOFF) != enable) {
         tlb_flush(env_cpu(env));
-- 
2.40.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Currently we only use the env->virt to encode the virtual mode enabled
status. Let's make it a bool type.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-ID: <20230325145348.1208-1-zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230327080858.39703-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 2 +-
 target/riscv/cpu_bits.h   | 3 ---
 target/riscv/cpu_helper.c | 6 +++---
 target/riscv/machine.c    | 6 +++---
 target/riscv/translate.c  | 4 ++--
 5 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
 #ifndef CONFIG_USER_ONLY
     target_ulong priv;
     /* This contains QEMU specific information about the virt state. */
-    target_ulong virt;
+    bool virt_enabled;
     target_ulong geilen;
     uint64_t resetvec;
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define PRV_H 2 /* Reserved */
 #define PRV_M 3
 
-/* Virtulisation Register Fields */
-#define VIRT_ONOFF          1
-
 /* RV32 satp CSR field masks */
 #define SATP32_MODE         0x80000000
 #define SATP32_ASID         0x7fc00000
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
 
 bool riscv_cpu_virt_enabled(CPURISCVState *env)
 {
-    return get_field(env->virt, VIRT_ONOFF);
+    return env->virt_enabled;
 }
 
 /* This function can only be called to set virt when RVH is enabled */
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 {
     /* Flush the TLB on all virt mode changes. */
-    if (get_field(env->virt, VIRT_ONOFF) != enable) {
+    if (env->virt_enabled != enable) {
         tlb_flush(env_cpu(env));
     }
 
-    env->virt = set_field(env->virt, VIRT_ONOFF, enable);
+    env->virt_enabled = enable;
 
     if (enable) {
         /*
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_jvt = {
 
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
-    .version_id = 7,
-    .minimum_version_id = 7,
+    .version_id = 8,
+    .minimum_version_id = 8,
     .post_load = riscv_cpu_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_UINT32(env.misa_mxl_max, RISCVCPU),
         VMSTATE_UINT32(env.misa_ext_mask, RISCVCPU),
         VMSTATE_UINTTL(env.priv, RISCVCPU),
-        VMSTATE_UINTTL(env.virt, RISCVCPU),
+        VMSTATE_BOOL(env.virt_enabled, RISCVCPU),
         VMSTATE_UINT64(env.resetvec, RISCVCPU),
         VMSTATE_UINTTL(env.mhartid, RISCVCPU),
         VMSTATE_UINT64(env.mstatus, RISCVCPU),
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_disas_log(const DisasContextBase *dcbase,
 
     fprintf(logfile, "IN: %s\n", lookup_symbol(dcbase->pc_first));
 #ifndef CONFIG_USER_ONLY
-    fprintf(logfile, "Priv: "TARGET_FMT_ld"; Virt: "TARGET_FMT_ld"\n",
-            env->priv, env->virt);
+    fprintf(logfile, "Priv: "TARGET_FMT_ld"; Virt: %d\n",
+            env->priv, env->virt_enabled);
 #endif
     target_disas(logfile, cpu, dcbase->pc_first, dcbase->tb->size);
 }
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Remove redundant parentheses in get_physical_address.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230327080858.39703-8-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ restart:
             if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
                 *prot |= PAGE_READ;
             }
-            if ((pte & PTE_X)) {
+            if (pte & PTE_X) {
                 *prot |= PAGE_EXEC;
             }
             /* add write permission on stores or if the page is already dirty,
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Function get_physical_address() translates both virtual address and
guest physical address, and the latter is 34-bits for Sv32x4. So we
should use vaddr type for 'addr' parameter.

From: Weiwei Li <liweiwei@iscas.ac.cn>

decode_save_opc() will not work for generate_exception(), since 0 is passed
to riscv_raise_exception() as pc in helper_raise_exception(), and bins will
not be restored in this case.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230330034636.44585-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvh.c.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/insn_trans/trans_rvh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvh.c.inc
+++ b/target/riscv/insn_trans/trans_rvh.c.inc
@@ -XXX,XX +XXX,XX @@
 static bool check_access(DisasContext *ctx)
 {
     if (!ctx->hlsx) {
+        tcg_gen_st_i32(tcg_constant_i32(ctx->opcode), cpu_env,
+                       offsetof(CPURISCVState, bins));
         if (ctx->virt_enabled) {
             generate_exception(ctx, RISCV_EXCP_VIRT_INSTRUCTION_FAULT);
         } else {
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Directly use env->virt_enabled instead.

Suggested-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230405085813.40643-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  1 -
 target/riscv/cpu.c        |  2 +-
 target/riscv/cpu_helper.c | 51 ++++++++++++++++++---------------------
 target/riscv/csr.c        | 46 +++++++++++++++++------------------
 target/riscv/debug.c      | 10 ++++----
 target/riscv/op_helper.c  | 18 +++++++-------
 target/riscv/pmu.c        |  4 +--
 target/riscv/translate.c  |  2 +-
 8 files changed, 64 insertions(+), 70 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_fp_enabled(CPURISCVState *env);
 target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
 void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
 bool riscv_cpu_vector_enabled(CPURISCVState *env);
-bool riscv_cpu_virt_enabled(CPURISCVState *env);
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
 bool riscv_cpu_two_stage_lookup(int mmu_idx);
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVH)) {
-        qemu_fprintf(f, " %s %d\n", "V      =  ", riscv_cpu_virt_enabled(env));
+        qemu_fprintf(f, " %s %d\n", "V      =  ", env->virt_enabled);
     }
 #endif
     qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc      ", env->pc);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
 
     if (riscv_has_ext(env, RVH)) {
         if (env->priv == PRV_M ||
-            (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
-            (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
+            (env->priv == PRV_S && !env->virt_enabled) ||
+            (env->priv == PRV_U && !env->virt_enabled &&
                 get_field(env->hstatus, HSTATUS_HU))) {
             flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
         }
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
     uint64_t irqs, pending, mie, hsie, vsie;
 
     /* Determine interrupt enable state of all privilege modes */
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         mie = 1;
         hsie = 1;
         vsie = (env->priv < PRV_S) ||
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 bool riscv_cpu_fp_enabled(CPURISCVState *env)
 {
     if (env->mstatus & MSTATUS_FS) {
-        if (riscv_cpu_virt_enabled(env) && !(env->mstatus_hs & MSTATUS_FS)) {
+        if (env->virt_enabled && !(env->mstatus_hs & MSTATUS_FS)) {
             return false;
         }
         return true;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_fp_enabled(CPURISCVState *env)
 bool riscv_cpu_vector_enabled(CPURISCVState *env)
 {
     if (env->mstatus & MSTATUS_VS) {
-        if (riscv_cpu_virt_enabled(env) && !(env->mstatus_hs & MSTATUS_VS)) {
+        if (env->virt_enabled && !(env->mstatus_hs & MSTATUS_VS)) {
             return false;
         }
         return true;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
     if (riscv_has_ext(env, RVF)) {
         mstatus_mask |= MSTATUS_FS;
     }
-    bool current_virt = riscv_cpu_virt_enabled(env);
+    bool current_virt = env->virt_enabled;
 
     g_assert(riscv_has_ext(env, RVH));
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
     env->geilen = geilen;
 }
 
-bool riscv_cpu_virt_enabled(CPURISCVState *env)
-{
-    return env->virt_enabled;
-}
-
 /* This function can only be called to set virt when RVH is enabled */
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 {
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
     CPUState *cs = env_cpu(env);
     uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         gein = get_field(env->hstatus, HSTATUS_VGEIN);
         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
     }
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      * was called. Background registers will be used if the guest has
      * forced a two stage translation to be on (in HS or M mode).
      */
-    if (!riscv_cpu_virt_enabled(env) && two_stage) {
+    if (!env->virt_enabled && two_stage) {
         use_background = true;
     }
 
@@ -XXX,XX +XXX,XX @@ restart:
         bool pbmte = env->menvcfg & MENVCFG_PBMTE;
         bool hade = env->menvcfg & MENVCFG_HADE;
 
-        if (first_stage && two_stage && riscv_cpu_virt_enabled(env)) {
+        if (first_stage && two_stage && env->virt_enabled) {
             pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
             hade = hade && (env->henvcfg & HENVCFG_HADE);
         }
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
 
     switch (access_type) {
     case MMU_INST_FETCH:
-        if (riscv_cpu_virt_enabled(env) && !first_stage) {
+        if (env->virt_enabled && !first_stage) {
             cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
         } else {
             cs->exception_index = page_fault_exceptions ?
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
     int mmu_idx = cpu_mmu_index(&cpu->env, false);
 
     if (get_physical_address(env, &phys_addr, &prot, addr, NULL, 0, mmu_idx,
-                             true, riscv_cpu_virt_enabled(env), true)) {
+                             true, env->virt_enabled, true)) {
         return -1;
     }
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
                                  0, mmu_idx, false, true, true)) {
             return -1;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     }
 
     env->badaddr = addr;
-    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+    env->two_stage_lookup = env->virt_enabled ||
                             riscv_cpu_two_stage_lookup(mmu_idx);
     env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
         g_assert_not_reached();
     }
     env->badaddr = addr;
-    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+    env->two_stage_lookup = env->virt_enabled ||
                             riscv_cpu_two_stage_lookup(mmu_idx);
     env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     }
 
     pmu_tlb_fill_incr_ctr(cpu, access_type);
-    if (riscv_cpu_virt_enabled(env) ||
+    if (env->virt_enabled ||
         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
          access_type != MMU_INST_FETCH)) {
         /* Two stage lookup */
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     } else {
         raise_mmu_exception(env, address, access_type, pmp_violation,
                             first_stage_error,
-                            riscv_cpu_virt_enabled(env) ||
+                            env->virt_enabled ||
                                 riscv_cpu_two_stage_lookup(mmu_idx),
                             two_stage_indirect_error);
         cpu_loop_exit_restore(cs, retaddr);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
 
             if (env->priv == PRV_M) {
                 cause = RISCV_EXCP_M_ECALL;
-            } else if (env->priv == PRV_S && riscv_cpu_virt_enabled(env)) {
+            } else if (env->priv == PRV_S && env->virt_enabled) {
                 cause = RISCV_EXCP_VS_ECALL;
-            } else if (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) {
+            } else if (env->priv == PRV_S && !env->virt_enabled) {
                 cause = RISCV_EXCP_S_ECALL;
             } else if (env->priv == PRV_U) {
                 cause = RISCV_EXCP_U_ECALL;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         if (riscv_has_ext(env, RVH)) {
             uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
 
-            if (riscv_cpu_virt_enabled(env) && ((hdeleg >> cause) & 1)) {
+            if (env->virt_enabled && ((hdeleg >> cause) & 1)) {
                 /* Trap to VS mode */
                 /*
                  * See if we need to adjust cause. Yes if its VS mode interrupt
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                     cause = cause - 1;
                 }
                 write_gva = false;
-            } else if (riscv_cpu_virt_enabled(env)) {
+            } else if (env->virt_enabled) {
                 /* Trap into HS mode, from virt */
                 riscv_cpu_swap_hypervisor_regs(env);
                 env->hstatus = set_field(env->hstatus, HSTATUS_SPVP,
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     } else {
         /* handle the trap in M-mode */
         if (riscv_has_ext(env, RVH)) {
-            if (riscv_cpu_virt_enabled(env)) {
+            if (env->virt_enabled) {
                 riscv_cpu_swap_hypervisor_regs(env);
             }
             env->mstatus = set_field(env->mstatus, MSTATUS_MPV,
-                                     riscv_cpu_virt_enabled(env));
-            if (riscv_cpu_virt_enabled(env) && tval) {
+                                     env->virt_enabled);
+            if (env->virt_enabled && tval) {
                 env->mstatus = set_field(env->mstatus, MSTATUS_GVA, 1);
             }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
 #if !defined(CONFIG_USER_ONLY)
 RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
 {
-    bool virt = riscv_cpu_virt_enabled(env);
+    bool virt = env->virt_enabled;
 
     if (env->priv == PRV_M || !riscv_cpu_cfg(env)->ext_smstateen) {
         return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ skip_ext_pmu_check:
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (!get_field(env->hcounteren, ctr_mask) ||
             (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException hstateenh(CPURISCVState *env, int csrno)
 
 static RISCVException sstateen(CPURISCVState *env, int csrno)
 {
-    bool virt = riscv_cpu_virt_enabled(env);
+    bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
 
     if (!riscv_cpu_cfg(env)->ext_smstateen) {
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
               get_field(env->henvcfg, HENVCFG_STCE))) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException seed(CPURISCVState *env, int csrno)
      */
     if (env->priv == PRV_M) {
         return RISCV_EXCP_NONE;
-    } else if (riscv_cpu_virt_enabled(env)) {
+    } else if (env->virt_enabled) {
         if (env->mseccfg & MSECCFG_SSEED) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         } else {
@@ -XXX,XX +XXX,XX @@ static int read_scountovf(CPURISCVState *env, int csrno, target_ulong *val)
 static RISCVException read_time(CPURISCVState *env, int csrno,
                                 target_ulong *val)
 {
-    uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
+    uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
 
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_time(CPURISCVState *env, int csrno,
 static RISCVException read_timeh(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
-    uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
+    uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
 
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
                                     target_ulong *val)
 {
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         *val = env->vstimecmp;
     } else {
         *val = env->stimecmp;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
                                      target_ulong *val)
 {
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         *val = env->vstimecmp >> 32;
     } else {
         *val = env->stimecmp >> 32;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
                                       target_ulong val)
 {
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
@@ -XXX,XX +XXX,XX @@ static int read_mtopi(CPURISCVState *env, int csrno, target_ulong *val)
 
 static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
 {
-    if (!riscv_cpu_virt_enabled(env)) {
+    if (!env->virt_enabled) {
         return csrno;
     }
 
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
 
 done:
     if (ret) {
-        return (riscv_cpu_virt_enabled(env) && virt) ?
+        return (env->virt_enabled && virt) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static int rmw_xtopei(CPURISCVState *env, int csrno, target_ulong *val,
 
 done:
     if (ret) {
-        return (riscv_cpu_virt_enabled(env) && virt) ?
+        return (env->virt_enabled && virt) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
 static RISCVException read_sstateen(CPURISCVState *env, int csrno,
                                     target_ulong *val)
 {
-    bool virt = riscv_cpu_virt_enabled(env);
+    bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
 
     *val = env->sstateen[index] & env->mstateen[index];
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstateen(CPURISCVState *env, int csrno,
 static RISCVException write_sstateen(CPURISCVState *env, int csrno,
                                      uint64_t mask, target_ulong new_val)
 {
-    bool virt = riscv_cpu_virt_enabled(env);
+    bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
     uint64_t wr_mask;
     uint64_t *reg;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
     RISCVException ret;
     uint64_t mask = env->mideleg & S_MODE_INTERRUPTS;
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
     RISCVException ret;
     uint64_t mask = env->mideleg & sip_writable_mask;
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
@@ -XXX,XX +XXX,XX @@ static int read_stopi(CPURISCVState *env, int csrno, target_ulong *val)
     int irq;
     uint8_t iprio;
 
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         return read_vstopi(env, CSR_VSTOPI, val);
     }
 
@@ -XXX,XX +XXX,XX @@ static int read_hvipriox(CPURISCVState *env, int first_index,
 
     /* First index has to be a multiple of number of irqs per register */
     if (first_index % num_irqs) {
-        return (riscv_cpu_virt_enabled(env)) ?
+        return (env->virt_enabled) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static int write_hvipriox(CPURISCVState *env, int first_index,
 
     /* First index has to be a multiple of number of irqs per register */
     if (first_index % num_irqs) {
-        return (riscv_cpu_virt_enabled(env)) ?
+        return (env->virt_enabled) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
     int csr_priv, effective_priv = env->priv;
 
     if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
-        !riscv_cpu_virt_enabled(env)) {
+        !env->virt_enabled) {
         /*
          * We are in HS mode. Add 1 to the effective privledge level to
          * allow us to access the Hypervisor CSRs.
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
 
     csr_priv = get_field(csrno, 0x300);
     if (!env->debugger && (effective_priv < csr_priv)) {
-        if (csr_priv == (PRV_S + 1) && riscv_cpu_virt_enabled(env)) {
+        if (csr_priv == (PRV_S + 1) && env->virt_enabled) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
         return RISCV_EXCP_ILLEGAL_INST;
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ itrigger_set_count(CPURISCVState *env, int index, int value)
 static bool check_itrigger_priv(CPURISCVState *env, int index)
 {
     target_ulong tdata1 = env->tdata1[index];
-    if (riscv_cpu_virt_enabled(env)) {
+    if (env->virt_enabled) {
         /* check VU/VS bit against current privilege level */
         return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
                (get_field(tdata1, ITRIGGER_VU) == env->priv);
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
             switch (trigger_type) {
             case TRIGGER_TYPE_AD_MATCH:
                 /* type 2 trigger cannot be fired in VU/VS mode */
-                if (riscv_cpu_virt_enabled(env)) {
+                if (env->virt_enabled) {
                     return false;
                 }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                 pc = env->tdata2[i];
 
                 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
-                    if (riscv_cpu_virt_enabled(env)) {
+                    if (env->virt_enabled) {
                         /* check VU/VS bit against current privilege level */
                         if ((ctrl >> 23) & BIT(env->priv)) {
                             return true;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
         switch (trigger_type) {
         case TRIGGER_TYPE_AD_MATCH:
             /* type 2 trigger cannot be fired in VU/VS mode */
-            if (riscv_cpu_virt_enabled(env)) {
+            if (env->virt_enabled) {
                 return false;
             }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
             }
 
             if ((wp->flags & flags) && (wp->vaddr == addr)) {
-                if (riscv_cpu_virt_enabled(env)) {
+                if (env->virt_enabled) {
                     /* check VU/VS bit against current privilege level */
                     if ((ctrl >> 23) & BIT(env->priv)) {
                         return true;
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void check_zicbo_envcfg(CPURISCVState *env, target_ulong envbits,
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
     }
 
-    if (riscv_cpu_virt_enabled(env) &&
+    if (env->virt_enabled &&
         (((env->priv < PRV_H) && !get_field(env->henvcfg, envbits)) ||
          ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    if (riscv_cpu_virt_enabled(env) && get_field(env->hstatus, HSTATUS_VTSR)) {
+    if (env->virt_enabled && get_field(env->hstatus, HSTATUS_VTSR)) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     }
 
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
     }
     env->mstatus = mstatus;
 
-    if (riscv_has_ext(env, RVH) && !riscv_cpu_virt_enabled(env)) {
+    if (riscv_has_ext(env, RVH) && !env->virt_enabled) {
         /* We support Hypervisor extensions and virtulisation is disabled */
         target_ulong hstatus = env->hstatus;
 
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
     bool prv_s = env->priv == PRV_S;
 
     if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) ||
-        (rvs && prv_u && !riscv_cpu_virt_enabled(env))) {
+        (rvs && prv_u && !env->virt_enabled)) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-    } else if (riscv_cpu_virt_enabled(env) && (prv_u ||
+    } else if (env->virt_enabled && (prv_u ||
         (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     } else {
@@ -XXX,XX +XXX,XX @@ void helper_tlb_flush(CPURISCVState *env)
         (env->priv == PRV_S &&
          get_field(env->mstatus, MSTATUS_TVM))) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-    } else if (riscv_has_ext(env, RVH) && riscv_cpu_virt_enabled(env) &&
+    } else if (riscv_has_ext(env, RVH) && env->virt_enabled &&
                get_field(env->hstatus, HSTATUS_VTVM)) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     } else {
@@ -XXX,XX +XXX,XX @@ void helper_hyp_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
 
-    if (env->priv == PRV_S && riscv_cpu_virt_enabled(env)) {
+    if (env->priv == PRV_S && env->virt_enabled) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     }
 
     if (env->priv == PRV_M ||
-        (env->priv == PRV_S && !riscv_cpu_virt_enabled(env))) {
+        (env->priv == PRV_S && !env->virt_enabled)) {
         tlb_flush(cs);
         return;
     }
@@ -XXX,XX +XXX,XX @@ void helper_hyp_tlb_flush(CPURISCVState *env)
 
 void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
 {
-    if (env->priv == PRV_S && !riscv_cpu_virt_enabled(env) &&
+    if (env->priv == PRV_S && !env->virt_enabled &&
         get_field(env->mstatus, MSTATUS_TVM)) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv32(RISCVCPU *cpu, uint32_t ctr_idx)
     CPURISCVState *env = &cpu->env;
     target_ulong max_val = UINT32_MAX;
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
-    bool virt_on = riscv_cpu_virt_enabled(env);
+    bool virt_on = env->virt_enabled;
 
     /* Privilege mode filtering */
     if ((env->priv == PRV_M &&
@@ -XXX,XX +XXX,XX @@ static int riscv_pmu_incr_ctr_rv64(RISCVCPU *cpu, uint32_t ctr_idx)
     CPURISCVState *env = &cpu->env;
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
     uint64_t max_val = UINT64_MAX;
-    bool virt_on = riscv_cpu_virt_enabled(env);
+    bool virt_on = env->virt_enabled;
 
     /* Privilege mode filtering */
     if ((env->priv == PRV_M &&
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->priv_ver = env->priv_ver;
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVH)) {
-        ctx->virt_enabled = riscv_cpu_virt_enabled(env);
+        ctx->virt_enabled = env->virt_enabled;
     } else {
         ctx->virt_enabled = false;
     }
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Fix identation problems, and try to use the same indentation strategy
in the same file.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230405085813.40643-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h                      |   9 +-
 target/riscv/arch_dump.c                |   4 +-
 target/riscv/cpu.c                      |  40 +++---
 target/riscv/cpu_helper.c               | 163 ++++++++++++------------
 target/riscv/fpu_helper.c               |  24 ++--
 target/riscv/m128_helper.c              |  16 +--
 target/riscv/machine.c                  |  18 +--
 target/riscv/op_helper.c                |   4 +-
 target/riscv/pmp.c                      |  19 +--
 target/riscv/translate.c                |   4 +-
 target/riscv/vector_helper.c            | 159 +++++++++++------------
 target/riscv/insn_trans/trans_rvv.c.inc |  28 ++--
 12 files changed, 247 insertions(+), 241 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 } pmp_table_t;
 
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
-    target_ulong val);
+                      target_ulong val);
 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
 
 void mseccfg_csr_write(CPURISCVState *env, target_ulong val);
 target_ulong mseccfg_csr_read(CPURISCVState *env);
 
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-    target_ulong val);
+                       target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
-    target_ulong mode);
+                       target_ulong size, pmp_priv_t privs,
+                       pmp_priv_t *allowed_privs,
+                       target_ulong mode);
 target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
                               target_ulong tlb_sa, target_ulong tlb_ea);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/arch_dump.c
+++ b/target/riscv/arch_dump.c
@@ -XXX,XX +XXX,XX @@ int cpu_get_dump_info(ArchDumpInfo *info,
     info->d_class = ELFCLASS32;
 #endif
 
-    info->d_endian = (env->mstatus & MSTATUS_UBE) != 0
-                     ? ELFDATA2MSB : ELFDATA2LSB;
+    info->d_endian = (env->mstatus & MSTATUS_UBE) != 0 ?
+                     ELFDATA2MSB : ELFDATA2LSB;
 
     return 0;
 }
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
 };
 
 #define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
-{#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+    {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
 /**
  * Here are the ordering rules of extension naming defined by RISC-V
@@ -XXX,XX +XXX,XX @@ static void isa_ext_update_enabled(RISCVCPU *cpu,
 }
 
 const char * const riscv_int_regnames[] = {
-  "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
-  "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
-  "x14/a4",  "x15/a5", "x16/a6", "x17/a7", "x18/s2", "x19/s3",  "x20/s4",
-  "x21/s5",  "x22/s6", "x23/s7", "x24/s8", "x25/s9", "x26/s10", "x27/s11",
-  "x28/t3",  "x29/t4", "x30/t5", "x31/t6"
+    "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
+    "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
+    "x14/a4",  "x15/a5", "x16/a6", "x17/a7", "x18/s2", "x19/s3",  "x20/s4",
+    "x21/s5",  "x22/s6", "x23/s7", "x24/s8", "x25/s9", "x26/s10", "x27/s11",
+    "x28/t3",  "x29/t4", "x30/t5", "x31/t6"
 };
 
 const char * const riscv_int_regnamesh[] = {
-  "x0h/zeroh", "x1h/rah",  "x2h/sph",   "x3h/gph",   "x4h/tph",  "x5h/t0h",
-  "x6h/t1h",   "x7h/t2h",  "x8h/s0h",   "x9h/s1h",   "x10h/a0h", "x11h/a1h",
-  "x12h/a2h",  "x13h/a3h", "x14h/a4h",  "x15h/a5h",  "x16h/a6h", "x17h/a7h",
-  "x18h/s2h",  "x19h/s3h", "x20h/s4h",  "x21h/s5h",  "x22h/s6h", "x23h/s7h",
-  "x24h/s8h",  "x25h/s9h", "x26h/s10h", "x27h/s11h", "x28h/t3h", "x29h/t4h",
-  "x30h/t5h",  "x31h/t6h"
+    "x0h/zeroh", "x1h/rah",  "x2h/sph",   "x3h/gph",   "x4h/tph",  "x5h/t0h",
+    "x6h/t1h",   "x7h/t2h",  "x8h/s0h",   "x9h/s1h",   "x10h/a0h", "x11h/a1h",
+    "x12h/a2h",  "x13h/a3h", "x14h/a4h",  "x15h/a5h",  "x16h/a6h", "x17h/a7h",
+    "x18h/s2h",  "x19h/s3h", "x20h/s4h",  "x21h/s5h",  "x22h/s6h", "x23h/s7h",
+    "x24h/s8h",  "x25h/s9h", "x26h/s10h", "x27h/s11h", "x28h/t3h", "x29h/t4h",
+    "x30h/t5h",  "x31h/t6h"
 };
 
 const char * const riscv_fpr_regnames[] = {
-  "f0/ft0",   "f1/ft1",  "f2/ft2",   "f3/ft3",   "f4/ft4",  "f5/ft5",
-  "f6/ft6",   "f7/ft7",  "f8/fs0",   "f9/fs1",   "f10/fa0", "f11/fa1",
-  "f12/fa2",  "f13/fa3", "f14/fa4",  "f15/fa5",  "f16/fa6", "f17/fa7",
-  "f18/fs2",  "f19/fs3", "f20/fs4",  "f21/fs5",  "f22/fs6", "f23/fs7",
-  "f24/fs8",  "f25/fs9", "f26/fs10", "f27/fs11", "f28/ft8", "f29/ft9",
-  "f30/ft10", "f31/ft11"
+    "f0/ft0",   "f1/ft1",  "f2/ft2",   "f3/ft3",   "f4/ft4",  "f5/ft5",
+    "f6/ft6",   "f7/ft7",  "f8/fs0",   "f9/fs1",   "f10/fa0", "f11/fa1",
+    "f12/fa2",  "f13/fa3", "f14/fa4",  "f15/fa5",  "f16/fa6", "f17/fa7",
+    "f18/fs2",  "f19/fs3", "f20/fs4",  "f21/fs5",  "f22/fs6", "f23/fs7",
+    "f24/fs8",  "f25/fs9", "f26/fs10", "f27/fs11", "f28/ft8", "f29/ft9",
+    "f30/ft10", "f31/ft11"
 };
 
 static const char * const riscv_excp_names[] = {
@@ -XXX,XX +XXX,XX @@ static void riscv_any_cpu_init(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(RISCV_CPU(obj),
-            riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
-                                    VM_1_10_SV32 : VM_1_10_SV57);
+        riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
+        VM_1_10_SV32 : VM_1_10_SV57);
 #endif
 
     set_priv_version(env, PRIV_VERSION_1_12_0);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
         flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
         flags = FIELD_DP32(flags, TB_FLAGS, SEW, sew);
         flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
-                    FIELD_EX64(env->vtype, VTYPE, VLMUL));
+                           FIELD_EX64(env->vtype, VTYPE, VLMUL));
         flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
         flags = FIELD_DP32(flags, TB_FLAGS, VTA,
-                    FIELD_EX64(env->vtype, VTYPE, VTA));
+                           FIELD_EX64(env->vtype, VTYPE, VTA));
         flags = FIELD_DP32(flags, TB_FLAGS, VMA,
-                    FIELD_EX64(env->vtype, VTYPE, VMA));
+                           FIELD_EX64(env->vtype, VTYPE, VMA));
     } else {
         flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
     }
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
         if (env->priv == PRV_M ||
             (env->priv == PRV_S && !env->virt_enabled) ||
             (env->priv == PRV_U && !env->virt_enabled &&
-                get_field(env->hstatus, HSTATUS_HU))) {
+             get_field(env->hstatus, HSTATUS_HU))) {
             flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
         }
 
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_hviprio_index2irq(int index, int *out_irq, int *out_rdzero)
  * ----------------------------------------------------------------
  */
 static const uint8_t default_iprio[64] = {
- /* Custom interrupts 48 to 63 */
- [63] = IPRIO_MMAXIPRIO,
- [62] = IPRIO_MMAXIPRIO,
- [61] = IPRIO_MMAXIPRIO,
- [60] = IPRIO_MMAXIPRIO,
- [59] = IPRIO_MMAXIPRIO,
- [58] = IPRIO_MMAXIPRIO,
- [57] = IPRIO_MMAXIPRIO,
- [56] = IPRIO_MMAXIPRIO,
- [55] = IPRIO_MMAXIPRIO,
- [54] = IPRIO_MMAXIPRIO,
- [53] = IPRIO_MMAXIPRIO,
- [52] = IPRIO_MMAXIPRIO,
- [51] = IPRIO_MMAXIPRIO,
- [50] = IPRIO_MMAXIPRIO,
- [49] = IPRIO_MMAXIPRIO,
- [48] = IPRIO_MMAXIPRIO,
-
- /* Custom interrupts 24 to 31 */
- [31] = IPRIO_MMAXIPRIO,
- [30] = IPRIO_MMAXIPRIO,
- [29] = IPRIO_MMAXIPRIO,
- [28] = IPRIO_MMAXIPRIO,
- [27] = IPRIO_MMAXIPRIO,
- [26] = IPRIO_MMAXIPRIO,
- [25] = IPRIO_MMAXIPRIO,
- [24] = IPRIO_MMAXIPRIO,
-
- [47] = IPRIO_DEFAULT_UPPER,
- [23] = IPRIO_DEFAULT_UPPER + 1,
- [46] = IPRIO_DEFAULT_UPPER + 2,
- [45] = IPRIO_DEFAULT_UPPER + 3,
- [22] = IPRIO_DEFAULT_UPPER + 4,
- [44] = IPRIO_DEFAULT_UPPER + 5,
-
- [43] = IPRIO_DEFAULT_UPPER + 6,
- [21] = IPRIO_DEFAULT_UPPER + 7,
- [42] = IPRIO_DEFAULT_UPPER + 8,
- [41] = IPRIO_DEFAULT_UPPER + 9,
- [20] = IPRIO_DEFAULT_UPPER + 10,
- [40] = IPRIO_DEFAULT_UPPER + 11,
-
- [11] = IPRIO_DEFAULT_M,
- [3]  = IPRIO_DEFAULT_M + 1,
- [7]  = IPRIO_DEFAULT_M + 2,
-
- [9]  = IPRIO_DEFAULT_S,
- [1]  = IPRIO_DEFAULT_S + 1,
- [5]  = IPRIO_DEFAULT_S + 2,
-
- [12] = IPRIO_DEFAULT_SGEXT,
-
- [10] = IPRIO_DEFAULT_VS,
- [2]  = IPRIO_DEFAULT_VS + 1,
- [6]  = IPRIO_DEFAULT_VS + 2,
-
- [39] = IPRIO_DEFAULT_LOWER,
- [19] = IPRIO_DEFAULT_LOWER + 1,
- [38] = IPRIO_DEFAULT_LOWER + 2,
- [37] = IPRIO_DEFAULT_LOWER + 3,
- [18] = IPRIO_DEFAULT_LOWER + 4,
- [36] = IPRIO_DEFAULT_LOWER + 5,
-
- [35] = IPRIO_DEFAULT_LOWER + 6,
- [17] = IPRIO_DEFAULT_LOWER + 7,
- [34] = IPRIO_DEFAULT_LOWER + 8,
- [33] = IPRIO_DEFAULT_LOWER + 9,
- [16] = IPRIO_DEFAULT_LOWER + 10,
- [32] = IPRIO_DEFAULT_LOWER + 11,
+    /* Custom interrupts 48 to 63 */
+    [63] = IPRIO_MMAXIPRIO,
+    [62] = IPRIO_MMAXIPRIO,
+    [61] = IPRIO_MMAXIPRIO,
+    [60] = IPRIO_MMAXIPRIO,
+    [59] = IPRIO_MMAXIPRIO,
+    [58] = IPRIO_MMAXIPRIO,
+    [57] = IPRIO_MMAXIPRIO,
+    [56] = IPRIO_MMAXIPRIO,
+    [55] = IPRIO_MMAXIPRIO,
+    [54] = IPRIO_MMAXIPRIO,
+    [53] = IPRIO_MMAXIPRIO,
+    [52] = IPRIO_MMAXIPRIO,
+    [51] = IPRIO_MMAXIPRIO,
+    [50] = IPRIO_MMAXIPRIO,
+    [49] = IPRIO_MMAXIPRIO,
+    [48] = IPRIO_MMAXIPRIO,
+
+    /* Custom interrupts 24 to 31 */
+    [31] = IPRIO_MMAXIPRIO,
+    [30] = IPRIO_MMAXIPRIO,
+    [29] = IPRIO_MMAXIPRIO,
+    [28] = IPRIO_MMAXIPRIO,
+    [27] = IPRIO_MMAXIPRIO,
+    [26] = IPRIO_MMAXIPRIO,
+    [25] = IPRIO_MMAXIPRIO,
+    [24] = IPRIO_MMAXIPRIO,
+
+    [47] = IPRIO_DEFAULT_UPPER,
+    [23] = IPRIO_DEFAULT_UPPER + 1,
+    [46] = IPRIO_DEFAULT_UPPER + 2,
+    [45] = IPRIO_DEFAULT_UPPER + 3,
+    [22] = IPRIO_DEFAULT_UPPER + 4,
+    [44] = IPRIO_DEFAULT_UPPER + 5,
+
+    [43] = IPRIO_DEFAULT_UPPER + 6,
+    [21] = IPRIO_DEFAULT_UPPER + 7,
+    [42] = IPRIO_DEFAULT_UPPER + 8,
+    [41] = IPRIO_DEFAULT_UPPER + 9,
+    [20] = IPRIO_DEFAULT_UPPER + 10,
+    [40] = IPRIO_DEFAULT_UPPER + 11,
+
+    [11] = IPRIO_DEFAULT_M,
+    [3]  = IPRIO_DEFAULT_M + 1,
+    [7]  = IPRIO_DEFAULT_M + 2,
+
+    [9]  = IPRIO_DEFAULT_S,
+    [1]  = IPRIO_DEFAULT_S + 1,
+    [5]  = IPRIO_DEFAULT_S + 2,
+
+    [12] = IPRIO_DEFAULT_SGEXT,
+
+    [10] = IPRIO_DEFAULT_VS,
+    [2]  = IPRIO_DEFAULT_VS + 1,
+    [6]  = IPRIO_DEFAULT_VS + 2,
+
+    [39] = IPRIO_DEFAULT_LOWER,
+    [19] = IPRIO_DEFAULT_LOWER + 1,
+    [38] = IPRIO_DEFAULT_LOWER + 2,
+    [37] = IPRIO_DEFAULT_LOWER + 3,
+    [18] = IPRIO_DEFAULT_LOWER + 4,
+    [36] = IPRIO_DEFAULT_LOWER + 5,
+
+    [35] = IPRIO_DEFAULT_LOWER + 6,
+    [17] = IPRIO_DEFAULT_LOWER + 7,
+    [34] = IPRIO_DEFAULT_LOWER + 8,
+    [33] = IPRIO_DEFAULT_LOWER + 9,
+    [16] = IPRIO_DEFAULT_LOWER + 10,
+    [32] = IPRIO_DEFAULT_LOWER + 11,
 };
 
 uint8_t riscv_cpu_default_priority(int irq)
@@ -XXX,XX +XXX,XX @@ restart:
                  */
                 MemoryRegion *mr;
                 hwaddr l = sizeof(target_ulong), addr1;
-                mr = address_space_translate(cs->as, pte_addr,
-                    &addr1, &l, false, MEMTXATTRS_UNSPECIFIED);
+                mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
+                                             false, MEMTXATTRS_UNSPECIFIED);
                 if (memory_region_is_ram(mr)) {
                     target_ulong *pte_pa =
                         qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ restart:
             /* add write permission on stores or if the page is already dirty,
                so that we TLB miss on later writes to update the dirty bit */
             if ((pte & PTE_W) &&
-                    (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
+                (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
                 *prot |= PAGE_WRITE;
             }
             return TRANSLATE_SUCCESS;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                                        false);
 
             qemu_log_mask(CPU_LOG_MMU,
-                    "%s 2nd-stage address=%" VADDR_PRIx " ret %d physical "
-                    HWADDR_FMT_plx " prot %d\n",
-                    __func__, im_address, ret, pa, prot2);
+                          "%s 2nd-stage address=%" VADDR_PRIx
+                          " ret %d physical "
+                          HWADDR_FMT_plx " prot %d\n",
+                          __func__, im_address, ret, pa, prot2);
 
             prot &= prot2;
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         env->htval = htval;
         env->htinst = tinst;
         env->pc = (env->stvec >> 2 << 2) +
-            ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
+                  ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
         riscv_cpu_set_mode(env, PRV_S);
     } else {
         /* handle the trap in M-mode */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         env->mtval2 = mtval2;
         env->mtinst = tinst;
         env->pc = (env->mtvec >> 2 << 2) +
-            ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
+                  ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
         riscv_cpu_set_mode(env, PRV_M);
     }
 
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     float32 frs1 = check_nanbox_s(env, rs1);
     float32 frs2 = check_nanbox_s(env, rs2);
     return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
-                    float32_minnum(frs1, frs2, &env->fp_status) :
-                    float32_minimum_number(frs1, frs2, &env->fp_status));
+                         float32_minnum(frs1, frs2, &env->fp_status) :
+                         float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     float32 frs1 = check_nanbox_s(env, rs1);
     float32 frs2 = check_nanbox_s(env, rs2);
     return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
-                    float32_maxnum(frs1, frs2, &env->fp_status) :
-                    float32_maximum_number(frs1, frs2, &env->fp_status));
+                         float32_maxnum(frs1, frs2, &env->fp_status) :
+                         float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fdiv_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return env->priv_ver < PRIV_VERSION_1_11_0 ?
-            float64_minnum(frs1, frs2, &env->fp_status) :
-            float64_minimum_number(frs1, frs2, &env->fp_status);
+           float64_minnum(frs1, frs2, &env->fp_status) :
+           float64_minimum_number(frs1, frs2, &env->fp_status);
 }
 
 uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return env->priv_ver < PRIV_VERSION_1_11_0 ?
-            float64_maxnum(frs1, frs2, &env->fp_status) :
-            float64_maximum_number(frs1, frs2, &env->fp_status);
+           float64_maxnum(frs1, frs2, &env->fp_status) :
+           float64_maximum_number(frs1, frs2, &env->fp_status);
 }
 
 uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     float16 frs1 = check_nanbox_h(env, rs1);
     float16 frs2 = check_nanbox_h(env, rs2);
     return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
-                    float16_minnum(frs1, frs2, &env->fp_status) :
-                    float16_minimum_number(frs1, frs2, &env->fp_status));
+                         float16_minnum(frs1, frs2, &env->fp_status) :
+                         float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     float16 frs1 = check_nanbox_h(env, rs1);
     float16 frs2 = check_nanbox_h(env, rs2);
     return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
-                    float16_maxnum(frs1, frs2, &env->fp_status) :
-                    float16_maximum_number(frs1, frs2, &env->fp_status));
+                         float16_maxnum(frs1, frs2, &env->fp_status) :
+                         float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
diff --git a/target/riscv/m128_helper.c b/target/riscv/m128_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/m128_helper.c
+++ b/target/riscv/m128_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 
 target_ulong HELPER(divu_i128)(CPURISCVState *env,
-                       target_ulong ul, target_ulong uh,
-                       target_ulong vl, target_ulong vh)
+                               target_ulong ul, target_ulong uh,
+                               target_ulong vl, target_ulong vh)
 {
     target_ulong ql, qh;
     Int128 q;
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(divu_i128)(CPURISCVState *env,
 }
 
 target_ulong HELPER(remu_i128)(CPURISCVState *env,
-                       target_ulong ul, target_ulong uh,
-                       target_ulong vl, target_ulong vh)
+                               target_ulong ul, target_ulong uh,
+                               target_ulong vl, target_ulong vh)
 {
     target_ulong rl, rh;
     Int128 r;
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(remu_i128)(CPURISCVState *env,
 }
 
 target_ulong HELPER(divs_i128)(CPURISCVState *env,
-                       target_ulong ul, target_ulong uh,
-                       target_ulong vl, target_ulong vh)
+                               target_ulong ul, target_ulong uh,
+                               target_ulong vl, target_ulong vh)
 {
     target_ulong qh, ql;
     Int128 q;
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(divs_i128)(CPURISCVState *env,
 }
 
 target_ulong HELPER(rems_i128)(CPURISCVState *env,
-                       target_ulong ul, target_ulong uh,
-                       target_ulong vl, target_ulong vh)
+                               target_ulong ul, target_ulong uh,
+                               target_ulong vl, target_ulong vh)
 {
     target_ulong rh, rl;
     Int128 r;
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vector = {
     .minimum_version_id = 2,
     .needed = vector_needed,
     .fields = (VMStateField[]) {
-            VMSTATE_UINT64_ARRAY(env.vreg, RISCVCPU, 32 * RV_VLEN_MAX / 64),
-            VMSTATE_UINTTL(env.vxrm, RISCVCPU),
-            VMSTATE_UINTTL(env.vxsat, RISCVCPU),
-            VMSTATE_UINTTL(env.vl, RISCVCPU),
-            VMSTATE_UINTTL(env.vstart, RISCVCPU),
-            VMSTATE_UINTTL(env.vtype, RISCVCPU),
-            VMSTATE_BOOL(env.vill, RISCVCPU),
-            VMSTATE_END_OF_LIST()
-        }
+        VMSTATE_UINT64_ARRAY(env.vreg, RISCVCPU, 32 * RV_VLEN_MAX / 64),
+        VMSTATE_UINTTL(env.vxrm, RISCVCPU),
+        VMSTATE_UINTTL(env.vxsat, RISCVCPU),
+        VMSTATE_UINTTL(env.vl, RISCVCPU),
+        VMSTATE_UINTTL(env.vstart, RISCVCPU),
+        VMSTATE_UINTTL(env.vtype, RISCVCPU),
+        VMSTATE_BOOL(env.vill, RISCVCPU),
+        VMSTATE_END_OF_LIST()
+    }
 };
 
 static bool pointermasking_needed(void *opaque)
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
     if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) ||
         (rvs && prv_u && !env->virt_enabled)) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-    } else if (env->virt_enabled && (prv_u ||
-        (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
+    } else if (env->virt_enabled &&
+               (prv_u || (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     } else {
         cs->halted = 1;
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 
 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
-    uint8_t val);
+                          uint8_t val);
 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
 
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 {
     int result = 0;
 
-    if ((addr >= env->pmp_state.addr[pmp_index].sa)
-        && (addr <= env->pmp_state.addr[pmp_index].ea)) {
+    if ((addr >= env->pmp_state.addr[pmp_index].sa) &&
+        (addr <= env->pmp_state.addr[pmp_index].ea)) {
         result = 1;
     } else {
         result = 0;
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
  * Check if the address has required RWX privs when no PMP entry is matched.
  */
 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
-    target_ulong mode)
+                                       target_ulong size, pmp_priv_t privs,
+                                       pmp_priv_t *allowed_privs,
+                                       target_ulong mode)
 {
     bool ret;
 
@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
  * Return negtive value if no match
  */
 int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
-    target_ulong mode)
+                       target_ulong size, pmp_priv_t privs,
+                       pmp_priv_t *allowed_privs, target_ulong mode)
 {
     int i = 0;
     int ret = -1;
@@ -XXX,XX +XXX,XX @@ int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
  * Handle a write to a pmpcfg CSR
  */
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
-    target_ulong val)
+                      target_ulong val)
 {
     int i;
     uint8_t cfg_val;
@@ -XXX,XX +XXX,XX @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
  * Handle a write to a pmpaddr CSR
  */
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-    target_ulong val)
+                       target_ulong val)
 {
     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ EX_SH(12)
 } while (0)
 
 #define REQUIRE_EITHER_EXT(ctx, A, B) do {       \
-    if (!ctx->cfg_ptr->ext_##A &&      \
-        !ctx->cfg_ptr->ext_##B) {      \
+    if (!ctx->cfg_ptr->ext_##A &&                \
+        !ctx->cfg_ptr->ext_##B) {                \
         return false;                            \
     }                                            \
 } while (0)
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
         }
     }
 
-    if ((sew > cpu->cfg.elen)
-        || vill
-        || (ediv != 0)
-        || (reserved != 0)) {
+    if ((sew > cpu->cfg.elen) || vill || (ediv != 0) || (reserved != 0)) {
         /* only set vill bit. */
         env->vill = 1;
         env->vtype = 0;
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,        \
                                                                          \
         *((ETYPE *)vd + H(i)) = DO_OP(s2, (ETYPE)(target_long)s1, carry);\
     }                                                                    \
-    env->vstart = 0;                                          \
+    env->vstart = 0;                                                     \
     /* set tail elements to 1s */                                        \
     vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);             \
 }
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_SHIFT_VV(vsra_vv_d, uint64_t, int64_t, H8, H8, DO_SRL, 0x3f)
 /* generate the helpers for shift instructions with one vector and one scalar */
 #define GEN_VEXT_SHIFT_VX(NAME, TD, TS2, HD, HS2, OP, MASK) \
 void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
-        void *vs2, CPURISCVState *env, uint32_t desc)       \
+                  void *vs2, CPURISCVState *env,            \
+                  uint32_t desc)                            \
 {                                                           \
     uint32_t vm = vext_vm(desc);                            \
     uint32_t vl = env->vl;                                  \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX(vmulhsu_vx_d, 8)
 /* Vector Integer Divide Instructions */
 #define DO_DIVU(N, M) (unlikely(M == 0) ? (__typeof(N))(-1) : N / M)
 #define DO_REMU(N, M) (unlikely(M == 0) ? N : N % M)
-#define DO_DIV(N, M)  (unlikely(M == 0) ? (__typeof(N))(-1) :\
+#define DO_DIV(N, M)  (unlikely(M == 0) ? (__typeof(N))(-1) : \
         unlikely((N == -N) && (M == (__typeof(N))(-1))) ? N : N / M)
-#define DO_REM(N, M)  (unlikely(M == 0) ? N :\
+#define DO_REM(N, M)  (unlikely(M == 0) ? N : \
         unlikely((N == -N) && (M == (__typeof(N))(-1))) ? 0 : N % M)
 
 RVVCALL(OPIVV2, vdivu_vv_b, OP_UUU_B, H1, H1, H1, DO_DIVU)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX(vwmulsu_vx_h, 4)
 GEN_VEXT_VX(vwmulsu_vx_w, 8)
 
 /* Vector Single-Width Integer Multiply-Add Instructions */
-#define OPIVV3(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)   \
+#define OPIVV3(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)       \
 static void do_##NAME(void *vd, void *vs1, void *vs2, int i)       \
 {                                                                  \
     TX1 s1 = *((T1 *)vs1 + HS1(i));                                \
@@ -XXX,XX +XXX,XX @@ vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
 /* generate helpers for fixed point instructions with OPIVX format */
 #define GEN_VEXT_VX_RM(NAME, ESZ)                         \
 void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-        void *vs2, CPURISCVState *env, uint32_t desc)     \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
 {                                                         \
     vext_vx_rm_2(vd, v0, s1, vs2, env, desc,              \
                  do_##NAME, ESZ);                         \
@@ -XXX,XX +XXX,XX @@ static inline int8_t vsmul8(CPURISCVState *env, int vxrm, int8_t a, int8_t b)
 
     res = (int16_t)a * (int16_t)b;
     round = get_round(vxrm, res, 7);
-    res   = (res >> 7) + round;
+    res = (res >> 7) + round;
 
     if (res > INT8_MAX) {
         env->vxsat = 0x1;
@@ -XXX,XX +XXX,XX @@ static int16_t vsmul16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
 
     res = (int32_t)a * (int32_t)b;
     round = get_round(vxrm, res, 15);
-    res   = (res >> 15) + round;
+    res = (res >> 15) + round;
 
     if (res > INT16_MAX) {
         env->vxsat = 0x1;
@@ -XXX,XX +XXX,XX @@ static int32_t vsmul32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
 
     res = (int64_t)a * (int64_t)b;
     round = get_round(vxrm, res, 31);
-    res   = (res >> 31) + round;
+    res = (res >> 31) + round;
 
     if (res > INT32_MAX) {
         env->vxsat = 0x1;
@@ -XXX,XX +XXX,XX @@ vssrl8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t b)
     uint8_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     return res;
 }
 static inline uint16_t
@@ -XXX,XX +XXX,XX @@ vnclip8(CPURISCVState *env, int vxrm, int16_t a, int8_t b)
     int16_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     if (res > INT8_MAX) {
         env->vxsat = 0x1;
         return INT8_MAX;
@@ -XXX,XX +XXX,XX @@ vnclip16(CPURISCVState *env, int vxrm, int32_t a, int16_t b)
     int32_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     if (res > INT16_MAX) {
         env->vxsat = 0x1;
         return INT16_MAX;
@@ -XXX,XX +XXX,XX @@ vnclip32(CPURISCVState *env, int vxrm, int64_t a, int32_t b)
     int64_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     if (res > INT32_MAX) {
         env->vxsat = 0x1;
         return INT32_MAX;
@@ -XXX,XX +XXX,XX @@ vnclipu8(CPURISCVState *env, int vxrm, uint16_t a, uint8_t b)
     uint16_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     if (res > UINT8_MAX) {
         env->vxsat = 0x1;
         return UINT8_MAX;
@@ -XXX,XX +XXX,XX @@ vnclipu16(CPURISCVState *env, int vxrm, uint32_t a, uint16_t b)
     uint32_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     if (res > UINT16_MAX) {
         env->vxsat = 0x1;
         return UINT16_MAX;
@@ -XXX,XX +XXX,XX @@ vnclipu32(CPURISCVState *env, int vxrm, uint64_t a, uint32_t b)
     uint64_t res;
 
     round = get_round(vxrm, a, shift);
-    res   = (a >> shift)  + round;
+    res = (a >> shift) + round;
     if (res > UINT32_MAX) {
         env->vxsat = 0x1;
         return UINT32_MAX;
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1,        \
     uint32_t vm = vext_vm(desc);                          \
     uint32_t vl = env->vl;                                \
     uint32_t total_elems =                                \
-        vext_get_total_elems(env, desc, ESZ);              \
+        vext_get_total_elems(env, desc, ESZ);             \
     uint32_t vta = vext_vta(desc);                        \
     uint32_t vma = vext_vma(desc);                        \
     uint32_t i;                                           \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfrsub_vf_d, 8)
 static uint32_t vfwadd16(uint16_t a, uint16_t b, float_status *s)
 {
     return float32_add(float16_to_float32(a, true, s),
-            float16_to_float32(b, true, s), s);
+                       float16_to_float32(b, true, s), s);
 }
 
 static uint64_t vfwadd32(uint32_t a, uint32_t b, float_status *s)
 {
     return float64_add(float32_to_float64(a, s),
-            float32_to_float64(b, s), s);
+                       float32_to_float64(b, s), s);
 
 }
 
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwadd_vf_w, 8)
 static uint32_t vfwsub16(uint16_t a, uint16_t b, float_status *s)
 {
     return float32_sub(float16_to_float32(a, true, s),
-            float16_to_float32(b, true, s), s);
+                       float16_to_float32(b, true, s), s);
 }
 
 static uint64_t vfwsub32(uint32_t a, uint32_t b, float_status *s)
 {
     return float64_sub(float32_to_float64(a, s),
-            float32_to_float64(b, s), s);
+                       float32_to_float64(b, s), s);
 
 }
 
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfrdiv_vf_d, 8)
 static uint32_t vfwmul16(uint16_t a, uint16_t b, float_status *s)
 {
     return float32_mul(float16_to_float32(a, true, s),
-            float16_to_float32(b, true, s), s);
+                       float16_to_float32(b, true, s), s);
 }
 
 static uint64_t vfwmul32(uint32_t a, uint32_t b, float_status *s)
 {
     return float64_mul(float32_to_float64(a, s),
-            float32_to_float64(b, s), s);
+                       float32_to_float64(b, s), s);
 
 }
 RVVCALL(OPFVV2, vfwmul_vv_h, WOP_UUU_H, H4, H2, H2, vfwmul16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwmul_vf_w, 8)
 /* Vector Single-Width Floating-Point Fused Multiply-Add Instructions */
 #define OPFVV3(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)       \
 static void do_##NAME(void *vd, void *vs1, void *vs2, int i,       \
-        CPURISCVState *env)                                        \
+                      CPURISCVState *env)                          \
 {                                                                  \
     TX1 s1 = *((T1 *)vs1 + HS1(i));                                \
     TX2 s2 = *((T2 *)vs2 + HS2(i));                                \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV_ENV(vfmacc_vv_d, 8)
 
 #define OPFVF3(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)           \
 static void do_##NAME(void *vd, uint64_t s1, void *vs2, int i,    \
-        CPURISCVState *env)                                       \
+                      CPURISCVState *env)                         \
 {                                                                 \
     TX2 s2 = *((T2 *)vs2 + HS2(i));                               \
     TD d = *((TD *)vd + HD(i));                                   \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfmacc_vf_d, 8)
 
 static uint16_t fnmacc16(uint16_t a, uint16_t b, uint16_t d, float_status *s)
 {
-    return float16_muladd(a, b, d,
-            float_muladd_negate_c | float_muladd_negate_product, s);
+    return float16_muladd(a, b, d, float_muladd_negate_c |
+                                   float_muladd_negate_product, s);
 }
 
 static uint32_t fnmacc32(uint32_t a, uint32_t b, uint32_t d, float_status *s)
 {
-    return float32_muladd(a, b, d,
-            float_muladd_negate_c | float_muladd_negate_product, s);
+    return float32_muladd(a, b, d, float_muladd_negate_c |
+                                   float_muladd_negate_product, s);
 }
 
 static uint64_t fnmacc64(uint64_t a, uint64_t b, uint64_t d, float_status *s)
 {
-    return float64_muladd(a, b, d,
-            float_muladd_negate_c | float_muladd_negate_product, s);
+    return float64_muladd(a, b, d, float_muladd_negate_c |
+                                   float_muladd_negate_product, s);
 }
 
 RVVCALL(OPFVV3, vfnmacc_vv_h, OP_UUU_H, H2, H2, H2, fnmacc16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfmadd_vf_d, 8)
 
 static uint16_t fnmadd16(uint16_t a, uint16_t b, uint16_t d, float_status *s)
 {
-    return float16_muladd(d, b, a,
-            float_muladd_negate_c | float_muladd_negate_product, s);
+    return float16_muladd(d, b, a, float_muladd_negate_c |
+                                   float_muladd_negate_product, s);
 }
 
 static uint32_t fnmadd32(uint32_t a, uint32_t b, uint32_t d, float_status *s)
 {
-    return float32_muladd(d, b, a,
-            float_muladd_negate_c | float_muladd_negate_product, s);
+    return float32_muladd(d, b, a, float_muladd_negate_c |
+                                   float_muladd_negate_product, s);
 }
 
 static uint64_t fnmadd64(uint64_t a, uint64_t b, uint64_t d, float_status *s)
 {
-    return float64_muladd(d, b, a,
-            float_muladd_negate_c | float_muladd_negate_product, s);
+    return float64_muladd(d, b, a, float_muladd_negate_c |
+                                   float_muladd_negate_product, s);
 }
 
 RVVCALL(OPFVV3, vfnmadd_vv_h, OP_UUU_H, H2, H2, H2, fnmadd16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfnmsub_vf_d, 8)
 static uint32_t fwmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
-                        float16_to_float32(b, true, s), d, 0, s);
+                          float16_to_float32(b, true, s), d, 0, s);
 }
 
 static uint64_t fwmacc32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
 {
     return float64_muladd(float32_to_float64(a, s),
-                        float32_to_float64(b, s), d, 0, s);
+                          float32_to_float64(b, s), d, 0, s);
 }
 
 RVVCALL(OPFVV3, vfwmacc_vv_h, WOP_UUU_H, H4, H2, H2, fwmacc16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwmacc_vf_w, 8)
 static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
-                        float16_to_float32(b, true, s), d,
-                        float_muladd_negate_c | float_muladd_negate_product, s);
+                          float16_to_float32(b, true, s), d,
+                          float_muladd_negate_c | float_muladd_negate_product,
+                          s);
 }
 
 static uint64_t fwnmacc32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
 {
-    return float64_muladd(float32_to_float64(a, s),
-                        float32_to_float64(b, s), d,
-                        float_muladd_negate_c | float_muladd_negate_product, s);
+    return float64_muladd(float32_to_float64(a, s), float32_to_float64(b, s),
+                          d, float_muladd_negate_c |
+                             float_muladd_negate_product, s);
 }
 
 RVVCALL(OPFVV3, vfwnmacc_vv_h, WOP_UUU_H, H4, H2, H2, fwnmacc16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmacc_vf_w, 8)
 static uint32_t fwmsac16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
-                        float16_to_float32(b, true, s), d,
-                        float_muladd_negate_c, s);
+                          float16_to_float32(b, true, s), d,
+                          float_muladd_negate_c, s);
 }
 
 static uint64_t fwmsac32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
 {
     return float64_muladd(float32_to_float64(a, s),
-                        float32_to_float64(b, s), d,
-                        float_muladd_negate_c, s);
+                          float32_to_float64(b, s), d,
+                          float_muladd_negate_c, s);
 }
 
 RVVCALL(OPFVV3, vfwmsac_vv_h, WOP_UUU_H, H4, H2, H2, fwmsac16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwmsac_vf_w, 8)
 static uint32_t fwnmsac16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
-                        float16_to_float32(b, true, s), d,
-                        float_muladd_negate_product, s);
+                          float16_to_float32(b, true, s), d,
+                          float_muladd_negate_product, s);
 }
 
 static uint64_t fwnmsac32(uint32_t a, uint32_t b, uint64_t d, float_status *s)
 {
     return float64_muladd(float32_to_float64(a, s),
-                        float32_to_float64(b, s), d,
-                        float_muladd_negate_product, s);
+                          float32_to_float64(b, s), d,
+                          float_muladd_negate_product, s);
 }
 
 RVVCALL(OPFVV3, vfwnmsac_vv_h, WOP_UUU_H, H4, H2, H2, fwnmsac16)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_w, 8)
 #define OP_UU_W uint32_t, uint32_t, uint32_t
 #define OP_UU_D uint64_t, uint64_t, uint64_t
 
-#define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)        \
+#define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 static void do_##NAME(void *vd, void *vs2, int i,      \
-        CPURISCVState *env)                            \
+                      CPURISCVState *env)              \
 {                                                      \
     TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
     *((TD *)vd + HD(i)) = OP(s2, &env->fp_status);     \
@@ -XXX,XX +XXX,XX @@ static void do_##NAME(void *vd, void *vs2, int i,      \
 
 #define GEN_VEXT_V_ENV(NAME, ESZ)                      \
 void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-        CPURISCVState *env, uint32_t desc)             \
+                  CPURISCVState *env, uint32_t desc)   \
 {                                                      \
     uint32_t vm = vext_vm(desc);                       \
     uint32_t vl = env->vl;                             \
@@ -XXX,XX +XXX,XX @@ static uint64_t frsqrt7(uint64_t f, int exp_size, int frac_size)
     }
 
     int idx = ((exp & 1) << (precision - 1)) |
-                (frac >> (frac_size - precision + 1));
+              (frac >> (frac_size - precision + 1));
     uint64_t out_frac = (uint64_t)(lookup_table[idx]) <<
-                            (frac_size - precision);
+                        (frac_size - precision);
     uint64_t out_exp = (3 * MAKE_64BIT_MASK(0, exp_size - 1) + ~exp) / 2;
 
     uint64_t val = 0;
@@ -XXX,XX +XXX,XX @@ static float16 frsqrt7_h(float16 f, float_status *s)
      * frsqrt7(-subnormal) = canonical NaN
      */
     if (float16_is_signaling_nan(f, s) ||
-            (float16_is_infinity(f) && sign) ||
-            (float16_is_normal(f) && sign) ||
-            (float16_is_zero_or_denormal(f) && !float16_is_zero(f) && sign)) {
+        (float16_is_infinity(f) && sign) ||
+        (float16_is_normal(f) && sign) ||
+        (float16_is_zero_or_denormal(f) && !float16_is_zero(f) && sign)) {
         s->float_exception_flags |= float_flag_invalid;
         return float16_default_nan(s);
     }
@@ -XXX,XX +XXX,XX @@ static float32 frsqrt7_s(float32 f, float_status *s)
      * frsqrt7(-subnormal) = canonical NaN
      */
     if (float32_is_signaling_nan(f, s) ||
-            (float32_is_infinity(f) && sign) ||
-            (float32_is_normal(f) && sign) ||
-            (float32_is_zero_or_denormal(f) && !float32_is_zero(f) && sign)) {
+        (float32_is_infinity(f) && sign) ||
+        (float32_is_normal(f) && sign) ||
+        (float32_is_zero_or_denormal(f) && !float32_is_zero(f) && sign)) {
         s->float_exception_flags |= float_flag_invalid;
         return float32_default_nan(s);
     }
@@ -XXX,XX +XXX,XX @@ static float64 frsqrt7_d(float64 f, float_status *s)
      * frsqrt7(-subnormal) = canonical NaN
      */
     if (float64_is_signaling_nan(f, s) ||
-            (float64_is_infinity(f) && sign) ||
-            (float64_is_normal(f) && sign) ||
-            (float64_is_zero_or_denormal(f) && !float64_is_zero(f) && sign)) {
+        (float64_is_infinity(f) && sign) ||
+        (float64_is_normal(f) && sign) ||
+        (float64_is_zero_or_denormal(f) && !float64_is_zero(f) && sign)) {
         s->float_exception_flags |= float_flag_invalid;
         return float64_default_nan(s);
     }
@@ -XXX,XX +XXX,XX @@ static uint64_t frec7(uint64_t f, int exp_size, int frac_size,
                 ((s->float_rounding_mode == float_round_up) && sign)) {
                 /* Return greatest/negative finite value. */
                 return (sign << (exp_size + frac_size)) |
-                    (MAKE_64BIT_MASK(frac_size, exp_size) - 1);
+                       (MAKE_64BIT_MASK(frac_size, exp_size) - 1);
             } else {
                 /* Return +-inf. */
                 return (sign << (exp_size + frac_size)) |
-                    MAKE_64BIT_MASK(frac_size, exp_size);
+                       MAKE_64BIT_MASK(frac_size, exp_size);
             }
         }
     }
 
     int idx = frac >> (frac_size - precision);
     uint64_t out_frac = (uint64_t)(lookup_table[idx]) <<
-                            (frac_size - precision);
+                        (frac_size - precision);
     uint64_t out_exp = 2 * MAKE_64BIT_MASK(0, exp_size - 1) + ~exp;
 
     if (out_exp == 0 || out_exp == UINT64_MAX) {
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2, \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
-        *((ETYPE *)vd + H(i))                                 \
-          = (!vm && !vext_elem_mask(v0, i) ? s2 : s1);        \
+        *((ETYPE *)vd + H(i)) =                               \
+            (!vm && !vext_elem_mask(v0, i) ? s2 : s1);        \
     }                                                         \
     env->vstart = 0;                                          \
     /* set tail elements to 1s */                             \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
 /* Vector Single-Width Integer Reduction Instructions */
 #define GEN_VEXT_RED(NAME, TD, TS2, HD, HS2, OP)          \
 void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-        void *vs2, CPURISCVState *env, uint32_t desc)     \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
 {                                                         \
     uint32_t vm = vext_vm(desc);                          \
     uint32_t vl = env->vl;                                \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VSLIDEDOWN_VX(vslidedown_vx_d, uint64_t, H8)
 
 #define GEN_VEXT_VSLIE1UP(BITWIDTH, H)                                      \
 static void vslide1up_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
-                     void *vs2, CPURISCVState *env, uint32_t desc)          \
+                                 void *vs2, CPURISCVState *env,             \
+                                 uint32_t desc)                             \
 {                                                                           \
     typedef uint##BITWIDTH##_t ETYPE;                                       \
     uint32_t vm = vext_vm(desc);                                            \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VSLIDE1UP_VX(vslide1up_vx_d, 64)
 
 #define GEN_VEXT_VSLIDE1DOWN(BITWIDTH, H)                                     \
 static void vslide1down_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
-                       void *vs2, CPURISCVState *env, uint32_t desc)          \
+                                   void *vs2, CPURISCVState *env,             \
+                                   uint32_t desc)                             \
 {                                                                             \
     typedef uint##BITWIDTH##_t ETYPE;                                         \
     uint32_t vm = vext_vm(desc);                                              \
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vext_check_store(DisasContext *s, int vd, int nf, uint8_t eew)
 {
     int8_t emul = eew - s->sew + s->lmul;
     return (emul >= -3 && emul <= 3) &&
-            require_align(vd, emul) &&
-            require_nf(vd, nf, emul);
+           require_align(vd, emul) &&
+           require_nf(vd, nf, emul);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool vext_check_ld_index(DisasContext *s, int vd, int vs2,
     int8_t seg_vd;
     int8_t emul = eew - s->sew + s->lmul;
     bool ret = vext_check_st_index(s, vd, vs2, nf, eew) &&
-        require_vm(vm, vd);
+               require_vm(vm, vd);
 
     /* Each segment register group has to follow overlap rules. */
     for (int i = 0; i < nf; ++i) {
@@ -XXX,XX +XXX,XX @@ static bool vext_check_ld_index(DisasContext *s, int vd, int vs2,
 static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
 {
     return require_vm(vm, vd) &&
-        require_align(vd, s->lmul) &&
-        require_align(vs, s->lmul);
+           require_align(vd, s->lmul) &&
+           require_align(vs, s->lmul);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_sss(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_ss(s, vd, vs2, vm) &&
-        require_align(vs1, s->lmul);
+           require_align(vs1, s->lmul);
 }
 
 static bool vext_check_ms(DisasContext *s, int vd, int vs)
@@ -XXX,XX +XXX,XX @@ static bool vext_check_ms(DisasContext *s, int vd, int vs)
 static bool vext_check_mss(DisasContext *s, int vd, int vs1, int vs2)
 {
     bool ret = vext_check_ms(s, vd, vs2) &&
-        require_align(vs1, s->lmul);
+               require_align(vs1, s->lmul);
     if (vd != vs1) {
         ret &= require_noover(vd, 0, vs1, s->lmul);
     }
@@ -XXX,XX +XXX,XX @@ static bool vext_narrow_check_common(DisasContext *s, int vd, int vs2,
 static bool vext_check_ds(DisasContext *s, int vd, int vs, int vm)
 {
     return vext_wide_check_common(s, vd, vm) &&
-        require_align(vs, s->lmul) &&
-        require_noover(vd, s->lmul + 1, vs, s->lmul);
+           require_align(vs, s->lmul) &&
+           require_noover(vd, s->lmul + 1, vs, s->lmul);
 }
 
 static bool vext_check_dd(DisasContext *s, int vd, int vs, int vm)
 {
     return vext_wide_check_common(s, vd, vm) &&
-        require_align(vs, s->lmul + 1);
+           require_align(vs, s->lmul + 1);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool vext_check_dd(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_dss(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_ds(s, vd, vs2, vm) &&
-        require_align(vs1, s->lmul) &&
-        require_noover(vd, s->lmul + 1, vs1, s->lmul);
+           require_align(vs1, s->lmul) &&
+           require_noover(vd, s->lmul + 1, vs1, s->lmul);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool vext_check_dss(DisasContext *s, int vd, int vs1, int vs2, int vm)
 static bool vext_check_dds(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_ds(s, vd, vs1, vm) &&
-        require_align(vs2, s->lmul + 1);
+           require_align(vs2, s->lmul + 1);
 }
 
 static bool vext_check_sd(DisasContext *s, int vd, int vs, int vm)
@@ -XXX,XX +XXX,XX @@ static bool vext_check_sd(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_sds(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_sd(s, vd, vs2, vm) &&
-        require_align(vs1, s->lmul);
+           require_align(vs1, s->lmul);
 }
 
 /*
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Fix formats for multi-lines comments.
Add spaces around single line comments(after "/*" and before "*/").

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230405085813.40643-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      | 26 ++++----
 target/riscv/cpu_bits.h                 |  2 +-
 target/riscv/sbi_ecall_interface.h      |  8 +--
 target/riscv/arch_dump.c                |  3 +-
 target/riscv/cpu.c                      |  2 +-
 target/riscv/cpu_helper.c               | 57 +++++++++++------
 target/riscv/csr.c                      |  6 +-
 target/riscv/pmp.c                      | 41 +++++++------
 target/riscv/translate.c                | 20 +++---
 target/riscv/vector_helper.c            | 82 +++++++++++++++----------
 target/riscv/insn_trans/trans_rvv.c.inc |  8 ++-
 11 files changed, 151 insertions(+), 104 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTYPE, RESERVED, 10, sizeof(target_ulong) * 8 - 11)
 typedef struct PMUCTRState {
     /* Current value of a counter */
     target_ulong mhpmcounter_val;
-    /* Current value of a counter in RV32*/
+    /* Current value of a counter in RV32 */
     target_ulong mhpmcounterh_val;
     /* Snapshot values of counter */
     target_ulong mhpmcounter_prev;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     target_ulong satp_hs;
     uint64_t mstatus_hs;
 
-    /* Signals whether the current exception occurred with two-stage address
-       translation active. */
+    /*
+     * Signals whether the current exception occurred with two-stage address
+     * translation active.
+     */
     bool two_stage_lookup;
     /*
      * Signals whether the current exception occurred while doing two-stage
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* PMU counter state */
     PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
 
-    /* PMU event selector configured values. First three are unused*/
+    /* PMU event selector configured values. First three are unused */
     target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 
-    /* PMU event selector configured values for RV32*/
+    /* PMU event selector configured values for RV32 */
     target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
 
     target_ulong sscratch;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
 
 OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
 
-/**
+/*
  * RISCVCPUClass:
  * @parent_realize: The parent class' realize handler.
  * @parent_phases: The parent class' reset phase handlers.
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
  * A RISCV CPU model.
  */
 struct RISCVCPUClass {
-    /*< private >*/
+    /* < private > */
     CPUClass parent_class;
-    /*< public >*/
+    /* < public > */
     DeviceRealize parent_realize;
     ResettablePhases parent_phases;
 };
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
 
-/**
+/*
  * RISCVCPU:
  * @env: #CPURISCVState
  *
  * A RISCV CPU.
  */
 struct ArchCPU {
-    /*< private >*/
+    /* < private > */
     CPUState parent_obj;
-    /*< public >*/
+    /* < public > */
     CPUNegativeOffsetState neg;
     CPURISCVState env;
 
@@ -XXX,XX +XXX,XX @@ enum {
     CSR_TABLE_SIZE = 0x1000
 };
 
-/**
+/*
  * The event id are encoded based on the encoding specified in the
  * SBI specification v0.3
  */
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MIE_SSIE                           (1 << IRQ_S_SOFT)
 #define MIE_USIE                           (1 << IRQ_U_SOFT)
 
-/* General PointerMasking CSR bits*/
+/* General PointerMasking CSR bits */
 #define PM_ENABLE       0x00000001ULL
 #define PM_CURRENT      0x00000002ULL
 #define PM_INSN         0x00000004ULL
diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/sbi_ecall_interface.h
+++ b/target/riscv/sbi_ecall_interface.h
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_RFENCE                  0x52464E43
 #define SBI_EXT_HSM                     0x48534D
 
-/* SBI function IDs for BASE extension*/
+/* SBI function IDs for BASE extension */
 #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
 #define SBI_EXT_BASE_GET_IMP_ID         0x1
 #define SBI_EXT_BASE_GET_IMP_VERSION    0x2
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_BASE_GET_MARCHID        0x5
 #define SBI_EXT_BASE_GET_MIMPID         0x6
 
-/* SBI function IDs for TIME extension*/
+/* SBI function IDs for TIME extension */
 #define SBI_EXT_TIME_SET_TIMER          0x0
 
-/* SBI function IDs for IPI extension*/
+/* SBI function IDs for IPI extension */
 #define SBI_EXT_IPI_SEND_IPI            0x0
 
-/* SBI function IDs for RFENCE extension*/
+/* SBI function IDs for RFENCE extension */
 #define SBI_EXT_RFENCE_REMOTE_FENCE_I       0x0
 #define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA    0x1
 #define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID  0x2
diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/arch_dump.c
+++ b/target/riscv/arch_dump.c
@@ -XXX,XX +XXX,XX @@
-/* Support for writing ELF notes for RISC-V architectures
+/*
+ * Support for writing ELF notes for RISC-V architectures
  *
  * Copyright (C) 2021 Huawei Technologies Co., Ltd
  *
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
 #define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
     {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
-/**
+/*
  * Here are the ordering rules of extension naming defined by RISC-V
  * specification :
  * 1. All extensions should be separated from other multi-letter extensions
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
     return TRANSLATE_SUCCESS;
 }
 
-/* get_physical_address - get the physical address for this virtual address
+/*
+ * get_physical_address - get the physical address for this virtual address
  *
  * Do a page table walk to obtain the physical address corresponding to a
  * virtual address. Returns 0 if the translation was successful
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
                                 bool first_stage, bool two_stage,
                                 bool is_debug)
 {
-    /* NOTE: the env->pc value visible here will not be
+    /*
+     * NOTE: the env->pc value visible here will not be
      * correct, but the value visible to the exception handler
-     * (riscv_cpu_do_interrupt) is correct */
+     * (riscv_cpu_do_interrupt) is correct
+     */
     MemTxResult res;
     MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     int mode = mmu_idx & TB_FLAGS_PRIV_MMU_MASK;
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         use_background = true;
     }
 
-    /* MPRV does not affect the virtual-machine load/store
-       instructions, HLV, HLVX, and HSV. */
+    /*
+     * MPRV does not affect the virtual-machine load/store
+     * instructions, HLV, HLVX, and HSV.
+     */
     if (riscv_cpu_two_stage_lookup(mmu_idx)) {
         mode = get_field(env->hstatus, HSTATUS_SPVP);
     } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     if (first_stage == false) {
-        /* We are in stage 2 translation, this is similar to stage 1. */
-        /* Stage 2 is always taken as U-mode */
+        /*
+         * We are in stage 2 translation, this is similar to stage 1.
+         * Stage 2 is always taken as U-mode
+         */
         mode = PRV_U;
     }
 
@@ -XXX,XX +XXX,XX @@ restart:
                     target_ulong *pte_pa =
                         qemu_map_ram_ptr(mr->ram_block, addr1);
 #if TCG_OVERSIZED_GUEST
-                    /* MTTCG is not enabled on oversized TCG guests so
-                     * page table updates do not need to be atomic */
+                    /*
+                     * MTTCG is not enabled on oversized TCG guests so
+                     * page table updates do not need to be atomic
+                     */
                     *pte_pa = pte = updated_pte;
 #else
                     target_ulong old_pte =
@@ -XXX,XX +XXX,XX @@ restart:
                     }
 #endif
                 } else {
-                    /* misconfigured PTE in ROM (AD bits are not preset) or
-                     * PTE is in IO space and can't be updated atomically */
+                    /*
+                     * misconfigured PTE in ROM (AD bits are not preset) or
+                     * PTE is in IO space and can't be updated atomically
+                     */
                     return TRANSLATE_FAIL;
                 }
             }
 
-            /* for superpage mappings, make a fake leaf PTE for the TLB's
-               benefit. */
+            /*
+             * for superpage mappings, make a fake leaf PTE for the TLB's
+             * benefit.
+             */
             target_ulong vpn = addr >> PGSHIFT;
 
             if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
@@ -XXX,XX +XXX,XX @@ restart:
             if (pte & PTE_X) {
                 *prot |= PAGE_EXEC;
             }
-            /* add write permission on stores or if the page is already dirty,
-               so that we TLB miss on later writes to update the dirty bit */
+            /*
+             * add write permission on stores or if the page is already dirty,
+             * so that we TLB miss on later writes to update the dirty bit
+             */
             if ((pte & PTE_W) &&
                 (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
                 *prot |= PAGE_WRITE;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                   __func__, address, access_type, mmu_idx);
 
-    /* MPRV does not affect the virtual-machine load/store
-       instructions, HLV, HLVX, and HSV. */
+    /*
+     * MPRV does not affect the virtual-machine load/store
+     * instructions, HLV, HLVX, and HSV.
+     */
     if (riscv_cpu_two_stage_lookup(mmu_idx)) {
         mode = get_field(env->hstatus, HSTATUS_SPVP);
     } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     bool write_gva = false;
     uint64_t s;
 
-    /* cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
+    /*
+     * cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
      * so we mask off the MSB and separate into trap type and cause.
      */
     bool async = !!(cs->exception_index & RISCV_EXCP_INT_FLAG);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         riscv_cpu_set_mode(env, PRV_M);
     }
 
-    /* NOTE: it is not necessary to yield load reservations here. It is only
+    /*
+     * NOTE: it is not necessary to yield load reservations here. It is only
      * necessary for an SC from "another hart" to cause a load reservation
      * to be yielded. Refer to the memory consistency model section of the
      * RISC-V ISA Specification.
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr(CPURISCVState *env, int csrno)
     }
     ctr_index = csrno - base_csrno;
     if (!pmu_num || ctr_index >= pmu_num) {
-        /* The PMU is not enabled or counter is out of range*/
+        /* The PMU is not enabled or counter is out of range */
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
                                         counter.mhpmcounter_val;
 
     if (get_field(env->mcountinhibit, BIT(ctr_idx))) {
-        /**
+        /*
          * Counter should not increment if inhibit bit is set. We can't really
          * stop the icount counting. Just return the counter value written by
          * the supervisor to indicate that counter was not incremented.
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
         }
     }
 
-    /**
+    /*
      * The kernel computes the perf delta by subtracting the current value from
      * the value it initialized previously (ctr_val).
      */
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 {
     /*
-       aaaa...aaa0   8-byte NAPOT range
-       aaaa...aa01   16-byte NAPOT range
-       aaaa...a011   32-byte NAPOT range
-       ...
-       aa01...1111   2^XLEN-byte NAPOT range
-       a011...1111   2^(XLEN+1)-byte NAPOT range
-       0111...1111   2^(XLEN+2)-byte NAPOT range
-       1111...1111   Reserved
-    */
+     * aaaa...aaa0   8-byte NAPOT range
+     * aaaa...aa01   16-byte NAPOT range
+     * aaaa...a011   32-byte NAPOT range
+     * ...
+     * aa01...1111   2^XLEN-byte NAPOT range
+     * a011...1111   2^(XLEN+1)-byte NAPOT range
+     * 0111...1111   2^(XLEN+2)-byte NAPOT range
+     * 1111...1111   Reserved
+     */
     a = (a << 2) | 0x3;
     *sa = a & (a + 1);
     *ea = a | (a + 1);
@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_nums(CPURISCVState *env)
     }
 }
 
-/* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
+/*
+ * Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
  *   end address values.
  *   This function is called relatively infrequently whereas the check that
  *   an address is within a pmp rule is called often, so optimise that one
@@ -XXX,XX +XXX,XX @@ int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
         pmp_size = size;
     }
 
-    /* 1.10 draft priv spec states there is an implicit order
-         from low to high */
+    /*
+     * 1.10 draft priv spec states there is an implicit order
+     * from low to high
+     */
     for (i = 0; i < MAX_RISCV_PMPS; i++) {
         s = pmp_is_in_range(env, i, addr);
         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
@@ -XXX,XX +XXX,XX @@ target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
         return TARGET_PAGE_SIZE;
     } else {
         /*
-        * At this point we have a tlb_size that is the smallest possible size
-        * That fits within a TARGET_PAGE_SIZE and the PMP region.
-        *
-        * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
-        * This means the result isn't cached in the TLB and is only used for
-        * a single translation.
-        */
+         * At this point we have a tlb_size that is the smallest possible size
+         * That fits within a TARGET_PAGE_SIZE and the PMP region.
+         *
+         * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
+         * This means the result isn't cached in the TLB and is only used for
+         * a single translation.
+         */
         return 1;
     }
 }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     uint32_t mstatus_hs_fs;
     uint32_t mstatus_hs_vs;
     uint32_t mem_idx;
-    /* Remember the rounding mode encoded in the previous fp instruction,
-       which we have already installed into env->fp_status.  Or -1 for
-       no previous fp instruction.  Note that we exit the TB when writing
-       to any system register, which includes CSR_FRM, so we do not have
-       to reset this known value.  */
+    /*
+     * Remember the rounding mode encoded in the previous fp instruction,
+     * which we have already installed into env->fp_status.  Or -1 for
+     * no previous fp instruction.  Note that we exit the TB when writing
+     * to any system register, which includes CSR_FRM, so we do not have
+     * to reset this known value.
+     */
     int frm;
     RISCVMXL ol;
     bool virt_inst_excp;
@@ -XXX,XX +XXX,XX @@ static TCGv_i64 dest_fpr(DisasContext *ctx, int reg_num)
     }
 }
 
-/* assume t is nanboxing (for normal) or sign-extended (for zfinx) */
+/* assume it is nanboxing (for normal) or sign-extended (for zfinx) */
 static void gen_set_fpr_hs(DisasContext *ctx, int reg_num, TCGv_i64 t)
 {
     if (!ctx->cfg_ptr->ext_zfinx) {
@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
 }
 
 #ifndef CONFIG_USER_ONLY
-/* The states of mstatus_fs are:
+/*
+ * The states of mstatus_fs are:
  * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
  * We will have already diagnosed disabled state,
  * and need to turn initial/clean into dirty.
@@ -XXX,XX +XXX,XX @@ static inline void mark_fs_dirty(DisasContext *ctx) { }
 #endif
 
 #ifndef CONFIG_USER_ONLY
-/* The states of mstatus_vs are:
+/*
+ * The states of mstatus_vs are:
  * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
  * We will have already diagnosed disabled state,
  * and need to turn initial/clean into dirty.
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static void vext_set_tail_elems_1s(CPURISCVState *env, target_ulong vl,
 }
 
 /*
- *** stride: access vector element from strided memory
+ * stride: access vector element from strided memory
  */
 static void
 vext_ldst_stride(void *vd, void *v0, target_ulong base,
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_STRIDE(vsse32_v, int32_t, ste_w)
 GEN_VEXT_ST_STRIDE(vsse64_v, int64_t, ste_d)
 
 /*
- *** unit-stride: access elements stored contiguously in memory
+ * unit-stride: access elements stored contiguously in memory
  */
 
-/* unmasked unit-stride load and store operation*/
+/* unmasked unit-stride load and store operation */
 static void
 vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
              vext_ldst_elem_fn *ldst_elem, uint32_t log2_esz, uint32_t evl,
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_US(vse32_v, int32_t, ste_w)
 GEN_VEXT_ST_US(vse64_v, int64_t, ste_d)
 
 /*
- *** unit stride mask load and store, EEW = 1
+ * unit stride mask load and store, EEW = 1
  */
 void HELPER(vlm_v)(void *vd, void *v0, target_ulong base,
                     CPURISCVState *env, uint32_t desc)
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm_v)(void *vd, void *v0, target_ulong base,
 }
 
 /*
- *** index: access vector element from indexed memory
+ * index: access vector element from indexed memory
  */
 typedef target_ulong vext_get_index_addr(target_ulong base,
         uint32_t idx, void *vs2);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_INDEX(vsxei64_32_v, int32_t, idx_d, ste_w)
 GEN_VEXT_ST_INDEX(vsxei64_64_v, int64_t, idx_d, ste_d)
 
 /*
- *** unit-stride fault-only-fisrt load instructions
+ * unit-stride fault-only-fisrt load instructions
  */
 static inline void
 vext_ldff(void *vd, void *v0, target_ulong base,
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
     uint32_t vma = vext_vma(desc);
     target_ulong addr, offset, remain;
 
-    /* probe every access*/
+    /* probe every access */
     for (i = env->vstart; i < env->vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
             continue;
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_LDFF(vle64ff_v, int64_t, lde_d)
 #define DO_MINU(N, M) DO_MIN((UMTYPE)N, (UMTYPE)M)
 
 /*
- *** load and store whole register instructions
+ * load and store whole register instructions
  */
 static void
 vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs4r_v, int8_t, ste_b)
 GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 
 /*
- *** Vector Integer Arithmetic Instructions
+ * Vector Integer Arithmetic Instructions
  */
 
 /* expand macro args before macro */
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
         vext_set_elem_mask(vd, i, DO_OP(s2, s1, carry));      \
     }                                                         \
     env->vstart = 0;                                          \
-    /* mask destination register are always tail-agnostic */  \
-    /* set tail elements to 1s */                             \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */                                                       \
     if (vta_all_1s) {                                         \
         for (; i < total_elems; i++) {                        \
             vext_set_elem_mask(vd, i, 1);                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,          \
                 DO_OP(s2, (ETYPE)(target_long)s1, carry));      \
     }                                                           \
     env->vstart = 0;                                            \
-    /* mask destination register are always tail-agnostic */    \
-    /* set tail elements to 1s */                               \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */                                                         \
     if (vta_all_1s) {                                           \
         for (; i < total_elems; i++) {                          \
             vext_set_elem_mask(vd, i, 1);                       \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
         vext_set_elem_mask(vd, i, DO_OP(s2, s1));             \
     }                                                         \
     env->vstart = 0;                                          \
-    /* mask destination register are always tail-agnostic */  \
-    /* set tail elements to 1s */                             \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */                                                       \
     if (vta_all_1s) {                                         \
         for (; i < total_elems; i++) {                        \
             vext_set_elem_mask(vd, i, 1);                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
                 DO_OP(s2, (ETYPE)(target_long)s1));                 \
     }                                                               \
     env->vstart = 0;                                                \
-    /* mask destination register are always tail-agnostic */        \
-    /* set tail elements to 1s */                                   \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */                                                             \
     if (vta_all_1s) {                                               \
         for (; i < total_elems; i++) {                              \
             vext_set_elem_mask(vd, i, 1);                           \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VMERGE_VX(vmerge_vxm_w, int32_t, H4)
 GEN_VEXT_VMERGE_VX(vmerge_vxm_d, int64_t, H8)
 
 /*
- *** Vector Fixed-Point Arithmetic Instructions
+ * Vector Fixed-Point Arithmetic Instructions
  */
 
 /* Vector Single-Width Saturating Add and Subtract */
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX_RM(vnclipu_wx_h, 2)
 GEN_VEXT_VX_RM(vnclipu_wx_w, 4)
 
 /*
- *** Vector Float Point Arithmetic Instructions
+ * Vector Float Point Arithmetic Instructions
  */
 /* Vector Single-Width Floating-Point Add/Subtract Instructions */
 #define OPFVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)   \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
                            DO_OP(s2, s1, &env->fp_status));   \
     }                                                         \
     env->vstart = 0;                                          \
-    /* mask destination register are always tail-agnostic */  \
-    /* set tail elements to 1s */                             \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */                                                       \
     if (vta_all_1s) {                                         \
         for (; i < total_elems; i++) {                        \
             vext_set_elem_mask(vd, i, 1);                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,       \
                            DO_OP(s2, (ETYPE)s1, &env->fp_status));  \
     }                                                               \
     env->vstart = 0;                                                \
-    /* mask destination register are always tail-agnostic */        \
-    /* set tail elements to 1s */                                   \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */                                                             \
     if (vta_all_1s) {                                               \
         for (; i < total_elems; i++) {                              \
             vext_set_elem_mask(vd, i, 1);                           \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfcvt_f_x_v_d, 8)
 #define WOP_UU_B uint16_t, uint8_t,  uint8_t
 #define WOP_UU_H uint32_t, uint16_t, uint16_t
 #define WOP_UU_W uint64_t, uint32_t, uint32_t
-/* vfwcvt.xu.f.v vd, vs2, vm # Convert float to double-width unsigned integer.*/
+/*
+ * vfwcvt.xu.f.v vd, vs2, vm # Convert float to double-width unsigned integer.
+ */
 RVVCALL(OPFVV1, vfwcvt_xu_f_v_h, WOP_UU_H, H4, H2, float16_to_uint32)
 RVVCALL(OPFVV1, vfwcvt_xu_f_v_w, WOP_UU_W, H8, H4, float32_to_uint64)
 GEN_VEXT_V_ENV(vfwcvt_xu_f_v_h, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
 
 /*
- *** Vector Reduction Operations
+ * Vector Reduction Operations
  */
 /* Vector Single-Width Integer Reduction Instructions */
 #define GEN_VEXT_RED(NAME, TD, TS2, HD, HS2, OP)          \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_FRED(vfwredosum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
 GEN_VEXT_FRED(vfwredosum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
 
 /*
- *** Vector Mask Operations
+ * Vector Mask Operations
  */
 /* Vector Mask-Register Logical Instructions */
 #define GEN_VEXT_MASK_VV(NAME, OP)                        \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
         vext_set_elem_mask(vd, i, OP(b, a));              \
     }                                                     \
     env->vstart = 0;                                      \
-    /* mask destination register are always tail-         \
-     * agnostic                                           \
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
      */                                                   \
-    /* set tail elements to 1s */                         \
     if (vta_all_1s) {                                     \
         for (; i < total_elems; i++) {                    \
             vext_set_elem_mask(vd, i, 1);                 \
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vcpop_m)(void *v0, void *vs2, CPURISCVState *env,
     return cnt;
 }
 
-/* vfirst find-first-set mask bit*/
+/* vfirst find-first-set mask bit */
 target_ulong HELPER(vfirst_m)(void *v0, void *vs2, CPURISCVState *env,
                               uint32_t desc)
 {
@@ -XXX,XX +XXX,XX @@ static void vmsetm(void *vd, void *v0, void *vs2, CPURISCVState *env,
         }
     }
     env->vstart = 0;
-    /* mask destination register are always tail-agnostic */
-    /* set tail elements to 1s */
+    /*
+     * mask destination register are always tail-agnostic
+     * set tail elements to 1s
+     */
     if (vta_all_1s) {
         for (; i < total_elems; i++) {
             vext_set_elem_mask(vd, i, 1);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VID_V(vid_v_w, uint32_t, H4)
 GEN_VEXT_VID_V(vid_v_d, uint64_t, H8)
 
 /*
- *** Vector Permutation Instructions
+ * Vector Permutation Instructions
  */
 
 /* Vector Slide Instructions */
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vfirst_m(DisasContext *s, arg_rmr *a)
     return false;
 }
 
-/* vmsbf.m set-before-first mask bit */
-/* vmsif.m set-includ-first mask bit */
-/* vmsof.m set-only-first mask bit */
+/*
+ * vmsbf.m set-before-first mask bit
+ * vmsif.m set-including-first mask bit
+ * vmsof.m set-only-first mask bit
+ */
 #define GEN_M_TRANS(NAME)                                          \
 static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
 {                                                                  \
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Fix lines with over 80 characters for both code and comments.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230405085813.40643-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h           |  4 +-
 target/riscv/cpu.c           |  3 +-
 target/riscv/cpu_helper.c    |  3 +-
 target/riscv/csr.c           | 38 ++++++++++--------
 target/riscv/debug.c         | 11 +++---
 target/riscv/gdbstub.c       |  3 +-
 target/riscv/pmp.c           |  6 ++-
 target/riscv/pmu.c           |  3 +-
 target/riscv/vector_helper.c | 76 ++++++++++++++++++++++++------------
 9 files changed, 91 insertions(+), 56 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
 bool riscv_cpu_two_stage_lookup(int mmu_idx);
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
 G_NORETURN void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-                                               MMUAccessType access_type, int mmu_idx,
-                                               uintptr_t retaddr);
+                                               MMUAccessType access_type,
+                                               int mmu_idx, uintptr_t retaddr);
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
                         bool probe, uintptr_t retaddr);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str, int max_str_len)
+static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
+                                 int max_str_len)
 {
     char *old = *isa_str;
     char *new = *isa_str;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
         } else {
             cs->exception_index = page_fault_exceptions ?
-                RISCV_EXCP_STORE_PAGE_FAULT : RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
+                RISCV_EXCP_STORE_PAGE_FAULT :
+                RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
         }
         break;
     default:
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP |
                                               SIP_LCOFIP;
 static const target_ulong hip_writable_mask = MIP_VSSIP;
-static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP |
+                                               MIP_VSEIP;
 static const target_ulong vsip_writable_mask = MIP_VSSIP;
 
 const bool valid_vm_1_10_32[16] = {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
 static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
                                         Int128 *val)
 {
-    *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128, env->mstatus));
+    *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128,
+                                                      env->mstatus));
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstatus(CPURISCVState *env, int csrno,
 {
     env->hstatus = val;
     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
-        qemu_log_mask(LOG_UNIMP, "QEMU does not support mixed HSXLEN options.");
+        qemu_log_mask(LOG_UNIMP,
+                      "QEMU does not support mixed HSXLEN options.");
     }
     if (get_field(val, HSTATUS_VSBE) != 0) {
         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mmte(CPURISCVState *env, int csrno,
     target_ulong wpri_val = val & MMTE_MASK;
 
     if (val != wpri_val) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
-                      "MMTE: WPRI violation written 0x", val,
-                      "vs expected 0x", wpri_val);
+        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
+                      TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
+                      val, "vs expected 0x", wpri_val);
     }
     /* for machine mode pm.current is hardwired to 1 */
     wpri_val |= MMTE_M_PM_CURRENT;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_smte(CPURISCVState *env, int csrno,
     target_ulong wpri_val = val & SMTE_MASK;
 
     if (val != wpri_val) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
-                      "SMTE: WPRI violation written 0x", val,
-                      "vs expected 0x", wpri_val);
+        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
+                      TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
+                      val, "vs expected 0x", wpri_val);
     }
 
     /* if pm.current==0 we can't modify current PM CSRs */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_umte(CPURISCVState *env, int csrno,
     target_ulong wpri_val = val & UMTE_MASK;
 
     if (val != wpri_val) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
-                      "UMTE: WPRI violation written 0x", val,
-                      "vs expected 0x", wpri_val);
+        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
+                      TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
+                      val, "vs expected 0x", wpri_val);
     }
 
     if (check_pm_current_disabled(env, csrno)) {
@@ -XXX,XX +XXX,XX @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
      * at all defined.
      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
-     * significant), for those, this fallback is correctly handling the accesses
+     * significant), for those, this fallback is correctly handling the
+     * accesses
      */
     target_ulong old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value,
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 
     /* Supervisor Trap Setup */
     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
-                         NULL,                read_sstatus_i128               },
-    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie        },
-    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec    },
+                         NULL,                read_sstatus_i128              },
+    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie       },
+    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec   },
     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
-                         write_scounteren                                     },
+                         write_scounteren                                    },
 
     /* Supervisor Trap Handling */
     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static target_ulong type2_mcontrol_validate(CPURISCVState *env,
     /* validate size encoding */
     size = type2_breakpoint_size(env, ctrl);
     if (access_size[size] == -1) {
-        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
-                      size);
+        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
+                                 "SIZE_ANY\n", size);
     } else {
         val |= (ctrl & TYPE2_SIZELO);
         if (riscv_cpu_mxl(env) == MXL_RV64) {
@@ -XXX,XX +XXX,XX @@ static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
     /* validate size encoding */
     size = extract32(ctrl, 16, 4);
     if (access_size[size] == -1) {
-        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
-                      size);
+        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
+                                 "SIZE_ANY\n", size);
     } else {
         val |= (ctrl & TYPE6_SIZE);
     }
@@ -XXX,XX +XXX,XX @@ target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
     int trigger_type;
     switch (tdata_index) {
     case TDATA1:
-        trigger_type = extract_trigger_type(env, env->tdata1[env->trigger_cur]);
+        trigger_type = extract_trigger_type(env,
+                                            env->tdata1[env->trigger_cur]);
         if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
             return deposit64(env->tdata1[env->trigger_cur], 10, 14,
                              itrigger_get_adjust_count(env));
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
     }
     if (env->misa_ext & RVV) {
         int base_reg = cs->gdb_num_regs;
-        gdb_register_coprocessor(cs, riscv_gdb_get_vector, riscv_gdb_set_vector,
+        gdb_register_coprocessor(cs, riscv_gdb_get_vector,
+                                 riscv_gdb_set_vector,
                                  ricsv_gen_dynamic_vector_xml(cs, base_reg),
                                  "riscv-vector.xml", 0);
     }
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
     }
 }
 
-static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
+static void pmp_decode_napot(target_ulong a, target_ulong *sa,
+                             target_ulong *ea)
 {
     /*
      * aaaa...aaa0   8-byte NAPOT range
@@ -XXX,XX +XXX,XX @@ static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
     pmp_update_rule_nums(env);
 }
 
-static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
+static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
+                           target_ulong addr)
 {
     int result = 0;
 
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value, uint32_t ctr_idx)
     } else {
         return -1;
     }
-    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + overflow_ns;
+    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                  overflow_ns;
 
     if (overflow_at > INT64_MAX) {
         overflow_left += overflow_at - INT64_MAX;
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
 }
 
 /*
- * masked unit-stride load and store operation will be a special case of stride,
- * stride = NF * sizeof (MTYPE)
+ * masked unit-stride load and store operation will be a special case of
+ * stride, stride = NF * sizeof (MTYPE)
  */
 
 #define GEN_VEXT_LD_US(NAME, ETYPE, LOAD_FN)                            \
@@ -XXX,XX +XXX,XX @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
         /* load/store rest of elements of current segment pointed by vstart */
         for (pos = off; pos < max_elems; pos++, env->vstart++) {
             target_ulong addr = base + ((pos + k * max_elems) << log2_esz);
-            ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd,
+                      ra);
         }
         k++;
     }
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_SHIFT_VV(vsra_vv_h, uint16_t, int16_t, H2, H2, DO_SRL, 0xf)
 GEN_VEXT_SHIFT_VV(vsra_vv_w, uint32_t, int32_t, H4, H4, DO_SRL, 0x1f)
 GEN_VEXT_SHIFT_VV(vsra_vv_d, uint64_t, int64_t, H8, H8, DO_SRL, 0x3f)
 
-/* generate the helpers for shift instructions with one vector and one scalar */
+/*
+ * generate the helpers for shift instructions with one vector and one scalar
+ */
 #define GEN_VEXT_SHIFT_VX(NAME, TD, TS2, HD, HS2, OP, MASK) \
 void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
                   void *vs2, CPURISCVState *env,            \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,     \
                  do_##NAME, ESZ);                               \
 }
 
-static inline uint8_t saddu8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t b)
+static inline uint8_t saddu8(CPURISCVState *env, int vxrm, uint8_t a,
+                             uint8_t b)
 {
     uint8_t res = a + b;
     if (res < a) {
@@ -XXX,XX +XXX,XX @@ static inline int8_t sadd8(CPURISCVState *env, int vxrm, int8_t a, int8_t b)
     return res;
 }
 
-static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
+static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a,
+                             int16_t b)
 {
     int16_t res = a + b;
     if ((res ^ a) & (res ^ b) & INT16_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
     return res;
 }
 
-static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
+static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a,
+                             int32_t b)
 {
     int32_t res = a + b;
     if ((res ^ a) & (res ^ b) & INT32_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
     return res;
 }
 
-static inline int64_t sadd64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
+static inline int64_t sadd64(CPURISCVState *env, int vxrm, int64_t a,
+                             int64_t b)
 {
     int64_t res = a + b;
     if ((res ^ a) & (res ^ b) & INT64_MIN) {
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX_RM(vsadd_vx_h, 2)
 GEN_VEXT_VX_RM(vsadd_vx_w, 4)
 GEN_VEXT_VX_RM(vsadd_vx_d, 8)
 
-static inline uint8_t ssubu8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t b)
+static inline uint8_t ssubu8(CPURISCVState *env, int vxrm, uint8_t a,
+                             uint8_t b)
 {
     uint8_t res = a - b;
     if (res > a) {
@@ -XXX,XX +XXX,XX @@ static inline int8_t ssub8(CPURISCVState *env, int vxrm, int8_t a, int8_t b)
     return res;
 }
 
-static inline int16_t ssub16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
+static inline int16_t ssub16(CPURISCVState *env, int vxrm, int16_t a,
+                             int16_t b)
 {
     int16_t res = a - b;
     if ((res ^ a) & (a ^ b) & INT16_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int16_t ssub16(CPURISCVState *env, int vxrm, int16_t a, int16_t b)
     return res;
 }
 
-static inline int32_t ssub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
+static inline int32_t ssub32(CPURISCVState *env, int vxrm, int32_t a,
+                             int32_t b)
 {
     int32_t res = a - b;
     if ((res ^ a) & (a ^ b) & INT32_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline int32_t ssub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
     return res;
 }
 
-static inline int64_t ssub64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
+static inline int64_t ssub64(CPURISCVState *env, int vxrm, int64_t a,
+                             int64_t b)
 {
     int64_t res = a - b;
     if ((res ^ a) & (a ^ b) & INT64_MIN) {
@@ -XXX,XX +XXX,XX @@ static inline uint8_t get_round(int vxrm, uint64_t v, uint8_t shift)
     return 0; /* round-down (truncate) */
 }
 
-static inline int32_t aadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
+static inline int32_t aadd32(CPURISCVState *env, int vxrm, int32_t a,
+                             int32_t b)
 {
     int64_t res = (int64_t)a + b;
     uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ static inline int32_t aadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
     return (res >> 1) + round;
 }
 
-static inline int64_t aadd64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
+static inline int64_t aadd64(CPURISCVState *env, int vxrm, int64_t a,
+                             int64_t b)
 {
     int64_t res = a + b;
     uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VX_RM(vaaddu_vx_h, 2)
 GEN_VEXT_VX_RM(vaaddu_vx_w, 4)
 GEN_VEXT_VX_RM(vaaddu_vx_d, 8)
 
-static inline int32_t asub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
+static inline int32_t asub32(CPURISCVState *env, int vxrm, int32_t a,
+                             int32_t b)
 {
     int64_t res = (int64_t)a - b;
     uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ static inline int32_t asub32(CPURISCVState *env, int vxrm, int32_t a, int32_t b)
     return (res >> 1) + round;
 }
 
-static inline int64_t asub64(CPURISCVState *env, int vxrm, int64_t a, int64_t b)
+static inline int64_t asub64(CPURISCVState *env, int vxrm, int64_t a,
+                             int64_t b)
 {
     int64_t res = (int64_t)a - b;
     uint8_t round = get_round(vxrm, res, 1);
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_x_f_v_w, WOP_UU_W, H8, H4, float32_to_int64)
 GEN_VEXT_V_ENV(vfwcvt_x_f_v_h, 4)
 GEN_VEXT_V_ENV(vfwcvt_x_f_v_w, 8)
 
-/* vfwcvt.f.xu.v vd, vs2, vm # Convert unsigned integer to double-width float */
+/*
+ * vfwcvt.f.xu.v vd, vs2, vm # Convert unsigned integer to double-width float.
+ */
 RVVCALL(OPFVV1, vfwcvt_f_xu_v_b, WOP_UU_B, H2, H1, uint8_to_float16)
 RVVCALL(OPFVV1, vfwcvt_f_xu_v_h, WOP_UU_H, H4, H2, uint16_to_float32)
 RVVCALL(OPFVV1, vfwcvt_f_xu_v_w, WOP_UU_W, H8, H4, uint32_to_float64)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfwcvt_f_x_v_h, 4)
 GEN_VEXT_V_ENV(vfwcvt_f_x_v_w, 8)
 
 /*
- * vfwcvt.f.f.v vd, vs2, vm
- * Convert single-width float to double-width float.
+ * vfwcvt.f.f.v vd, vs2, vm # Convert single-width float to double-width float.
  */
 static uint32_t vfwcvtffv16(uint16_t a, float_status *s)
 {
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_V_ENV(vfncvt_x_f_w_b, 1)
 GEN_VEXT_V_ENV(vfncvt_x_f_w_h, 2)
 GEN_VEXT_V_ENV(vfncvt_x_f_w_w, 4)
 
-/* vfncvt.f.xu.v vd, vs2, vm # Convert double-width unsigned integer to float */
+/*
+ * vfncvt.f.xu.v vd, vs2, vm # Convert double-width unsigned integer to float.
+ */
 RVVCALL(OPFVV1, vfncvt_f_xu_w_h, NOP_UU_H, H2, H4, uint32_to_float16)
 RVVCALL(OPFVV1, vfncvt_f_xu_w_w, NOP_UU_W, H4, H8, uint64_to_float32)
 GEN_VEXT_V_ENV(vfncvt_f_xu_w_h, 2)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_FRED(vfredosum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
 GEN_VEXT_FRED(vfredosum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
 
 /* Maximum value */
-GEN_VEXT_FRED(vfredmax_vs_h, uint16_t, uint16_t, H2, H2, float16_maximum_number)
-GEN_VEXT_FRED(vfredmax_vs_w, uint32_t, uint32_t, H4, H4, float32_maximum_number)
-GEN_VEXT_FRED(vfredmax_vs_d, uint64_t, uint64_t, H8, H8, float64_maximum_number)
+GEN_VEXT_FRED(vfredmax_vs_h, uint16_t, uint16_t, H2, H2,
+              float16_maximum_number)
+GEN_VEXT_FRED(vfredmax_vs_w, uint32_t, uint32_t, H4, H4,
+              float32_maximum_number)
+GEN_VEXT_FRED(vfredmax_vs_d, uint64_t, uint64_t, H8, H8,
+              float64_maximum_number)
 
 /* Minimum value */
-GEN_VEXT_FRED(vfredmin_vs_h, uint16_t, uint16_t, H2, H2, float16_minimum_number)
-GEN_VEXT_FRED(vfredmin_vs_w, uint32_t, uint32_t, H4, H4, float32_minimum_number)
-GEN_VEXT_FRED(vfredmin_vs_d, uint64_t, uint64_t, H8, H8, float64_minimum_number)
+GEN_VEXT_FRED(vfredmin_vs_h, uint16_t, uint16_t, H2, H2,
+              float16_minimum_number)
+GEN_VEXT_FRED(vfredmin_vs_w, uint32_t, uint32_t, H4, H4,
+              float32_minimum_number)
+GEN_VEXT_FRED(vfredmin_vs_d, uint64_t, uint64_t, H8, H8,
+              float64_minimum_number)
 
 /* Vector Widening Floating-Point Add Instructions */
 static uint32_t fwadd16(uint32_t a, uint16_t b, float_status *s)
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add signature and signature-granularity properties in spike to specify the target
signatrue file and the line size for signature data.

Recgonize the signature section between begin_signature and end_signature symbols
when loading elf of ACT tests. Then dump signature data in signature section just
before the ACT tests exit.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230405095720.75848-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/char/riscv_htif.h |  3 +++
 hw/char/riscv_htif.c         | 44 +++++++++++++++++++++++++++++++++++-
 hw/riscv/spike.c             | 13 +++++++++++
 3 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -XXX,XX +XXX,XX @@ typedef struct HTIFState {
     uint64_t pending_read;
 } HTIFState;
 
+extern const char *sig_file;
+extern uint8_t line_size;
+
 /* HTIF symbol callback */
 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
     uint64_t st_size);
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
+#include "exec/address-spaces.h"
+#include "sysemu/dma.h"
 
 #define RISCV_DEBUG_HTIF 0
 #define HTIF_DEBUG(fmt, ...)                                                   \
@@ -XXX,XX +XXX,XX @@
 /* PK system call number */
 #define PK_SYS_WRITE            64
 
-static uint64_t fromhost_addr, tohost_addr;
+const char *sig_file;
+uint8_t line_size = 16;
+
+static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr;
 
 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
                           uint64_t st_size)
@@ -XXX,XX +XXX,XX @@ void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
             error_report("HTIF tohost must be 8 bytes");
             exit(1);
         }
+    } else if (strcmp("begin_signature", st_name) == 0) {
+        begin_sig_addr = st_value;
+    } else if (strcmp("end_signature", st_name) == 0) {
+        end_sig_addr = st_value;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             if (payload & 0x1) {
                 /* exit code */
                 int exit_code = payload >> 1;
+
+                /*
+                 * Dump signature data if sig_file is specified and
+                 * begin/end_signature symbols exist.
+                 */
+                if (sig_file && begin_sig_addr && end_sig_addr) {
+                    uint64_t sig_len = end_sig_addr - begin_sig_addr;
+                    char *sig_data = g_malloc(sig_len);
+                    dma_memory_read(&address_space_memory, begin_sig_addr,
+                                    sig_data, sig_len, MEMTXATTRS_UNSPECIFIED);
+                    FILE *signature = fopen(sig_file, "w");
+                    if (signature == NULL) {
+                        error_report("Unable to open %s with error %s",
+                                     sig_file, strerror(errno));
+                        exit(1);
+                    }
+
+                    for (int i = 0; i < sig_len; i += line_size) {
+                        for (int j = line_size; j > 0; j--) {
+                            if (i + j <= sig_len) {
+                                fprintf(signature, "%02x",
+                                        sig_data[i + j - 1] & 0xff);
+                            } else {
+                                fprintf(signature, "%02x", 0);
+                            }
+                        }
+                        fprintf(signature, "\n");
+                    }
+
+                    fclose(signature);
+                    g_free(sig_data);
+                }
+
                 exit(exit_code);
             } else {
                 uint64_t syscall[8];
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
                  htif_custom_base);
 }
 
+static void spike_set_signature(Object *obj, const char *val, Error **errp)
+{
+    sig_file = g_strdup(val);
+}
+
 static void spike_machine_instance_init(Object *obj)
 {
 }
@@ -XXX,XX +XXX,XX @@ static void spike_machine_class_init(ObjectClass *oc, void *data)
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
     mc->default_ram_id = "riscv.spike.ram";
+    object_class_property_add_str(oc, "signature", NULL, spike_set_signature);
+    object_class_property_set_description(oc, "signature",
+                                          "File to write ACT test signature");
+    object_class_property_add_uint8_ptr(oc, "signature-granularity",
+                                        &line_size, OBJ_PROP_FLAG_WRITE);
+    object_class_property_set_description(oc, "signature-granularity",
+                                          "Size of each line in ACT signature "
+                                          "file");
 }
 
 static const TypeInfo spike_machine_typeinfo = {
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

When riscv_cpu_realize() starts we're guaranteed to have cpu->cfg.ext_N
properties updated. The same can't be said about env->misa_ext*, since
the user might enable/disable MISA extensions in the command line, and
env->misa_ext* won't caught these changes. The current solution is to
sync everything at the end of validate_set_extensions(), checking every
cpu->cfg.ext_N value to do a set_misa() in the end.

The last change we're making in the MISA cfg flags are in the G
extension logic, enabling IMAFG if cpu->cfg_ext.g is enabled. Otherwise
we're not making any changes in MISA bits ever since realize() starts.

There's no reason to postpone misa_ext updates until the end of the
validation. Let's do it earlier, during realize(), in a new helper
called riscv_cpu_sync_misa_cfg(). If cpu->cfg.ext_g is enabled, do it
again by updating env->misa_ext* directly.

This is a pre-requisite to allow riscv_cpu_validate_set_extensions() to
use riscv_has_ext() instead of cpu->cfg.ext_N to validate the MISA
extensions, which is our end goal here.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 94 +++++++++++++++++++++++++++-------------------
 1 file changed, 56 insertions(+), 38 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 
 /*
  * Check consistency between chosen extensions while setting
- * cpu->cfg accordingly, doing a set_misa() in the end.
+ * cpu->cfg accordingly.
  */
 static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 {
     CPURISCVState *env = &cpu->env;
-    uint32_t ext = 0;
 
     /* Do some ISA extension error checking */
     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_d = true;
         cpu->cfg.ext_icsr = true;
         cpu->cfg.ext_ifencei = true;
+
+        env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
+        env->misa_ext_mask = env->misa_ext;
     }
 
     if (cpu->cfg.ext_i && cpu->cfg.ext_e) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_zksh = true;
     }
 
-    if (cpu->cfg.ext_i) {
-        ext |= RVI;
-    }
-    if (cpu->cfg.ext_e) {
-        ext |= RVE;
-    }
-    if (cpu->cfg.ext_m) {
-        ext |= RVM;
-    }
-    if (cpu->cfg.ext_a) {
-        ext |= RVA;
-    }
-    if (cpu->cfg.ext_f) {
-        ext |= RVF;
-    }
-    if (cpu->cfg.ext_d) {
-        ext |= RVD;
-    }
-    if (cpu->cfg.ext_c) {
-        ext |= RVC;
-    }
-    if (cpu->cfg.ext_s) {
-        ext |= RVS;
-    }
-    if (cpu->cfg.ext_u) {
-        ext |= RVU;
-    }
-    if (cpu->cfg.ext_h) {
-        ext |= RVH;
-    }
     if (cpu->cfg.ext_v) {
         int vext_version = VEXT_VERSION_1_00_0;
-        ext |= RVV;
         if (!is_power_of_2(cpu->cfg.vlen)) {
             error_setg(errp,
                        "Vector extension VLEN must be power of 2");
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         }
         set_vext_version(env, vext_version);
     }
-    if (cpu->cfg.ext_j) {
-        ext |= RVJ;
-    }
-
-    set_misa(env, env->misa_mxl, ext);
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
 #endif
 }
 
+static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
+{
+    uint32_t ext = 0;
+
+    if (riscv_cpu_cfg(env)->ext_i) {
+        ext |= RVI;
+    }
+    if (riscv_cpu_cfg(env)->ext_e) {
+        ext |= RVE;
+    }
+    if (riscv_cpu_cfg(env)->ext_m) {
+        ext |= RVM;
+    }
+    if (riscv_cpu_cfg(env)->ext_a) {
+        ext |= RVA;
+    }
+    if (riscv_cpu_cfg(env)->ext_f) {
+        ext |= RVF;
+    }
+    if (riscv_cpu_cfg(env)->ext_d) {
+        ext |= RVD;
+    }
+    if (riscv_cpu_cfg(env)->ext_c) {
+        ext |= RVC;
+    }
+    if (riscv_cpu_cfg(env)->ext_s) {
+        ext |= RVS;
+    }
+    if (riscv_cpu_cfg(env)->ext_u) {
+        ext |= RVU;
+    }
+    if (riscv_cpu_cfg(env)->ext_h) {
+        ext |= RVH;
+    }
+    if (riscv_cpu_cfg(env)->ext_v) {
+        ext |= RVV;
+    }
+    if (riscv_cpu_cfg(env)->ext_j) {
+        ext |= RVJ;
+    }
+
+    env->misa_ext = env->misa_ext_mask = ext;
+}
+
 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         set_priv_version(env, priv_version);
     }
 
+    /*
+     * We can't be sure of whether we set defaults during cpu_init()
+     * or whether the user enabled/disabled some bits via cpu->cfg
+     * flags. Sync env->misa_ext with cpu->cfg now to allow us to
+     * use just env->misa_ext later.
+     */
+    riscv_cpu_sync_misa_cfg(env);
+
     /* Force disable extensions if priv spec version does not match */
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
         if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The code that disables extensions if there's a priv version mismatch
uses cpu->cfg.ext_N properties to do its job.

We're aiming to not rely on cpu->cfg.ext_N props for MISA bits. Split
the MISA related verifications in a new function, removing it from
isa_edata_arr[].

We're also erroring it out instead of disabling, making the cpu_init()
function responsible for running an adequate priv spec for the MISA
extensions it wants to use.

Note that the RVV verification is being ignored since we're always have
at least PRIV_VERSION_1_10_0.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
  * 4. Non-standard extensions (starts with 'X') must be listed after all
  *    standard extensions. They must be separated from other multi-letter
  *    extensions by an underscore.
+ *
+ * Single letter extensions are checked in riscv_cpu_validate_misa_priv()
+ * instead.
  */
 static const struct isa_ext_data isa_edata_arr[] = {
-    ISA_EXT_DATA_ENTRY(h, false, PRIV_VERSION_1_12_0, ext_h),
-    ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_10_0, ext_v),
     ISA_EXT_DATA_ENTRY(zicbom, true, PRIV_VERSION_1_12_0, ext_icbom),
     ISA_EXT_DATA_ENTRY(zicboz, true, PRIV_VERSION_1_12_0, ext_icboz),
     ISA_EXT_DATA_ENTRY(zicond, true, PRIV_VERSION_1_12_0, ext_zicond),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     env->misa_ext = env->misa_ext_mask = ext;
 }
 
+static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
+{
+    if (riscv_has_ext(env, RVH) && env->priv_ver < PRIV_VERSION_1_12_0) {
+        error_setg(errp, "H extension requires priv spec 1.12.0");
+        return;
+    }
+}
+
 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
      */
     riscv_cpu_sync_misa_cfg(env);
 
+    riscv_cpu_validate_misa_priv(env, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
     /* Force disable extensions if priv spec version does not match */
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
         if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We don't have MISA extensions in isa_edata_arr[] anymore. Remove the
redundant 'multi_letter' field from isa_ext_data.

Suggested-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 132 ++++++++++++++++++++++-----------------------
 1 file changed, 65 insertions(+), 67 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
     const char *name;
-    bool multi_letter;
     int min_version;
     int ext_enable_offset;
 };
 
-#define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
-    {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+#define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
+    {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
 /*
  * Here are the ordering rules of extension naming defined by RISC-V
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
  * instead.
  */
 static const struct isa_ext_data isa_edata_arr[] = {
-    ISA_EXT_DATA_ENTRY(zicbom, true, PRIV_VERSION_1_12_0, ext_icbom),
-    ISA_EXT_DATA_ENTRY(zicboz, true, PRIV_VERSION_1_12_0, ext_icboz),
-    ISA_EXT_DATA_ENTRY(zicond, true, PRIV_VERSION_1_12_0, ext_zicond),
-    ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
-    ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
-    ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
-    ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
-    ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_11_0, ext_zfh),
-    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_11_0, ext_zfhmin),
-    ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
-    ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
-    ISA_EXT_DATA_ENTRY(zca, true, PRIV_VERSION_1_12_0, ext_zca),
-    ISA_EXT_DATA_ENTRY(zcb, true, PRIV_VERSION_1_12_0, ext_zcb),
-    ISA_EXT_DATA_ENTRY(zcf, true, PRIV_VERSION_1_12_0, ext_zcf),
-    ISA_EXT_DATA_ENTRY(zcd, true, PRIV_VERSION_1_12_0, ext_zcd),
-    ISA_EXT_DATA_ENTRY(zce, true, PRIV_VERSION_1_12_0, ext_zce),
-    ISA_EXT_DATA_ENTRY(zcmp, true, PRIV_VERSION_1_12_0, ext_zcmp),
-    ISA_EXT_DATA_ENTRY(zcmt, true, PRIV_VERSION_1_12_0, ext_zcmt),
-    ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
-    ISA_EXT_DATA_ENTRY(zbb, true, PRIV_VERSION_1_12_0, ext_zbb),
-    ISA_EXT_DATA_ENTRY(zbc, true, PRIV_VERSION_1_12_0, ext_zbc),
-    ISA_EXT_DATA_ENTRY(zbkb, true, PRIV_VERSION_1_12_0, ext_zbkb),
-    ISA_EXT_DATA_ENTRY(zbkc, true, PRIV_VERSION_1_12_0, ext_zbkc),
-    ISA_EXT_DATA_ENTRY(zbkx, true, PRIV_VERSION_1_12_0, ext_zbkx),
-    ISA_EXT_DATA_ENTRY(zbs, true, PRIV_VERSION_1_12_0, ext_zbs),
-    ISA_EXT_DATA_ENTRY(zk, true, PRIV_VERSION_1_12_0, ext_zk),
-    ISA_EXT_DATA_ENTRY(zkn, true, PRIV_VERSION_1_12_0, ext_zkn),
-    ISA_EXT_DATA_ENTRY(zknd, true, PRIV_VERSION_1_12_0, ext_zknd),
-    ISA_EXT_DATA_ENTRY(zkne, true, PRIV_VERSION_1_12_0, ext_zkne),
-    ISA_EXT_DATA_ENTRY(zknh, true, PRIV_VERSION_1_12_0, ext_zknh),
-    ISA_EXT_DATA_ENTRY(zkr, true, PRIV_VERSION_1_12_0, ext_zkr),
-    ISA_EXT_DATA_ENTRY(zks, true, PRIV_VERSION_1_12_0, ext_zks),
-    ISA_EXT_DATA_ENTRY(zksed, true, PRIV_VERSION_1_12_0, ext_zksed),
-    ISA_EXT_DATA_ENTRY(zksh, true, PRIV_VERSION_1_12_0, ext_zksh),
-    ISA_EXT_DATA_ENTRY(zkt, true, PRIV_VERSION_1_12_0, ext_zkt),
-    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_10_0, ext_zve32f),
-    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_10_0, ext_zve64f),
-    ISA_EXT_DATA_ENTRY(zve64d, true, PRIV_VERSION_1_10_0, ext_zve64d),
-    ISA_EXT_DATA_ENTRY(zvfh, true, PRIV_VERSION_1_12_0, ext_zvfh),
-    ISA_EXT_DATA_ENTRY(zvfhmin, true, PRIV_VERSION_1_12_0, ext_zvfhmin),
-    ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
-    ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
-    ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
-    ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
-    ISA_EXT_DATA_ENTRY(sscofpmf, true, PRIV_VERSION_1_12_0, ext_sscofpmf),
-    ISA_EXT_DATA_ENTRY(sstc, true, PRIV_VERSION_1_12_0, ext_sstc),
-    ISA_EXT_DATA_ENTRY(svadu, true, PRIV_VERSION_1_12_0, ext_svadu),
-    ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
-    ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
-    ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
-    ISA_EXT_DATA_ENTRY(xtheadba, true, PRIV_VERSION_1_11_0, ext_xtheadba),
-    ISA_EXT_DATA_ENTRY(xtheadbb, true, PRIV_VERSION_1_11_0, ext_xtheadbb),
-    ISA_EXT_DATA_ENTRY(xtheadbs, true, PRIV_VERSION_1_11_0, ext_xtheadbs),
-    ISA_EXT_DATA_ENTRY(xtheadcmo, true, PRIV_VERSION_1_11_0, ext_xtheadcmo),
-    ISA_EXT_DATA_ENTRY(xtheadcondmov, true, PRIV_VERSION_1_11_0, ext_xtheadcondmov),
-    ISA_EXT_DATA_ENTRY(xtheadfmemidx, true, PRIV_VERSION_1_11_0, ext_xtheadfmemidx),
-    ISA_EXT_DATA_ENTRY(xtheadfmv, true, PRIV_VERSION_1_11_0, ext_xtheadfmv),
-    ISA_EXT_DATA_ENTRY(xtheadmac, true, PRIV_VERSION_1_11_0, ext_xtheadmac),
-    ISA_EXT_DATA_ENTRY(xtheadmemidx, true, PRIV_VERSION_1_11_0, ext_xtheadmemidx),
-    ISA_EXT_DATA_ENTRY(xtheadmempair, true, PRIV_VERSION_1_11_0, ext_xtheadmempair),
-    ISA_EXT_DATA_ENTRY(xtheadsync, true, PRIV_VERSION_1_11_0, ext_xtheadsync),
-    ISA_EXT_DATA_ENTRY(xventanacondops, true, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
+    ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_icbom),
+    ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_icboz),
+    ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
+    ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
+    ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
+    ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+    ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
+    ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
+    ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
+    ISA_EXT_DATA_ENTRY(zdinx, PRIV_VERSION_1_12_0, ext_zdinx),
+    ISA_EXT_DATA_ENTRY(zca, PRIV_VERSION_1_12_0, ext_zca),
+    ISA_EXT_DATA_ENTRY(zcb, PRIV_VERSION_1_12_0, ext_zcb),
+    ISA_EXT_DATA_ENTRY(zcf, PRIV_VERSION_1_12_0, ext_zcf),
+    ISA_EXT_DATA_ENTRY(zcd, PRIV_VERSION_1_12_0, ext_zcd),
+    ISA_EXT_DATA_ENTRY(zce, PRIV_VERSION_1_12_0, ext_zce),
+    ISA_EXT_DATA_ENTRY(zcmp, PRIV_VERSION_1_12_0, ext_zcmp),
+    ISA_EXT_DATA_ENTRY(zcmt, PRIV_VERSION_1_12_0, ext_zcmt),
+    ISA_EXT_DATA_ENTRY(zba, PRIV_VERSION_1_12_0, ext_zba),
+    ISA_EXT_DATA_ENTRY(zbb, PRIV_VERSION_1_12_0, ext_zbb),
+    ISA_EXT_DATA_ENTRY(zbc, PRIV_VERSION_1_12_0, ext_zbc),
+    ISA_EXT_DATA_ENTRY(zbkb, PRIV_VERSION_1_12_0, ext_zbkb),
+    ISA_EXT_DATA_ENTRY(zbkc, PRIV_VERSION_1_12_0, ext_zbkc),
+    ISA_EXT_DATA_ENTRY(zbkx, PRIV_VERSION_1_12_0, ext_zbkx),
+    ISA_EXT_DATA_ENTRY(zbs, PRIV_VERSION_1_12_0, ext_zbs),
+    ISA_EXT_DATA_ENTRY(zk, PRIV_VERSION_1_12_0, ext_zk),
+    ISA_EXT_DATA_ENTRY(zkn, PRIV_VERSION_1_12_0, ext_zkn),
+    ISA_EXT_DATA_ENTRY(zknd, PRIV_VERSION_1_12_0, ext_zknd),
+    ISA_EXT_DATA_ENTRY(zkne, PRIV_VERSION_1_12_0, ext_zkne),
+    ISA_EXT_DATA_ENTRY(zknh, PRIV_VERSION_1_12_0, ext_zknh),
+    ISA_EXT_DATA_ENTRY(zkr, PRIV_VERSION_1_12_0, ext_zkr),
+    ISA_EXT_DATA_ENTRY(zks, PRIV_VERSION_1_12_0, ext_zks),
+    ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
+    ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
+    ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
+    ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
+    ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
+    ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
+    ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+    ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+    ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+    ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+    ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
+    ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
+    ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
+    ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
+    ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
+    ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
+    ISA_EXT_DATA_ENTRY(svpbmt, PRIV_VERSION_1_12_0, ext_svpbmt),
+    ISA_EXT_DATA_ENTRY(xtheadba, PRIV_VERSION_1_11_0, ext_xtheadba),
+    ISA_EXT_DATA_ENTRY(xtheadbb, PRIV_VERSION_1_11_0, ext_xtheadbb),
+    ISA_EXT_DATA_ENTRY(xtheadbs, PRIV_VERSION_1_11_0, ext_xtheadbs),
+    ISA_EXT_DATA_ENTRY(xtheadcmo, PRIV_VERSION_1_11_0, ext_xtheadcmo),
+    ISA_EXT_DATA_ENTRY(xtheadcondmov, PRIV_VERSION_1_11_0, ext_xtheadcondmov),
+    ISA_EXT_DATA_ENTRY(xtheadfmemidx, PRIV_VERSION_1_11_0, ext_xtheadfmemidx),
+    ISA_EXT_DATA_ENTRY(xtheadfmv, PRIV_VERSION_1_11_0, ext_xtheadfmv),
+    ISA_EXT_DATA_ENTRY(xtheadmac, PRIV_VERSION_1_11_0, ext_xtheadmac),
+    ISA_EXT_DATA_ENTRY(xtheadmemidx, PRIV_VERSION_1_11_0, ext_xtheadmemidx),
+    ISA_EXT_DATA_ENTRY(xtheadmempair, PRIV_VERSION_1_11_0, ext_xtheadmempair),
+    ISA_EXT_DATA_ENTRY(xtheadsync, PRIV_VERSION_1_11_0, ext_xtheadsync),
+    ISA_EXT_DATA_ENTRY(xventanacondops, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
 };
 
 static bool isa_ext_is_enabled(RISCVCPU *cpu,
@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
     int i;
 
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-        if (isa_edata_arr[i].multi_letter &&
-            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
             g_free(old);
             old = new;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Ever since RISCVCPUConfig got introduced users are able to set CPU extensions
in the command line. User settings are reflected in the cpu->cfg object
for later use. These properties are used in the target/riscv/cpu.c code,
most notably in riscv_cpu_validate_set_extensions(), where most of our
realize time validations are made.

And then there's env->misa_ext, the field where the MISA extensions are
set, that is read everywhere else. We need to keep env->misa_ext updated
with cpu->cfg settings, since our validations rely on it, forcing us to
make register_cpu_props() write cpu->cfg.ext_N flags to cover for named
CPUs that aren't used named properties but also needs to go through the
same validation steps. Failing to so will make those name CPUs fail
validation (see c66ffcd5358b for more info). Not only that, but we also
need to sync env->misa_ext with cpu->cfg again during realize() time to
catch any change the user might have done, since the rest of the code
relies on that.

Making cpu->cfg.ext_N and env->misa_ext reflect each other is not
needed. What we want is a way for users to enable/disable MISA extensions,
and there's nothing stopping us from letting the user write env->misa_ext
directly. Here are the artifacts that will enable us to do that:

- RISCVCPUMisaExtConfig will declare each MISA property;

- cpu_set_misa_ext_cfg() is the setter for each property. We'll write
  env->misa_ext and env->misa_ext_mask with the appropriate misa_bit;
  cutting off cpu->cfg.ext_N from the logic;

- cpu_get_misa_ext_cfg() is a getter that will retrieve the current val
  of the property based on env->misa_ext;

- riscv_cpu_add_misa_properties() will be called in register_cpu_props()
  to init all MISA properties from the misa_ext_cfgs[] array.

With this infrastructure we'll start to get rid of each cpu->cfg.ext_N
attribute in the next patches.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_init(Object *obj)
 #endif /* CONFIG_USER_ONLY */
 }
 
+typedef struct RISCVCPUMisaExtConfig {
+    const char *name;
+    const char *description;
+    target_ulong misa_bit;
+    bool enabled;
+} RISCVCPUMisaExtConfig;
+
+static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+                                 void *opaque, Error **errp)
+{
+    const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
+    target_ulong misa_bit = misa_ext_cfg->misa_bit;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    CPURISCVState *env = &cpu->env;
+    bool value;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    if (value) {
+        env->misa_ext |= misa_bit;
+        env->misa_ext_mask |= misa_bit;
+    } else {
+        env->misa_ext &= ~misa_bit;
+        env->misa_ext_mask &= ~misa_bit;
+    }
+}
+
+static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+                                 void *opaque, Error **errp)
+{
+    const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
+    target_ulong misa_bit = misa_ext_cfg->misa_bit;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    CPURISCVState *env = &cpu->env;
+    bool value;
+
+    value = env->misa_ext & misa_bit;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
+static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {};
+
+static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
+        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+
+        object_property_add(cpu_obj, misa_cfg->name, "bool",
+                            cpu_get_misa_ext_cfg,
+                            cpu_set_misa_ext_cfg,
+                            NULL, (void *)misa_cfg);
+        object_property_set_description(cpu_obj, misa_cfg->name,
+                                        misa_cfg->description);
+        object_property_set_bool(cpu_obj, misa_cfg->name,
+                                 misa_cfg->enabled, NULL);
+    }
+}
+
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
     DEFINE_PROP_BOOL("i", RISCVCPU, cfg.ext_i, true),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
         return;
     }
 
+    riscv_cpu_add_misa_properties(obj);
+
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
         qdev_property_add_static(dev, prop);
     }
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "a" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVA. Instances of cpu->cfg.ext_a and similar are
replaced with riscv_has_ext(env, RVA).

Remove the old "a" property and 'ext_a' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 16 ++++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "c" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVC. Instances of cpu->cfg.ext_c and similar are
replaced with riscv_has_ext(env, RVC).

Remove the old "c" property and 'ext_c' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 -
 target/riscv/cpu.c | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "d" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVD. Instances of cpu->cfg.ext_d and similar are
replaced with riscv_has_ext(env, RVD).

Remove the old "d" property and 'ext_d' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 17 ++++++++---------
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_g;
     bool ext_m;
     bool ext_f;
-    bool ext_d;
     bool ext_s;
     bool ext_u;
     bool ext_h;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     /* Do some ISA extension error checking */
     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
                             riscv_has_ext(env, RVA) &&
-                            cpu->cfg.ext_f && cpu->cfg.ext_d &&
+                            cpu->cfg.ext_f && riscv_has_ext(env, RVD) &&
                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
         cpu->cfg.ext_i = true;
         cpu->cfg.ext_m = true;
         cpu->cfg.ext_f = true;
-        cpu->cfg.ext_d = true;
         cpu->cfg.ext_icsr = true;
         cpu->cfg.ext_ifencei = true;
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_d && !cpu->cfg.ext_f) {
+    if (riscv_has_ext(env, RVD) && !cpu->cfg.ext_f) {
         error_setg(errp, "D extension requires F extension");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_zve32f = true;
     }
 
-    if (cpu->cfg.ext_zve64d && !cpu->cfg.ext_d) {
+    if (cpu->cfg.ext_zve64d && !riscv_has_ext(env, RVD)) {
         error_setg(errp, "Zve64d/V extensions require D extension");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
             cpu->cfg.ext_zcf = true;
         }
-        if (cpu->cfg.ext_d) {
+        if (riscv_has_ext(env, RVD)) {
             cpu->cfg.ext_zcd = true;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (!cpu->cfg.ext_d && cpu->cfg.ext_zcd) {
+    if (!riscv_has_ext(env, RVD) && cpu->cfg.ext_zcd) {
         error_setg(errp, "Zcd extension requires D extension");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_cpu_cfg(env)->ext_f) {
         ext |= RVF;
     }
-    if (riscv_cpu_cfg(env)->ext_d) {
+    if (riscv_has_ext(env, RVD)) {
         ext |= RVD;
     }
     if (riscv_has_ext(env, RVC)) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVA, .enabled = true},
     {.name = "c", .description = "Compressed instructions",
      .misa_bit = RVC, .enabled = true},
+    {.name = "d", .description = "Double-precision float point",
+     .misa_bit = RVD, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
     DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
-    DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
         cpu->cfg.ext_e = misa_ext & RVE;
         cpu->cfg.ext_m = misa_ext & RVM;
         cpu->cfg.ext_f = misa_ext & RVF;
-        cpu->cfg.ext_d = misa_ext & RVD;
         cpu->cfg.ext_v = misa_ext & RVV;
         cpu->cfg.ext_s = misa_ext & RVS;
         cpu->cfg.ext_u = misa_ext & RVU;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "f" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVF. Instances of cpu->cfg.ext_f and similar are
replaced with riscv_has_ext(env, RVF).

Remove the old "f" property and 'ext_f' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 26 +++++++++++++-------------
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_e;
     bool ext_g;
     bool ext_m;
-    bool ext_f;
     bool ext_s;
     bool ext_u;
     bool ext_h;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     /* Do some ISA extension error checking */
     if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
                             riscv_has_ext(env, RVA) &&
-                            cpu->cfg.ext_f && riscv_has_ext(env, RVD) &&
+                            riscv_has_ext(env, RVF) &&
+                            riscv_has_ext(env, RVD) &&
                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
         cpu->cfg.ext_i = true;
         cpu->cfg.ext_m = true;
-        cpu->cfg.ext_f = true;
         cpu->cfg.ext_icsr = true;
         cpu->cfg.ext_ifencei = true;
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
+    if (riscv_has_ext(env, RVF) && !cpu->cfg.ext_icsr) {
         error_setg(errp, "F extension requires Zicsr");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_zfhmin = true;
     }
 
-    if (cpu->cfg.ext_zfhmin && !cpu->cfg.ext_f) {
+    if (cpu->cfg.ext_zfhmin && !riscv_has_ext(env, RVF)) {
         error_setg(errp, "Zfh/Zfhmin extensions require F extension");
         return;
     }
 
-    if (riscv_has_ext(env, RVD) && !cpu->cfg.ext_f) {
+    if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
         error_setg(errp, "D extension requires F extension");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_zve32f && !cpu->cfg.ext_f) {
+    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
         error_setg(errp, "Zve32f/Zve64f extensions require F extension");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
             error_setg(errp, "Zfinx extension requires Zicsr");
             return;
         }
-        if (cpu->cfg.ext_f) {
+        if (riscv_has_ext(env, RVF)) {
             error_setg(errp,
                        "Zfinx cannot be supported together with F extension");
             return;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_zcb = true;
         cpu->cfg.ext_zcmp = true;
         cpu->cfg.ext_zcmt = true;
-        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
+        if (riscv_has_ext(env, RVF) && env->misa_mxl_max == MXL_RV32) {
             cpu->cfg.ext_zcf = true;
         }
     }
 
     if (riscv_has_ext(env, RVC)) {
         cpu->cfg.ext_zca = true;
-        if (cpu->cfg.ext_f && env->misa_mxl_max == MXL_RV32) {
+        if (riscv_has_ext(env, RVF) && env->misa_mxl_max == MXL_RV32) {
             cpu->cfg.ext_zcf = true;
         }
         if (riscv_has_ext(env, RVD)) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (!cpu->cfg.ext_f && cpu->cfg.ext_zcf) {
+    if (!riscv_has_ext(env, RVF) && cpu->cfg.ext_zcf) {
         error_setg(errp, "Zcf extension requires F extension");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_has_ext(env, RVA)) {
         ext |= RVA;
     }
-    if (riscv_cpu_cfg(env)->ext_f) {
+    if (riscv_has_ext(env, RVF)) {
         ext |= RVF;
     }
     if (riscv_has_ext(env, RVD)) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVC, .enabled = true},
     {.name = "d", .description = "Double-precision float point",
      .misa_bit = RVD, .enabled = true},
+    {.name = "f", .description = "Single-precision float point",
+     .misa_bit = RVF, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-    DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
         cpu->cfg.ext_i = misa_ext & RVI;
         cpu->cfg.ext_e = misa_ext & RVE;
         cpu->cfg.ext_m = misa_ext & RVM;
-        cpu->cfg.ext_f = misa_ext & RVF;
         cpu->cfg.ext_v = misa_ext & RVV;
         cpu->cfg.ext_s = misa_ext & RVS;
         cpu->cfg.ext_u = misa_ext & RVU;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "i" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVI. Instances of cpu->cfg.ext_i and similar are
replaced with riscv_has_ext(env, RVI).

Remove the old "i" property and 'ext_i' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-10-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 15 +++++++--------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {
-    bool ext_i;
     bool ext_e;
     bool ext_g;
     bool ext_m;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     CPURISCVState *env = &cpu->env;
 
     /* Do some ISA extension error checking */
-    if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
+    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) && cpu->cfg.ext_m &&
                             riscv_has_ext(env, RVA) &&
                             riscv_has_ext(env, RVF) &&
                             riscv_has_ext(env, RVD) &&
                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-        cpu->cfg.ext_i = true;
         cpu->cfg.ext_m = true;
         cpu->cfg.ext_icsr = true;
         cpu->cfg.ext_ifencei = true;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         env->misa_ext_mask = env->misa_ext;
     }
 
-    if (cpu->cfg.ext_i && cpu->cfg.ext_e) {
+    if (riscv_has_ext(env, RVI) && cpu->cfg.ext_e) {
         error_setg(errp,
                    "I and E extensions are incompatible");
         return;
     }
 
-    if (!cpu->cfg.ext_i && !cpu->cfg.ext_e) {
+    if (!riscv_has_ext(env, RVI) && !cpu->cfg.ext_e) {
         error_setg(errp,
                    "Either I or E extension must be set");
         return;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_h && !cpu->cfg.ext_i) {
+    if (cpu->cfg.ext_h && !riscv_has_ext(env, RVI)) {
         error_setg(errp,
                    "H depends on an I base integer ISA with 32 x registers");
         return;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 {
     uint32_t ext = 0;
 
-    if (riscv_cpu_cfg(env)->ext_i) {
+    if (riscv_has_ext(env, RVI)) {
         ext |= RVI;
     }
     if (riscv_cpu_cfg(env)->ext_e) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVD, .enabled = true},
     {.name = "f", .description = "Single-precision float point",
      .misa_bit = RVF, .enabled = true},
+    {.name = "i", .description = "Base integer instruction set",
+     .misa_bit = RVI, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
-    DEFINE_PROP_BOOL("i", RISCVCPU, cfg.ext_i, true),
     DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
      * later on.
      */
     if (cpu->env.misa_ext != 0) {
-        cpu->cfg.ext_i = misa_ext & RVI;
         cpu->cfg.ext_e = misa_ext & RVE;
         cpu->cfg.ext_m = misa_ext & RVM;
         cpu->cfg.ext_v = misa_ext & RVV;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "e" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVE. Instances of cpu->cfg.ext_e and similar are
replaced with riscv_has_ext(env, RVE).

Remove the old "e" property and 'ext_e' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                        |  1 -
 target/riscv/cpu.c                        | 10 +++++-----
 target/riscv/insn_trans/trans_rvzce.c.inc |  2 +-
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {
-    bool ext_e;
     bool ext_g;
     bool ext_m;
     bool ext_s;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         env->misa_ext_mask = env->misa_ext;
     }
 
-    if (riscv_has_ext(env, RVI) && cpu->cfg.ext_e) {
+    if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
         error_setg(errp,
                    "I and E extensions are incompatible");
         return;
     }
 
-    if (!riscv_has_ext(env, RVI) && !cpu->cfg.ext_e) {
+    if (!riscv_has_ext(env, RVI) && !riscv_has_ext(env, RVE)) {
         error_setg(errp,
                    "Either I or E extension must be set");
         return;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_has_ext(env, RVI)) {
         ext |= RVI;
     }
-    if (riscv_cpu_cfg(env)->ext_e) {
+    if (riscv_has_ext(env, RVE)) {
         ext |= RVE;
     }
     if (riscv_cpu_cfg(env)->ext_m) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVF, .enabled = true},
     {.name = "i", .description = "Base integer instruction set",
      .misa_bit = RVI, .enabled = true},
+    {.name = "e", .description = "Base integer instruction set (embedded)",
+     .misa_bit = RVE, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
-    DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
     DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
      * later on.
      */
     if (cpu->env.misa_ext != 0) {
-        cpu->cfg.ext_e = misa_ext & RVE;
         cpu->cfg.ext_m = misa_ext & RVM;
         cpu->cfg.ext_v = misa_ext & RVV;
         cpu->cfg.ext_s = misa_ext & RVS;
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -XXX,XX +XXX,XX @@ static uint32_t decode_push_pop_list(DisasContext *ctx, target_ulong rlist)
 {
     uint32_t reg_bitmap = 0;
 
-    if (ctx->cfg_ptr->ext_e && rlist > 6) {
+    if (has_ext(ctx, RVE) && rlist > 6) {
         return 0;
     }
 
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "m" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVM. Instances of cpu->cfg.ext_m and similar are
replaced with riscv_has_ext(env, RVM).

Remove the old "m" property and 'ext_m' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 10 +++++-----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 struct RISCVCPUConfig {
     bool ext_g;
-    bool ext_m;
     bool ext_s;
     bool ext_u;
     bool ext_h;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     CPURISCVState *env = &cpu->env;
 
     /* Do some ISA extension error checking */
-    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) && cpu->cfg.ext_m &&
+    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) &&
+                            riscv_has_ext(env, RVM) &&
                             riscv_has_ext(env, RVA) &&
                             riscv_has_ext(env, RVF) &&
                             riscv_has_ext(env, RVD) &&
                             cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-        cpu->cfg.ext_m = true;
         cpu->cfg.ext_icsr = true;
         cpu->cfg.ext_ifencei = true;
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_has_ext(env, RVE)) {
         ext |= RVE;
     }
-    if (riscv_cpu_cfg(env)->ext_m) {
+    if (riscv_has_ext(env, RVM)) {
         ext |= RVM;
     }
     if (riscv_has_ext(env, RVA)) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVI, .enabled = true},
     {.name = "e", .description = "Base integer instruction set (embedded)",
      .misa_bit = RVE, .enabled = false},
+    {.name = "m", .description = "Integer multiplication and division",
+     .misa_bit = RVM, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-    DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
      * later on.
      */
     if (cpu->env.misa_ext != 0) {
-        cpu->cfg.ext_m = misa_ext & RVM;
         cpu->cfg.ext_v = misa_ext & RVV;
         cpu->cfg.ext_s = misa_ext & RVS;
         cpu->cfg.ext_u = misa_ext & RVU;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "s" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVS. Instances of cpu->cfg.ext_s and similar are
replaced with riscv_has_ext(env, RVS).

Remove the old "s" property and 'ext_s' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 11 +++++------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 struct RISCVCPUConfig {
     bool ext_g;
-    bool ext_s;
     bool ext_u;
     bool ext_h;
     bool ext_j;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
 
     cpu->cfg.ext_g = true;
     cpu->cfg.ext_u = true;
-    cpu->cfg.ext_s = true;
     cpu->cfg.ext_icsr = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_s && !cpu->cfg.ext_u) {
+    if (riscv_has_ext(env, RVS) && !cpu->cfg.ext_u) {
         error_setg(errp,
                    "Setting S extension without U extension is illegal");
         return;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_h && !cpu->cfg.ext_s) {
+    if (cpu->cfg.ext_h && !riscv_has_ext(env, RVS)) {
         error_setg(errp, "H extension implicitly requires S-mode");
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_has_ext(env, RVC)) {
         ext |= RVC;
     }
-    if (riscv_cpu_cfg(env)->ext_s) {
+    if (riscv_has_ext(env, RVS)) {
         ext |= RVS;
     }
     if (riscv_cpu_cfg(env)->ext_u) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVE, .enabled = false},
     {.name = "m", .description = "Integer multiplication and division",
      .misa_bit = RVM, .enabled = true},
+    {.name = "s", .description = "Supervisor-level instructions",
+     .misa_bit = RVS, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-    DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
     DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
      */
     if (cpu->env.misa_ext != 0) {
         cpu->cfg.ext_v = misa_ext & RVV;
-        cpu->cfg.ext_s = misa_ext & RVS;
         cpu->cfg.ext_u = misa_ext & RVU;
         cpu->cfg.ext_h = misa_ext & RVH;
         cpu->cfg.ext_j = misa_ext & RVJ;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "u" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVU. Instances of cpu->cfg.ext_u and similar are
replaced with riscv_has_ext(env, RVU).

Remove the old "u" property and 'ext_u' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 -
 target/riscv/cpu.c | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 struct RISCVCPUConfig {
     bool ext_g;
-    bool ext_u;
     bool ext_h;
     bool ext_j;
     bool ext_v;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     set_priv_version(env, PRIV_VERSION_1_11_0);
 
     cpu->cfg.ext_g = true;
-    cpu->cfg.ext_u = true;
     cpu->cfg.ext_icsr = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (riscv_has_ext(env, RVS) && !cpu->cfg.ext_u) {
+    if (riscv_has_ext(env, RVS) && !riscv_has_ext(env, RVU)) {
         error_setg(errp,
                    "Setting S extension without U extension is illegal");
         return;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_has_ext(env, RVS)) {
         ext |= RVS;
     }
-    if (riscv_cpu_cfg(env)->ext_u) {
+    if (riscv_has_ext(env, RVU)) {
         ext |= RVU;
     }
     if (riscv_cpu_cfg(env)->ext_h) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVM, .enabled = true},
     {.name = "s", .description = "Supervisor-level instructions",
      .misa_bit = RVS, .enabled = true},
+    {.name = "u", .description = "User-level instructions",
+     .misa_bit = RVU, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-    DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
     DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
      */
     if (cpu->env.misa_ext != 0) {
         cpu->cfg.ext_v = misa_ext & RVV;
-        cpu->cfg.ext_u = misa_ext & RVU;
         cpu->cfg.ext_h = misa_ext & RVH;
         cpu->cfg.ext_j = misa_ext & RVJ;
 
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "h" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVH. Instances of cpu->cfg.ext_h and similar are
replaced with riscv_has_ext(env, RVH).

Remove the old "h" property and 'ext_h' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 10 +++++-----
 2 files changed, 5 insertions(+), 6 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "j" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVJ. Instances of cpu->cfg.ext_j and similar are
replaced with riscv_has_ext(env, RVJ).

Remove the old "j" property and 'ext_j' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 -
 target/riscv/cpu.c | 6 +++---
 2 files changed, 3 insertions(+), 4 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a new "v" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVV. Instances of cpu->cfg.ext_v and similar are
replaced with riscv_has_ext(env, RVV).

Remove the old "v" property and 'ext_v' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  1 -
 target/riscv/cpu.c | 12 +++++-------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 struct RISCVCPUConfig {
     bool ext_g;
-    bool ext_v;
     bool ext_zba;
     bool ext_zbb;
     bool ext_zbc;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     }
 
     /* The V vector extension depends on the Zve64d extension */
-    if (cpu->cfg.ext_v) {
+    if (riscv_has_ext(env, RVV)) {
         cpu->cfg.ext_zve64d = true;
     }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_zksh = true;
     }
 
-    if (cpu->cfg.ext_v) {
+    if (riscv_has_ext(env, RVV)) {
         int vext_version = VEXT_VERSION_1_00_0;
         if (!is_power_of_2(cpu->cfg.vlen)) {
             error_setg(errp,
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
     if (riscv_has_ext(env, RVH)) {
         ext |= RVH;
     }
-    if (riscv_cpu_cfg(env)->ext_v) {
+    if (riscv_has_ext(env, RVV)) {
         ext |= RVV;
     }
     if (riscv_has_ext(env, RVJ)) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVH, .enabled = true},
     {.name = "x-j", .description = "Dynamic translated languages",
      .misa_bit = RVJ, .enabled = false},
+    {.name = "v", .description = "Vector operations",
+     .misa_bit = RVV, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
     DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-    DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
 static void register_cpu_props(Object *obj)
 {
     RISCVCPU *cpu = RISCV_CPU(obj);
-    uint32_t misa_ext = cpu->env.misa_ext;
     Property *prop;
     DeviceState *dev = DEVICE(obj);
 
@@ -XXX,XX +XXX,XX @@ static void register_cpu_props(Object *obj)
      * later on.
      */
     if (cpu->env.misa_ext != 0) {
-        cpu->cfg.ext_v = misa_ext & RVV;
-
         /*
          * We don't want to set the default riscv_cpu_extensions
          * in this case.
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This function was created to move the sync between cpu->cfg.ext_N bit
changes to env->misa_ext* from the validation step to an ealier step,
giving us a guarantee that we could use either cpu->cfg.ext_N or
riscv_has_ext(env,N) in the validation.

We don't have any cpu->cfg.ext_N left that has an existing MISA bit
(cfg.ext_g will be handled shortly). The function is now a no-op, simply
copying the existing values of misa_ext* back to misa_ext*.

Remove it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 52 ----------------------------------------------
 1 file changed, 52 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
 #endif
 }
 
-static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-{
-    uint32_t ext = 0;
-
-    if (riscv_has_ext(env, RVI)) {
-        ext |= RVI;
-    }
-    if (riscv_has_ext(env, RVE)) {
-        ext |= RVE;
-    }
-    if (riscv_has_ext(env, RVM)) {
-        ext |= RVM;
-    }
-    if (riscv_has_ext(env, RVA)) {
-        ext |= RVA;
-    }
-    if (riscv_has_ext(env, RVF)) {
-        ext |= RVF;
-    }
-    if (riscv_has_ext(env, RVD)) {
-        ext |= RVD;
-    }
-    if (riscv_has_ext(env, RVC)) {
-        ext |= RVC;
-    }
-    if (riscv_has_ext(env, RVS)) {
-        ext |= RVS;
-    }
-    if (riscv_has_ext(env, RVU)) {
-        ext |= RVU;
-    }
-    if (riscv_has_ext(env, RVH)) {
-        ext |= RVH;
-    }
-    if (riscv_has_ext(env, RVV)) {
-        ext |= RVV;
-    }
-    if (riscv_has_ext(env, RVJ)) {
-        ext |= RVJ;
-    }
-
-    env->misa_ext = env->misa_ext_mask = ext;
-}
-
 static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
 {
     if (riscv_has_ext(env, RVH) && env->priv_ver < PRIV_VERSION_1_12_0) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         set_priv_version(env, priv_version);
     }
 
-    /*
-     * We can't be sure of whether we set defaults during cpu_init()
-     * or whether the user enabled/disabled some bits via cpu->cfg
-     * flags. Sync env->misa_ext with cpu->cfg now to allow us to
-     * use just env->misa_ext later.
-     */
-    riscv_cpu_sync_misa_cfg(env);
-
     riscv_cpu_validate_misa_priv(env, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This CPU is enabling G via cfg.ext_g and, at the same time, setting
IMAFD in set_misa() and cfg.ext_icsr.

riscv_cpu_validate_set_extensions() is already doing that, so there's no
need for cpu_init() setups to worry about setting G and its extensions.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     RISCVCPU *cpu = RISCV_CPU(obj);
 
-    set_misa(env, MXL_RV64, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
+    set_misa(env, MXL_RV64, RVC | RVS | RVU);
     set_priv_version(env, PRIV_VERSION_1_11_0);
 
     cpu->cfg.ext_g = true;
-    cpu->cfg.ext_icsr = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
     cpu->cfg.ext_xtheadba = true;
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're still have one RISCVCPUConfig MISA flag, 'ext_g'. We'll remove it
the same way we did with the others: create a "g" RISCVCPUMisaExtConfig
property, remove the old "g" property, remove all instances of 'cfg.ext_g'
and use riscv_has_ext(env, RVG).

The caveat is that we don't have RVG, so add it. RVG will be used right
off the bat in set_misa() of rv64_thead_c906_cpu_init() because the CPU is
enabling G via the now removed 'ext_g' flag.

After this patch, there are no more MISA extensions represented by flags
in RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  2 +-
 target/riscv/cpu.c | 17 ++++++++---------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define RVU RV('U')
 #define RVH RV('H')
 #define RVJ RV('J')
+#define RVG RV('G')
 
 
 /* Privileged specification version */
@@ -XXX,XX +XXX,XX @@ typedef struct {
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {
-    bool ext_g;
     bool ext_zba;
     bool ext_zbb;
     bool ext_zbc;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     RISCVCPU *cpu = RISCV_CPU(obj);
 
-    set_misa(env, MXL_RV64, RVC | RVS | RVU);
+    set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
     set_priv_version(env, PRIV_VERSION_1_11_0);
 
-    cpu->cfg.ext_g = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
     cpu->cfg.ext_xtheadba = true;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     CPURISCVState *env = &cpu->env;
 
     /* Do some ISA extension error checking */
-    if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) &&
-                            riscv_has_ext(env, RVM) &&
-                            riscv_has_ext(env, RVA) &&
-                            riscv_has_ext(env, RVF) &&
-                            riscv_has_ext(env, RVD) &&
-                            cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
+    if (riscv_has_ext(env, RVG) &&
+        !(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
+          riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
+          riscv_has_ext(env, RVD) &&
+          cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
         warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
         cpu->cfg.ext_icsr = true;
         cpu->cfg.ext_ifencei = true;
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
      .misa_bit = RVJ, .enabled = false},
     {.name = "v", .description = "Vector operations",
      .misa_bit = RVV, .enabled = false},
+    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
+     .misa_bit = RVG, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 
 static Property riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
-    DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The function is now a no-op for all cpu_init() callers that are setting
a non-zero misa value in set_misa(), since it's no longer used to sync
cpu->cfg props with env->misa_ext bits. Remove it in those cases.

While we're at it, rename the function to match what it's actually
doing: create user properties to set/remove CPU extensions. Make a note
that it will overwrite env->misa_ext with the defaults set by each user
property.

Update the MISA bits comment in cpu.h as well.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406180351.570807-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  5 +----
 target/riscv/cpu.c | 41 ++++++++++-------------------------------
 2 files changed, 11 insertions(+), 35 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
-/*
- * Consider updating register_cpu_props() when adding
- * new MISA bits here.
- */
+/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
 #define RVI RV('I')
 #define RVE RV('E') /* E and I are mutually exclusive */
 #define RVM RV('M')
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char * const riscv_intr_names[] = {
     "reserved"
 };
 
-static void register_cpu_props(Object *obj);
+static void riscv_cpu_add_user_properties(Object *obj);
 
 const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_any_cpu_init(Object *obj)
 #endif
 
     set_priv_version(env, PRIV_VERSION_1_12_0);
-    register_cpu_props(obj);
 }
 
 #if defined(TARGET_RISCV64)
@@ -XXX,XX +XXX,XX @@ static void rv64_base_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     /* We set this in the realise function */
     set_misa(env, MXL_RV64, 0);
-    register_cpu_props(obj);
+    riscv_cpu_add_user_properties(obj);
     /* Set latest version of privileged specification */
     set_priv_version(env, PRIV_VERSION_1_12_0);
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void rv64_sifive_u_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     set_misa(env, MXL_RV64, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-    register_cpu_props(obj);
     set_priv_version(env, PRIV_VERSION_1_10_0);
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV39);
@@ -XXX,XX +XXX,XX @@ static void rv64_sifive_e_cpu_init(Object *obj)
     RISCVCPU *cpu = RISCV_CPU(obj);
 
     set_misa(env, MXL_RV64, RVI | RVM | RVA | RVC | RVU);
-    register_cpu_props(obj);
     set_priv_version(env, PRIV_VERSION_1_10_0);
     cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void rv128_base_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     /* We set this in the realise function */
     set_misa(env, MXL_RV128, 0);
-    register_cpu_props(obj);
+    riscv_cpu_add_user_properties(obj);
     /* Set latest version of privileged specification */
     set_priv_version(env, PRIV_VERSION_1_12_0);
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void rv32_base_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     /* We set this in the realise function */
     set_misa(env, MXL_RV32, 0);
-    register_cpu_props(obj);
+    riscv_cpu_add_user_properties(obj);
     /* Set latest version of privileged specification */
     set_priv_version(env, PRIV_VERSION_1_12_0);
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void rv32_sifive_u_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-    register_cpu_props(obj);
     set_priv_version(env, PRIV_VERSION_1_10_0);
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
@@ -XXX,XX +XXX,XX @@ static void rv32_sifive_e_cpu_init(Object *obj)
     RISCVCPU *cpu = RISCV_CPU(obj);
 
     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVC | RVU);
-    register_cpu_props(obj);
     set_priv_version(env, PRIV_VERSION_1_10_0);
     cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void rv32_ibex_cpu_init(Object *obj)
     RISCVCPU *cpu = RISCV_CPU(obj);
 
     set_misa(env, MXL_RV32, RVI | RVM | RVC | RVU);
-    register_cpu_props(obj);
     set_priv_version(env, PRIV_VERSION_1_11_0);
     cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
     RISCVCPU *cpu = RISCV_CPU(obj);
 
     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVC | RVU);
-    register_cpu_props(obj);
     set_priv_version(env, PRIV_VERSION_1_10_0);
     cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_host_cpu_init(Object *obj)
 #elif defined(TARGET_RISCV64)
     set_misa(env, MXL_RV64, 0);
 #endif
-    register_cpu_props(obj);
+    riscv_cpu_add_user_properties(obj);
 }
 #endif
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
 };
 
 /*
- * Register CPU props based on env.misa_ext. If a non-zero
- * value was set, register only the required cpu->cfg.ext_*
- * properties and leave. env.misa_ext = 0 means that we want
- * all the default properties to be registered.
+ * Add CPU properties with user-facing flags.
+ *
+ * This will overwrite existing env->misa_ext values with the
+ * defaults set via riscv_cpu_add_misa_properties().
  */
-static void register_cpu_props(Object *obj)
+static void riscv_cpu_add_user_properties(Object *obj)
 {
-    RISCVCPU *cpu = RISCV_CPU(obj);
     Property *prop;
     DeviceState *dev = DEVICE(obj);
 
-    /*
-     * If misa_ext is not zero, set cfg properties now to
-     * allow them to be read during riscv_cpu_realize()
-     * later on.
-     */
-    if (cpu->env.misa_ext != 0) {
-        /*
-         * We don't want to set the default riscv_cpu_extensions
-         * in this case.
-         */
-        return;
-    }
-
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The MPP will be set to the least-privileged supported mode (U if
U-mode is implemented, else M).

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230407014743.18779-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
     mstatus = set_field(mstatus, MSTATUS_MIE,
                         get_field(mstatus, MSTATUS_MPIE));
     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
-    mstatus = set_field(mstatus, MSTATUS_MPP, PRV_U);
+    mstatus = set_field(mstatus, MSTATUS_MPP,
+                        riscv_has_ext(env, RVU) ? PRV_U : PRV_M);
     mstatus = set_field(mstatus, MSTATUS_MPV, 0);
     if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) {
         mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

PRV_H has no real meaning, but just a reserved privilege mode currently.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230407014743.18779-3-liweiwei@iscas.ac.cn>
[ Changes by AF:
 - Convert one missing use of PRV_H
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 2 +-
 target/riscv/cpu_bits.h   | 2 +-
 target/riscv/cpu_helper.c | 2 +-
 target/riscv/gdbstub.c    | 2 +-
 target/riscv/op_helper.c  | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
         case PRV_U:
             xl = get_field(env->mstatus, MSTATUS64_UXL);
             break;
-        default: /* PRV_S | PRV_H */
+        default: /* PRV_S */
             xl = get_field(env->mstatus, MSTATUS64_SXL);
             break;
         }
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 /* Privilege modes */
 #define PRV_U 0
 #define PRV_S 1
-#define PRV_H 2 /* Reserved */
+#define PRV_RESERVED 2
 #define PRV_M 3
 
 /* RV32 satp CSR field masks */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     if (newpriv > PRV_M) {
         g_assert_not_reached();
     }
-    if (newpriv == PRV_H) {
+    if (newpriv == PRV_RESERVED) {
         newpriv = PRV_U;
     }
     if (icount_enabled() && newpriv != env->priv) {
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_virtual(CPURISCVState *cs, uint8_t *mem_buf, int n)
     if (n == 0) {
 #ifndef CONFIG_USER_ONLY
         cs->priv = ldtul_p(mem_buf) & 0x3;
-        if (cs->priv == PRV_H) {
+        if (cs->priv == PRV_RESERVED) {
             cs->priv = PRV_S;
         }
 #endif
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void check_zicbo_envcfg(CPURISCVState *env, target_ulong envbits,
     }
 
     if (env->virt_enabled &&
-        (((env->priv < PRV_H) && !get_field(env->henvcfg, envbits)) ||
+        (((env->priv <= PRV_S) && !get_field(env->henvcfg, envbits)) ||
          ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra);
     }
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

mstatus.MPP field is a WARL field since priv version 1.11, so we
remain it unchanged if an invalid value is written into it. And
after this, RVH shouldn't be passed to riscv_cpu_set_mode().

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230407014743.18779-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  8 ++------
 target/riscv/csr.c        | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
 
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
 {
-    if (newpriv > PRV_M) {
-        g_assert_not_reached();
-    }
-    if (newpriv == PRV_RESERVED) {
-        newpriv = PRV_U;
-    }
+    g_assert(newpriv <= PRV_M && newpriv != PRV_RESERVED);
+
     if (icount_enabled() && newpriv != env->priv) {
         riscv_itrigger_update_priv(env);
     }
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static bool validate_vm(CPURISCVState *env, target_ulong vm)
            satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
 }
 
+static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
+                                 target_ulong val)
+{
+    bool valid = false;
+    target_ulong new_mpp = get_field(val, MSTATUS_MPP);
+
+    switch (new_mpp) {
+    case PRV_M:
+        valid = true;
+        break;
+    case PRV_S:
+        valid = riscv_has_ext(env, RVS);
+        break;
+    case PRV_U:
+        valid = riscv_has_ext(env, RVU);
+        break;
+    }
+
+    /* Remain field unchanged if new_mpp value is invalid */
+    if (!valid) {
+        val = set_field(val, MSTATUS_MPP, old_mpp);
+    }
+
+    return val;
+}
+
 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
                                     target_ulong val)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     uint64_t mask = 0;
     RISCVMXL xl = riscv_cpu_mxl(env);
 
+    /*
+     * MPP field have been made WARL since priv version 1.11. However,
+     * legalization for it will not break any software running on 1.10.
+     */
+    val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
+
     /* flush tlb on mstatus fields that affect VM */
     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
             MSTATUS_MPRV | MSTATUS_SUM)) {
-- 
2.40.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Zdinx/Zhinx{min} require Zfinx. And require relationship is usually done
by check currently.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230408135908.25269-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_zhinxmin = true;
     }
 
-    if (cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinxmin) {
-        cpu->cfg.ext_zfinx = true;
+    if ((cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinxmin) && !cpu->cfg.ext_zfinx) {
+        error_setg(errp, "Zdinx/Zhinx/Zhinxmin extensions require Zfinx");
+        return;
     }
 
     if (cpu->cfg.ext_zfinx) {
-- 
2.40.0

From: Yi Chen <chenyi2000@zju.edu.cn>

- Trap satp/hgatp accesses from HS-mode when MSTATUS.TVM is enabled.
- Trap satp accesses from VS-mode when HSTATUS.VTVM is enabled.
- Raise RISCV_EXCP_ILLEGAL_INST when U-mode executes SFENCE.VMA/SINVAL.VMA.
- Raise RISCV_EXCP_VIRT_INSTRUCTION_FAULT when VU-mode executes
  SFENCE.VMA/SINVAL.VMA or VS-mode executes SFENCE.VMA/SINVAL.VMA with
  HSTATUS.VTVM enabled.
- Raise RISCV_EXCP_VIRT_INSTRUCTION_FAULT when VU-mode executes
  HFENCE.GVMA/HFENCE.VVMA/HINVAL.GVMA/HINVAL.VVMA.

Signed-off-by: Yi Chen <chenyi2000@zju.edu.cn>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406101559.39632-1-chenyi2000@zju.edu.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c       | 56 +++++++++++++++++++++++++---------------
 target/riscv/op_helper.c | 12 ++++-----
 2 files changed, 41 insertions(+), 27 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc_32(CPURISCVState *env, int csrno)
     return sstc(env, csrno);
 }
 
+static RISCVException satp(CPURISCVState *env, int csrno)
+{
+    if (env->priv == PRV_S && !env->virt_enabled &&
+        get_field(env->mstatus, MSTATUS_TVM)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+    if (env->priv == PRV_S && env->virt_enabled &&
+        get_field(env->hstatus, HSTATUS_VTVM)) {
+        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+    }
+
+    return smode(env, csrno);
+}
+
+static RISCVException hgatp(CPURISCVState *env, int csrno)
+{
+    if (env->priv == PRV_S && !env->virt_enabled &&
+        get_field(env->mstatus, MSTATUS_TVM)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return hmode(env, csrno);
+}
+
 /* Checks if PointerMasking registers could be accessed */
 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
         *val = 0;
         return RISCV_EXCP_NONE;
     }
-
-    if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    } else {
-        *val = env->satp;
-    }
-
+    *val = env->satp;
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_satp(CPURISCVState *env, int csrno,
     }
 
     if (vm && mask) {
-        if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
-            return RISCV_EXCP_ILLEGAL_INST;
-        } else {
-            /*
-             * The ISA defines SATP.MODE=Bare as "no translation", but we still
-             * pass these through QEMU's TLB emulation as it improves
-             * performance.  Flushing the TLB on SATP writes with paging
-             * enabled avoids leaking those invalid cached mappings.
-             */
-            tlb_flush(env_cpu(env));
-            env->satp = val;
-        }
+        /*
+         * The ISA defines SATP.MODE=Bare as "no translation", but we still
+         * pass these through QEMU's TLB emulation as it improves
+         * performance.  Flushing the TLB on SATP writes with paging
+         * enabled avoids leaking those invalid cached mappings.
+         */
+        tlb_flush(env_cpu(env));
+        env->satp = val;
     }
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                          .min_priv_ver = PRIV_VERSION_1_12_0 },
 
     /* Supervisor Protection and Translation */
-    [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
+    [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
 
     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
-    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,   write_hgatp,
+    [CSR_HGATP]       = { "hgatp",       hgatp,   read_hgatp,   write_hgatp,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
                           write_htimedelta,
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
 void helper_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
-    if (!(env->priv >= PRV_S) ||
-        (env->priv == PRV_S &&
-         get_field(env->mstatus, MSTATUS_TVM))) {
+    if (!env->virt_enabled &&
+        (env->priv == PRV_U ||
+         (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)))) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-    } else if (riscv_has_ext(env, RVH) && env->virt_enabled &&
-               get_field(env->hstatus, HSTATUS_VTVM)) {
+    } else if (env->virt_enabled &&
+               (env->priv == PRV_U || get_field(env->hstatus, HSTATUS_VTVM))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     } else {
         tlb_flush(cs);
@@ -XXX,XX +XXX,XX @@ void helper_hyp_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
 
-    if (env->priv == PRV_S && env->virt_enabled) {
+    if (env->virt_enabled) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     }
 
-- 
2.40.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Virt enabled state is not a constant, so we should put it into tb flags.
Thus we can use it like a constant condition at translation phase.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230324143031.1093-2-zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-2-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-2-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  2 ++
 target/riscv/cpu_helper.c |  1 +
 target/riscv/translate.c  | 10 +---------
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VTA, 24, 1)
 FIELD(TB_FLAGS, VMA, 25, 1)
 /* Native debug itrigger */
 FIELD(TB_FLAGS, ITRIGGER, 26, 1)
+/* Virtual mode enabled */
+FIELD(TB_FLAGS, VIRT_ENABLED, 27, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
 
         flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
                            get_field(env->mstatus_hs, MSTATUS_VS));
+        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, env->virt_enabled);
     }
     if (cpu->cfg.debug && !icount_enabled()) {
         flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->mstatus_fs = tb_flags & TB_FLAGS_MSTATUS_FS;
     ctx->mstatus_vs = tb_flags & TB_FLAGS_MSTATUS_VS;
     ctx->priv_ver = env->priv_ver;
-#if !defined(CONFIG_USER_ONLY)
-    if (riscv_has_ext(env, RVH)) {
-        ctx->virt_enabled = env->virt_enabled;
-    } else {
-        ctx->virt_enabled = false;
-    }
-#else
-    ctx->virt_enabled = false;
-#endif
+    ctx->virt_enabled = FIELD_EX32(tb_flags, TB_FLAGS, VIRT_ENABLED);
     ctx->misa_ext = env->misa_ext;
     ctx->frm = -1;  /* unknown rounding mode */
     ctx->cfg_ptr = &(cpu->cfg);
-- 
2.40.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

The pointer masking is the only extension that directly use status.
The vector or float extension uses the status in an indirect way.

Replace the pointer masking extension special status fields with
the general status.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230324143031.1093-3-zhiwei_liu@linux.alibaba.com>
[rth: Add a typedef for the enum]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-3-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-3-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h      |  8 ++++++++
 target/riscv/cpu_bits.h | 12 ++++--------
 target/riscv/cpu.c      |  2 +-
 target/riscv/csr.c      | 14 +++++++-------
 4 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ enum {
     TRANSLATE_G_STAGE_FAIL
 };
 
+/* Extension context status */
+typedef enum {
+    EXT_STATUS_DISABLED = 0,
+    EXT_STATUS_INITIAL,
+    EXT_STATUS_CLEAN,
+    EXT_STATUS_DIRTY,
+} RISCVExtStatus;
+
 #define MMU_USER_IDX 3
 
 #define MAX_RISCV_PMPS (16)
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
                  (((uint64_t)(val) * ((mask) & ~((mask) << 1))) & \
                  (uint64_t)(mask)))
 
+/* Extension context status mask */
+#define EXT_STATUS_MASK     0x3ULL
+
 /* Floating point round mode */
 #define FSR_RD_SHIFT        5
 #define FSR_RD              (0x7 << FSR_RD_SHIFT)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define PM_ENABLE       0x00000001ULL
 #define PM_CURRENT      0x00000002ULL
 #define PM_INSN         0x00000004ULL
-#define PM_XS_MASK      0x00000003ULL
-
-/* PointerMasking XS bits values */
-#define PM_EXT_DISABLE  0x00000000ULL
-#define PM_EXT_INITIAL  0x00000001ULL
-#define PM_EXT_CLEAN    0x00000002ULL
-#define PM_EXT_DIRTY    0x00000003ULL
 
 /* Execution enviornment configuration bits */
 #define MENVCFG_FIOM                       BIT(0)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define S_OFFSET     5ULL
 #define M_OFFSET     8ULL
 
-#define PM_XS_BITS   (PM_XS_MASK << XS_OFFSET)
+#define PM_XS_BITS   (EXT_STATUS_MASK << XS_OFFSET)
 #define U_PM_ENABLE  (PM_ENABLE  << U_OFFSET)
 #define U_PM_CURRENT (PM_CURRENT << U_OFFSET)
 #define U_PM_INSN    (PM_INSN    << U_OFFSET)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
         i++;
     }
     /* mmte is supposed to have pm.current hardwired to 1 */
-    env->mmte |= (PM_EXT_INITIAL | MMTE_M_PM_CURRENT);
+    env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
 #endif
     env->xl = riscv_cpu_mxl(env);
     riscv_cpu_update_mask(env);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mmte(CPURISCVState *env, int csrno,
 
     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
-    env->mmte = wpri_val | PM_EXT_DIRTY;
+    env->mmte = wpri_val | EXT_STATUS_DIRTY;
     riscv_cpu_update_mask(env);
 
     /* Set XS and SD bits, since PM CSRs are dirty */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
-    env->mmte |= PM_EXT_DIRTY;
+    env->mmte |= EXT_STATUS_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
-    env->mmte |= PM_EXT_DIRTY;
+    env->mmte |= EXT_STATUS_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
-    env->mmte |= PM_EXT_DIRTY;
+    env->mmte |= EXT_STATUS_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
-    env->mmte |= PM_EXT_DIRTY;
+    env->mmte |= EXT_STATUS_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
-    env->mmte |= PM_EXT_DIRTY;
+    env->mmte |= EXT_STATUS_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
-    env->mmte |= PM_EXT_DIRTY;
+    env->mmte |= EXT_STATUS_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
-- 
2.40.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Reuse the MSTATUS_FS and MSTATUS_VS for the tb flags positions is not a
normal way.

It will make it hard to change the tb flags layout. And even worse, if we
want to keep tb flags for a same extension togather without a hole.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230324143031.1093-4-zhiwei_liu@linux.alibaba.com>
[rth: Adjust trans_rvf.c.inc as well; use the typedef]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-4-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-4-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      | 15 ++++++------
 target/riscv/cpu_helper.c               | 11 +++++----
 target/riscv/translate.c                | 32 +++++++++++--------------
 target/riscv/insn_trans/trans_rvf.c.inc |  2 +-
 target/riscv/insn_trans/trans_rvv.c.inc |  8 +++----
 5 files changed, 32 insertions(+), 36 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
 
 #define TB_FLAGS_PRIV_MMU_MASK                3
 #define TB_FLAGS_PRIV_HYP_ACCESS_MASK   (1 << 2)
-#define TB_FLAGS_MSTATUS_FS MSTATUS_FS
-#define TB_FLAGS_MSTATUS_VS MSTATUS_VS
 
 #include "exec/cpu-all.h"
 
 FIELD(TB_FLAGS, MEM_IDX, 0, 3)
-FIELD(TB_FLAGS, LMUL, 3, 3)
-FIELD(TB_FLAGS, SEW, 6, 3)
-/* Skip MSTATUS_VS (0x600) bits */
-FIELD(TB_FLAGS, VL_EQ_VLMAX, 11, 1)
-FIELD(TB_FLAGS, VILL, 12, 1)
-/* Skip MSTATUS_FS (0x6000) bits */
+FIELD(TB_FLAGS, FS, 3, 2)
+/* Vector flags */
+FIELD(TB_FLAGS, VS, 5, 2)
+FIELD(TB_FLAGS, LMUL, 7, 3)
+FIELD(TB_FLAGS, SEW, 10, 3)
+FIELD(TB_FLAGS, VL_EQ_VLMAX, 13, 1)
+FIELD(TB_FLAGS, VILL, 14, 1)
 /* Is a Hypervisor instruction load/store allowed? */
 FIELD(TB_FLAGS, HLSX, 15, 1)
 FIELD(TB_FLAGS, MSTATUS_HS_FS, 16, 2)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     }
 
 #ifdef CONFIG_USER_ONLY
-    flags |= TB_FLAGS_MSTATUS_FS;
-    flags |= TB_FLAGS_MSTATUS_VS;
+    flags = FIELD_DP32(flags, TB_FLAGS, FS, EXT_STATUS_DIRTY);
+    flags = FIELD_DP32(flags, TB_FLAGS, VS, EXT_STATUS_DIRTY);
 #else
     flags |= cpu_mmu_index(env, 0);
     if (riscv_cpu_fp_enabled(env)) {
-        flags |= env->mstatus & MSTATUS_FS;
+        flags = FIELD_DP32(flags, TB_FLAGS, FS,
+                           get_field(env->mstatus, MSTATUS_FS));
     }
-
     if (riscv_cpu_vector_enabled(env)) {
-        flags |= env->mstatus & MSTATUS_VS;
+        flags = FIELD_DP32(flags, TB_FLAGS, VS,
+                           get_field(env->mstatus, MSTATUS_VS));
     }
 
     if (riscv_has_ext(env, RVH)) {
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     RISCVMXL xl;
     uint32_t misa_ext;
     uint32_t opcode;
-    uint32_t mstatus_fs;
-    uint32_t mstatus_vs;
-    uint32_t mstatus_hs_fs;
-    uint32_t mstatus_hs_vs;
+    RISCVExtStatus mstatus_fs;
+    RISCVExtStatus mstatus_vs;
+    RISCVExtStatus mstatus_hs_fs;
+    RISCVExtStatus mstatus_hs_vs;
     uint32_t mem_idx;
     /*
      * Remember the rounding mode encoded in the previous fp instruction,
@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
 
 #ifndef CONFIG_USER_ONLY
 /*
- * The states of mstatus_fs are:
- * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
  * We will have already diagnosed disabled state,
  * and need to turn initial/clean into dirty.
  */
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
         return;
     }
 
-    if (ctx->mstatus_fs != MSTATUS_FS) {
+    if (ctx->mstatus_fs != EXT_STATUS_DIRTY) {
         /* Remember the state change for the rest of the TB. */
-        ctx->mstatus_fs = MSTATUS_FS;
+        ctx->mstatus_fs = EXT_STATUS_DIRTY;
 
         tmp = tcg_temp_new();
         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
     }
 
-    if (ctx->virt_enabled && ctx->mstatus_hs_fs != MSTATUS_FS) {
+    if (ctx->virt_enabled && ctx->mstatus_hs_fs != EXT_STATUS_DIRTY) {
         /* Remember the stage change for the rest of the TB. */
-        ctx->mstatus_hs_fs = MSTATUS_FS;
+        ctx->mstatus_hs_fs = EXT_STATUS_DIRTY;
 
         tmp = tcg_temp_new();
         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
@@ -XXX,XX +XXX,XX @@ static inline void mark_fs_dirty(DisasContext *ctx) { }
 
 #ifndef CONFIG_USER_ONLY
 /*
- * The states of mstatus_vs are:
- * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
  * We will have already diagnosed disabled state,
  * and need to turn initial/clean into dirty.
  */
@@ -XXX,XX +XXX,XX @@ static void mark_vs_dirty(DisasContext *ctx)
 {
     TCGv tmp;
 
-    if (ctx->mstatus_vs != MSTATUS_VS) {
+    if (ctx->mstatus_vs != EXT_STATUS_DIRTY) {
         /* Remember the state change for the rest of the TB.  */
-        ctx->mstatus_vs = MSTATUS_VS;
+        ctx->mstatus_vs = EXT_STATUS_DIRTY;
 
         tmp = tcg_temp_new();
         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
@@ -XXX,XX +XXX,XX @@ static void mark_vs_dirty(DisasContext *ctx)
         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
     }
 
-    if (ctx->virt_enabled && ctx->mstatus_hs_vs != MSTATUS_VS) {
+    if (ctx->virt_enabled && ctx->mstatus_hs_vs != EXT_STATUS_DIRTY) {
         /* Remember the stage change for the rest of the TB. */
-        ctx->mstatus_hs_vs = MSTATUS_VS;
+        ctx->mstatus_hs_vs = EXT_STATUS_DIRTY;
 
         tmp = tcg_temp_new();
         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 
     ctx->pc_succ_insn = ctx->base.pc_first;
     ctx->mem_idx = FIELD_EX32(tb_flags, TB_FLAGS, MEM_IDX);
-    ctx->mstatus_fs = tb_flags & TB_FLAGS_MSTATUS_FS;
-    ctx->mstatus_vs = tb_flags & TB_FLAGS_MSTATUS_VS;
+    ctx->mstatus_fs = FIELD_EX32(tb_flags, TB_FLAGS, FS);
+    ctx->mstatus_vs = FIELD_EX32(tb_flags, TB_FLAGS, VS);
     ctx->priv_ver = env->priv_ver;
     ctx->virt_enabled = FIELD_EX32(tb_flags, TB_FLAGS, VIRT_ENABLED);
     ctx->misa_ext = env->misa_ext;
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -XXX,XX +XXX,XX @@
  */
 
 #define REQUIRE_FPU do {\
-    if (ctx->mstatus_fs == 0) \
+    if (ctx->mstatus_fs == EXT_STATUS_DISABLED) \
         if (!ctx->cfg_ptr->ext_zfinx) \
             return false; \
 } while (0)
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool is_overlapped(const int8_t astart, int8_t asize,
 
 static bool require_rvv(DisasContext *s)
 {
-    return s->mstatus_vs != 0;
+    return s->mstatus_vs != EXT_STATUS_DISABLED;
 }
 
 static bool require_rvf(DisasContext *s)
 {
-    if (s->mstatus_fs == 0) {
+    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool require_rvf(DisasContext *s)
 
 static bool require_scale_rvf(DisasContext *s)
 {
-    if (s->mstatus_fs == 0) {
+    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvf(DisasContext *s)
 
 static bool require_scale_rvfmin(DisasContext *s)
 {
-    if (s->mstatus_fs == 0) {
+    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
         return false;
     }
 
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Merge with mstatus_{fs,vs}.  We might perform a redundant
assignment to one or the other field, but it's a trivial
and saves 4 bits from TB_FLAGS.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-5-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-5-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 16 +++++++---------
 target/riscv/cpu_helper.c | 33 ++++++++++++++++-----------------
 target/riscv/translate.c  | 32 ++++++++++----------------------
 3 files changed, 33 insertions(+), 48 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VL_EQ_VLMAX, 13, 1)
 FIELD(TB_FLAGS, VILL, 14, 1)
 /* Is a Hypervisor instruction load/store allowed? */
 FIELD(TB_FLAGS, HLSX, 15, 1)
-FIELD(TB_FLAGS, MSTATUS_HS_FS, 16, 2)
-FIELD(TB_FLAGS, MSTATUS_HS_VS, 18, 2)
 /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
-FIELD(TB_FLAGS, XL, 20, 2)
+FIELD(TB_FLAGS, XL, 16, 2)
 /* If PointerMasking should be applied */
-FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
-FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
-FIELD(TB_FLAGS, VTA, 24, 1)
-FIELD(TB_FLAGS, VMA, 25, 1)
+FIELD(TB_FLAGS, PM_MASK_ENABLED, 18, 1)
+FIELD(TB_FLAGS, PM_BASE_ENABLED, 19, 1)
+FIELD(TB_FLAGS, VTA, 20, 1)
+FIELD(TB_FLAGS, VMA, 21, 1)
 /* Native debug itrigger */
-FIELD(TB_FLAGS, ITRIGGER, 26, 1)
+FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
-FIELD(TB_FLAGS, VIRT_ENABLED, 27, 1)
+FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
 {
     CPUState *cs = env_cpu(env);
     RISCVCPU *cpu = RISCV_CPU(cs);
-
+    RISCVExtStatus fs, vs;
     uint32_t flags = 0;
 
     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     }
 
 #ifdef CONFIG_USER_ONLY
-    flags = FIELD_DP32(flags, TB_FLAGS, FS, EXT_STATUS_DIRTY);
-    flags = FIELD_DP32(flags, TB_FLAGS, VS, EXT_STATUS_DIRTY);
+    fs = EXT_STATUS_DIRTY;
+    vs = EXT_STATUS_DIRTY;
 #else
     flags |= cpu_mmu_index(env, 0);
-    if (riscv_cpu_fp_enabled(env)) {
-        flags = FIELD_DP32(flags, TB_FLAGS, FS,
-                           get_field(env->mstatus, MSTATUS_FS));
-    }
-    if (riscv_cpu_vector_enabled(env)) {
-        flags = FIELD_DP32(flags, TB_FLAGS, VS,
-                           get_field(env->mstatus, MSTATUS_VS));
-    }
+    fs = get_field(env->mstatus, MSTATUS_FS);
+    vs = get_field(env->mstatus, MSTATUS_VS);
 
     if (riscv_has_ext(env, RVH)) {
         if (env->priv == PRV_M ||
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
             flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
         }
 
-        flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_FS,
-                           get_field(env->mstatus_hs, MSTATUS_FS));
-
-        flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
-                           get_field(env->mstatus_hs, MSTATUS_VS));
-        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, env->virt_enabled);
+        if (env->virt_enabled) {
+            flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
+            /*
+             * Merge DISABLED and !DIRTY states using MIN.
+             * We will set both fields when dirtying.
+             */
+            fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
+            vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
+        }
     }
     if (cpu->cfg.debug && !icount_enabled()) {
         flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
     }
 #endif
 
+    flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
+    flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
     if (env->cur_pmmask < (env->xl == MXL_RV32 ? UINT32_MAX : UINT64_MAX)) {
         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     uint32_t opcode;
     RISCVExtStatus mstatus_fs;
     RISCVExtStatus mstatus_vs;
-    RISCVExtStatus mstatus_hs_fs;
-    RISCVExtStatus mstatus_hs_vs;
     uint32_t mem_idx;
     /*
      * Remember the rounding mode encoded in the previous fp instruction,
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
         tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-    }
-
-    if (ctx->virt_enabled && ctx->mstatus_hs_fs != EXT_STATUS_DIRTY) {
-        /* Remember the stage change for the rest of the TB. */
-        ctx->mstatus_hs_fs = EXT_STATUS_DIRTY;
 
-        tmp = tcg_temp_new();
-        tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-        tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
-        tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
+        if (ctx->virt_enabled) {
+            tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
+            tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
+            tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
+        }
     }
 }
 #else
@@ -XXX,XX +XXX,XX @@ static void mark_vs_dirty(DisasContext *ctx)
         tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
         tcg_gen_ori_tl(tmp, tmp, MSTATUS_VS);
         tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-    }
-
-    if (ctx->virt_enabled && ctx->mstatus_hs_vs != EXT_STATUS_DIRTY) {
-        /* Remember the stage change for the rest of the TB. */
-        ctx->mstatus_hs_vs = EXT_STATUS_DIRTY;
 
-        tmp = tcg_temp_new();
-        tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-        tcg_gen_ori_tl(tmp, tmp, MSTATUS_VS);
-        tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
+        if (ctx->virt_enabled) {
+            tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
+            tcg_gen_ori_tl(tmp, tmp, MSTATUS_VS);
+            tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
+        }
     }
 }
 #else
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->misa_ext = env->misa_ext;
     ctx->frm = -1;  /* unknown rounding mode */
     ctx->cfg_ptr = &(cpu->cfg);
-    ctx->mstatus_hs_fs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_FS);
-    ctx->mstatus_hs_vs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_VS);
     ctx->hlsx = FIELD_EX32(tb_flags, TB_FLAGS, HLSX);
     ctx->vill = FIELD_EX32(tb_flags, TB_FLAGS, VILL);
     ctx->sew = FIELD_EX32(tb_flags, TB_FLAGS, SEW);
-- 
2.40.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Once we mistook the vstart directly from the env->vstart. As env->vstart is not
a constant, we should record it in the tb flags if we want to use
it in translation.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230324143031.1093-5-zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-6-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-6-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      |  1 +
 target/riscv/cpu_helper.c               |  1 +
 target/riscv/translate.c                |  4 ++--
 target/riscv/insn_trans/trans_rvv.c.inc | 14 +++++++-------
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VMA, 21, 1)
 FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
+FIELD(TB_FLAGS, VSTART_EQ_ZERO, 24, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                            FIELD_EX64(env->vtype, VTYPE, VTA));
         flags = FIELD_DP32(flags, TB_FLAGS, VMA,
                            FIELD_EX64(env->vtype, VTYPE, VMA));
+        flags = FIELD_DP32(flags, TB_FLAGS, VSTART_EQ_ZERO, env->vstart == 0);
     } else {
         flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     uint8_t vta;
     uint8_t vma;
     bool cfg_vta_all_1s;
-    target_ulong vstart;
+    bool vstart_eq_zero;
     bool vl_eq_vlmax;
     CPUState *cs;
     TCGv zero;
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->vta = FIELD_EX32(tb_flags, TB_FLAGS, VTA) && cpu->cfg.rvv_ta_all_1s;
     ctx->vma = FIELD_EX32(tb_flags, TB_FLAGS, VMA) && cpu->cfg.rvv_ma_all_1s;
     ctx->cfg_vta_all_1s = cpu->cfg.rvv_ta_all_1s;
-    ctx->vstart = env->vstart;
+    ctx->vstart_eq_zero = FIELD_EX32(tb_flags, TB_FLAGS, VSTART_EQ_ZERO);
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
     ctx->misa_mxl_max = env->misa_mxl_max;
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vext_check_sds(DisasContext *s, int vd, int vs1, int vs2, int vm)
  */
 static bool vext_check_reduction(DisasContext *s, int vs2)
 {
-    return require_align(vs2, s->lmul) && (s->vstart == 0);
+    return require_align(vs2, s->lmul) && s->vstart_eq_zero;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool trans_vcpop_m(DisasContext *s, arg_rmr *a)
 {
     if (require_rvv(s) &&
         vext_check_isa_ill(s) &&
-        s->vstart == 0) {
+        s->vstart_eq_zero) {
         TCGv_ptr src2, mask;
         TCGv dst;
         TCGv_i32 desc;
@@ -XXX,XX +XXX,XX @@ static bool trans_vfirst_m(DisasContext *s, arg_rmr *a)
 {
     if (require_rvv(s) &&
         vext_check_isa_ill(s) &&
-        s->vstart == 0) {
+        s->vstart_eq_zero) {
         TCGv_ptr src2, mask;
         TCGv dst;
         TCGv_i32 desc;
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         vext_check_isa_ill(s) &&                                   \
         require_vm(a->vm, a->rd) &&                                \
         (a->rd != a->rs2) &&                                       \
-        (s->vstart == 0)) {                                        \
+        s->vstart_eq_zero) {                                       \
         uint32_t data = 0;                                         \
         gen_helper_gvec_3_ptr *fn = gen_helper_##NAME;             \
         TCGLabel *over = gen_new_label();                          \
@@ -XXX,XX +XXX,XX @@ static bool trans_viota_m(DisasContext *s, arg_viota_m *a)
         !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
         require_vm(a->vm, a->rd) &&
         require_align(a->rd, s->lmul) &&
-        (s->vstart == 0)) {
+        s->vstart_eq_zero) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
         tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
@@ -XXX,XX +XXX,XX @@ static bool vcompress_vm_check(DisasContext *s, arg_r *a)
            require_align(a->rs2, s->lmul) &&
            (a->rd != a->rs2) &&
            !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs1, 1) &&
-           (s->vstart == 0);
+           s->vstart_eq_zero;
 }
 
 static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
         QEMU_IS_ALIGNED(a->rd, LEN) &&                                  \
         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
-        if (s->vstart == 0) {                                           \
+        if (s->vstart_eq_zero) {                                        \
             /* EEW = 8 */                                               \
             tcg_gen_gvec_mov(MO_8, vreg_ofs(s, a->rd),                  \
                              vreg_ofs(s, a->rs2), maxsz, maxsz);        \
-- 
2.40.0

From: Fei Wu <fei2.wu@intel.com>

Currently it's assumed the 2 low bits of mmu_idx map to privilege mode,
this assumption won't last as we are about to add more mmu_idx. Here an
individual priv field is added into TB_FLAGS.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Fei Wu <fei2.wu@intel.com>
Message-Id: <20230324054154.414846-2-fei2.wu@intel.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-7-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-7-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                             |  2 +-
 target/riscv/cpu_helper.c                      |  4 +++-
 target/riscv/translate.c                       |  2 ++
 target/riscv/insn_trans/trans_privileged.c.inc |  2 +-
 target/riscv/insn_trans/trans_xthead.c.inc     | 14 +-------------
 5 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
 target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
 void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
 
-#define TB_FLAGS_PRIV_MMU_MASK                3
 #define TB_FLAGS_PRIV_HYP_ACCESS_MASK   (1 << 2)
 
 #include "exec/cpu-all.h"
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 FIELD(TB_FLAGS, VSTART_EQ_ZERO, 24, 1)
+FIELD(TB_FLAGS, PRIV, 25, 2)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     fs = EXT_STATUS_DIRTY;
     vs = EXT_STATUS_DIRTY;
 #else
+    flags = FIELD_DP32(flags, TB_FLAGS, PRIV, env->priv);
+
     flags |= cpu_mmu_index(env, 0);
     fs = get_field(env->mstatus, MSTATUS_FS);
     vs = get_field(env->mstatus, MSTATUS_VS);
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      */
     MemTxResult res;
     MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
-    int mode = mmu_idx & TB_FLAGS_PRIV_MMU_MASK;
+    int mode = env->priv;
     bool use_background = false;
     hwaddr ppn;
     int napot_bits = 0;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     RISCVExtStatus mstatus_fs;
     RISCVExtStatus mstatus_vs;
     uint32_t mem_idx;
+    uint32_t priv;
     /*
      * Remember the rounding mode encoded in the previous fp instruction,
      * which we have already installed into env->fp_status.  Or -1 for
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     uint32_t tb_flags = ctx->base.tb->flags;
 
     ctx->pc_succ_insn = ctx->base.pc_first;
+    ctx->priv = FIELD_EX32(tb_flags, TB_FLAGS, PRIV);
     ctx->mem_idx = FIELD_EX32(tb_flags, TB_FLAGS, MEM_IDX);
     ctx->mstatus_fs = FIELD_EX32(tb_flags, TB_FLAGS, FS);
     ctx->mstatus_vs = FIELD_EX32(tb_flags, TB_FLAGS, VS);
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
      * that no exception will be raised when fetching them.
      */
 
-    if (semihosting_enabled(ctx->mem_idx < PRV_S) &&
+    if (semihosting_enabled(ctx->priv == PRV_U) &&
         (pre_addr & TARGET_PAGE_MASK) == (post_addr & TARGET_PAGE_MASK)) {
         pre    = opcode_at(&ctx->base, pre_addr);
         ebreak = opcode_at(&ctx->base, ebreak_addr);
diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_th_tst(DisasContext *ctx, arg_th_tst *a)
 
 /* XTheadCmo */
 
-static inline int priv_level(DisasContext *ctx)
-{
-#ifdef CONFIG_USER_ONLY
-    return PRV_U;
-#else
-     /* Priv level is part of mem_idx. */
-    return ctx->mem_idx & TB_FLAGS_PRIV_MMU_MASK;
-#endif
-}
-
 /* Test if priv level is M, S, or U (cannot fail). */
 #define REQUIRE_PRIV_MSU(ctx)
 
 /* Test if priv level is M or S. */
 #define REQUIRE_PRIV_MS(ctx)                                    \
 do {                                                            \
-    int priv = priv_level(ctx);                                 \
-    if (!(priv == PRV_M ||                                      \
-          priv == PRV_S)) {                                     \
+    if (ctx->priv == PRV_U) {                                   \
         return false;                                           \
     }                                                           \
 } while (0)
-- 
2.40.0

From: Fei Wu <fei2.wu@intel.com>

Kernel needs to access user mode memory e.g. during syscalls, the window
is usually opened up for a very limited time through MSTATUS.SUM, the
overhead is too much if tlb_flush() gets called for every SUM change.

This patch creates a separate MMU index for S+SUM, so that it's not
necessary to flush tlb anymore when SUM changes. This is similar to how
ARM handles Privileged Access Never (PAN).

Result of 'pipe 10' from unixbench boosts from 223656 to 1705006. Many
other syscalls benefit a lot from this too.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Fei Wu <fei2.wu@intel.com>
Message-Id: <20230324054154.414846-3-fei2.wu@intel.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-8-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-8-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      |  2 --
 target/riscv/internals.h                | 14 ++++++++++++++
 target/riscv/cpu_helper.c               | 17 +++++++++++++++--
 target/riscv/csr.c                      |  3 +--
 target/riscv/op_helper.c                |  5 +++--
 target/riscv/insn_trans/trans_rvh.c.inc |  4 ++--
 6 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
 target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
 void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
 
-#define TB_FLAGS_PRIV_HYP_ACCESS_MASK   (1 << 2)
-
 #include "exec/cpu-all.h"
 
 FIELD(TB_FLAGS, MEM_IDX, 0, 3)
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/registerfields.h"
 
+/*
+ * The current MMU Modes are:
+ *  - U                 0b000
+ *  - S                 0b001
+ *  - S+SUM             0b010
+ *  - M                 0b011
+ *  - HLV/HLVX/HSV adds 0b100
+ */
+#define MMUIdx_U            0
+#define MMUIdx_S            1
+#define MMUIdx_S_SUM        2
+#define MMUIdx_M            3
+#define MMU_HYP_ACCESS_BIT  (1 << 2)
+
 /* share data between vector helpers and decode code */
 FIELD(VDATA, VM, 0, 1)
 FIELD(VDATA, LMUL, 1, 3)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "internals.h"
 #include "pmu.h"
 #include "exec/exec-all.h"
 #include "instmap.h"
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 #ifdef CONFIG_USER_ONLY
     return 0;
 #else
-    return env->priv;
+    if (ifetch) {
+        return env->priv;
+    }
+
+    /* All priv -> mmu_idx mapping are here */
+    int mode = env->priv;
+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+    }
+    if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
+        return MMUIdx_S_SUM;
+    }
+    return mode;
 #endif
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 
 bool riscv_cpu_two_stage_lookup(int mmu_idx)
 {
-    return mmu_idx & TB_FLAGS_PRIV_HYP_ACCESS_MASK;
+    return mmu_idx & MMU_HYP_ACCESS_BIT;
 }
 
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
 
     /* flush tlb on mstatus fields that affect VM */
-    if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
-            MSTATUS_MPRV | MSTATUS_SUM)) {
+    if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPV)) {
         tlb_flush(env_cpu(env));
     }
     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "internals.h"
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
 
 target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong address)
 {
-    int mmu_idx = cpu_mmu_index(env, true) | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
+    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
 
     return cpu_lduw_mmuidx_ra(env, address, mmu_idx, GETPC());
 }
 
 target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong address)
 {
-    int mmu_idx = cpu_mmu_index(env, true) | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
+    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
 
     return cpu_ldl_mmuidx_ra(env, address, mmu_idx, GETPC());
 }
diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/insn_trans/trans_rvh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvh.c.inc
+++ b/target/riscv/insn_trans/trans_rvh.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_hlv(DisasContext *ctx, arg_r2 *a, MemOp mop)
     if (check_access(ctx)) {
         TCGv dest = dest_gpr(ctx, a->rd);
         TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-        int mem_idx = ctx->mem_idx | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
+        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
         tcg_gen_qemu_ld_tl(dest, addr, mem_idx, mop);
         gen_set_gpr(ctx, a->rd, dest);
     }
@@ -XXX,XX +XXX,XX @@ static bool do_hsv(DisasContext *ctx, arg_r2_s *a, MemOp mop)
     if (check_access(ctx)) {
         TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
         TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
-        int mem_idx = ctx->mem_idx | TB_FLAGS_PRIV_HYP_ACCESS_MASK;
+        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
         tcg_gen_qemu_st_tl(data, addr, mem_idx, mop);
     }
     return true;
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Use the new functions to properly check execute permission
for the read rather than read permission.

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
     helper_hyp_tlb_flush(env);
 }
 
+/*
+ * TODO: These implementations are not quite correct.  They perform the
+ * access using execute permission just fine, but the final PMP check
+ * is supposed to have read permission as well.  Without replicating
+ * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx
+ * which would imply that exact check in tlb_fill.
+ */
 target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong address)
 {
     int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 
-    return cpu_lduw_mmuidx_ra(env, address, mmu_idx, GETPC());
+    return cpu_ldw_code_mmu(env, address, oi, GETPC());
 }
 
 target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong address)
 {
     int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 
-    return cpu_ldl_mmuidx_ra(env, address, mmu_idx, GETPC());
+    return cpu_ldl_code_mmu(env, address, oi, GETPC());
 }
 
 #endif /* !CONFIG_USER_ONLY */
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Implement these instructions via helpers, in expectation
of determining the mmu_idx to use at runtime.  This allows
the permission check to also be moved out of line, which
allows HLSX to be removed from TB_FLAGS.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-11-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-11-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      |   6 +-
 target/riscv/helper.h                   |  12 ++-
 target/riscv/cpu_helper.c               |  26 ++---
 target/riscv/op_helper.c                |  99 ++++++++++++++++--
 target/riscv/translate.c                |   2 -
 target/riscv/insn_trans/trans_rvh.c.inc | 129 ++++++++++--------------
 6 files changed, 165 insertions(+), 109 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, LMUL, 7, 3)
 FIELD(TB_FLAGS, SEW, 10, 3)
 FIELD(TB_FLAGS, VL_EQ_VLMAX, 13, 1)
 FIELD(TB_FLAGS, VILL, 14, 1)
-/* Is a Hypervisor instruction load/store allowed? */
-FIELD(TB_FLAGS, HLSX, 15, 1)
+FIELD(TB_FLAGS, VSTART_EQ_ZERO, 15, 1)
 /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
 FIELD(TB_FLAGS, XL, 16, 2)
 /* If PointerMasking should be applied */
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, VMA, 21, 1)
 FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
-FIELD(TB_FLAGS, VSTART_EQ_ZERO, 24, 1)
-FIELD(TB_FLAGS, PRIV, 25, 2)
+FIELD(TB_FLAGS, PRIV, 24, 2)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(itrigger_match, void, env)
 #ifndef CONFIG_USER_ONLY
 DEF_HELPER_1(hyp_tlb_flush, void, env)
 DEF_HELPER_1(hyp_gvma_tlb_flush, void, env)
-DEF_HELPER_2(hyp_hlvx_hu, tl, env, tl)
-DEF_HELPER_2(hyp_hlvx_wu, tl, env, tl)
+DEF_HELPER_FLAGS_2(hyp_hlv_bu, TCG_CALL_NO_WG, tl, env, tl)
+DEF_HELPER_FLAGS_2(hyp_hlv_hu, TCG_CALL_NO_WG, tl, env, tl)
+DEF_HELPER_FLAGS_2(hyp_hlv_wu, TCG_CALL_NO_WG, tl, env, tl)
+DEF_HELPER_FLAGS_2(hyp_hlv_d, TCG_CALL_NO_WG, tl, env, tl)
+DEF_HELPER_FLAGS_2(hyp_hlvx_hu, TCG_CALL_NO_WG, tl, env, tl)
+DEF_HELPER_FLAGS_2(hyp_hlvx_wu, TCG_CALL_NO_WG, tl, env, tl)
+DEF_HELPER_FLAGS_3(hyp_hsv_b, TCG_CALL_NO_WG, void, env, tl, tl)
+DEF_HELPER_FLAGS_3(hyp_hsv_h, TCG_CALL_NO_WG, void, env, tl, tl)
+DEF_HELPER_FLAGS_3(hyp_hsv_w, TCG_CALL_NO_WG, void, env, tl, tl)
+DEF_HELPER_FLAGS_3(hyp_hsv_d, TCG_CALL_NO_WG, void, env, tl, tl)
 #endif
 
 /* Vector functions */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     fs = get_field(env->mstatus, MSTATUS_FS);
     vs = get_field(env->mstatus, MSTATUS_VS);
 
-    if (riscv_has_ext(env, RVH)) {
-        if (env->priv == PRV_M ||
-            (env->priv == PRV_S && !env->virt_enabled) ||
-            (env->priv == PRV_U && !env->virt_enabled &&
-             get_field(env->hstatus, HSTATUS_HU))) {
-            flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
-        }
-
-        if (env->virt_enabled) {
-            flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
-            /*
-             * Merge DISABLED and !DIRTY states using MIN.
-             * We will set both fields when dirtying.
-             */
-            fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
-            vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
-        }
+    if (env->virt_enabled) {
+        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
+        /*
+         * Merge DISABLED and !DIRTY states using MIN.
+         * We will set both fields when dirtying.
+         */
+        fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
+        vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
     }
+
     if (cpu->cfg.debug && !icount_enabled()) {
         flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
     }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
     helper_hyp_tlb_flush(env);
 }
 
+static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
+{
+    if (env->priv == PRV_M) {
+        /* always allowed */
+    } else if (env->virt_enabled) {
+        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra);
+    } else if (env->priv == PRV_U && !get_field(env->hstatus, HSTATUS_HU)) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
+    }
+
+    return cpu_mmu_index(env, x) | MMU_HYP_ACCESS_BIT;
+}
+
+target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
+
+    return cpu_ldb_mmu(env, addr, oi, ra);
+}
+
+target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
+
+    return cpu_ldw_mmu(env, addr, oi, ra);
+}
+
+target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
+
+    return cpu_ldl_mmu(env, addr, oi, ra);
+}
+
+target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
+
+    return cpu_ldq_mmu(env, addr, oi, ra);
+}
+
+void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
+
+    cpu_stb_mmu(env, addr, val, oi, ra);
+}
+
+void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
+
+    cpu_stw_mmu(env, addr, val, oi, ra);
+}
+
+void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
+
+    cpu_stl_mmu(env, addr, val, oi, ra);
+}
+
+void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
+{
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, false, ra);
+    MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
+
+    cpu_stq_mmu(env, addr, val, oi, ra);
+}
+
 /*
  * TODO: These implementations are not quite correct.  They perform the
  * access using execute permission just fine, but the final PMP check
@@ -XXX,XX +XXX,XX @@ void helper_hyp_gvma_tlb_flush(CPURISCVState *env)
  * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx
  * which would imply that exact check in tlb_fill.
  */
-target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong address)
+target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr)
 {
-    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, true, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 
-    return cpu_ldw_code_mmu(env, address, oi, GETPC());
+    return cpu_ldw_code_mmu(env, addr, oi, GETPC());
 }
 
-target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong address)
+target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
 {
-    int mmu_idx = cpu_mmu_index(env, true) | MMU_HYP_ACCESS_BIT;
+    uintptr_t ra = GETPC();
+    int mmu_idx = check_access_hlsv(env, true, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 
-    return cpu_ldl_code_mmu(env, address, oi, GETPC());
+    return cpu_ldl_code_mmu(env, addr, oi, ra);
 }
 
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool virt_inst_excp;
     bool virt_enabled;
     const RISCVCPUConfig *cfg_ptr;
-    bool hlsx;
     /* vector extension */
     bool vill;
     /*
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->misa_ext = env->misa_ext;
     ctx->frm = -1;  /* unknown rounding mode */
     ctx->cfg_ptr = &(cpu->cfg);
-    ctx->hlsx = FIELD_EX32(tb_flags, TB_FLAGS, HLSX);
     ctx->vill = FIELD_EX32(tb_flags, TB_FLAGS, VILL);
     ctx->sew = FIELD_EX32(tb_flags, TB_FLAGS, SEW);
     ctx->lmul = sextract32(FIELD_EX32(tb_flags, TB_FLAGS, LMUL), 0, 3);
diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/insn_trans/trans_rvh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvh.c.inc
+++ b/target/riscv/insn_trans/trans_rvh.c.inc
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef CONFIG_USER_ONLY
-static bool check_access(DisasContext *ctx)
-{
-    if (!ctx->hlsx) {
-        tcg_gen_st_i32(tcg_constant_i32(ctx->opcode), cpu_env,
-                       offsetof(CPURISCVState, bins));
-        if (ctx->virt_enabled) {
-            generate_exception(ctx, RISCV_EXCP_VIRT_INSTRUCTION_FAULT);
-        } else {
-            generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
-        }
-        return false;
-    }
+#ifdef CONFIG_USER_ONLY
+#define do_hlv(ctx, a, func)  false
+#define do_hsv(ctx, a, func)  false
+#else
+static void gen_helper_hyp_hlv_b(TCGv r, TCGv_env e, TCGv a)
+{
+    gen_helper_hyp_hlv_bu(r, e, a);
+    tcg_gen_ext8s_tl(r, r);
+}
+
+static void gen_helper_hyp_hlv_h(TCGv r, TCGv_env e, TCGv a)
+{
+    gen_helper_hyp_hlv_hu(r, e, a);
+    tcg_gen_ext16s_tl(r, r);
+}
+
+static void gen_helper_hyp_hlv_w(TCGv r, TCGv_env e, TCGv a)
+{
+    gen_helper_hyp_hlv_wu(r, e, a);
+    tcg_gen_ext32s_tl(r, r);
+}
+
+static bool do_hlv(DisasContext *ctx, arg_r2 *a,
+                   void (*func)(TCGv, TCGv_env, TCGv))
+{
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
+
+    decode_save_opc(ctx);
+    func(dest, cpu_env, addr);
+    gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
-#endif
 
-static bool do_hlv(DisasContext *ctx, arg_r2 *a, MemOp mop)
+static bool do_hsv(DisasContext *ctx, arg_r2_s *a,
+                   void (*func)(TCGv_env, TCGv, TCGv))
 {
-#ifdef CONFIG_USER_ONLY
-    return false;
-#else
+    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
+
     decode_save_opc(ctx);
-    if (check_access(ctx)) {
-        TCGv dest = dest_gpr(ctx, a->rd);
-        TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
-        tcg_gen_qemu_ld_tl(dest, addr, mem_idx, mop);
-        gen_set_gpr(ctx, a->rd, dest);
-    }
+    func(cpu_env, addr, data);
     return true;
-#endif
 }
+#endif /* CONFIG_USER_ONLY */
 
 static bool trans_hlv_b(DisasContext *ctx, arg_hlv_b *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_SB);
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_b);
 }
 
 static bool trans_hlv_h(DisasContext *ctx, arg_hlv_h *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_TESW);
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_h);
 }
 
 static bool trans_hlv_w(DisasContext *ctx, arg_hlv_w *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_TESL);
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_w);
 }
 
 static bool trans_hlv_bu(DisasContext *ctx, arg_hlv_bu *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_UB);
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_bu);
 }
 
 static bool trans_hlv_hu(DisasContext *ctx, arg_hlv_hu *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_TEUW);
-}
-
-static bool do_hsv(DisasContext *ctx, arg_r2_s *a, MemOp mop)
-{
-#ifdef CONFIG_USER_ONLY
-    return false;
-#else
-    decode_save_opc(ctx);
-    if (check_access(ctx)) {
-        TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-        TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
-        int mem_idx = ctx->mem_idx | MMU_HYP_ACCESS_BIT;
-        tcg_gen_qemu_st_tl(data, addr, mem_idx, mop);
-    }
-    return true;
-#endif
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_hu);
 }
 
 static bool trans_hsv_b(DisasContext *ctx, arg_hsv_b *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hsv(ctx, a, MO_SB);
+    return do_hsv(ctx, a, gen_helper_hyp_hsv_b);
 }
 
 static bool trans_hsv_h(DisasContext *ctx, arg_hsv_h *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hsv(ctx, a, MO_TESW);
+    return do_hsv(ctx, a, gen_helper_hyp_hsv_h);
 }
 
 static bool trans_hsv_w(DisasContext *ctx, arg_hsv_w *a)
 {
     REQUIRE_EXT(ctx, RVH);
-    return do_hsv(ctx, a, MO_TESL);
+    return do_hsv(ctx, a, gen_helper_hyp_hsv_w);
 }
 
 static bool trans_hlv_wu(DisasContext *ctx, arg_hlv_wu *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_TEUL);
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_wu);
 }
 
 static bool trans_hlv_d(DisasContext *ctx, arg_hlv_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_EXT(ctx, RVH);
-    return do_hlv(ctx, a, MO_TEUQ);
+    return do_hlv(ctx, a, gen_helper_hyp_hlv_d);
 }
 
 static bool trans_hsv_d(DisasContext *ctx, arg_hsv_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_EXT(ctx, RVH);
-    return do_hsv(ctx, a, MO_TEUQ);
-}
-
-#ifndef CONFIG_USER_ONLY
-static bool do_hlvx(DisasContext *ctx, arg_r2 *a,
-                    void (*func)(TCGv, TCGv_env, TCGv))
-{
-    decode_save_opc(ctx);
-    if (check_access(ctx)) {
-        TCGv dest = dest_gpr(ctx, a->rd);
-        TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-        func(dest, cpu_env, addr);
-        gen_set_gpr(ctx, a->rd, dest);
-    }
-    return true;
+    return do_hsv(ctx, a, gen_helper_hyp_hsv_d);
 }
-#endif
 
 static bool trans_hlvx_hu(DisasContext *ctx, arg_hlvx_hu *a)
 {
     REQUIRE_EXT(ctx, RVH);
-#ifndef CONFIG_USER_ONLY
-    return do_hlvx(ctx, a, gen_helper_hyp_hlvx_hu);
-#else
-    return false;
-#endif
+    return do_hlv(ctx, a, gen_helper_hyp_hlvx_hu);
 }
 
 static bool trans_hlvx_wu(DisasContext *ctx, arg_hlvx_wu *a)
 {
     REQUIRE_EXT(ctx, RVH);
-#ifndef CONFIG_USER_ONLY
-    return do_hlvx(ctx, a, gen_helper_hyp_hlvx_wu);
-#else
-    return false;
-#endif
+    return do_hlv(ctx, a, gen_helper_hyp_hlvx_wu);
 }
 
 static bool trans_hfence_gvma(DisasContext *ctx, arg_sfence_vma *a)
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

We will enable more uses of this bit in the future.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-12-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-12-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/internals.h  | 6 ++++--
 target/riscv/cpu_helper.c | 2 +-
 target/riscv/op_helper.c  | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@
  *  - S                 0b001
  *  - S+SUM             0b010
  *  - M                 0b011
- *  - HLV/HLVX/HSV adds 0b100
+ *  - U+2STAGE          0b100
+ *  - S+2STAGE          0b101
+ *  - S+SUM+2STAGE      0b110
  */
 #define MMUIdx_U            0
 #define MMUIdx_S            1
 #define MMUIdx_S_SUM        2
 #define MMUIdx_M            3
-#define MMU_HYP_ACCESS_BIT  (1 << 2)
+#define MMU_2STAGE_BIT      (1 << 2)
 
 /* share data between vector helpers and decode code */
 FIELD(VDATA, VM, 0, 1)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 
 bool riscv_cpu_two_stage_lookup(int mmu_idx)
 {
-    return mmu_idx & MMU_HYP_ACCESS_BIT;
+    return mmu_idx & MMU_2STAGE_BIT;
 }
 
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
     }
 
-    return cpu_mmu_index(env, x) | MMU_HYP_ACCESS_BIT;
+    return cpu_mmu_index(env, x) | MMU_2STAGE_BIT;
 }
 
 target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

In get_physical_address, we should use the setting passed
via mmu_idx rather than checking env->mstatus directly.

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@
 #define MMUIdx_M            3
 #define MMU_2STAGE_BIT      (1 << 2)
 
+static inline bool mmuidx_sum(int mmu_idx)
+{
+    return (mmu_idx & 3) == MMUIdx_S_SUM;
+}
+
 /* share data between vector helpers and decode code */
 FIELD(VDATA, VM, 0, 1)
 FIELD(VDATA, LMUL, 1, 3)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         widened = 2;
     }
     /* status.SUM will be ignored if execute on background */
-    sum = get_field(env->mstatus, MSTATUS_SUM) || use_background || is_debug;
+    sum = mmuidx_sum(mmu_idx) || use_background || is_debug;
     switch (vm) {
     case VM_1_10_SV32:
       levels = 2; ptidxbits = 10; ptesize = 4; break;
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Use the priv level encoded into the mmu_idx, rather than
starting from env->priv.  We have already checked MPRV+MPP
in riscv_cpu_mmu_index -- no need to repeat that.

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@
 #define MMUIdx_M            3
 #define MMU_2STAGE_BIT      (1 << 2)
 
+static inline int mmuidx_priv(int mmu_idx)
+{
+    int ret = mmu_idx & 3;
+    if (ret == MMUIdx_S_SUM) {
+        ret = PRV_S;
+    }
+    return ret;
+}
+
 static inline bool mmuidx_sum(int mmu_idx)
 {
     return (mmu_idx & 3) == MMUIdx_S_SUM;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      */
     MemTxResult res;
     MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
-    int mode = env->priv;
+    int mode = mmuidx_priv(mmu_idx);
     bool use_background = false;
     hwaddr ppn;
     int napot_bits = 0;
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      */
     if (riscv_cpu_two_stage_lookup(mmu_idx)) {
         mode = get_field(env->hstatus, HSTATUS_SPVP);
-    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
-        if (get_field(env->mstatus, MSTATUS_MPRV)) {
-            mode = get_field(env->mstatus, MSTATUS_MPP);
-        }
     }
 
     if (first_stage == false) {
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Move and rename riscv_cpu_two_stage_lookup, to match
the other mmuidx_* functions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-15-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-15-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  1 -
 target/riscv/internals.h  |  5 +++++
 target/riscv/cpu_helper.c | 20 ++++++--------------
 3 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
 void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
 bool riscv_cpu_vector_enabled(CPURISCVState *env);
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
-bool riscv_cpu_two_stage_lookup(int mmu_idx);
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
 G_NORETURN void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
                                                MMUAccessType access_type,
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool mmuidx_sum(int mmu_idx)
     return (mmu_idx & 3) == MMUIdx_S_SUM;
 }
 
+static inline bool mmuidx_2stage(int mmu_idx)
+{
+    return mmu_idx & MMU_2STAGE_BIT;
+}
+
 /* share data between vector helpers and decode code */
 FIELD(VDATA, VM, 0, 1)
 FIELD(VDATA, LMUL, 1, 3)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
     }
 }
 
-bool riscv_cpu_two_stage_lookup(int mmu_idx)
-{
-    return mmu_idx & MMU_2STAGE_BIT;
-}
-
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      * MPRV does not affect the virtual-machine load/store
      * instructions, HLV, HLVX, and HSV.
      */
-    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+    if (mmuidx_2stage(mmu_idx)) {
         mode = get_field(env->hstatus, HSTATUS_SPVP);
     }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     }
 
     env->badaddr = addr;
-    env->two_stage_lookup = env->virt_enabled ||
-                            riscv_cpu_two_stage_lookup(mmu_idx);
+    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
     env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
         g_assert_not_reached();
     }
     env->badaddr = addr;
-    env->two_stage_lookup = env->virt_enabled ||
-                            riscv_cpu_two_stage_lookup(mmu_idx);
+    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
     env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
 }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      * MPRV does not affect the virtual-machine load/store
      * instructions, HLV, HLVX, and HSV.
      */
-    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+    if (mmuidx_2stage(mmu_idx)) {
         mode = get_field(env->hstatus, HSTATUS_SPVP);
     } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
                get_field(env->mstatus, MSTATUS_MPRV)) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 
     pmu_tlb_fill_incr_ctr(cpu, access_type);
     if (env->virt_enabled ||
-        ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
+        ((mmuidx_2stage(mmu_idx) || two_stage_lookup) &&
          access_type != MMU_INST_FETCH)) {
         /* Two stage lookup */
         ret = get_physical_address(env, &pa, &prot, address,
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     } else {
         raise_mmu_exception(env, address, access_type, pmp_violation,
                             first_stage_error,
-                            env->virt_enabled ||
-                                riscv_cpu_two_stage_lookup(mmu_idx),
+                            env->virt_enabled || mmuidx_2stage(mmu_idx),
                             two_stage_indirect_error);
         cpu_loop_exit_restore(cs, retaddr);
     }
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

The current cpu_mmu_index value is really irrelevant to
the HLV/HSV lookup.  Provide the correct priv level directly.

From: Richard Henderson <richard.henderson@linaro.org>

Incorporate the virt_enabled and MPV checks into the cpu_mmu_index
function, so we don't have to keep doing it within tlb_fill and
subroutines.  This also elides a flush on changes to MPV.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230325105429.1142530-17-richard.henderson@linaro.org>
Message-Id: <20230412114333.118895-17-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 49 ++++++++++++++-------------------------
 target/riscv/csr.c        |  6 +----
 2 files changed, 18 insertions(+), 37 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 #ifdef CONFIG_USER_ONLY
     return 0;
 #else
-    if (ifetch) {
-        return env->priv;
-    }
+    bool virt = env->virt_enabled;
+    int mode = env->priv;
 
     /* All priv -> mmu_idx mapping are here */
-    int mode = env->priv;
-    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
-        mode = get_field(env->mstatus, MSTATUS_MPP);
-    }
-    if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
-        return MMUIdx_S_SUM;
+    if (!ifetch) {
+        if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+            mode = get_field(env->mstatus, MSTATUS_MPP);
+            virt = get_field(env->mstatus, MSTATUS_MPV);
+        }
+        if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
+            mode = MMUIdx_S_SUM;
+        }
     }
-    return mode;
+
+    return mode | (virt ? MMU_2STAGE_BIT : 0);
 #endif
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     }
 
     env->badaddr = addr;
-    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
+    env->two_stage_lookup = mmuidx_2stage(mmu_idx);
     env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
         g_assert_not_reached();
     }
     env->badaddr = addr;
-    env->two_stage_lookup = env->virt_enabled || mmuidx_2stage(mmu_idx);
+    env->two_stage_lookup = mmuidx_2stage(mmu_idx);
     env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
 }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     int prot, prot2, prot_pmp;
     bool pmp_violation = false;
     bool first_stage_error = true;
-    bool two_stage_lookup = false;
+    bool two_stage_lookup = mmuidx_2stage(mmu_idx);
     bool two_stage_indirect_error = false;
     int ret = TRANSLATE_FAIL;
     int mode = mmu_idx;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                   __func__, address, access_type, mmu_idx);
 
-    /*
-     * MPRV does not affect the virtual-machine load/store
-     * instructions, HLV, HLVX, and HSV.
-     */
-    if (mmuidx_2stage(mmu_idx)) {
-        ;
-    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
-               get_field(env->mstatus, MSTATUS_MPRV)) {
-        mode = get_field(env->mstatus, MSTATUS_MPP);
-        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
-            two_stage_lookup = true;
-        }
-    }
-
     pmu_tlb_fill_incr_ctr(cpu, access_type);
-    if (env->virt_enabled ||
-        ((mmuidx_2stage(mmu_idx) || two_stage_lookup) &&
-         access_type != MMU_INST_FETCH)) {
+    if (two_stage_lookup) {
         /* Two stage lookup */
         ret = get_physical_address(env, &pa, &prot, address,
                                    &env->guest_phys_fault_addr, access_type,
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         return false;
     } else {
         raise_mmu_exception(env, address, access_type, pmp_violation,
-                            first_stage_error,
-                            env->virt_enabled || mmuidx_2stage(mmu_idx),
+                            first_stage_error, two_stage_lookup,
                             two_stage_indirect_error);
         cpu_loop_exit_restore(cs, retaddr);
     }
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
 
     /* flush tlb on mstatus fields that affect VM */
-    if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPV)) {
+    if ((val ^ mstatus) & MSTATUS_MXR) {
         tlb_flush(env_cpu(env));
     }
     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
     uint64_t valh = (uint64_t)val << 32;
     uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
 
-    if ((valh ^ env->mstatus) & (MSTATUS_MPV)) {
-        tlb_flush(env_cpu(env));
-    }
-
     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 
     return RISCV_EXCP_NONE;
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Table 9.5 "Effect of MPRV..." specifies that MPV=1 uses VS-level
vsstatus.SUM instead of HS-level sstatus.SUM.

For HLV/HSV instructions, the HS-level register does not apply, but
the VS-level register presumably does, though this is not mentioned
explicitly in the manual.  However, it matches the behavior for MPV.

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 
     /* All priv -> mmu_idx mapping are here */
     if (!ifetch) {
-        if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        uint64_t status = env->mstatus;
+
+        if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
             virt = get_field(env->mstatus, MSTATUS_MPV);
+            if (virt) {
+                status = env->vsstatus;
+            }
         }
-        if (mode == PRV_S && get_field(env->mstatus, MSTATUS_SUM)) {
+        if (mode == PRV_S && get_field(status, MSTATUS_SUM)) {
             mode = MMUIdx_S_SUM;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         }
         widened = 2;
     }
-    /* status.SUM will be ignored if execute on background */
-    sum = mmuidx_sum(mmu_idx) || use_background || is_debug;
+    sum = mmuidx_sum(mmu_idx) || is_debug;
     switch (vm) {
     case VM_1_10_SV32:
       levels = 2; ptidxbits = 10; ptesize = 4; break;
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
     }
 
-    return get_field(env->hstatus, HSTATUS_SPVP) | MMU_2STAGE_BIT;
+    int mode = get_field(env->hstatus, HSTATUS_SPVP);
+    if (!x && mode == PRV_S && get_field(env->vsstatus, MSTATUS_SUM)) {
+        mode = MMUIdx_S_SUM;
+    }
+    return mode | MMU_2STAGE_BIT;
 }
 
 target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Move the check from the top of get_physical_address to
the two callers, where passing mmu_idx makes no sense.

From: Richard Henderson <richard.henderson@linaro.org>

These values are constant for every level of pte lookup.

From: Richard Henderson <richard.henderson@linaro.org>

Move the code that never loops outside of the loop.
Unchain the if-return-else statements.

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     int ptshift = (levels - 1) * ptidxbits;
+    target_ulong pte;
+    hwaddr pte_addr;
     int i;
 
 #if !TCG_OVERSIZED_GUEST
@@ -XXX,XX +XXX,XX @@ restart:
         }
 
         /* check that physical address of PTE is legal */
-        hwaddr pte_addr;
 
         if (two_stage && first_stage) {
             int vbase_prot;
@@ -XXX,XX +XXX,XX @@ restart:
             return TRANSLATE_PMP_FAIL;
         }
 
-        target_ulong pte;
         if (riscv_cpu_mxl(env) == MXL_RV32) {
             pte = address_space_ldl(cs->as, pte_addr, attrs, &res);
         } else {
@@ -XXX,XX +XXX,XX @@ restart:
         if (!(pte & PTE_V)) {
             /* Invalid PTE */
             return TRANSLATE_FAIL;
-        } else if (!pbmte && (pte & PTE_PBMT)) {
-            return TRANSLATE_FAIL;
-        } else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
-            /* Inner PTE, continue walking */
-            if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
-                return TRANSLATE_FAIL;
-            }
-            base = ppn << PGSHIFT;
-        } else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
-            /* Reserved leaf PTE flags: PTE_W */
-            return TRANSLATE_FAIL;
-        } else if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
-            /* Reserved leaf PTE flags: PTE_W + PTE_X */
-            return TRANSLATE_FAIL;
-        } else if ((pte & PTE_U) && ((mode != PRV_U) &&
-                   (!sum || access_type == MMU_INST_FETCH))) {
-            /* User PTE flags when not U mode and mstatus.SUM is not set,
-               or the access type is an instruction fetch */
-            return TRANSLATE_FAIL;
-        } else if (!(pte & PTE_U) && (mode != PRV_S)) {
-            /* Supervisor PTE flags when not S mode */
-            return TRANSLATE_FAIL;
-        } else if (ppn & ((1ULL << ptshift) - 1)) {
-            /* Misaligned PPN */
-            return TRANSLATE_FAIL;
-        } else if (access_type == MMU_DATA_LOAD && !((pte & PTE_R) ||
-                   ((pte & PTE_X) && mxr))) {
-            /* Read access check failed */
-            return TRANSLATE_FAIL;
-        } else if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
-            /* Write access check failed */
-            return TRANSLATE_FAIL;
-        } else if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
-            /* Fetch access check failed */
+        }
+        if (pte & (PTE_R | PTE_W | PTE_X)) {
+            goto leaf;
+        }
+
+        /* Inner PTE, continue walking */
+        if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
             return TRANSLATE_FAIL;
-        } else {
-            /* if necessary, set accessed and dirty bits. */
-            target_ulong updated_pte = pte | PTE_A |
+        }
+        base = ppn << PGSHIFT;
+    }
+
+    /* No leaf pte at any translation level. */
+    return TRANSLATE_FAIL;
+
+ leaf:
+    if (ppn & ((1ULL << ptshift) - 1)) {
+        /* Misaligned PPN */
+        return TRANSLATE_FAIL;
+    }
+    if (!pbmte && (pte & PTE_PBMT)) {
+        /* Reserved without Svpbmt. */
+        return TRANSLATE_FAIL;
+    }
+    if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
+        /* Reserved leaf PTE flags: PTE_W */
+        return TRANSLATE_FAIL;
+    }
+    if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
+        /* Reserved leaf PTE flags: PTE_W + PTE_X */
+        return TRANSLATE_FAIL;
+    }
+    if ((pte & PTE_U) &&
+        ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
+        /*
+         * User PTE flags when not U mode and mstatus.SUM is not set,
+         * or the access type is an instruction fetch.
+         */
+        return TRANSLATE_FAIL;
+    }
+    if (!(pte & PTE_U) && (mode != PRV_S)) {
+        /* Supervisor PTE flags when not S mode */
+        return TRANSLATE_FAIL;
+    }
+    if (access_type == MMU_DATA_LOAD &&
+        !((pte & PTE_R) || ((pte & PTE_X) && mxr))) {
+        /* Read access check failed */
+        return TRANSLATE_FAIL;
+    }
+    if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
+        /* Write access check failed */
+        return TRANSLATE_FAIL;
+    }
+    if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
+        /* Fetch access check failed */
+        return TRANSLATE_FAIL;
+    }
+
+    /* If necessary, set accessed and dirty bits. */
+    target_ulong updated_pte = pte | PTE_A |
                 (access_type == MMU_DATA_STORE ? PTE_D : 0);
 
-            /* Page table updates need to be atomic with MTTCG enabled */
-            if (updated_pte != pte) {
-                if (!hade) {
-                    return TRANSLATE_FAIL;
-                }
+    /* Page table updates need to be atomic with MTTCG enabled */
+    if (updated_pte != pte) {
+        if (!hade) {
+            return TRANSLATE_FAIL;
+        }
 
-                /*
-                 * - if accessed or dirty bits need updating, and the PTE is
-                 *   in RAM, then we do so atomically with a compare and swap.
-                 * - if the PTE is in IO space or ROM, then it can't be updated
-                 *   and we return TRANSLATE_FAIL.
-                 * - if the PTE changed by the time we went to update it, then
-                 *   it is no longer valid and we must re-walk the page table.
-                 */
-                MemoryRegion *mr;
-                hwaddr l = sizeof(target_ulong), addr1;
-                mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
-                                             false, MEMTXATTRS_UNSPECIFIED);
-                if (memory_region_is_ram(mr)) {
-                    target_ulong *pte_pa =
-                        qemu_map_ram_ptr(mr->ram_block, addr1);
+        /*
+         * - if accessed or dirty bits need updating, and the PTE is
+         *   in RAM, then we do so atomically with a compare and swap.
+         * - if the PTE is in IO space or ROM, then it can't be updated
+         *   and we return TRANSLATE_FAIL.
+         * - if the PTE changed by the time we went to update it, then
+         *   it is no longer valid and we must re-walk the page table.
+         */
+        MemoryRegion *mr;
+        hwaddr l = sizeof(target_ulong), addr1;
+        mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
+                                     false, MEMTXATTRS_UNSPECIFIED);
+        if (memory_region_is_ram(mr)) {
+            target_ulong *pte_pa = qemu_map_ram_ptr(mr->ram_block, addr1);
 #if TCG_OVERSIZED_GUEST
-                    /*
-                     * MTTCG is not enabled on oversized TCG guests so
-                     * page table updates do not need to be atomic
-                     */
-                    *pte_pa = pte = updated_pte;
+            /*
+             * MTTCG is not enabled on oversized TCG guests so
+             * page table updates do not need to be atomic
+             */
+            *pte_pa = pte = updated_pte;
 #else
-                    target_ulong old_pte =
-                        qatomic_cmpxchg(pte_pa, pte, updated_pte);
-                    if (old_pte != pte) {
-                        goto restart;
-                    } else {
-                        pte = updated_pte;
-                    }
-#endif
-                } else {
-                    /*
-                     * misconfigured PTE in ROM (AD bits are not preset) or
-                     * PTE is in IO space and can't be updated atomically
-                     */
-                    return TRANSLATE_FAIL;
-                }
+            target_ulong old_pte = qatomic_cmpxchg(pte_pa, pte, updated_pte);
+            if (old_pte != pte) {
+                goto restart;
             }
-
+            pte = updated_pte;
+#endif
+        } else {
             /*
-             * for superpage mappings, make a fake leaf PTE for the TLB's
-             * benefit.
+             * Misconfigured PTE in ROM (AD bits are not preset) or
+             * PTE is in IO space and can't be updated atomically.
              */
-            target_ulong vpn = addr >> PGSHIFT;
-
-            if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
-                napot_bits = ctzl(ppn) + 1;
-                if ((i != (levels - 1)) || (napot_bits != 4)) {
-                    return TRANSLATE_FAIL;
-                }
-            }
+            return TRANSLATE_FAIL;
+        }
+    }
 
-            napot_mask = (1 << napot_bits) - 1;
-            *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
-                          (vpn & (((target_ulong)1 << ptshift) - 1))
-                         ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
+    /* For superpage mappings, make a fake leaf PTE for the TLB's benefit. */
+    target_ulong vpn = addr >> PGSHIFT;
 
-            /* set permissions on the TLB entry */
-            if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
-                *prot |= PAGE_READ;
-            }
-            if (pte & PTE_X) {
-                *prot |= PAGE_EXEC;
-            }
-            /*
-             * add write permission on stores or if the page is already dirty,
-             * so that we TLB miss on later writes to update the dirty bit
-             */
-            if ((pte & PTE_W) &&
-                (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
-                *prot |= PAGE_WRITE;
-            }
-            return TRANSLATE_SUCCESS;
+    if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
+        napot_bits = ctzl(ppn) + 1;
+        if ((i != (levels - 1)) || (napot_bits != 4)) {
+            return TRANSLATE_FAIL;
         }
     }
-    return TRANSLATE_FAIL;
+
+    napot_mask = (1 << napot_bits) - 1;
+    *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
+                  (vpn & (((target_ulong)1 << ptshift) - 1))
+                 ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
+
+    /* set permissions on the TLB entry */
+    if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
+        *prot |= PAGE_READ;
+    }
+    if (pte & PTE_X) {
+        *prot |= PAGE_EXEC;
+    }
+    /*
+     * Add write permission on stores or if the page is already dirty,
+     * so that we TLB miss on later writes to update the dirty bit.
+     */
+    if ((pte & PTE_W) && (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
+        *prot |= PAGE_WRITE;
+    }
+    return TRANSLATE_SUCCESS;
 }
 
 static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

The debugger should not modify PTE_A or PTE_D.

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ restart:
                 (access_type == MMU_DATA_STORE ? PTE_D : 0);
 
     /* Page table updates need to be atomic with MTTCG enabled */
-    if (updated_pte != pte) {
+    if (updated_pte != pte && !is_debug) {
         if (!hade) {
             return TRANSLATE_FAIL;
         }
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

If we want to give the debugger a greater view of memory than
the cpu, we should simply disable the access check entirely,
not simply for this one corner case.

From: Richard Henderson <richard.henderson@linaro.org>

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ restart:
         /* Reserved without Svpbmt. */
         return TRANSLATE_FAIL;
     }
-    if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
-        /* Reserved leaf PTE flags: PTE_W */
-        return TRANSLATE_FAIL;
-    }
-    if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
-        /* Reserved leaf PTE flags: PTE_W + PTE_X */
+
+    /* Check for reserved combinations of RWX flags. */
+    switch (pte & (PTE_R | PTE_W | PTE_X)) {
+    case PTE_W:
+    case PTE_W | PTE_X:
         return TRANSLATE_FAIL;
     }
+
     if ((pte & PTE_U) &&
         ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
         /*
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

We were effectively computing the protection bits twice,
once while performing access checks and once while returning
the valid bits to the caller.  Reorg so we do this once.

Move the computation of mxr close to its single use.

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
  * @is_debug: Is this access from a debugger or the monitor?
  */
 static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-                                int *prot, vaddr addr,
+                                int *ret_prot, vaddr addr,
                                 target_ulong *fault_pte_addr,
                                 int access_type, int mmu_idx,
                                 bool first_stage, bool two_stage,
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
 
     if (mode == PRV_M || !riscv_cpu_cfg(env)->mmu) {
         *physical = addr;
-        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        *ret_prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
         return TRANSLATE_SUCCESS;
     }
 
-    *prot = 0;
+    *ret_prot = 0;
 
     hwaddr base;
-    int levels, ptidxbits, ptesize, vm, sum, mxr, widened;
-
-    if (first_stage == true) {
-        mxr = get_field(env->mstatus, MSTATUS_MXR);
-    } else {
-        mxr = get_field(env->vsstatus, MSTATUS_MXR);
-    }
+    int levels, ptidxbits, ptesize, vm, sum, widened;
 
     if (first_stage == true) {
         if (use_background) {
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
       levels = 5; ptidxbits = 9; ptesize = 8; break;
     case VM_1_10_MBARE:
         *physical = addr;
-        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        *ret_prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
         return TRANSLATE_SUCCESS;
     default:
       g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ restart:
         return TRANSLATE_FAIL;
     }
 
+    int prot = 0;
+    if (pte & PTE_R) {
+        prot |= PAGE_READ;
+    }
+    if (pte & PTE_W) {
+        prot |= PAGE_WRITE;
+    }
+    if (pte & PTE_X) {
+        bool mxr;
+
+        if (first_stage == true) {
+            mxr = get_field(env->mstatus, MSTATUS_MXR);
+        } else {
+            mxr = get_field(env->vsstatus, MSTATUS_MXR);
+        }
+        if (mxr) {
+            prot |= PAGE_READ;
+        }
+        prot |= PAGE_EXEC;
+    }
+
     if ((pte & PTE_U) &&
         ((mode != PRV_U) && (!sum || access_type == MMU_INST_FETCH))) {
         /*
@@ -XXX,XX +XXX,XX @@ restart:
         /* Supervisor PTE flags when not S mode */
         return TRANSLATE_FAIL;
     }
-    if (access_type == MMU_DATA_LOAD &&
-        !((pte & PTE_R) || ((pte & PTE_X) && mxr))) {
-        /* Read access check failed */
-        return TRANSLATE_FAIL;
-    }
-    if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
-        /* Write access check failed */
-        return TRANSLATE_FAIL;
-    }
-    if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
-        /* Fetch access check failed */
+
+    if (!((prot >> access_type) & 1)) {
+        /* Access check failed */
         return TRANSLATE_FAIL;
     }
 
@@ -XXX,XX +XXX,XX @@ restart:
                   (vpn & (((target_ulong)1 << ptshift) - 1))
                  ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
 
-    /* set permissions on the TLB entry */
-    if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
-        *prot |= PAGE_READ;
-    }
-    if (pte & PTE_X) {
-        *prot |= PAGE_EXEC;
-    }
     /*
-     * Add write permission on stores or if the page is already dirty,
-     * so that we TLB miss on later writes to update the dirty bit.
+     * Remove write permission unless this is a store, or the page is
+     * already dirty, so that we TLB miss on later writes to update
+     * the dirty bit.
      */
-    if ((pte & PTE_W) && (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
-        *prot |= PAGE_WRITE;
+    if (access_type != MMU_DATA_STORE && !(pte & PTE_D)) {
+        prot &= ~PAGE_WRITE;
     }
+    *ret_prot = prot;
+
     return TRANSLATE_SUCCESS;
 }
 
-- 
2.40.0

From: Richard Henderson <richard.henderson@linaro.org>

Implement this by adjusting prot, which reduces the set of
checks required.  This prevents exec to be set for U pages
in MMUIdx_S_SUM.  While it had been technically incorrect,
it did not manifest as a bug, because we will never attempt
to execute from MMUIdx_S_SUM.

From: Ivan Klokov <ivan.klokov@syntacore.com>

Since g_new is used to initialize the RISCVAPLICState->state structure,
in some case we get behavior that is not as expected. This patch
changes this to g_new0, which allows to initialize the APLIC in the correct state.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Message-Id: <20230413133432.53771-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
 
     aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
     aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-    aplic->state = g_new(uint32_t, aplic->num_irqs);
+    aplic->state = g_new0(uint32_t, aplic->num_irqs);
     aplic->target = g_new0(uint32_t, aplic->num_irqs);
     if (!aplic->msimode) {
         for (i = 0; i < aplic->num_irqs; i++) {
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

QMP CPU commands are usually implemented by a separated file,
<arch>-qmp-cmds.c, to allow them to be build only for softmmu targets.
This file uses a CPU QOM header with basic QOM declarations for the
arch.

We'll introduce query-cpu-definitions for RISC-V CPUs in the next patch,
but first we need a cpu-qom.h header with the definitions of
TYPE_RISCV_CPU and RISCVCPUClass declarations. These were moved from
cpu.h to the new file, and cpu.h now includes "cpu-qom.h".

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230411183511.189632-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h | 70 ++++++++++++++++++++++++++++++++++++++++++
 target/riscv/cpu.h     | 46 +--------------------------
 2 files changed, 71 insertions(+), 45 deletions(-)
 create mode 100644 target/riscv/cpu-qom.h

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V CPU QOM header
+ *
+ * Copyright (c) 2023 Ventana Micro Systems Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef RISCV_CPU_QOM_H
+#define RISCV_CPU_QOM_H
+
+#include "hw/core/cpu.h"
+#include "qom/object.h"
+
+#define TYPE_RISCV_CPU "riscv-cpu"
+
+#define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
+#define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
+#define CPU_RESOLVING_TYPE TYPE_RISCV_CPU
+
+#define TYPE_RISCV_CPU_ANY              RISCV_CPU_TYPE_NAME("any")
+#define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
+#define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
+#define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
+#define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
+#define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
+#define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
+#define TYPE_RISCV_CPU_SIFIVE_E34       RISCV_CPU_TYPE_NAME("sifive-e34")
+#define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
+#define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
+#define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
+#define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
+#define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
+
+#if defined(TARGET_RISCV32)
+# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE32
+#elif defined(TARGET_RISCV64)
+# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE64
+#endif
+
+typedef struct CPUArchState CPURISCVState;
+
+OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
+
+/**
+ * RISCVCPUClass:
+ * @parent_realize: The parent class' realize handler.
+ * @parent_phases: The parent class' reset phase handlers.
+ *
+ * A RISCV CPU model.
+ */
+struct RISCVCPUClass {
+    /*< private >*/
+    CPUClass parent_class;
+    /*< public >*/
+    DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
+};
+
+#endif /* RISCV_CPU_QOM_H */
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/int128.h"
 #include "cpu_bits.h"
 #include "qapi/qapi-types-common.h"
+#include "cpu-qom.h"
 
 #define TCG_GUEST_DEFAULT_MO 0
 
@@ -XXX,XX +XXX,XX @@
  */
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-#define TYPE_RISCV_CPU "riscv-cpu"
-
-#define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
-#define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
-#define CPU_RESOLVING_TYPE TYPE_RISCV_CPU
-
-#define TYPE_RISCV_CPU_ANY              RISCV_CPU_TYPE_NAME("any")
-#define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
-#define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
-#define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
-#define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
-#define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
-#define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
-#define TYPE_RISCV_CPU_SIFIVE_E34       RISCV_CPU_TYPE_NAME("sifive-e34")
-#define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
-#define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
-#define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
-#define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
-#define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
-
-#if defined(TARGET_RISCV32)
-# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE32
-#elif defined(TARGET_RISCV64)
-# define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE64
-#endif
-
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
 /* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 #define MAX_RISCV_PMPS (16)
 
-typedef struct CPUArchState CPURISCVState;
-
 #if !defined(CONFIG_USER_ONLY)
 #include "pmp.h"
 #include "debug.h"
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     uint64_t kvm_timer_frequency;
 };
 
-OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
-
-/*
- * RISCVCPUClass:
- * @parent_realize: The parent class' realize handler.
- * @parent_phases: The parent class' reset phase handlers.
- *
- * A RISCV CPU model.
- */
-struct RISCVCPUClass {
-    /* < private > */
-    CPUClass parent_class;
-    /* < public > */
-    DeviceRealize parent_realize;
-    ResettablePhases parent_phases;
-};
-
 /*
  * map is a 16-bit bitmap: the most significant set bit in map is the maximum
  * satp mode that is supported. It may be chosen by the user and must respect
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This command is used by tooling like libvirt to retrieve a list of
supported CPUs. Each entry returns a CpuDefinitionInfo object that
contains more information about each CPU.

This initial support includes only the name of the CPU and its typename.
Here's what the command produces for the riscv64 target:

$ ./build/qemu-system-riscv64 -S -M virt -display none -qmp stdio
{"QMP": {"version": (...)}
{"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
{"return": {}}
{"execute": "query-cpu-definitions"}
{"return": [
{"name": "rv64", "typename": "rv64-riscv-cpu", "static": false, "deprecated": false},
{"name": "sifive-e51", "typename": "sifive-e51-riscv-cpu", "static": false, "deprecated": false},
{"name": "any", "typename": "any-riscv-cpu", "static": false, "deprecated": false},
{"name": "x-rv128", "typename": "x-rv128-riscv-cpu", "static": false, "deprecated": false},
{"name": "shakti-c", "typename": "shakti-c-riscv-cpu", "static": false, "deprecated": false},
{"name": "thead-c906", "typename": "thead-c906-riscv-cpu", "static": false, "deprecated": false},
{"name": "sifive-u54", "typename": "sifive-u54-riscv-cpu", "static": false, "deprecated": false}]
}

Next patch will introduce a way to tell whether a given CPU is static or
not.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230411183511.189632-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 qapi/machine-target.json      |  6 ++--
 target/riscv/riscv-qmp-cmds.c | 53 +++++++++++++++++++++++++++++++++++
 target/riscv/meson.build      |  3 +-
 3 files changed, 59 insertions(+), 3 deletions(-)
 create mode 100644 target/riscv/riscv-qmp-cmds.c

diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -XXX,XX +XXX,XX @@
                    'TARGET_I386',
                    'TARGET_S390X',
                    'TARGET_MIPS',
-                   'TARGET_LOONGARCH64' ] } }
+                   'TARGET_LOONGARCH64',
+                   'TARGET_RISCV' ] } }
 
 ##
 # @query-cpu-definitions:
@@ -XXX,XX +XXX,XX @@
                    'TARGET_I386',
                    'TARGET_S390X',
                    'TARGET_MIPS',
-                   'TARGET_LOONGARCH64' ] } }
+                   'TARGET_LOONGARCH64',
+                   'TARGET_RISCV' ] } }
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU CPU QMP commands for RISC-V
+ *
+ * Copyright (c) 2023 Ventana Micro Systems Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qapi/qapi-commands-machine-target.h"
+#include "cpu-qom.h"
+
+static void riscv_cpu_add_definition(gpointer data, gpointer user_data)
+{
+    ObjectClass *oc = data;
+    CpuDefinitionInfoList **cpu_list = user_data;
+    CpuDefinitionInfo *info = g_malloc0(sizeof(*info));
+    const char *typename = object_class_get_name(oc);
+
+    info->name = g_strndup(typename,
+                           strlen(typename) - strlen("-" TYPE_RISCV_CPU));
+    info->q_typename = g_strdup(typename);
+
+    QAPI_LIST_PREPEND(*cpu_list, info);
+}
+
+CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
+{
+    CpuDefinitionInfoList *cpu_list = NULL;
+    GSList *list = object_class_get_list(TYPE_RISCV_CPU, false);
+
+    g_slist_foreach(list, riscv_cpu_add_definition, &cpu_list);
+    g_slist_free(list);
+
+    return cpu_list;
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_softmmu_ss.add(files(
   'monitor.c',
   'machine.c',
   'pmu.c',
-  'time_helper.c'
+  'time_helper.c',
+  'riscv-qmp-cmds.c',
 ))
 
 target_arch += {'riscv': riscv_ss}
-- 
2.40.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This new abstract type will be used to differentiate between static and
non-static CPUs in query-cpu-definitions.

All generic CPUs were changed to be of this type. Named CPUs are kept as
TYPE_RISCV_CPU and will still be considered static.

This is the output of query-cpu-definitions after this change for the
riscv64 target:

$ ./build/qemu-system-riscv64 -S -M virt -display none -qmp stdio
{"QMP": {"version": (...)}
{"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
{"return": {}}
{"execute": "query-cpu-definitions"}
{"return": [
{"name": "rv64", "typename": "rv64-riscv-cpu", "static": false, "deprecated": false},
{"name": "sifive-e51", "typename": "sifive-e51-riscv-cpu", "static": true, "deprecated": false},
{"name": "any", "typename": "any-riscv-cpu", "static": false, "deprecated": false},
{"name": "x-rv128", "typename": "x-rv128-riscv-cpu", "static": false, "deprecated": false},
{"name": "shakti-c", "typename": "shakti-c-riscv-cpu", "static": true, "deprecated": false},
{"name": "thead-c906", "typename": "thead-c906-riscv-cpu", "static": true, "deprecated": false},
{"name": "sifive-u54", "typename": "sifive-u54-riscv-cpu", "static": true, "deprecated": false}
]}

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230411183511.189632-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h        |  2 +-
 target/riscv/cpu.c            | 20 ++++++++++++++++----
 target/riscv/riscv-qmp-cmds.c |  4 ++++
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_RISCV_CPU "riscv-cpu"
+#define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
 
 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUClass {
     DeviceRealize parent_realize;
     ResettablePhases parent_phases;
 };
-
 #endif /* RISCV_CPU_QOM_H */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_list(void)
         .instance_init = initfn            \
     }
 
+#define DEFINE_DYNAMIC_CPU(type_name, initfn) \
+    {                                         \
+        .name = type_name,                    \
+        .parent = TYPE_RISCV_DYNAMIC_CPU,     \
+        .instance_init = initfn               \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .class_size = sizeof(RISCVCPUClass),
         .class_init = riscv_cpu_class_init,
     },
-    DEFINE_CPU(TYPE_RISCV_CPU_ANY,              riscv_any_cpu_init),
+    {
+        .name = TYPE_RISCV_DYNAMIC_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+    },
+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
 #if defined(CONFIG_KVM)
     DEFINE_CPU(TYPE_RISCV_CPU_HOST,             riscv_host_cpu_init),
 #endif
 #if defined(TARGET_RISCV32)
-    DEFINE_CPU(TYPE_RISCV_CPU_BASE32,           rv32_base_cpu_init),
+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,   rv32_base_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,       rv32_sifive_e_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,       rv32_imafcu_nommu_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,       rv32_sifive_u_cpu_init),
 #elif defined(TARGET_RISCV64)
-    DEFINE_CPU(TYPE_RISCV_CPU_BASE64,           rv64_base_cpu_init),
+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,       rv64_sifive_e_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_BASE128,          rv128_base_cpu_init),
+    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
 #endif
 };
 
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_definition(gpointer data, gpointer user_data)
     CpuDefinitionInfoList **cpu_list = user_data;
     CpuDefinitionInfo *info = g_malloc0(sizeof(*info));
     const char *typename = object_class_get_name(oc);
+    ObjectClass *dyn_class;
 
     info->name = g_strndup(typename,
                            strlen(typename) - strlen("-" TYPE_RISCV_CPU));
     info->q_typename = g_strdup(typename);
 
+    dyn_class = object_class_dynamic_cast(oc, TYPE_RISCV_DYNAMIC_CPU);
+    info->q_static = dyn_class == NULL;
+
     QAPI_LIST_PREPEND(*cpu_list, info);
 }
 
-- 
2.40.0

From: Bin Meng <bmeng@tinylab.org>

When reading a non-existent CSR QEMU should raise illegal instruction
exception, but currently it just exits due to the g_assert() check.

This actually reverts commit 0ee342256af9205e7388efdf193a6d8f1ba1a617.
Some comments are also added to indicate that predicate() must be
provided for an implemented CSR.

Reported-by: Fei Wu <fei2.wu@intel.com>
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230417043054.3125614-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
+    /* ensure CSR is implemented by checking predicate */
+    if (!csr_ops[csrno].predicate) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
     /* privileged spec version check */
     if (env->priv_ver < csr_min_priv) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
      * illegal instruction exception should be triggered instead of virtual
      * instruction exception. Hence this comes after the read / write check.
      */
-    g_assert(csr_ops[csrno].predicate != NULL);
     RISCVException ret = csr_ops[csrno].predicate(env, csrno);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_jvt(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-/* Control and Status Register function table */
+/*
+ * Control and Status Register function table
+ * riscv_csr_operations::predicate() must be provided for an implemented CSR
+ */
 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     /* User Floating-Point CSRs */
     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
-- 
2.40.0

From: Irina Ryapolova <irina.ryapolova@syntacore.com>

Before changing the flow check for sv39/48/57.

According to specification (for Supervisor mode):
Sv39 implementations support a 39-bit virtual address space, divided into 4 KiB
pages.
Instruction fetch addresses and load and store effective addresses, which are
64 bits,
must have bits 63–39 all equal to bit 38, or else a page-fault exception will
occur.
Likewise for Sv48 and Sv57.

So the high bits are equal to bit 38 for sv39.

According to specification (for Hypervisor mode):
For Sv39x4, address bits of the guest physical address 63:41 must all be zeros,
or else a
guest-page-fault exception occurs.

Likewise for Sv48x4 and Sv57x4.
For Sv48x4 address bits 63:50 must all be zeros, or else a guest-page-fault
exception occurs.
For Sv57x4 address bits 63:59 must all be zeros, or else a guest-page-fault
exception occurs.

For example we are trying to access address 0xffff_ffff_ff01_0000 with only
G-translation enabled.
So expected behavior is to generate exception. But qemu doesn't generate such
exception.

For the old check, we get
va_bits == 41, mask == (1 << 24) - 1, masked_msbs == (0xffff_ffff_ff01_0000 >>
40) & mask == mask.
Accordingly, the condition masked_msbs != 0 && masked_msbs != mask is not
fulfilled
and the check passes.

Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230418075423.26217-1-irina.ryapolova@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

From: Alexandre Ghiti <alexghiti@rivosinc.com>

As per the specification, in 64-bit, if any of the pte reserved bits
60-54 is set an exception should be triggered (see 4.4.1, "Addressing and
Memory Protection"). In addition, we must check the napot/pbmt bits are
not set if those extensions are not active.

Reported-by: Andrea Parri <andrea@rivosinc.com>
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230420150220.60919-1-alexghiti@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  1 +
 target/riscv/cpu_helper.c | 15 +++++++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define PTE_SOFT            0x300 /* Reserved for Software */
 #define PTE_PBMT            0x6000000000000000ULL /* Page-based memory types */
 #define PTE_N               0x8000000000000000ULL /* NAPOT translation */
+#define PTE_RESERVED        0x1FC0000000000000ULL /* Reserved bits */
 #define PTE_ATTR            (PTE_N | PTE_PBMT) /* All attributes bits */
 
 /* Page table PPN shift amount */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ restart:
 
         if (riscv_cpu_sxl(env) == MXL_RV32) {
             ppn = pte >> PTE_PPN_SHIFT;
-        } else if (pbmte || riscv_cpu_cfg(env)->ext_svnapot) {
-            ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
         } else {
-            ppn = pte >> PTE_PPN_SHIFT;
-            if ((pte & ~(target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT) {
+            if (pte & PTE_RESERVED) {
+                return TRANSLATE_FAIL;
+            }
+
+            if (!pbmte && (pte & PTE_PBMT)) {
                 return TRANSLATE_FAIL;
             }
+
+            if (!riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
+                return TRANSLATE_FAIL;
+            }
+
+            ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
         }
 
         if (!(pte & PTE_V)) {
-- 
2.40.0

From: Rahul Pathak <rpathak@ventanamicro.com>

Add a virtual CPU for Ventana's first CPU named veyron-v1. It runs
exclusively for the rv64 target. It's tested with the 'virt' board.

CPU specs and general information can be found here:

https://www.nextplatform.com/2023/02/02/the-first-risc-v-shot-across-the-datacenter-bow/

Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230418123624.16414-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h      |  1 +
 target/riscv/cpu_vendorid.h |  4 ++++
 target/riscv/cpu.c          | 38 +++++++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
 #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
 #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
+#define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
 #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
 
 #if defined(TARGET_RISCV32)
diff --git a/target/riscv/cpu_vendorid.h b/target/riscv/cpu_vendorid.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_vendorid.h
+++ b/target/riscv/cpu_vendorid.h
@@ -XXX,XX +XXX,XX @@
 
 #define THEAD_VENDOR_ID         0x5b7
 
+#define VEYRON_V1_MARCHID       0x8000000000010000
+#define VEYRON_V1_MIMPID        0x111
+#define VEYRON_V1_MVENDORID     0x61f
+
 #endif /*  TARGET_RISCV_CPU_VENDORID_H */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
 #endif
 }
 
+static void rv64_veyron_v1_cpu_init(Object *obj)
+{
+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+
+    set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU | RVH);
+    env->priv_ver = PRIV_VERSION_1_12_0;
+
+    /* Enable ISA extensions */
+    cpu->cfg.mmu = true;
+    cpu->cfg.ext_icbom = true;
+    cpu->cfg.cbom_blocksize = 64;
+    cpu->cfg.cboz_blocksize = 64;
+    cpu->cfg.ext_icboz = true;
+    cpu->cfg.ext_smaia = true;
+    cpu->cfg.ext_ssaia = true;
+    cpu->cfg.ext_sscofpmf = true;
+    cpu->cfg.ext_sstc = true;
+    cpu->cfg.ext_svinval = true;
+    cpu->cfg.ext_svnapot = true;
+    cpu->cfg.ext_svpbmt = true;
+    cpu->cfg.ext_smstateen = true;
+    cpu->cfg.ext_zba = true;
+    cpu->cfg.ext_zbb = true;
+    cpu->cfg.ext_zbc = true;
+    cpu->cfg.ext_zbs = true;
+    cpu->cfg.ext_XVentanaCondOps = true;
+
+    cpu->cfg.mvendorid = VEYRON_V1_MVENDORID;
+    cpu->cfg.marchid = VEYRON_V1_MARCHID;
+    cpu->cfg.mimpid = VEYRON_V1_MIMPID;
+
+#ifndef CONFIG_USER_ONLY
+    set_satp_mode_max_supported(cpu, VM_1_10_SV48);
+#endif
+}
+
 static void rv128_base_cpu_init(Object *obj)
 {
     if (qemu_tcg_mttcg_enabled()) {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
+    DEFINE_CPU(TYPE_RISCV_CPU_VEYRON_V1,        rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
 #endif
 };
-- 
2.40.0

The following changes since commit ad10b4badc1dd5b28305f9b9f1168cf0aa3ae946:

Merge tag 'pull-error-2024-05-27' of https://repo.or.cz/qemu/armbru into staging (2024-05-27 06:40:42 -0700)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240528

for you to fetch changes up to 1806da76cb81088ea026ca3441551782b850e393:

target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR (2024-05-28 12:20:27 +1000)

----------------------------------------------------------------
RISC-V PR for 9.1

* APLICs add child earlier than realize
* Fix exposure of Zkr
* Raise exceptions on wrs.nto
* Implement SBI debug console (DBCN) calls for KVM
* Support 64-bit addresses for initrd
* Change RISCV_EXCP_SEMIHOST exception number to 63
* Tolerate KVM disable ext errors
* Set tval in breakpoints
* Add support for Zve32x extension
* Add support for Zve64x extension
* Relax vector register check in RISCV gdbstub
* Fix the element agnostic Vector function problem
* Fix Zvkb extension config
* Implement dynamic establishment of custom decoder
* Add th.sxstatus CSR emulation
* Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
* Check single width operator for vector fp widen instructions
* Check single width operator for vfncvt.rod.f.f.w
* Remove redudant SEW checking for vector fp narrow/widen instructions
* Prioritize pmp errors in raise_mmu_exception()
* Do not set mtval2 for non guest-page faults
* Remove experimental prefix from "B" extension
* Fixup CBO extension register calculation
* Fix the hart bit setting of AIA
* Fix reg_width in ricsv_gen_dynamic_vector_feature()
* Decode all of the pmpcfg and pmpaddr CSRs
* Raise an exception when CSRRS/CSRRC writes a read-only CSR

----------------------------------------------------------------
Alexei Filippov (1):
      target/riscv: do not set mtval2 for non guest-page faults

Alistair Francis (2):
      target/riscv: rvzicbo: Fixup CBO extension register calculation
      disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs

Andrew Jones (2):
      target/riscv/kvm: Fix exposure of Zkr
      target/riscv: Raise exceptions on wrs.nto

Cheng Yang (1):
      hw/riscv/boot.c: Support 64-bit address for initrd

Christoph Müllner (1):
      riscv: thead: Add th.sxstatus CSR emulation

Clément Léger (1):
      target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63

Daniel Henrique Barboza (6):
      target/riscv/kvm: implement SBI debug console (DBCN) calls
      target/riscv/kvm: tolerate KVM disable ext errors
      target/riscv/debug: set tval=pc in breakpoint exceptions
      trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
      target/riscv: prioritize pmp errors in raise_mmu_exception()
      riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()

Huang Tao (2):
      target/riscv: Fix the element agnostic function problem
      target/riscv: Implement dynamic establishment of custom decoder

Jason Chien (3):
      target/riscv: Add support for Zve32x extension
      target/riscv: Add support for Zve64x extension
      target/riscv: Relax vector register check in RISCV gdbstub

Max Chou (4):
      target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
      target/riscv: rvv: Check single width operator for vector fp widen instructions
      target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
      target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions

Rob Bradford (1):
      target/riscv: Remove experimental prefix from "B" extension

Yangyu Chen (1):
      target/riscv/cpu.c: fix Zvkb extension config

Yong-Xuan Wang (1):
      target/riscv/kvm.c: Fix the hart bit setting of AIA

Yu-Ming Chang (1):
      target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR

yang.zhang (1):
      hw/intc/riscv_aplic: APLICs should add child earlier than realize

From: "yang.zhang" <yang.zhang@hexintek.com>

Since only root APLICs can have hw IRQ lines, aplic->parent should
be initialized first.

Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: yang.zhang <yang.zhang@hexintek.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240409014445.278-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "msimode", msimode);
     qdev_prop_set_bit(dev, "mmode", mmode);
 
+    if (parent) {
+        riscv_aplic_add_child(parent, dev);
+    }
+
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     if (!is_kvm_aia(msimode)) {
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     }
 
-    if (parent) {
-        riscv_aplic_add_child(parent, dev);
-    }
-
     if (!msimode) {
         for (i = 0; i < num_harts; i++) {
             CPUState *cpu = cpu_by_arch_id(hartid_base + i);
-- 
2.45.1

From: Andrew Jones <ajones@ventanamicro.com>

The Zkr extension may only be exposed to KVM guests if the VMM
implements the SEED CSR. Use the same implementation as TCG.

Without this patch, running with a KVM which does not forward the
SEED CSR access to QEMU will result in an ILL exception being
injected into the guest (this results in Linux guests crashing on
boot). And, when running with a KVM which does forward the access,
QEMU will crash, since QEMU doesn't know what to do with the exit.

Fixes: 3108e2f1c69d ("target/riscv/kvm: update KVM exts to Linux 6.8")
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240422134605.534207-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  3 +++
 target/riscv/csr.c         | 18 ++++++++++++++----
 target/riscv/kvm/kvm-cpu.c | 25 +++++++++++++++++++++++++
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
 
 void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
 
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+                                target_ulong write_mask);
+
 uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
 #endif
 
 /* Crypto Extension */
-static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-                               target_ulong *ret_value,
-                               target_ulong new_value,
-                               target_ulong write_mask)
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+                                target_ulong write_mask)
 {
     uint16_t random_v;
     Error *random_e = NULL;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
         rval = random_v | SEED_OPST_ES16;
     }
 
+    return rval;
+}
+
+static RISCVException rmw_seed(CPURISCVState *env, int csrno,
+                               target_ulong *ret_value,
+                               target_ulong new_value,
+                               target_ulong write_mask)
+{
+    target_ulong rval;
+
+    rval = riscv_new_csr_seed(new_value, write_mask);
+
     if (ret_value) {
         *ret_value = rval;
     }
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
     return ret;
 }
 
+static int kvm_riscv_handle_csr(CPUState *cs, struct kvm_run *run)
+{
+    target_ulong csr_num = run->riscv_csr.csr_num;
+    target_ulong new_value = run->riscv_csr.new_value;
+    target_ulong write_mask = run->riscv_csr.write_mask;
+    int ret = 0;
+
+    switch (csr_num) {
+    case CSR_SEED:
+        run->riscv_csr.ret_value = riscv_new_csr_seed(new_value, write_mask);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: un-handled CSR EXIT for CSR %lx\n",
+                      __func__, csr_num);
+        ret = -1;
+        break;
+    }
+
+    return ret;
+}
+
 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     case KVM_EXIT_RISCV_SBI:
         ret = kvm_riscv_handle_sbi(cs, run);
         break;
+    case KVM_EXIT_RISCV_CSR:
+        ret = kvm_riscv_handle_csr(cs, run);
+        break;
     default:
         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
                       __func__, run->exit_reason);
-- 
2.45.1

From: Andrew Jones <ajones@ventanamicro.com>

Implementing wrs.nto to always just return is consistent with the
specification, as the instruction is permitted to terminate the
stall for any reason, but it's not useful for virtualization, where
we'd like the guest to trap to the hypervisor in order to allow
scheduling of the lock holding VCPU. Change to always immediately
raise exceptions when the appropriate conditions are present,
otherwise continue to just return. Note, immediately raising
exceptions is also consistent with the specification since the
time limit that should expire prior to the exception is
implementation-specific.

Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240424142808.62936-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                       |  1 +
 target/riscv/op_helper.c                    | 11 ++++++++
 target/riscv/insn_trans/trans_rvzawrs.c.inc | 29 ++++++++++++++-------
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
 DEF_HELPER_1(sret, tl, env)
 DEF_HELPER_1(mret, tl, env)
 DEF_HELPER_1(wfi, void, env)
+DEF_HELPER_1(wrs_nto, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
 DEF_HELPER_1(tlb_flush_all, void, env)
 /* Native Debug */
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
     }
 }
 
+void helper_wrs_nto(CPURISCVState *env)
+{
+    if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) &&
+        get_field(env->hstatus, HSTATUS_VTW) &&
+        !get_field(env->mstatus, MSTATUS_TW)) {
+        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
+    } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
 void helper_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzawrs.c.inc
+++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-static bool trans_wrs(DisasContext *ctx)
+static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
 {
     if (!ctx->cfg_ptr->ext_zawrs) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_wrs(DisasContext *ctx)
     return true;
 }
 
-#define GEN_TRANS_WRS(insn)                                     \
-static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
-{                                                               \
-    (void)a;                                                    \
-    return trans_wrs(ctx);                                      \
-}
+static bool trans_wrs_nto(DisasContext *ctx, arg_wrs_nto *a)
+{
+    if (!ctx->cfg_ptr->ext_zawrs) {
+        return false;
+    }
 
-GEN_TRANS_WRS(wrs_nto)
-GEN_TRANS_WRS(wrs_sto)
+    /*
+     * Depending on the mode of execution, mstatus.TW and hstatus.VTW, wrs.nto
+     * should raise an exception when the implementation-specific bounded time
+     * limit has expired. Our time limit is zero, so we either return
+     * immediately, as does our implementation of wrs.sto, or raise an
+     * exception, as handled by the wrs.nto helper.
+     */
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wrs_nto(tcg_env);
+#endif
+
+    /* We only get here when helper_wrs_nto() doesn't raise an exception. */
+    return trans_wrs_sto(ctx, NULL);
+}
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

SBI defines a Debug Console extension "DBCN" that will, in time, replace
the legacy console putchar and getchar SBI extensions.

The appeal of the DBCN extension is that it allows multiple bytes to be
read/written in the SBI console in a single SBI call.

As far as KVM goes, the DBCN calls are forwarded by an in-kernel KVM
module to userspace. But this will only happens if the KVM module
actually supports this SBI extension and we activate it.

We'll check for DBCN support during init time, checking if get-reg-list
is advertising KVM_RISCV_SBI_EXT_DBCN. In that case, we'll enable it via
kvm_set_one_reg() during kvm_arch_init_vcpu().

Finally, change kvm_riscv_handle_sbi() to handle the incoming calls for
SBI_EXT_DBCN, reading and writing as required.

A simple KVM guest with 'earlycon=sbi', running in an emulated RISC-V
host, takes around 20 seconds to boot without using DBCN. With this
patch we're taking around 14 seconds to boot due to the speed-up in the
terminal output.  There's no change in boot time if the guest isn't
using earlycon.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20240425155012.581366-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/sbi_ecall_interface.h |  17 +++++
 target/riscv/kvm/kvm-cpu.c         | 111 +++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+)

diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/sbi_ecall_interface.h
+++ b/target/riscv/sbi_ecall_interface.h
@@ -XXX,XX +XXX,XX @@
 
 /* clang-format off */
 
+#define SBI_SUCCESS                      0
+#define SBI_ERR_FAILED                  -1
+#define SBI_ERR_NOT_SUPPORTED           -2
+#define SBI_ERR_INVALID_PARAM           -3
+#define SBI_ERR_DENIED                  -4
+#define SBI_ERR_INVALID_ADDRESS         -5
+#define SBI_ERR_ALREADY_AVAILABLE       -6
+#define SBI_ERR_ALREADY_STARTED         -7
+#define SBI_ERR_ALREADY_STOPPED         -8
+#define SBI_ERR_NO_SHMEM                -9
+
 /* SBI Extension IDs */
 #define SBI_EXT_0_1_SET_TIMER           0x0
 #define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_IPI                     0x735049
 #define SBI_EXT_RFENCE                  0x52464E43
 #define SBI_EXT_HSM                     0x48534D
+#define SBI_EXT_DBCN                    0x4442434E
 
 /* SBI function IDs for BASE extension */
 #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_HSM_HART_STOP           0x1
 #define SBI_EXT_HSM_HART_GET_STATUS     0x2
 
+/* SBI function IDs for DBCN extension */
+#define SBI_EXT_DBCN_CONSOLE_WRITE      0x0
+#define SBI_EXT_DBCN_CONSOLE_READ       0x1
+#define SBI_EXT_DBCN_CONSOLE_WRITE_BYTE 0x2
+
 #define SBI_HSM_HART_STATUS_STARTED     0x0
 #define SBI_HSM_HART_STATUS_STOPPED     0x1
 #define SBI_HSM_HART_STATUS_START_PENDING   0x2
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_v_vlenb = {
                    KVM_REG_RISCV_VECTOR_CSR_REG(vlenb)
 };
 
+static KVMCPUConfig kvm_sbi_dbcn = {
+    .name = "sbi_dbcn",
+    .kvm_reg_id = KVM_REG_RISCV | KVM_REG_SIZE_U64 |
+                  KVM_REG_RISCV_SBI_EXT | KVM_RISCV_SBI_EXT_DBCN
+};
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int uint64_cmp(const void *a, const void *b)
     return 0;
 }
 
+static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
+                                             KVMScratchCPU *kvmcpu,
+                                             struct kvm_reg_list *reglist)
+{
+    struct kvm_reg_list *reg_search;
+
+    reg_search = bsearch(&kvm_sbi_dbcn.kvm_reg_id, reglist->reg, reglist->n,
+                         sizeof(uint64_t), uint64_cmp);
+
+    if (reg_search) {
+        kvm_sbi_dbcn.supported = true;
+    }
+}
+
 static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
                                  struct kvm_reg_list *reglist)
 {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (riscv_has_ext(&cpu->env, RVV)) {
         kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
     }
+
+    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
 }
 
 static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
     return ret;
 }
 
+static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
+{
+    target_ulong reg = 1;
+
+    if (!kvm_sbi_dbcn.supported) {
+        return 0;
+    }
+
+    return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     kvm_riscv_update_cpu_misa_ext(cpu, cs);
     kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
 
+    ret = kvm_vcpu_enable_sbi_dbcn(cpu, cs);
+
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
     return true;
 }
 
+static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
+{
+    g_autofree uint8_t *buf = NULL;
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    target_ulong num_bytes;
+    uint64_t addr;
+    unsigned char ch;
+    int ret;
+
+    switch (run->riscv_sbi.function_id) {
+    case SBI_EXT_DBCN_CONSOLE_READ:
+    case SBI_EXT_DBCN_CONSOLE_WRITE:
+        num_bytes = run->riscv_sbi.args[0];
+
+        if (num_bytes == 0) {
+            run->riscv_sbi.ret[0] = SBI_SUCCESS;
+            run->riscv_sbi.ret[1] = 0;
+            break;
+        }
+
+        addr = run->riscv_sbi.args[1];
+
+        /*
+         * Handle the case where a 32 bit CPU is running in a
+         * 64 bit addressing env.
+         */
+        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
+            addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
+        }
+
+        buf = g_malloc0(num_bytes);
+
+        if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
+            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
+            if (ret < 0) {
+                error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
+                             "reading chardev");
+                exit(1);
+            }
+
+            cpu_physical_memory_write(addr, buf, ret);
+        } else {
+            cpu_physical_memory_read(addr, buf, num_bytes);
+
+            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
+            if (ret < 0) {
+                error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
+                             "writing chardev");
+                exit(1);
+            }
+        }
+
+        run->riscv_sbi.ret[0] = SBI_SUCCESS;
+        run->riscv_sbi.ret[1] = ret;
+        break;
+    case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
+        ch = run->riscv_sbi.args[0];
+        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
+
+        if (ret < 0) {
+            error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
+                         "writing chardev");
+            exit(1);
+        }
+
+        run->riscv_sbi.ret[0] = SBI_SUCCESS;
+        run->riscv_sbi.ret[1] = 0;
+        break;
+    default:
+        run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
+    }
+}
+
 static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
         }
         ret = 0;
         break;
+    case SBI_EXT_DBCN:
+        kvm_riscv_handle_sbi_dbcn(cs, run);
+        break;
     default:
         qemu_log_mask(LOG_UNIMP,
                       "%s: un-handled SBI EXIT, specific reasons is %lu\n",
-- 
2.45.1

From: Cheng Yang <yangcheng.work@foxmail.com>

Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell()
to set the address of initrd in FDT to support 64-bit address.

Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/boot.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
     /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
     if (fdt) {
         end = start + size;
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", start);
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", end);
+        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-start", start);
+        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-end", end);
     }
 }
 
-- 
2.45.1

From: Clément Léger <cleger@rivosinc.com>

The current semihost exception number (16) is a reserved number (range
[16-17]). The upcoming double trap specification uses that number for
the double trap exception. Since the privileged spec (Table 22) defines
ranges for custom uses change the semihosting exception number to 63
which belongs to the range [48-63] in order to avoid any future
collisions with reserved exception.

Signed-off-by: Clément Léger <cleger@rivosinc.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240422135840.1959967-1-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
-    RISCV_EXCP_SEMIHOST = 0x10,
     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
     RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
     RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
     RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
+    RISCV_EXCP_SEMIHOST = 0x3f,
 } RISCVException;
 
 #define RISCV_EXCP_INT_FLAG                0x80000000
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Running a KVM guest using a 6.9-rc3 kernel, in a 6.8 host that has zkr
enabled, will fail with a kernel oops SIGILL right at the start. The
reason is that we can't expose zkr without implementing the SEED CSR.
Disabling zkr in the guest would be a workaround, but if the KVM doesn't
allow it we'll error out and never boot.

In hindsight this is too strict. If we keep proceeding, despite not
disabling the extension in the KVM vcpu, we'll not add the extension in
the riscv,isa. The guest kernel will be unaware of the extension, i.e.
it doesn't matter if the KVM vcpu has it enabled underneath or not. So
it's ok to keep booting in this case.

Change our current logic to not error out if we fail to disable an
extension in kvm_set_one_reg(), but show a warning and keep booting. It
is important to throw a warning because we must make the user aware that
the extension is still available in the vcpu, meaning that an
ill-behaved guest can ignore the riscv,isa settings and  use the
extension.

The case we're handling happens with an EINVAL error code. If we fail to
disable the extension in KVM for any other reason, error out.

We'll also keep erroring out when we fail to enable an extension in KVM,
since adding the extension in riscv,isa at this point will cause a guest
malfunction because the extension isn't enabled in the vcpu.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240422171425.333037-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
-            error_report("Unable to %s extension %s in KVM, error %d",
-                         reg ? "enable" : "disable",
-                         multi_ext_cfg->name, ret);
-            exit(EXIT_FAILURE);
+            if (!reg && ret == -EINVAL) {
+                warn_report("KVM cannot disable extension %s",
+                            multi_ext_cfg->name);
+            } else {
+                error_report("Unable to enable extension %s in KVM, error %d",
+                             multi_ext_cfg->name, ret);
+                exit(EXIT_FAILURE);
+            }
         }
     }
 }
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're not setting (s/m)tval when triggering breakpoints of type 2
(mcontrol) and 6 (mcontrol6). According to the debug spec section
5.7.12, "Match Control Type 6":

"The Privileged Spec says that breakpoint exceptions that occur on
instruction fetches, loads, or stores update the tval CSR with either
zero or the faulting virtual address. The faulting virtual address for
an mcontrol6 trigger with action = 0 is the address being accessed and
which caused that trigger to fire."

A similar text is also found in the Debug spec section 5.7.11 w.r.t.
mcontrol.

Note that what we're doing ATM is not violating the spec, but it's
simple enough to set mtval/stval and it makes life easier for any
software that relies on this info.

Given that we always use action = 0, save the faulting address for the
mcontrol and mcontrol6 trigger breakpoints into env->badaddr, which is
used as as scratch area for traps with address information. 'tval' is
then set during riscv_cpu_do_interrupt().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20240416230437.1869024-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 +
 target/riscv/debug.c      | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
             tval = env->bins;
             break;
         case RISCV_EXCP_BREAKPOINT:
+            tval = env->badaddr;
             if (cs->watchpoint_hit) {
                 tval = cs->watchpoint_hit->hitaddr;
                 cs->watchpoint_hit = NULL;
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
                     /* check U/S/M bit against current privilege level */
                     if ((ctrl >> 3) & BIT(env->priv)) {
+                        env->badaddr = pc;
                         return true;
                     }
                 }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                     if (env->virt_enabled) {
                         /* check VU/VS bit against current privilege level */
                         if ((ctrl >> 23) & BIT(env->priv)) {
+                            env->badaddr = pc;
                             return true;
                         }
                     } else {
                         /* check U/S/M bit against current privilege level */
                         if ((ctrl >> 3) & BIT(env->priv)) {
+                            env->badaddr = pc;
                             return true;
                         }
                     }
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Privileged spec section 4.1.9 mentions:

"When a trap is taken into S-mode, stval is written with
exception-specific information to assist software in handling the trap.
(...)

If stval is written with a nonzero value when a breakpoint,
address-misaligned, access-fault, or page-fault exception occurs on an
instruction fetch, load, or store, then stval will contain the faulting
virtual address."

A similar text is found for mtval in section 3.1.16.

Setting mtval/stval in this scenario is optional, but some softwares read
these regs when handling ebreaks.

Write 'badaddr' in all ebreak breakpoints to write the appropriate
'tval' during riscv_do_cpu_interrrupt().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240416230437.1869024-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_privileged.c.inc | 2 ++
 1 file changed, 2 insertions(+)

From: Jason Chien <jason.chien@sifive.com>

Add support for Zve32x extension and replace some checks for Zve32f with
Zve32x, since Zve32f depends on Zve32x.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240328022343.6871-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                  |  1 +
 target/riscv/cpu.c                      |  2 ++
 target/riscv/cpu_helper.c               |  2 +-
 target/riscv/csr.c                      |  2 +-
 target/riscv/tcg/tcg-cpu.c              | 16 ++++++++--------
 target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zhinx;
     bool ext_zhinxmin;
     bool ext_zve32f;
+    bool ext_zve32x;
     bool ext_zve64f;
     bool ext_zve64d;
     bool ext_zvbb;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
+    ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
+    MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
     *cs_base = 0;
 
-    if (cpu->cfg.ext_zve32f) {
+    if (cpu->cfg.ext_zve32x) {
         /*
          * If env->vl equals to VLMAX, we can use generic vector operation
          * expanders (GVEC) to accerlate the vector operations.
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
 
 static RISCVException vs(CPURISCVState *env, int csrno)
 {
-    if (riscv_cpu_cfg(env)->ext_zve32f) {
+    if (riscv_cpu_cfg(env)->ext_zve32x) {
 #if !defined(CONFIG_USER_ONLY)
         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
             return RISCV_EXCP_ILLEGAL_INST;
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
-        error_setg(errp, "Zve32f/Zve64f extensions require F extension");
-        return;
+    /* The Zve32f extension depends on the Zve32x extension */
+    if (cpu->cfg.ext_zve32f) {
+        if (!riscv_has_ext(env, RVF)) {
+            error_setg(errp, "Zve32f/Zve64f extensions require F extension");
+            return;
+        }
+        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
     }
 
     if (cpu->cfg.ext_zvfh) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zvbc), true);
     }
 
-    /*
-     * In principle Zve*x would also suffice here, were they supported
-     * in qemu
-     */
     if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkb || cpu->cfg.ext_zvkg ||
          cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed ||
-         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
+         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32x) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
 {
     TCGv s1, dst;
 
-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
+    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
 {
     TCGv dst;
 
-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
+    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
         return false;
     }
 
-- 
2.45.1

From: Jason Chien <jason.chien@sifive.com>

Add support for Zve64x extension. Enabling Zve64f enables Zve64x and
enabling Zve64x enables Zve32x according to their dependency.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2107
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240328022343.6871-3-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     |  1 +
 target/riscv/cpu.c         |  2 ++
 target/riscv/tcg/tcg-cpu.c | 17 +++++++++++------
 3 files changed, 14 insertions(+), 6 deletions(-)

From: Jason Chien <jason.chien@sifive.com>

In current implementation, the gdbstub allows reading vector registers
only if V extension is supported. However, all vector extensions and
vector crypto extensions have the vector registers and they all depend
on Zve32x. The gdbstub should check for Zve32x instead.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Message-ID: <20240328022343.6871-4-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
                                  gdb_find_static_feature("riscv-32bit-fpu.xml"),
                                  0);
     }
-    if (env->misa_ext & RVV) {
+    if (cpu->cfg.ext_zve32x) {
         gdb_register_coprocessor(cs, riscv_gdb_get_vector,
                                  riscv_gdb_set_vector,
                                  ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
-- 
2.45.1

From: Huang Tao <eric.huang@linux.alibaba.com>

In RVV and vcrypto instructions, the masked and tail elements are set to 1s
using vext_set_elems_1s function if the vma/vta bit is set. It is the element
agnostic policy.

However, this function can't deal the big endian situation. This patch fixes
the problem by adding handling of such case.

Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240325021654.6594-1-eric.huang@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.c
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
     if (tot - cnt == 0) {
         return ;
     }
+
+    if (HOST_BIG_ENDIAN) {
+        /*
+         * Deal the situation when the elements are insdie
+         * only one uint64 block including setting the
+         * masked-off element.
+         */
+        if (((tot - 1) ^ cnt) < 8) {
+            memset(base + H1(tot - 1), -1, tot - cnt);
+            return;
+        }
+        /*
+         * Otherwise, at least cross two uint64_t blocks.
+         * Set first unaligned block.
+         */
+        if (cnt % 8 != 0) {
+            uint32_t j = ROUND_UP(cnt, 8);
+            memset(base + H1(j - 1), -1, j - cnt);
+            cnt = j;
+        }
+        /* Set other 64bit aligend blocks */
+    }
     memset(base + cnt, -1, tot - cnt);
 }
 
-- 
2.45.1

From: Yangyu Chen <cyy@cyyself.name>

This code has a typo that writes zvkb to zvkg, causing users can't
enable zvkb through the config. This patch gets this fixed.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Fixes: ea61ef7097d0 ("target/riscv: Move vector crypto extensions to riscv_cpu_extensions")
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by:  Weiwei Li <liwei1518@gmail.com>
Message-ID: <tencent_7E34EEF0F90B9A68BF38BEE09EC6D4877C0A@qq.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
-    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
+    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkb, false),
     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
     MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
-- 
2.45.1

From: Huang Tao <eric.huang@linux.alibaba.com>

In this patch, we modify the decoder to be a freely composable data
structure instead of a hardcoded one. It can be dynamically builded up
according to the extensions.
This approach has several benefits:
1. Provides support for heterogeneous cpu architectures. As we add decoder in
   RISCVCPU, each cpu can have their own decoder, and the decoders can be
   different due to cpu's features.
2. Improve the decoding efficiency. We run the guard_func to see if the decoder
   can be added to the dynamic_decoder when building up the decoder. Therefore,
   there is no need to run the guard_func when decoding each instruction. It can
   improve the decoding efficiency
3. For vendor or dynamic cpus, it allows them to customize their own decoder
   functions to improve decoding efficiency, especially when vendor-defined
   instruction sets increase. Because of dynamic building up, it can skip the other
   decoder guard functions when decoding.
4. Pre patch for allowing adding a vendor decoder before decode_insn32() with minimal
   overhead for users that don't need this particular vendor decoder.

Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
Suggested-by: Christoph Muellner <christoph.muellner@vrull.eu>
Co-authored-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240506023607.29544-1-eric.huang@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/tcg/tcg-cpu.h | 15 +++++++++++++++
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++
 target/riscv/translate.c   | 31 +++++++++++++++----------------
 5 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint32_t pmu_avail_ctrs;
     /* Mapping of events to counters */
     GHashTable *pmu_event_ctr_map;
+    const GPtrArray *decoders;
 };
 
 /**
diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.h
+++ b/target/riscv/tcg/tcg-cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
 void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
 
+struct DisasContext;
+struct RISCVCPUConfig;
+typedef struct RISCVDecoder {
+    bool (*guard_func)(const struct RISCVCPUConfig *);
+    bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
+} RISCVDecoder;
+
+typedef bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
+
+extern const size_t decoder_table_size;
+
+extern const RISCVDecoder decoder_table[];
+
+void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu);
+
 #endif
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
             error_propagate(errp, local_err);
             return;
         }
+        riscv_tcg_cpu_finalize_dynamic_decoder(cpu);
     } else if (kvm_enabled()) {
         riscv_kvm_cpu_finalize_features(cpu, &local_err);
         if (local_err != NULL) {
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     }
 }
 
+void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
+{
+    GPtrArray *dynamic_decoders;
+    dynamic_decoders = g_ptr_array_sized_new(decoder_table_size);
+    for (size_t i = 0; i < decoder_table_size; ++i) {
+        if (decoder_table[i].guard_func &&
+            decoder_table[i].guard_func(&cpu->cfg)) {
+            g_ptr_array_add(dynamic_decoders,
+                            (gpointer)decoder_table[i].riscv_cpu_decode_fn);
+        }
+    }
+
+    cpu->decoders = dynamic_decoders;
+}
+
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu)
 {
     return object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST) == NULL;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-info.c.inc"
 #undef  HELPER_H
 
+#include "tcg/tcg-cpu.h"
+
 /* global register indices */
 static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
 static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     /* FRM is known to contain a valid value. */
     bool frm_valid;
     bool insn_start_updated;
+    const GPtrArray *decoders;
 } DisasContext;
 
 static inline bool has_ext(DisasContext *ctx, uint32_t ext)
@@ -XXX,XX +XXX,XX @@ static inline int insn_len(uint16_t first_word)
     return (first_word & 3) == 3 ? 4 : 2;
 }
 
+const RISCVDecoder decoder_table[] = {
+    { always_true_p, decode_insn32 },
+    { has_xthead_p, decode_xthead},
+    { has_XVentanaCondOps_p, decode_XVentanaCodeOps},
+};
+
+const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
-    /*
-     * A table with predicate (i.e., guard) functions and decoder functions
-     * that are tested in-order until a decoder matches onto the opcode.
-     */
-    static const struct {
-        bool (*guard_func)(const RISCVCPUConfig *);
-        bool (*decode_func)(DisasContext *, uint32_t);
-    } decoders[] = {
-        { always_true_p,  decode_insn32 },
-        { has_xthead_p, decode_xthead },
-        { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
-    };
-
     ctx->virt_inst_excp = false;
     ctx->cur_insn_len = insn_len(opcode);
     /* Check for compressed insn */
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
                                              ctx->base.pc_next + 2));
         ctx->opcode = opcode32;
 
-        for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx->cfg_ptr) &&
-                decoders[i].decode_func(ctx, opcode32)) {
+        for (guint i = 0; i < ctx->decoders->len; ++i) {
+            riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
+            if (func(ctx, opcode32)) {
                 return;
             }
         }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->zero = tcg_constant_tl(0);
     ctx->virt_inst_excp = false;
+    ctx->decoders = cpu->decoders;
 }
 
 static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu)
-- 
2.45.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

The th.sxstatus CSR can be used to identify available custom extension
on T-Head CPUs. The CSR is documented here:
  https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadsxstatus.adoc

An important property of this patch is, that the th.sxstatus MAEE field
is not set (indicating that XTheadMae is not available).
XTheadMae is a memory attribute extension (similar to Svpbmt) which is
implemented in many T-Head CPUs (C906, C910, etc.) and utilizes bits
in PTEs that are marked as reserved. QEMU maintainers prefer to not
implement XTheadMae, so we need give kernels a mechanism to identify
if XTheadMae is available in a system or not. And this patch introduces
this mechanism in QEMU in a way that's compatible with real HW
(i.e., probing the th.sxstatus.MAEE bit).

Further context can be found on the list:
https://lists.gnu.org/archive/html/qemu-devel/2024-02/msg00775.html

Reviewed-by: LIU Zhiwei <zhiwe_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-ID: <20240429073656.2486732-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS              |  1 +
 target/riscv/cpu.h       |  3 ++
 target/riscv/cpu.c       |  1 +
 target/riscv/th_csr.c    | 79 ++++++++++++++++++++++++++++++++++++++++
 target/riscv/meson.build |  1 +
 5 files changed, 85 insertions(+)
 create mode 100644 target/riscv/th_csr.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-riscv@nongnu.org
 S: Supported
 F: target/riscv/insn_trans/trans_xthead.c.inc
 F: target/riscv/xthead*.decode
+F: target/riscv/th_*
 F: disas/riscv-xthead*
 
 RISC-V XVentanaCondOps extension
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
 uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
+/* Implemented in th_csr.c */
+void th_register_custom_csrs(RISCVCPU *cpu);
+
 #endif /* RISCV_CPU_H */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     cpu->cfg.mvendorid = THEAD_VENDOR_ID;
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(cpu, VM_1_10_SV39);
+    th_register_custom_csrs(cpu);
 #endif
 
     /* inherited from parent obj via riscv_cpu_init() */
diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/th_csr.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * T-Head-specific CSRs.
+ *
+ * Copyright (c) 2024 VRULL GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "cpu_vendorid.h"
+
+#define CSR_TH_SXSTATUS 0x5c0
+
+/* TH_SXSTATUS bits */
+#define TH_SXSTATUS_UCME        BIT(16)
+#define TH_SXSTATUS_MAEE        BIT(21)
+#define TH_SXSTATUS_THEADISAEE  BIT(22)
+
+typedef struct {
+    int csrno;
+    int (*insertion_test)(RISCVCPU *cpu);
+    riscv_csr_operations csr_ops;
+} riscv_csr;
+
+static RISCVException smode(CPURISCVState *env, int csrno)
+{
+    if (riscv_has_ext(env, RVS)) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return RISCV_EXCP_ILLEGAL_INST;
+}
+
+static int test_thead_mvendorid(RISCVCPU *cpu)
+{
+    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
+                                       target_ulong *val)
+{
+    /* We don't set MAEE here, because QEMU does not implement MAEE. */
+    *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
+    return RISCV_EXCP_NONE;
+}
+
+static riscv_csr th_csr_list[] = {
+    {
+        .csrno = CSR_TH_SXSTATUS,
+        .insertion_test = test_thead_mvendorid,
+        .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
+    }
+};
+
+void th_register_custom_csrs(RISCVCPU *cpu)
+{
+    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
+        int csrno = th_csr_list[i].csrno;
+        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
+        if (!th_csr_list[i].insertion_test(cpu)) {
+            riscv_set_csr_ops(csrno, csr_ops);
+        }
+    }
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_system_ss.add(files(
   'monitor.c',
   'machine.c',
   'pmu.c',
+  'th_csr.c',
   'time_helper.c',
   'riscv-qmp-cmds.c',
 ))
-- 
2.45.1

From: Max Chou <max.chou@sifive.com>

According v spec 18.4, only the vfwcvt.f.f.v and vfncvt.f.f.w
instructions will be affected by Zvfhmin extension.
And the vfwcvt.f.f.v and vfncvt.f.f.w instructions only support the
conversions of

* From 1*SEW(16/32) to 2*SEW(32/64)
* From 2*SEW(32/64) to 1*SEW(16/32)

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

The require_scale_rvf function only checks the double width operator for
the vector floating point widen instructions, so most of the widen
checking functions need to add require_rvf for single width operator.

The vfwcvt.f.x.v and vfwcvt.f.xu.v instructions convert single width
integer to double width float, so the opfxv_widen_check function doesn’t
need require_rvf for the single width operator(integer).

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 5 +++++
 1 file changed, 5 insertions(+)

From: Max Chou <max.chou@sifive.com>

If the checking functions check both the single and double width
operators at the same time, then the single width operator checking
functions (require_rvf[min]) will check whether the SEW is 8.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_ds(s, a->rd, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dd(s, a->rd, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_widen_check(s, a) &&
            require_rvfmin(s) &&
-           require_scale_rvfmin(s) &&
-           (s->sew != MO_8);
+           require_scale_rvfmin(s);
 }
 
 #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_narrow_check(s, a) &&
            require_rvfmin(s) &&
-           require_scale_rvfmin(s) &&
-           (s->sew != MO_8);
+           require_scale_rvfmin(s);
 }
 
 static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_narrow_check(s, a) &&
            require_rvf(s) &&
-           require_scale_rvf(s) &&
-           (s->sew != MO_8);
+           require_scale_rvf(s);
 }
 
 #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
 {
     return reduction_widen_check(s, a) &&
            require_rvf(s) &&
-           require_scale_rvf(s) &&
-           (s->sew != MO_8);
+           require_scale_rvf(s);
 }
 
 GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

raise_mmu_exception(), as is today, is prioritizing guest page faults by
checking first if virt_enabled && !first_stage, and then considering the
regular inst/load/store faults.

There's no mention in the spec about guest page fault being a higher
priority that PMP faults. In fact, privileged spec section 3.7.1 says:

"Attempting to fetch an instruction from a PMP region that does not have
execute permissions raises an instruction access-fault exception.
Attempting to execute a load or load-reserved instruction which accesses
a physical address within a PMP region without read permissions raises a
load access-fault exception. Attempting to execute a store,
store-conditional, or AMO instruction which accesses a physical address
within a PMP region without write permissions raises a store
access-fault exception."

So, in fact, we're doing it wrong - PMP faults should always be thrown,
regardless of also being a first or second stage fault.

The way riscv_cpu_tlb_fill() and get_physical_address() work is
adequate: a TRANSLATE_PMP_FAIL error is immediately reported and
reflected in the 'pmp_violation' flag. What we need is to change
raise_mmu_exception() to prioritize it.

Reported-by: Joseph Chan <jchan@ventanamicro.com>
Fixes: 82d53adfbb ("target/riscv/cpu_helper.c: Invalid exception on MMU translation stage")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240413105929.7030-1-alexei.filippov@syntacore.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
 
     switch (access_type) {
     case MMU_INST_FETCH:
-        if (env->virt_enabled && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
+        } else if (env->virt_enabled && !first_stage) {
             cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_INST_ACCESS_FAULT : RISCV_EXCP_INST_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
         }
         break;
     case MMU_DATA_LOAD:
-        if (two_stage && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
+        } else if (two_stage && !first_stage) {
             cs->exception_index = RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_LOAD_ACCESS_FAULT : RISCV_EXCP_LOAD_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
         }
         break;
     case MMU_DATA_STORE:
-        if (two_stage && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
+        } else if (two_stage && !first_stage) {
             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_STORE_AMO_ACCESS_FAULT :
-                RISCV_EXCP_STORE_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
         }
         break;
     default:
-- 
2.45.1

From: Alexei Filippov <alexei.filippov@syntacore.com>

Previous patch fixed the PMP priority in raise_mmu_exception() but we're still
setting mtval2 incorrectly. In riscv_cpu_tlb_fill(), after pmp check in 2 stage
translation part, mtval2 will be set in case of successes 2 stage translation but
failed pmp check.

In this case we gonna set mtval2 via env->guest_phys_fault_addr in context of
riscv_cpu_tlb_fill(), as this was a guest-page-fault, but it didn't and mtval2
should be zero, according to RISCV privileged spec sect. 9.4.4: When a guest
page-fault is taken into M-mode, mtval2 is written with either zero or guest
physical address that faulted, shifted by 2 bits. *For other traps, mtval2
is set to zero...*

Signed-off-by: Alexei Filippov <alexei.filippov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240503103052.6819-1-alexei.filippov@syntacore.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                               __func__, pa, ret, prot_pmp, tlb_size);
 
                 prot &= prot_pmp;
-            }
-
-            if (ret != TRANSLATE_SUCCESS) {
+            } else {
                 /*
                  * Guest physical address translation failed, this is a HS
                  * level exception
                  */
                 first_stage_error = false;
-                env->guest_phys_fault_addr = (im_address |
-                                              (address &
-                                               (TARGET_PAGE_SIZE - 1))) >> 2;
+                if (ret != TRANSLATE_PMP_FAIL) {
+                    env->guest_phys_fault_addr = (im_address |
+                                                  (address &
+                                                   (TARGET_PAGE_SIZE - 1))) >> 2;
+                }
             }
         }
     } else {
-- 
2.45.1

From: Rob Bradford <rbradford@rivosinc.com>

This extension has now been ratified:
https://jira.riscv.org/browse/RVS-2006 so the "x-" prefix can be
removed.

Since this is now a ratified extension add it to the list of extensions
included in the "max" CPU variant.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20240514110217.22516-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         | 2 +-
 target/riscv/tcg/tcg-cpu.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
     MISA_EXT_INFO(RVV, "v", "Vector operations"),
     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
-    MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
+    MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
 };
 
 static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
     const RISCVCPUMultiExtConfig *prop;
 
     /* Enable RVG, RVJ and RVV that are disabled by default */
-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVG | RVJ | RVV);
+    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
         isa_ext_update_enabled(cpu, prop->offset, true);
-- 
2.45.1

From: Alistair Francis <alistair23@gmail.com>

When running the instruction

```
    cbo.flush 0(x0)
```

QEMU would segfault.

The issue was in cpu_gpr[a->rs1] as QEMU does not have cpu_gpr[0]
allocated.

In order to fix this let's use the existing get_address()
helper. This also has the benefit of performing pointer mask
calculations on the address specified in rs1.

The pointer masking specificiation specifically states:

"""
Cache Management Operations: All instructions in Zicbom, Zicbop and Zicboz
"""

So this is the correct behaviour and we previously have been incorrectly
not masking the address.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reported-by: Fabian Thomas <fabian.thomas@cispa.de>
Fixes: e05da09b7cfd ("target/riscv: implement Zicbom extension")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240514023910.301766-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzicbo.c.inc | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/insn_trans/trans_rvzicbo.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzicbo.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicbo.c.inc
@@ -XXX,XX +XXX,XX @@
 static bool trans_cbo_clean(DisasContext *ctx, arg_cbo_clean *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_clean_flush(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_flush(DisasContext *ctx, arg_cbo_flush *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_clean_flush(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_inval(DisasContext *ctx, arg_cbo_inval *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_inval(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_inval(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_zero(DisasContext *ctx, arg_cbo_zero *a)
 {
     REQUIRE_ZICBOZ(ctx);
-    gen_helper_cbo_zero(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_zero(tcg_env, src);
     return true;
 }
-- 
2.45.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In AIA spec, each hart (or each hart within a group) has a unique hart
number to locate the memory pages of interrupt files in the address
space. The number of bits required to represent any hart number is equal
to ceil(log2(hmax + 1)), where hmax is the largest hart number among
groups.

However, if the largest hart number among groups is a power of 2, QEMU
will pass an inaccurate hart-index-bit setting to Linux. For example, when
the guest OS has 4 harts, only ceil(log2(3 + 1)) = 2 bits are sufficient
to represent 4 harts, but we passes 3 to Linux. The code needs to be
updated to ensure accurate hart-index-bit settings.

Additionally, a Linux patch[1] is necessary to correctly recover the hart
index when the guest OS has only 1 hart, where the hart-index-bit is 0.

[1] https://lore.kernel.org/lkml/20240415064905.25184-1-yongxuan.wang@sifive.com/t/

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240515091129.28116-1-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         }
     }
 
-    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+
+    if (max_hart_per_socket > 1) {
+        max_hart_per_socket--;
+        hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    } else {
+        hart_bits = 0;
+    }
+
     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
                             KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
                             &hart_bits, true, NULL);
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 33a24910ae changed 'reg_width' to use 'vlenb', i.e. vector length
in bytes, when in this context we want 'reg_width' as the length in
bits.

Fix 'reg_width' back to the value in bits like 7cb59921c05a
("target/riscv/gdbstub.c: use 'vlenb' instead of shifting 'vlen'") set
beforehand.

While we're at it, rename 'reg_width' to 'bitsize' to provide a bit more
clarity about what the variable represents. 'bitsize' is also used in
riscv_gen_dynamic_csr_feature() with the same purpose, i.e. as an input to
gdb_feature_builder_append_reg().

Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
Cc: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Robin Dapp <rdapp.gcc@gmail.com>
Fixes: 33a24910ae ("target/riscv: Use GDBFeature for dynamic XML")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240517203054.880861-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
 static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
-    int reg_width = cpu->cfg.vlenb;
+    int bitsize = cpu->cfg.vlenb << 3;
     GDBFeatureBuilder builder;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
+        int count = bitsize / vec_lanes[i].size;
         gdb_feature_builder_append_tag(
             &builder, "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
             vec_lanes[i].id, vec_lanes[i].gdb_type, count);
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
     /* Define vector registers */
     for (i = 0; i < 32; i++) {
         gdb_feature_builder_append_reg(&builder, g_strdup_printf("v%d", i),
-                                       reg_width, i, "riscv_vector", "vector");
+                                       bitsize, i, "riscv_vector", "vector");
     }
 
     gdb_feature_builder_end(&builder);
-- 
2.45.1

From: Alistair Francis <alistair23@gmail.com>

Previously we only listed a single pmpcfg CSR and the first 16 pmpaddr
CSRs. This patch fixes this to list all 16 pmpcfg and all 64 pmpaddr
CSRs are part of the disassembly.

Reported-by: Eric DeVolder <eric_devolder@yahoo.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Fixes: ea10325917 ("RISC-V Disassembler")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240514051615.330979-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 64 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x0383: return "mibound";
     case 0x0384: return "mdbase";
     case 0x0385: return "mdbound";
-    case 0x03a0: return "pmpcfg3";
+    case 0x03a0: return "pmpcfg0";
+    case 0x03a1: return "pmpcfg1";
+    case 0x03a2: return "pmpcfg2";
+    case 0x03a3: return "pmpcfg3";
+    case 0x03a4: return "pmpcfg4";
+    case 0x03a5: return "pmpcfg5";
+    case 0x03a6: return "pmpcfg6";
+    case 0x03a7: return "pmpcfg7";
+    case 0x03a8: return "pmpcfg8";
+    case 0x03a9: return "pmpcfg9";
+    case 0x03aa: return "pmpcfg10";
+    case 0x03ab: return "pmpcfg11";
+    case 0x03ac: return "pmpcfg12";
+    case 0x03ad: return "pmpcfg13";
+    case 0x03ae: return "pmpcfg14";
+    case 0x03af: return "pmpcfg15";
     case 0x03b0: return "pmpaddr0";
     case 0x03b1: return "pmpaddr1";
     case 0x03b2: return "pmpaddr2";
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x03bd: return "pmpaddr13";
     case 0x03be: return "pmpaddr14";
     case 0x03bf: return "pmpaddr15";
+    case 0x03c0: return "pmpaddr16";
+    case 0x03c1: return "pmpaddr17";
+    case 0x03c2: return "pmpaddr18";
+    case 0x03c3: return "pmpaddr19";
+    case 0x03c4: return "pmpaddr20";
+    case 0x03c5: return "pmpaddr21";
+    case 0x03c6: return "pmpaddr22";
+    case 0x03c7: return "pmpaddr23";
+    case 0x03c8: return "pmpaddr24";
+    case 0x03c9: return "pmpaddr25";
+    case 0x03ca: return "pmpaddr26";
+    case 0x03cb: return "pmpaddr27";
+    case 0x03cc: return "pmpaddr28";
+    case 0x03cd: return "pmpaddr29";
+    case 0x03ce: return "pmpaddr30";
+    case 0x03cf: return "pmpaddr31";
+    case 0x03d0: return "pmpaddr32";
+    case 0x03d1: return "pmpaddr33";
+    case 0x03d2: return "pmpaddr34";
+    case 0x03d3: return "pmpaddr35";
+    case 0x03d4: return "pmpaddr36";
+    case 0x03d5: return "pmpaddr37";
+    case 0x03d6: return "pmpaddr38";
+    case 0x03d7: return "pmpaddr39";
+    case 0x03d8: return "pmpaddr40";
+    case 0x03d9: return "pmpaddr41";
+    case 0x03da: return "pmpaddr42";
+    case 0x03db: return "pmpaddr43";
+    case 0x03dc: return "pmpaddr44";
+    case 0x03dd: return "pmpaddr45";
+    case 0x03de: return "pmpaddr46";
+    case 0x03df: return "pmpaddr47";
+    case 0x03e0: return "pmpaddr48";
+    case 0x03e1: return "pmpaddr49";
+    case 0x03e2: return "pmpaddr50";
+    case 0x03e3: return "pmpaddr51";
+    case 0x03e4: return "pmpaddr52";
+    case 0x03e5: return "pmpaddr53";
+    case 0x03e6: return "pmpaddr54";
+    case 0x03e7: return "pmpaddr55";
+    case 0x03e8: return "pmpaddr56";
+    case 0x03e9: return "pmpaddr57";
+    case 0x03ea: return "pmpaddr58";
+    case 0x03eb: return "pmpaddr59";
+    case 0x03ec: return "pmpaddr60";
+    case 0x03ed: return "pmpaddr61";
+    case 0x03ee: return "pmpaddr62";
+    case 0x03ef: return "pmpaddr63";
     case 0x0780: return "mtohost";
     case 0x0781: return "mfromhost";
     case 0x0782: return "mreset";
-- 
2.45.1

From: Yu-Ming Chang <yumin686@andestech.com>

Both CSRRS and CSRRC always read the addressed CSR and cause any read side
effects regardless of rs1 and rd fields. Note that if rs1 specifies a register
holding a zero value other than x0, the instruction will still attempt to write
the unmodified value back to the CSR and will cause any attendant side effects.

So if CSRRS or CSRRC tries to write a read-only CSR with rs1 which specifies
a register holding a zero value, an illegal instruction exception should be
raised.

Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240403070823.80897-1-yumin686@andestech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h       |  4 ++++
 target/riscv/csr.c       | 51 ++++++++++++++++++++++++++++++++++++----
 target/riscv/op_helper.c |  6 ++---
 3 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env);
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
+RISCVException riscv_csrr(CPURISCVState *env, int csrno,
+                          target_ulong *ret_value);
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask);
@@ -XXX,XX +XXX,XX @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
                                           target_ulong new_value,
                                           target_ulong write_mask);
 
+RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
+                               Int128 *ret_value);
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 *ret_value,
                                 Int128 new_value, Int128 write_mask);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
 
 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                int csrno,
-                                               bool write_mask)
+                                               bool write)
 {
     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
     bool read_only = get_field(csrno, 0xC00) == 3;
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
     }
 
     /* read / write check */
-    if (write_mask && read_only) {
+    if (write && read_only) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+RISCVException riscv_csrr(CPURISCVState *env, int csrno,
+                           target_ulong *ret_value)
+{
+    RISCVException ret = riscv_csrrw_check(env, csrno, false);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
+}
+
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask)
 {
-    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
+    RISCVException ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
+                               Int128 *ret_value)
+{
+    RISCVException ret;
+
+    ret = riscv_csrrw_check(env, csrno, false);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    if (csr_ops[csrno].read128) {
+        return riscv_csrrw_do128(env, csrno, ret_value,
+                                 int128_zero(), int128_zero());
+    }
+
+    /*
+     * Fall back to 64-bit version for now, if the 128-bit alternative isn't
+     * at all defined.
+     * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
+     * significant), for those, this fallback is correctly handling the
+     * accesses
+     */
+    target_ulong old_value;
+    ret = riscv_csrrw_do64(env, csrno, &old_value,
+                           (target_ulong)0,
+                           (target_ulong)0);
+    if (ret == RISCV_EXCP_NONE && ret_value) {
+        *ret_value = int128_make64(old_value);
+    }
+    return ret;
+}
+
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 *ret_value,
                                 Int128 new_value, Int128 write_mask)
 {
     RISCVException ret;
 
-    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
+    ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
     }
 
     target_ulong val = 0;
-    RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
+    RISCVException ret = riscv_csrr(env, csr, &val);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
 target_ulong helper_csrr_i128(CPURISCVState *env, int csr)
 {
     Int128 rv = int128_zero();
-    RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
-                                          int128_zero(),
-                                          int128_zero());
+    RISCVException ret = riscv_csrr_i128(env, csr, &rv);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
-- 
2.45.1