Series comparison

-[PULL 00/54] riscv-to-apply queue
+[PULL v2 00/45] riscv-to-apply queue
-The following changes since commit fcb237e64f9d026c03d635579c7b288d0008a6e5:
+The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:
-  Merge tag 'pull-vfio-20230710' of https://github.com/legoater/qemu into staging (2023-07-10 09:17:06 +0100)
+  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230710-1
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911
-for you to fetch changes up to a47842d16653b4f73b5d56ff0c252dd8a329481b:
+for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:
-  riscv: Add support for the Zfa extension (2023-07-10 22:29:20 +1000)
+  target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)
 ----------------------------------------------------------------
-Third RISC-V PR for 8.1
+First RISC-V PR for 8.2
-* Use xl instead of mxl for disassemble
+ * Remove 'host' CPU from TCG
-* Factor out extension tests to cpu_cfg.h
+ * riscv_htif Fixup printing on big endian hosts
-* disas/riscv: Add vendor extension support
+ * Add zmmul isa string
-* disas/riscv: Add support for XVentanaCondOps
+ * Add smepmp isa string
-* disas/riscv: Add support for XThead* instructions
+ * Fix page_check_range use in fault-only-first
-* Fix mstatus related problems
+ * Use existing lookup tables for MixColumns
-* Fix veyron-v1 CPU properties
+ * Add RISC-V vector cryptographic instruction set support
-* Fix the xlen for data address when MPRV=1
+ * Implement WARL behaviour for mcountinhibit/mcounteren
-* opensbi: Upgrade from v1.2 to v1.3
+ * Add Zihintntl extension ISA string to DTS
-* Enable 32-bit Spike OpenSBI boot testing
+ * Fix zfa fleq.d and fltq.d
-* Support the watchdog timer of HiFive 1 rev b
+ * Fix upper/lower mtime write calculation
-* Only build qemu-system-riscv$$ on rv$$ host
+ * Make rtc variable names consistent
-* Add RVV registers to log
+ * Use abi type for linux-user target_ucontext
-* Restrict ACLINT to TCG
+ * Add RISC-V KVM AIA Support
-* Add syscall riscv_hwprobe
+ * Fix riscv,pmu DT node path in the virt machine
-* Add support for BF16 extensions
+ * Update CSR bits name for svadu extension
-* KVM_RISCV_SET_TIMER macro is not configured correctly
+ * Mark zicond non-experimental
-* Generate devicetree only after machine initialization is complete
+ * Fix satp_mode_finalize() when satp_mode.supported = 0
-* virt: Convert fdt_load_addr to uint64_t
+ * Fix non-KVM --enable-debug build
-* KVM: fixes and enhancements
+ * Add new extensions to hwprobe
-* Add support for the Zfa extension
+ * Use accelerated helper for AES64KS1I
  * Allocate itrigger timers only once
  * Respect mseccfg.RLB for pmpaddrX changes
  * Align the AIA model to v1.0 ratified spec
  * Don't read the CSR in riscv_csrrw_do64
 ----------------------------------------------------------------
-Bin Meng (2):
+Akihiko Odaki (1):
-      roms/opensbi: Upgrade from v1.2 to v1.3
+      target/riscv: Allocate itrigger timers only once
       tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing
-Christoph Müllner (8):
+Ard Biesheuvel (2):
-      target/riscv: Factor out extension tests to cpu_cfg.h
+      target/riscv: Use existing lookup tables for MixColumns
-      disas/riscv: Move types/constants to new header file
+      target/riscv: Use accelerated helper for AES64KS1I
       disas/riscv: Make rv_op_illegal a shared enum value
       disas/riscv: Encapsulate opcode_data into decode
       disas/riscv: Provide infrastructure for vendor extensions
       disas/riscv: Add support for XVentanaCondOps
       disas/riscv: Add support for XThead* instructions
       riscv: Add support for the Zfa extension
-Daniel Henrique Barboza (20):
+Conor Dooley (1):
-      target/riscv/cpu.c: fix veyron-v1 CPU properties
+      hw/riscv: virt: Fix riscv,pmu DT node path
       target/riscv: skip features setup for KVM CPUs
       hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
       target/riscv/cpu.c: restrict 'mvendorid' value
       target/riscv/cpu.c: restrict 'mimpid' value
       target/riscv/cpu.c: restrict 'marchid' value
       target/riscv: use KVM scratch CPUs to init KVM properties
       target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
       target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
       target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
       target/riscv/cpu: add misa_ext_info_arr[]
       target/riscv: add KVM specific MISA properties
       target/riscv/kvm.c: update KVM MISA bits
       target/riscv/kvm.c: add multi-letter extension KVM properties
       target/riscv/cpu.c: add satp_mode properties earlier
       target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
       target/riscv/cpu.c: create KVM mock properties
       target/riscv: update multi-letter extension KVM properties
       target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
       target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM
-Guenter Roeck (1):
+Daniel Henrique Barboza (6):
-      riscv: Generate devicetree only after machine initialization is complete
+      target/riscv/cpu.c: do not run 'host' CPU with TCG
       target/riscv/cpu.c: add zmmul isa string
       target/riscv/cpu.c: add smepmp isa string
       target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
       hw/riscv/virt.c: fix non-KVM --enable-debug build
       hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-Ivan Klokov (1):
+Dickon Hood (2):
-      target/riscv: Add RVV registers to log
+      target/riscv: Refactor translation of vector-widening instruction
       target/riscv: Add Zvbb ISA extension support
-Jason Chien (1):
+Jason Chien (3):
-      target/riscv: Set the correct exception for implict G-stage translation fail
+      target/riscv: Add Zihintntl extension ISA string to DTS
       hw/intc: Fix upper/lower mtime write calculation
       hw/intc: Make rtc variable names consistent
-LIU Zhiwei (1):
+Kiran Ostrolenk (4):
-      target/riscv: Use xl instead of mxl for disassemble
+      target/riscv: Refactor some of the generic vector functionality
       target/riscv: Refactor vector-vector translation macro
       target/riscv: Refactor some of the generic vector functionality
       target/riscv: Add Zvknh ISA extension support
-Lakshmi Bai Raja Subramanian (1):
+LIU Zhiwei (3):
-      hw/riscv: virt: Convert fdt_load_addr to uint64_t
+      target/riscv: Fix page_check_range use in fault-only-first
       target/riscv: Fix zfa fleq.d and fltq.d
       linux-user/riscv: Use abi type for target_ucontext
-Philippe Mathieu-Daudé (3):
+Lawrence Hunter (2):
-      target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
+      target/riscv: Add Zvbc ISA extension support
-      target/riscv: Only build KVM guest with same wordsize as host
+      target/riscv: Add Zvksh ISA extension support
-      hw/riscv/virt: Restrict ACLINT to TCG
 Leon Schuermann (1):
       target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
 Max Chou (3):
       crypto: Create sm4_subword
       crypto: Add SM4 constant parameter CK
       target/riscv: Add Zvksed ISA extension support
 Nazar Kazakov (4):
       target/riscv: Remove redundant "cpu_vl == 0" checks
       target/riscv: Move vector translation checks
       target/riscv: Add Zvkned ISA extension support
       target/riscv: Add Zvkg ISA extension support
 Nikita Shubin (1):
       target/riscv: don't read CSR in riscv_csrrw_do64
 Rob Bradford (1):
       target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
 Robbin Ehn (1):
-      linux-user/riscv: Add syscall riscv_hwprobe
+      linux-user/riscv: Add new extensions to hwprobe
-Tommy Wu (3):
+Thomas Huth (2):
-      hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
+      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
-      hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
+      hw/char/riscv_htif: Fix the console syscall on big endian hosts
       tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e
-Weiwei Li (11):
+Tommy Wu (1):
-      target/riscv: Make MPV only work when MPP != PRV_M
+      target/riscv: Align the AIA model to v1.0 ratified spec
       target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
       target/riscv: Remove redundant assignment to SXL
       target/riscv: Add additional xlen for address when MPRV=1
       target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
       target/riscv: Add properties for BF16 extensions
       target/riscv: Add support for Zfbfmin extension
       target/riscv: Add support for Zvfbfmin extension
       target/riscv: Add support for Zvfbfwma extension
       target/riscv: Expose properties for BF16 extensions
       target/riscv: Add disas support for BF16 extensions
-yang.zhang (1):
+Vineet Gupta (1):
-      target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly
+      riscv: zicond: make non-experimental
- docs/system/riscv/virt.rst                     |   1 +
+Weiwei Li (1):
- meson.build                                    |  15 +-
+      target/riscv: Update CSR bits name for svadu extension
  disas/riscv-xthead.h                           |  28 +
  disas/riscv-xventana.h                         |  18 +
  disas/riscv.h                                  | 302 +++++++++++
  include/hw/misc/sifive_e_aon.h                 |  60 +++
  include/hw/riscv/sifive_e.h                    |   9 +-
  linux-user/riscv/syscall32_nr.h                |   1 +
  linux-user/riscv/syscall64_nr.h                |   1 +
  target/riscv/cpu.h                             |  56 +-
  target/riscv/cpu_cfg.h                         |  41 ++
  target/riscv/helper.h                          |  29 +
  target/riscv/kvm_riscv.h                       |   1 +
  target/riscv/insn32.decode                     |  38 ++
  disas/riscv-xthead.c                           | 707 +++++++++++++++++++++++++
  disas/riscv-xventana.c                         |  41 ++
  disas/riscv.c                                  | 559 +++++++++----------
  hw/misc/sifive_e_aon.c                         | 319 +++++++++++
  hw/riscv/sifive_e.c                            |  17 +-
  hw/riscv/virt.c                                |  56 +-
  linux-user/syscall.c                           | 146 +++++
  target/riscv/cpu.c                             | 439 +++++++++++++--
  target/riscv/cpu_helper.c                      |  12 +-
  target/riscv/csr.c                             |  41 +-
  target/riscv/fpu_helper.c                      | 166 ++++++
  target/riscv/kvm.c                             | 501 +++++++++++++++++-
  target/riscv/op_helper.c                       |   3 +-
  target/riscv/translate.c                       |  42 +-
  target/riscv/vector_helper.c                   |  17 +
  tests/qtest/sifive-e-aon-watchdog-test.c       | 450 ++++++++++++++++
  tests/tcg/riscv64/test-fcvtmod.c               | 345 ++++++++++++
  target/riscv/insn_trans/trans_rvbf16.c.inc     | 175 ++++++
  target/riscv/insn_trans/trans_rvzfa.c.inc      | 521 ++++++++++++++++++
  target/riscv/insn_trans/trans_rvzfh.c.inc      |  12 +-
  disas/meson.build                              |   6 +-
  hw/misc/Kconfig                                |   3 +
  hw/misc/meson.build                            |   1 +
  hw/riscv/Kconfig                               |   1 +
  pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 123072 -> 135344 bytes
  pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 121800 -> 138304 bytes
  roms/opensbi                                   |   2 +-
  tests/avocado/riscv_opensbi.py                 |   2 -
  tests/qtest/meson.build                        |   3 +
  tests/tcg/riscv64/Makefile.target              |   6 +
 files changed, 4751 insertions(+), 442 deletions(-)
  create mode 100644 disas/riscv-xthead.h
  create mode 100644 disas/riscv-xventana.h
  create mode 100644 disas/riscv.h
  create mode 100644 include/hw/misc/sifive_e_aon.h
  create mode 100644 disas/riscv-xthead.c
  create mode 100644 disas/riscv-xventana.c
  create mode 100644 hw/misc/sifive_e_aon.c
  create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
  create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
  create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
  create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc
+Yong-Xuan Wang (5):
+      target/riscv: support the AIA device emulation with KVM enabled
+      target/riscv: check the in-kernel irqchip support
+      target/riscv: Create an KVM AIA irqchip
+      target/riscv: update APLIC and IMSIC to support KVM AIA
+      target/riscv: select KVM AIA in riscv virt machine
+ include/crypto/aes.h                      |   7 +
+ include/crypto/sm4.h                      |   9 +
+ target/riscv/cpu_bits.h                   |   8 +-
+ target/riscv/cpu_cfg.h                    |   9 +
+ target/riscv/debug.h                      |   3 +-
+ target/riscv/helper.h                     |  98 +++
+ target/riscv/kvm_riscv.h                  |   5 +
+ target/riscv/vector_internals.h           | 228 +++++++
+ target/riscv/insn32.decode                |  58 ++
+ crypto/aes.c                              |   4 +-
+ crypto/sm4.c                              |  10 +
+ hw/char/riscv_htif.c                      |  12 +-
+ hw/intc/riscv_aclint.c                    |  11 +-
+ hw/intc/riscv_aplic.c                     |  52 +-
+ hw/intc/riscv_imsic.c                     |  25 +-
+ hw/riscv/virt.c                           | 374 ++++++------
+ linux-user/riscv/signal.c                 |   4 +-
+ linux-user/syscall.c                      |  14 +-
+ target/arm/tcg/crypto_helper.c            |  10 +-
+ target/riscv/cpu.c                        |  83 ++-
+ target/riscv/cpu_helper.c                 |   6 +-
+ target/riscv/crypto_helper.c              |  51 +-
+ target/riscv/csr.c                        |  54 +-
+ target/riscv/debug.c                      |  15 +-
+ target/riscv/kvm.c                        | 201 ++++++-
+ target/riscv/pmp.c                        |   4 +
+ target/riscv/translate.c                  |   1 +
+ target/riscv/vcrypto_helper.c             | 970 ++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c              | 245 +-------
+ target/riscv/vector_internals.c           |  81 +++
+ target/riscv/insn_trans/trans_rvv.c.inc   | 171 +++---
+ target/riscv/insn_trans/trans_rvvk.c.inc  | 606 +++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfa.c.inc |   4 +-
+ target/riscv/meson.build                  |   4 +-
+files changed, 2785 insertions(+), 652 deletions(-)
+ create mode 100644 target/riscv/vector_internals.h
+ create mode 100644 target/riscv/vcrypto_helper.c
+ create mode 100644 target/riscv/vector_internals.c
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

-[PULL 35/54] target/riscv: skip features setup for KVM CPUs
+[PULL v2 01/45] target/riscv/cpu.c: do not run 'host' CPU with TCG
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-As it is today it's not possible to use '-cpu host' if the RISC-V host
+The 'host' CPU is available in a CONFIG_KVM build and it's currently
-has RVH enabled. This is the resulting error:
+available for all accels, but is a KVM only CPU. This means that in a
 RISC-V KVM capable host we can do things like this:
-$ ./qemu/build/qemu-system-riscv64 \
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
     -machine virt,accel=kvm -m 2G -smp 1 \
     -nographic -snapshot -kernel ./guest_imgs/Image  \
     -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
     -append "earlycon=sbi root=/dev/ram rw" \
     -cpu host
 qemu-system-riscv64: H extension requires priv spec 1.12.0
-This happens because we're checking for priv spec for all CPUs, and
+This CPU does not have a priv spec because we don't filter its extensions
-since we're not setting  env->priv_ver for the 'host' CPU, it's being
+via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
-default to zero (i.e. PRIV_SPEC_1_10_0).
+with the 'host' CPU.
-In reality env->priv_ver does not make sense when running with the KVM
+We don't have a way to filter the 'host' CPU out of the available CPU
-'host' CPU. It's used to gate certain CSRs/extensions during translation
+options (-cpu help) if the build includes both KVM and TCG. What we can
-to make them unavailable if the hart declares an older spec version. It
+do is to error out during riscv_cpu_realize_tcg() if the user chooses
-doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
+the 'host' CPU with accel=tcg:
 checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
 are available [1].
-'priv_ver' is just one example. We're doing a lot of feature validation
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
-and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
+qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration
 Validating the feature set for those CPUs is a KVM problem that should
 be handled in KVM specific code.
 The new riscv_cpu_realize_tcg() helper contains all validation logic that
 are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
 running TCG and, if it's the case, proceed with the usual TCG realize()
 logic.
 [1] lib/sbi/sbi_hart.c, hart_detect_features()
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
+ target/riscv/cpu.c | 5 +++++
-file changed, 25 insertions(+), 10 deletions(-)
+file changed, 5 insertions(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
  #include "migration/vmstate.h"
  #include "fpu/softfloat-helpers.h"
  #include "sysemu/kvm.h"
 +#include "sysemu/tcg.h"
  #include "kvm_riscv.h"
  #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
      }
  }
 -static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 +static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
  {
 -    CPUState *cs = CPU(dev);
      RISCVCPU *cpu = RISCV_CPU(dev);
      CPURISCVState *env = &cpu->env;
--    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
      Error *local_err = NULL;
--    cpu_exec_realizefn(cs, &local_err);
++    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
--    if (local_err != NULL) {
++        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
--        error_propagate(errp, local_err);
++        return;
--        return;
++    }
--    }
++
 -
      riscv_cpu_validate_misa_mxl(cpu, &local_err);
      if (local_err != NULL) {
          error_propagate(errp, local_err);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-     }
- #ifndef CONFIG_USER_ONLY
--    cs->tcg_cflags |= CF_PCREL;
-+    CPU(dev)->tcg_cflags |= CF_PCREL;
-     if (cpu->cfg.ext_sstc) {
-         riscv_timer_init(cpu);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-         }
-      }
- #endif
-+}
-+
-+static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-+{
-+    CPUState *cs = CPU(dev);
-+    RISCVCPU *cpu = RISCV_CPU(dev);
-+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
-+    Error *local_err = NULL;
-+
-+    cpu_exec_realizefn(cs, &local_err);
-+    if (local_err != NULL) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+
-+    if (tcg_enabled()) {
-+        riscv_cpu_realize_tcg(dev, &local_err);
-+        if (local_err != NULL) {
-+            error_propagate(errp, local_err);
-+            return;
-+        }
-+    }
-     riscv_cpu_finalize_features(cpu, &local_err);
-     if (local_err != NULL) {
 --
-.40.1
+.41.0

-[PULL 21/54] target/riscv: Only build KVM guest with same wordsize as host
+[PULL v2 02/45] hw/char/riscv_htif: Fix printing of console characters on big endian hosts
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Thomas Huth <thuth@redhat.com>
-Per Anup Patel in [*]:
+The character that should be printed is stored in the 64 bit "payload"
 variable. The code currently tries to print it by taking the address
 of the variable and passing this pointer to qemu_chr_fe_write(). However,
 this only works on little endian hosts where the least significant bits
 are stored on the lowest address. To do this in a portable way, we have
 to store the value in an uint8_t variable instead.
- > Currently, we only support running rv64 guest on rv64 host
+Fixes: 5033606780 ("RISC-V HTIF Console")
- > and rv32 guest on rv32 host.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
  >
  > In the future, we might support running rv32 guest on rv64
  > host but as of now we don't see a strong push for it.
 Therefore, when only using the KVM accelerator it is pointless
 to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
 on a rv32 host). Restrict meson to only build the correct binary,
 avoiding to waste ressources building unusable code.
 [*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627143235.29947-3-philmd@linaro.org>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721094720.902454-2-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- meson.build | 6 ++++--
+ hw/char/riscv_htif.c | 3 ++-
-file changed, 4 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/meson.build b/meson.build
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/hw/char/riscv_htif.c
-+++ b/meson.build
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
+             s->tohost = 0; /* clear to indicate we read */
- elif cpu in ['mips', 'mips64']
+             return;
-   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
+         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
--elif cpu in ['riscv32', 'riscv64']
+-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
--  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
++            uint8_t ch = (uint8_t)payload;
-+elif cpu in ['riscv32']
++            qemu_chr_fe_write(&s->chr, &ch, 1);
-+  kvm_targets = ['riscv32-softmmu']
+             resp = 0x100 | (uint8_t)payload;
-+elif cpu in ['riscv64']
+         } else {
-+  kvm_targets = ['riscv64-softmmu']
+             qemu_log("HTIF device %d: unknown command\n", device);
  else
    kvm_targets = []
  endif
 --
-.40.1
+.41.0

-[PULL 52/54] target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
+[PULL v2 03/45] hw/char/riscv_htif: Fix the console syscall on big endian hosts
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Thomas Huth <thuth@redhat.com>
-There are 2 places in which we need to get a pointer to a certain
+Values that have been read via cpu_physical_memory_read() from the
-property of the cpu->cfg struct based on property offset. Next patch
+guest's memory have to be swapped in case the host endianess differs
-will add a couple more.
+from the guest.
-Create a helper to avoid repeating this code over and over.
+Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230721094720.902454-3-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 11 +++++++----
+ hw/char/riscv_htif.c | 9 +++++----
-file changed, 7 insertions(+), 4 deletions(-)
+file changed, 5 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/hw/char/riscv_htif.c
-+++ b/target/riscv/kvm.c
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+@@ -XXX,XX +XXX,XX @@
-     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+ #include "qemu/timer.h"
- };
+ #include "qemu/error-report.h"
+ #include "exec/address-spaces.h"
-+static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
++#include "exec/tswap.h"
-+{
+ #include "sysemu/dma.h"
-+    return (void *)&cpu->cfg + kvmcfg->offset;
-+}
+ #define RISCV_DEBUG_HTIF 0
-+
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
- static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
+             } else {
-                             uint32_t val)
+                 uint64_t syscall[8];
- {
+                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
--    int cpu_cfg_offset = multi_ext->offset;
+-                if (syscall[0] == PK_SYS_WRITE &&
--    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+-                    syscall[1] == HTIF_DEV_CONSOLE &&
-+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
+-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
++                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
-     *ext_enabled = val;
++                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
- }
++                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
+                     uint8_t ch;
- static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
+-                    cpu_physical_memory_read(syscall[2], &ch, 1);
-                                 KVMCPUConfig *multi_ext)
++                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
- {
+                     qemu_chr_fe_write(&s->chr, &ch, 1);
--    int cpu_cfg_offset = multi_ext->offset;
+                     resp = 0x100 | (uint8_t)payload;
--    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+                 } else {
 +    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
      return *ext_enabled;
  }
 --
-.40.1
+.41.0

-[PULL 49/54] target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
+[PULL v2 04/45] target/riscv/cpu.c: add zmmul isa string
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-riscv_isa_string_ext() is being used by riscv_isa_string(), which is
+zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
-then used by boards to retrieve the 'riscv,isa' string to be written in
+Add a riscv,isa string for it.
 the FDT. All this happens after riscv_cpu_realize(), meaning that we're
 already past riscv_cpu_validate_set_extensions() and, more important,
 riscv_cpu_disable_priv_spec_isa_exts().
-This means that all extensions that needed to be disabled due to
+Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
 priv_spec mismatch are already disabled. Checking this again during
 riscv_isa_string_ext() is unneeded. Remove it.
 As a bonus, riscv_isa_string_ext() can now be used with the 'host'
 KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
 would fail this check for no good reason.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
+Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 3 +--
+ target/riscv/cpu.c | 1 +
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 1 insertion(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     int i;
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
--        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
++    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
--            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
-             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
+     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
              g_free(old);
              old = new;
 --
-.40.1
+.41.0

-[PULL 48/54] target/riscv/cpu.c: add satp_mode properties earlier
+[PULL v2 05/45] target/riscv/cpu.c: add smepmp isa string
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
+The cpu->cfg.epmp extension is still experimental, but it already has a
-CONFIG_USER_ONLY" blocks after changes that added KVM properties
+'smepmp' riscv,isa string. Add it.
 handling.
 KVM specific properties are required to be created earlier than their
 TCG counterparts, but the remaining props can be created at any order.
 Move riscv_add_satp_mode_properties() to the start of the function,
 inside the !CONFIG_USER_ONLY block already present there, to remove the
 last ifndef block.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
+Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 6 ++----
+ target/riscv/cpu.c | 1 +
-file changed, 2 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     DeviceState *dev = DEVICE(obj);
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
- #ifndef CONFIG_USER_ONLY
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+    riscv_add_satp_mode_properties(obj);
++    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
-+
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-     if (kvm_enabled()) {
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
-         kvm_riscv_init_user_properties(obj);
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
      }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
  #endif
          qdev_property_add_static(dev, prop);
      }
 -
 -#ifndef CONFIG_USER_ONLY
 -    riscv_add_satp_mode_properties(obj);
 -#endif
  }
  static Property riscv_cpu_properties[] = {
 --
-.40.1
+.41.0

-[PULL 32/54] target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly
+[PULL v2 06/45] target/riscv: Fix page_check_range use in fault-only-first
-From: "yang.zhang" <yang.zhang@hexintek.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Should set/get riscv all reg timer,i.e, time/compare/frequency/state.
+Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
 integer return value to bool type. However, it wrongly converted the use
 of the API in riscv fault-only-first, where page_check_range < = 0, should
 be converted to !page_check_range.
-Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 2 +-
+ target/riscv/vector_helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
+                                          cpu_mmu_index(env, false));
- #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
+                 if (host) {
-     do { \
+ #ifdef CONFIG_USER_ONLY
--        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
+-                    if (page_check_range(addr, offset, PAGE_READ)) {
-+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
++                    if (!page_check_range(addr, offset, PAGE_READ)) {
-         if (ret) { \
+                         vl = i;
-             abort(); \
+                         goto ProbeSuccess;
-         } \
+                     }
 --
-.40.1
+.41.0

-[PULL 22/54] target/riscv: Add RVV registers to log
+[PULL v2 07/45] target/riscv: Use existing lookup tables for MixColumns
-From: Ivan Klokov <ivan.klokov@syntacore.com>
+From: Ard Biesheuvel <ardb@kernel.org>
-Print RvV extension register to log if VPU option is enabled.
+The AES MixColumns and InvMixColumns operations are relatively
 expensive 4x4 matrix multiplications in GF(2^8), which is why C
 implementations usually rely on precomputed lookup tables rather than
 performing the calculations on demand.
-Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
+Given that we already carry those tables in QEMU, we can just grab the
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+right value in the implementation of the RISC-V AES32 instructions. Note
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+that the tables in question are permuted according to the respective
-Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
+Sbox, so we can omit the Sbox lookup as well in this case.
 Cc: Richard Henderson <richard.henderson@linaro.org>
 Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
 Cc: Zewen Ye <lustrew@foxmail.com>
 Cc: Weiwei Li <liweiwei@iscas.ac.cn>
 Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
+ include/crypto/aes.h         |  7 +++++++
-file changed, 56 insertions(+), 1 deletion(-)
+ crypto/aes.c                 |  4 ++--
  target/riscv/crypto_helper.c | 34 ++++------------------------------
 files changed, 13 insertions(+), 32 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/include/crypto/aes.h b/include/crypto/aes.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/include/crypto/aes.h
-+++ b/target/riscv/cpu.c
++++ b/include/crypto/aes.h
-@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
+@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
- #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
+ extern const uint8_t AES_sbox[256];
-     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+ extern const uint8_t AES_isbox[256];
 +/*
-+ * From vector_helper.c
++AES_Te0[x] = S [x].[02, 01, 01, 03];
-+ * Note that vector data is stored in host-endian 64-bit chunks,
++AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
-+ * so addressing bytes needs a host-endian fixup.
++*/
 + */
 +#if HOST_BIG_ENDIAN
 +#define BYTE(x)   ((x) ^ 7)
 +#else
 +#define BYTE(x)   (x)
 +#endif
 +
- /*
++extern const uint32_t AES_Te0[256], AES_Td0[256];
-  * Here are the ordering rules of extension naming defined by RISC-V
++
-  * specification :
+ #endif
-@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
+diff --git a/crypto/aes.c b/crypto/aes.c
-     "f30/ft10", "f31/ft11"
+index XXXXXXX..XXXXXXX 100644
 --- a/crypto/aes.c
 +++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
  AES_Td4[x] = Si[x].[01, 01, 01, 01];
  */
 -static const uint32_t AES_Te0[256] = {
 +const uint32_t AES_Te0[256] = {
 xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
 xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
 x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
 xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
  };
-+const char * const riscv_rvv_regnames[] = {
+-static const uint32_t AES_Td0[256] = {
-+  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
++const uint32_t AES_Td0[256] = {
-+  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
+x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
-+  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
+x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
-+  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
+x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
-+  "v28", "v29", "v30", "v31"
+diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
-+};
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/riscv/crypto_helper.c
- static const char * const riscv_excp_names[] = {
++++ b/target/riscv/crypto_helper.c
-     "misaligned_fetch",
+@@ -XXX,XX +XXX,XX @@
-     "fault_fetch",
+ #include "crypto/aes-round.h"
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+ #include "crypto/sm4.h"
 -#define AES_XTIME(a) \
 -    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
 -
 -#define AES_GFMUL(a, b) (( \
 -    (((b) & 0x1) ? (a) : 0) ^ \
 -    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
 -    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
 -    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
 -
 -static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
 -{
 -    uint32_t u;
 -
 -    if (fwd) {
 -        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
 -            (AES_GFMUL(x, 2) << 0);
 -    } else {
 -        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
 -            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
 -    }
 -    return u;
 -}
 -
  #define sext32_xlen(x) (target_ulong)(int32_t)(x)
  static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                             bool enc, bool mix)
  {
-     RISCVCPU *cpu = RISCV_CPU(cs);
+     uint8_t si = rs2 >> shamt;
-     CPURISCVState *env = &cpu->env;
+-    uint8_t so;
--    int i;
+     uint32_t mixed;
-+    int i, j;
+     target_ulong res;
-+    uint8_t *p;
+     if (enc) {
- #if !defined(CONFIG_USER_ONLY)
+-        so = AES_sbox[si];
-     if (riscv_has_ext(env, RVH)) {
+         if (mix) {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+-            mixed = aes_mixcolumn_byte(so, true);
-             }
++            mixed = be32_to_cpu(AES_Te0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_sbox[si];
          }
      } else {
 -        so = AES_isbox[si];
          if (mix) {
 -            mixed = aes_mixcolumn_byte(so, false);
 +            mixed = be32_to_cpu(AES_Td0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_isbox[si];
          }
      }
-+    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
+     mixed = rol32(mixed, shamt);
 +        static const int dump_rvv_csrs[] = {
 +                    CSR_VSTART,
 +                    CSR_VXSAT,
 +                    CSR_VXRM,
 +                    CSR_VCSR,
 +                    CSR_VL,
 +                    CSR_VTYPE,
 +                    CSR_VLENB,
 +                };
 +        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
 +            int csrno = dump_rvv_csrs[i];
 +            target_ulong val = 0;
 +            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
 +
 +            /*
 +             * Rely on the smode, hmode, etc, predicates within csr.c
 +             * to do the filtering of the registers that are present.
 +             */
 +            if (res == RISCV_EXCP_NONE) {
 +                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
 +                             csr_ops[csrno].name, val);
 +            }
 +        }
 +        uint16_t vlenb = cpu->cfg.vlen >> 3;
 +
 +        for (i = 0; i < 32; i++) {
 +            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
 +            p = (uint8_t *)env->vreg;
 +            for (j = vlenb - 1 ; j >= 0; j--) {
 +                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
 +            }
 +            qemu_fprintf(f, "\n");
 +        }
 +    }
  }
  static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
 --
-.40.1
+.41.0

-[PULL 17/54] hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
+[PULL v2 08/45] target/riscv: Refactor some of the generic vector functionality
-From: Tommy Wu <tommy.wu@sifive.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-The watchdog timer is in the always-on domain device of HiFive 1 rev b,
+Take some functions/macros out of `vector_helper` and put them in a new
-so this patch added the AON device to the sifive_e machine. This patch
+module called `vector_internals`. This ensures they can be used by both
-only implemented the functionality of the watchdog timer.
+vector and vector-crypto helpers (latter implemented in proceeding
 commits).
-Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
+Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/misc/sifive_e_aon.h |  60 +++++++
+ target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
- hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c    | 201 +-------------------------------
- hw/misc/Kconfig                |   3 +
+ target/riscv/vector_internals.c |  81 +++++++++++++
- hw/misc/meson.build            |   1 +
+ target/riscv/meson.build        |   1 +
-files changed, 383 insertions(+)
+files changed, 265 insertions(+), 200 deletions(-)
- create mode 100644 include/hw/misc/sifive_e_aon.h
+ create mode 100644 target/riscv/vector_internals.h
- create mode 100644 hw/misc/sifive_e_aon.c
+ create mode 100644 target/riscv/vector_internals.c
-diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/sifive_e_aon.h
++++ b/target/riscv/vector_internals.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * SiFive HiFive1 AON (Always On Domain) interface.
++ * RISC-V Vector Extension Internals
 + *
-+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef HW_SIFIVE_AON_H
++#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
-+#define HW_SIFIVE_AON_H
++#define TARGET_RISCV_VECTOR_INTERNALS_H
 +
-+#include "hw/sysbus.h"
++#include "qemu/osdep.h"
-+#include "qom/object.h"
++#include "qemu/bitops.h"
-+
++#include "cpu.h"
-+#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
++#include "tcg/tcg-gvec-desc.h"
-+OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
++#include "internals.h"
 +
-+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
++static inline uint32_t vext_nf(uint32_t desc)
-+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
++{
-+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
++    return FIELD_EX32(simd_data(desc), VDATA, NF);
-+
++}
-+enum {
++
-+    SIFIVE_E_AON_WDT    = 0x0,
++/*
-+    SIFIVE_E_AON_RTC    = 0x40,
++ * Note that vector data is stored in host-endian 64-bit chunks,
-+    SIFIVE_E_AON_LFROSC = 0x70,
++ * so addressing units smaller than that needs a host-endian fixup.
-+    SIFIVE_E_AON_BACKUP = 0x80,
++ */
-+    SIFIVE_E_AON_PMU    = 0x100,
++#if HOST_BIG_ENDIAN
-+    SIFIVE_E_AON_MAX    = 0x150
++#define H1(x)   ((x) ^ 7)
-+};
++#define H1_2(x) ((x) ^ 6)
-+
++#define H1_4(x) ((x) ^ 4)
-+struct SiFiveEAONState {
++#define H2(x)   ((x) ^ 3)
-+    /*< private >*/
++#define H4(x)   ((x) ^ 1)
-+    SysBusDevice parent_obj;
++#define H8(x)   ((x))
-+
++#else
-+    /*< public >*/
++#define H1(x)   (x)
-+    MemoryRegion mmio;
++#define H1_2(x) (x)
-+
++#define H1_4(x) (x)
-+    /*< watchdog timer >*/
++#define H2(x)   (x)
-+    QEMUTimer *wdog_timer;
++#define H4(x)   (x)
-+    qemu_irq wdog_irq;
++#define H8(x)   (x)
 +    uint64_t wdog_restart_time;
 +    uint64_t wdogclk_freq;
 +
 +    uint32_t wdogcfg;
 +    uint16_t wdogcmp0;
 +    uint32_t wdogcount;
 +    uint8_t wdogunlock;
 +};
 +
 +#endif
-diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
++
 +/*
 + * Encode LMUL to lmul as following:
 + *     LMUL    vlmul    lmul
 + *      1       000       0
 + *      2       001       1
 + *      4       010       2
 + *      8       011       3
 + *      -       100       -
 + *     1/8      101      -3
 + *     1/4      110      -2
 + *     1/2      111      -1
 + */
 +static inline int32_t vext_lmul(uint32_t desc)
 +{
 +    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
 +}
 +
 +static inline uint32_t vext_vm(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VM);
 +}
 +
 +static inline uint32_t vext_vma(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VMA);
 +}
 +
 +static inline uint32_t vext_vta(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VTA);
 +}
 +
 +static inline uint32_t vext_vta_all_1s(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
 +}
 +
 +/*
 + * Earlier designs (pre-0.9) had a varying number of bits
 + * per mask value (MLEN). In the 0.9 design, MLEN=1.
 + * (Section 4.5)
 + */
 +static inline int vext_elem_mask(void *v0, int index)
 +{
 +    int idx = index / 64;
 +    int pos = index  % 64;
 +    return (((uint64_t *)v0)[idx] >> pos) & 1;
 +}
 +
 +/*
 + * Get number of total elements, including prestart, body and tail elements.
 + * Note that when LMUL < 1, the tail includes the elements past VLMAX that
 + * are held in the same vector register.
 + */
 +static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
 +                                            uint32_t esz)
 +{
 +    uint32_t vlenb = simd_maxsz(desc);
 +    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
 +    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
 +                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
 +    return (vlenb << emul) / esz;
 +}
 +
 +/* set agnostic elements to 1s */
 +void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 +                       uint32_t tot);
 +
 +/* expand macro args before macro */
 +#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 +
 +/* (TD, T1, T2, TX1, TX2) */
 +#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 +#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 +#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 +#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 +
 +/* operation of two vector elements */
 +typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 +
 +#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
 +static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
 +{                                                               \
 +    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
 +    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
 +}
 +
 +void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivv2_fn *fn, uint32_t esz);
 +
 +/* generate the helpers for OPIVV */
 +#define GEN_VEXT_VV(NAME, ESZ)                            \
 +void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
 +                  void *vs2, CPURISCVState *env,          \
 +                  uint32_t desc)                          \
 +{                                                         \
 +    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
 +               do_##NAME, ESZ);                           \
 +}
 +
 +typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
 +
 +/*
 + * (T1)s1 gives the real operator type.
 + * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
 + */
 +#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
 +static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
 +{                                                                   \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
 +    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 +}
 +
 +void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivx2_fn fn, uint32_t esz);
 +
 +/* generate the helpers for OPIVX */
 +#define GEN_VEXT_VX(NAME, ESZ)                            \
 +void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
 +                  void *vs2, CPURISCVState *env,          \
 +                  uint32_t desc)                          \
 +{                                                         \
 +    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
 +               do_##NAME, ESZ);                           \
 +}
 +
 +#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "fpu/softfloat.h"
  #include "tcg/tcg-gvec-desc.h"
  #include "internals.h"
 +#include "vector_internals.h"
  #include <math.h>
  target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
      return vl;
  }
 -/*
 - * Note that vector data is stored in host-endian 64-bit chunks,
 - * so addressing units smaller than that needs a host-endian fixup.
 - */
 -#if HOST_BIG_ENDIAN
 -#define H1(x)   ((x) ^ 7)
 -#define H1_2(x) ((x) ^ 6)
 -#define H1_4(x) ((x) ^ 4)
 -#define H2(x)   ((x) ^ 3)
 -#define H4(x)   ((x) ^ 1)
 -#define H8(x)   ((x))
 -#else
 -#define H1(x)   (x)
 -#define H1_2(x) (x)
 -#define H1_4(x) (x)
 -#define H2(x)   (x)
 -#define H4(x)   (x)
 -#define H8(x)   (x)
 -#endif
 -
 -static inline uint32_t vext_nf(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, NF);
 -}
 -
 -static inline uint32_t vext_vm(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VM);
 -}
 -
 -/*
 - * Encode LMUL to lmul as following:
 - *     LMUL    vlmul    lmul
 - *      1       000       0
 - *      2       001       1
 - *      4       010       2
 - *      8       011       3
 - *      -       100       -
 - *     1/8      101      -3
 - *     1/4      110      -2
 - *     1/2      111      -1
 - */
 -static inline int32_t vext_lmul(uint32_t desc)
 -{
 -    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
 -}
 -
 -static inline uint32_t vext_vta(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VTA);
 -}
 -
 -static inline uint32_t vext_vma(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VMA);
 -}
 -
 -static inline uint32_t vext_vta_all_1s(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
 -}
 -
  /*
   * Get the maximum number of elements can be operated.
   *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
      return scale < 0 ? vlenb >> -scale : vlenb << scale;
  }
 -/*
 - * Get number of total elements, including prestart, body and tail elements.
 - * Note that when LMUL < 1, the tail includes the elements past VLMAX that
 - * are held in the same vector register.
 - */
 -static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
 -                                            uint32_t esz)
 -{
 -    uint32_t vlenb = simd_maxsz(desc);
 -    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
 -    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
 -                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
 -    return (vlenb << emul) / esz;
 -}
 -
  static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
  {
      return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
      }
  }
 -/* set agnostic elements to 1s */
 -static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 -                              uint32_t tot)
 -{
 -    if (is_agnostic == 0) {
 -        /* policy undisturbed */
 -        return;
 -    }
 -    if (tot - cnt == 0) {
 -        return;
 -    }
 -    memset(base + cnt, -1, tot - cnt);
 -}
 -
  static inline void vext_set_elem_mask(void *v0, int index,
                                        uint8_t value)
  {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
      ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
  }
 -/*
 - * Earlier designs (pre-0.9) had a varying number of bits
 - * per mask value (MLEN). In the 0.9 design, MLEN=1.
 - * (Section 4.5)
 - */
 -static inline int vext_elem_mask(void *v0, int index)
 -{
 -    int idx = index / 64;
 -    int pos = index  % 64;
 -    return (((uint64_t *)v0)[idx] >> pos) & 1;
 -}
 -
  /* elements operations for load and store */
  typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                 uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
   * Vector Integer Arithmetic Instructions
   */
 -/* expand macro args before macro */
 -#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 -
  /* (TD, T1, T2, TX1, TX2) */
  #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
  #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
  #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
  #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
 -#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 -#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 -#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 -#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
  #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
  #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
  #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
  #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 -/* operation of two vector elements */
 -typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 -
 -#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
 -static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
 -{                                                               \
 -    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
 -    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
 -}
  #define DO_SUB(N, M) (N - M)
  #define DO_RSUB(N, M) (M - N)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
  RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
  RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 -static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 -                       CPURISCVState *env, uint32_t desc,
 -                       opivv2_fn *fn, uint32_t esz)
 -{
 -    uint32_t vm = vext_vm(desc);
 -    uint32_t vl = env->vl;
 -    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    uint32_t vta = vext_vta(desc);
 -    uint32_t vma = vext_vma(desc);
 -    uint32_t i;
 -
 -    for (i = env->vstart; i < vl; i++) {
 -        if (!vm && !vext_elem_mask(v0, i)) {
 -            /* set masked-off elements to 1s */
 -            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 -            continue;
 -        }
 -        fn(vd, vs1, vs2, i);
 -    }
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 -}
 -
 -/* generate the helpers for OPIVV */
 -#define GEN_VEXT_VV(NAME, ESZ)                            \
 -void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
 -                  void *vs2, CPURISCVState *env,          \
 -                  uint32_t desc)                          \
 -{                                                         \
 -    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
 -               do_##NAME, ESZ);                           \
 -}
 -
  GEN_VEXT_VV(vadd_vv_b, 1)
  GEN_VEXT_VV(vadd_vv_h, 2)
  GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
  GEN_VEXT_VV(vsub_vv_w, 4)
  GEN_VEXT_VV(vsub_vv_d, 8)
 -typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
 -
 -/*
 - * (T1)s1 gives the real operator type.
 - * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
 - */
 -#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
 -static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
 -{                                                                   \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
 -    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 -}
  RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
  RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
  RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
  RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 -static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 -                       CPURISCVState *env, uint32_t desc,
 -                       opivx2_fn fn, uint32_t esz)
 -{
 -    uint32_t vm = vext_vm(desc);
 -    uint32_t vl = env->vl;
 -    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    uint32_t vta = vext_vta(desc);
 -    uint32_t vma = vext_vma(desc);
 -    uint32_t i;
 -
 -    for (i = env->vstart; i < vl; i++) {
 -        if (!vm && !vext_elem_mask(v0, i)) {
 -            /* set masked-off elements to 1s */
 -            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 -            continue;
 -        }
 -        fn(vd, s1, vs2, i);
 -    }
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 -}
 -
 -/* generate the helpers for OPIVX */
 -#define GEN_VEXT_VX(NAME, ESZ)                            \
 -void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
 -                  void *vs2, CPURISCVState *env,          \
 -                  uint32_t desc)                          \
 -{                                                         \
 -    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
 -               do_##NAME, ESZ);                           \
 -}
 -
  GEN_VEXT_VX(vadd_vx_b, 1)
  GEN_VEXT_VX(vadd_vx_h, 2)
  GEN_VEXT_VX(vadd_vx_w, 4)
 diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/sifive_e_aon.c
++++ b/target/riscv/vector_internals.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * SiFive HiFive1 AON (Always On Domain) for QEMU.
++ * RISC-V Vector Extension Internals
 + *
-+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#include "qemu/osdep.h"
++#include "vector_internals.h"
-+#include "qemu/timer.h"
++
-+#include "qemu/log.h"
++/* set agnostic elements to 1s */
-+#include "hw/irq.h"
++void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-+#include "hw/registerfields.h"
++                       uint32_t tot)
-+#include "hw/misc/sifive_e_aon.h"
++{
-+#include "qapi/visitor.h"
++    if (is_agnostic == 0) {
-+#include "qapi/error.h"
++        /* policy undisturbed */
 +#include "sysemu/watchdog.h"
 +#include "hw/qdev-properties.h"
 +
 +REG32(AON_WDT_WDOGCFG, 0x0)
 +    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
 +    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
 +    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
 +    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
 +    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
 +    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
 +    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
 +REG32(AON_WDT_WDOGCOUNT, 0x8)
 +    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
 +REG32(AON_WDT_WDOGS, 0x10)
 +REG32(AON_WDT_WDOGFEED, 0x18)
 +REG32(AON_WDT_WDOGKEY, 0x1c)
 +REG32(AON_WDT_WDOGCMP0, 0x20)
 +
 +static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
 +{
 +    int64_t now;
 +    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
 +        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
 +        return;
 +    }
-+
++    if (tot - cnt == 0) {
-+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
++        return ;
-+    r->wdogcount += muldiv64(now - r->wdog_restart_time,
++    }
-+                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
++    memset(base + cnt, -1, tot - cnt);
-+
++}
-+    /* Clean the most significant bit. */
++
-+    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
++void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
-+    r->wdog_restart_time = now;
++                CPURISCVState *env, uint32_t desc,
-+}
++                opivv2_fn *fn, uint32_t esz)
-+
++{
-+static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
++    uint32_t vm = vext_vm(desc);
-+{
++    uint32_t vl = env->vl;
-+    uint16_t wdogs;
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-+    bool cmp_signal = false;
++    uint32_t vta = vext_vta(desc);
-+    sifive_e_aon_wdt_update_wdogcount(r);
++    uint32_t vma = vext_vma(desc);
-+    wdogs = (uint16_t)(r->wdogcount >>
++    uint32_t i;
-+                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
++
-+
++    for (i = env->vstart; i < vl; i++) {
-+    if (wdogs >= r->wdogcmp0) {
++        if (!vm && !vext_elem_mask(v0, i)) {
-+        cmp_signal = true;
++            /* set masked-off elements to 1s */
-+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
++            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-+            r->wdogcount = 0;
++            continue;
 +            wdogs = 0;
 +        }
++        fn(vd, vs1, vs2, i);
 +    }
-+
++    env->vstart = 0;
-+    if (cmp_signal) {
++    /* set tail elements to 1s */
-+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
++    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-+            watchdog_perform_action();
++}
 +
 +void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivx2_fn fn, uint32_t esz)
 +{
 +    uint32_t vm = vext_vm(desc);
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t vma = vext_vma(desc);
 +    uint32_t i;
 +
 +    for (i = env->vstart; i < vl; i++) {
 +        if (!vm && !vext_elem_mask(v0, i)) {
 +            /* set masked-off elements to 1s */
 +            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 +            continue;
 +        }
-+        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
++        fn(vd, s1, vs2, i);
 +    }
-+
++    env->vstart = 0;
-+    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
++    /* set tail elements to 1s */
-+
++    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-+    if (wdogs < r->wdogcmp0 &&
++}
-+        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
+diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 +         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
 +        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        next += muldiv64((r->wdogcmp0 - wdogs) <<
 +                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
 +                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
 +        timer_mod(r->wdog_timer, next);
 +    } else {
 +        timer_mod(r->wdog_timer, INT64_MAX);
 +    }
 +}
 +
 +/*
 + * Callback used when the timer set using timer_mod expires.
 + */
 +static void sifive_e_aon_wdt_expired_cb(void *opaque)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
 +    sifive_e_aon_wdt_update_state(r);
 +}
 +
 +static uint64_t
 +sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
 +
 +    switch (addr) {
 +    case A_AON_WDT_WDOGCFG:
 +        return r->wdogcfg;
 +    case A_AON_WDT_WDOGCOUNT:
 +        sifive_e_aon_wdt_update_wdogcount(r);
 +        return r->wdogcount;
 +    case A_AON_WDT_WDOGS:
 +        sifive_e_aon_wdt_update_wdogcount(r);
 +        return r->wdogcount >>
 +               FIELD_EX32(r->wdogcfg,
 +                          AON_WDT_WDOGCFG,
 +                          SCALE);
 +    case A_AON_WDT_WDOGFEED:
 +        return 0;
 +    case A_AON_WDT_WDOGKEY:
 +        return r->wdogunlock;
 +    case A_AON_WDT_WDOGCMP0:
 +        return r->wdogcmp0;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +
 +    return 0;
 +}
 +
 +static void
 +sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
 +                       uint64_t val64, unsigned int size)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
 +    uint32_t value = val64;
 +
 +    switch (addr) {
 +    case A_AON_WDT_WDOGCFG: {
 +        uint8_t new_en_always;
 +        uint8_t new_en_core_awake;
 +        uint8_t old_en_always;
 +        uint8_t old_en_core_awake;
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +
 +        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
 +        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
 +        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
 +        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
 +                                       EN_CORE_AWAKE);
 +
 +        if ((old_en_always ||
 +             old_en_core_awake) == 1 &&
 +            (new_en_always ||
 +             new_en_core_awake) == 0) {
 +            sifive_e_aon_wdt_update_wdogcount(r);
 +        } else if ((old_en_always ||
 +                    old_en_core_awake) == 0 &&
 +                   (new_en_always ||
 +                    new_en_core_awake) == 1) {
 +            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        }
 +        r->wdogcfg = value;
 +        r->wdogunlock = 0;
 +        break;
 +    }
 +    case A_AON_WDT_WDOGCOUNT:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
 +        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        r->wdogunlock = 0;
 +        break;
 +    case A_AON_WDT_WDOGS:
 +        return;
 +    case A_AON_WDT_WDOGFEED:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        if (value == SIFIVE_E_AON_WDOGFEED) {
 +            r->wdogcount = 0;
 +            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        }
 +        r->wdogunlock = 0;
 +        break;
 +    case A_AON_WDT_WDOGKEY:
 +        if (value == SIFIVE_E_AON_WDOGKEY) {
 +            r->wdogunlock = 1;
 +        }
 +        break;
 +    case A_AON_WDT_WDOGCMP0:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        r->wdogcmp0 = (uint16_t) value;
 +        r->wdogunlock = 0;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
 +                      __func__, (int)addr, (int)value);
 +    }
 +    sifive_e_aon_wdt_update_state(r);
 +}
 +
 +static uint64_t
 +sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    if (addr < SIFIVE_E_AON_RTC) {
 +        return sifive_e_aon_wdt_read(opaque, addr, size);
 +    } else if (addr < SIFIVE_E_AON_MAX) {
 +        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +    return 0;
 +}
 +
 +static void
 +sifive_e_aon_write(void *opaque, hwaddr addr,
 +                   uint64_t val64, unsigned int size)
 +{
 +    if (addr < SIFIVE_E_AON_RTC) {
 +        sifive_e_aon_wdt_write(opaque, addr, val64, size);
 +    } else if (addr < SIFIVE_E_AON_MAX) {
 +        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +}
 +
 +static const MemoryRegionOps sifive_e_aon_ops = {
 +    .read = sifive_e_aon_read,
 +    .write = sifive_e_aon_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    }
 +};
 +
 +static void sifive_e_aon_reset(DeviceState *dev)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(dev);
 +
 +    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
 +    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
 +    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
 +    r->wdogcmp0 = 0xbeef;
 +
 +    sifive_e_aon_wdt_update_state(r);
 +}
 +
 +static void sifive_e_aon_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    SiFiveEAONState *r = SIFIVE_E_AON(obj);
 +
 +    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
 +                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
 +    sysbus_init_mmio(sbd, &r->mmio);
 +
 +    /* watchdog timer */
 +    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                 sifive_e_aon_wdt_expired_cb, r);
 +    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
 +    sysbus_init_irq(sbd, &r->wdog_irq);
 +}
 +
 +static Property sifive_e_aon_properties[] = {
 +    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
 +                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
 +    dc->reset = sifive_e_aon_reset;
 +    device_class_set_props(dc, sifive_e_aon_properties);
 +}
 +
 +static const TypeInfo sifive_e_aon_info = {
 +    .name          = TYPE_SIFIVE_E_AON,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(SiFiveEAONState),
 +    .instance_init = sifive_e_aon_init,
 +    .class_init    = sifive_e_aon_class_init,
 +};
 +
 +static void sifive_e_aon_register_types(void)
 +{
 +    type_register_static(&sifive_e_aon_info);
 +}
 +
 +type_init(sifive_e_aon_register_types)
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Kconfig
+--- a/target/riscv/meson.build
-+++ b/hw/misc/Kconfig
++++ b/target/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_TEST
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
- config SIFIVE_E_PRCI
+   'gdbstub.c',
-     bool
+   'op_helper.c',
+   'vector_helper.c',
-+config SIFIVE_E_AON
++  'vector_internals.c',
-+    bool
+   'bitmanip_helper.c',
-+
+   'translate.c',
- config SIFIVE_U_OTP
+   'm128_helper.c',
      bool
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
  system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
 +system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 --
-.40.1
+.41.0

-[PULL 46/54] target/riscv/kvm.c: update KVM MISA bits
+[PULL v2 09/45] target/riscv: Refactor vector-vector translation macro
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Our design philosophy with KVM properties can be resumed in two main
+Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
-decisions based on KVM interface availability and what the user wants to
+function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
-do:
+used in proceeding vector-crypto commits.
-- if the user disables an extension that the host KVM module doesn't
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-keep booting the CPU. This will avoid users having to deal with issues
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-with older KVM versions while disabling features they don't care;
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-- for any other case we're going to error out immediately. If the user
+Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
 wants to enable a feature that KVM doesn't know about this a problem that
 is worth aborting - the user must know that the feature wasn't enabled
 in the hart. Likewise, if KVM knows about the extension, the user wants
 to enable/disable it, and we fail to do it so, that's also a problem we
 can't shrug it off.
 In the case of MISA bits we won't even try enabling bits that aren't
 already available in the host. The ioctl() is so likely to fail that
 it's not worth trying. This check is already done in the previous patch,
 in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.
 In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
 option and do as follows:
 - if the user didn't set the property or set to the same value of the
 host, do nothing;
 - Disable the given extension in KVM. Error out if anything goes wrong.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
-file changed, 40 insertions(+)
+file changed, 32 insertions(+), 30 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@ GEN_OPIWX_WIDEN_TRANS(vwadd_wx)
-                "enabled in the host", misa_ext_cfg->name);
+ GEN_OPIWX_WIDEN_TRANS(vwsubu_wx)
- }
+ GEN_OPIWX_WIDEN_TRANS(vwsub_wx)
-+static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
++static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
 +                        gen_helper_gvec_4_ptr *fn, DisasContext *s)
 +{
-+    CPURISCVState *env = &cpu->env;
++    uint32_t data = 0;
-+    uint64_t id, reg;
++    TCGLabel *over = gen_new_label();
-+    int i, ret;
++    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
 +    tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +
-+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
++    data = FIELD_DP32(data, VDATA, VM, vm);
-+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
++    data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-+        target_ulong misa_bit = misa_cfg->offset;
++    data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+
++    data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+        if (!misa_cfg->user_set) {
++    data = FIELD_DP32(data, VDATA, VMA, s->vma);
-+            continue;
++    tcg_gen_gvec_4_ptr(vreg_ofs(s, vd), vreg_ofs(s, 0), vreg_ofs(s, vs1),
-+        }
++                       vreg_ofs(s, vs2), cpu_env, s->cfg_ptr->vlen / 8,
-+
++                       s->cfg_ptr->vlen / 8, data, fn);
-+        /* If we're here we're going to disable the MISA bit */
++    mark_vs_dirty(s);
-+        reg = 0;
++    gen_set_label(over);
-+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
++    return true;
 +                              misa_cfg->kvm_reg_id);
 +        ret = kvm_set_one_reg(cs, id, &reg);
 +        if (ret != 0) {
 +            /*
 +             * We're not checking for -EINVAL because if the bit is about
 +             * to be disabled, it means that it was already enabled by
 +             * KVM. We determined that by fetching the 'isa' register
 +             * during init() time. Any error at this point is worth
 +             * aborting.
 +             */
 +            error_report("Unable to set KVM reg %s, error %d",
 +                         misa_cfg->name, ret);
 +            exit(EXIT_FAILURE);
 +        }
 +        env->misa_ext &= ~misa_bit;
 +    }
 +}
 +
- static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+ /* Vector Integer Add-with-Carry / Subtract-with-Borrow Instructions */
- {
+ /* OPIVV without GVEC IR */
-     int i;
+-#define GEN_OPIVV_TRANS(NAME, CHECK)                               \
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+-{                                                                  \
-     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+-    if (CHECK(s, a)) {                                             \
-         ret = kvm_vcpu_set_machine_ids(cpu, cs);
+-        uint32_t data = 0;                                         \
-+        if (ret != 0) {
+-        static gen_helper_gvec_4_ptr * const fns[4] = {            \
-+            return ret;
+-            gen_helper_##NAME##_b, gen_helper_##NAME##_h,          \
-+        }
+-            gen_helper_##NAME##_w, gen_helper_##NAME##_d,          \
-     }
+-        };                                                         \
+-        TCGLabel *over = gen_new_label();                          \
-+    kvm_riscv_update_cpu_misa_ext(cpu, cs);
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
-+
+-        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
-     return ret;
+-                                                                   \
 -        data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
 -        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
 -        data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
 -        data =                                                     \
 -            FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
 -        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
 -        tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
 -                           vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env,           \
 -                           s->cfg_ptr->vlen / 8,                   \
 -                           s->cfg_ptr->vlen / 8, data,             \
 -                           fns[s->sew]);                           \
 -        mark_vs_dirty(s);                                          \
 -        gen_set_label(over);                                       \
 -        return true;                                               \
 -    }                                                              \
 -    return false;                                                  \
 +#define GEN_OPIVV_TRANS(NAME, CHECK)                                     \
 +static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
 +{                                                                        \
 +    if (CHECK(s, a)) {                                                   \
 +        static gen_helper_gvec_4_ptr * const fns[4] = {                  \
 +            gen_helper_##NAME##_b, gen_helper_##NAME##_h,                \
 +            gen_helper_##NAME##_w, gen_helper_##NAME##_d,                \
 +        };                                                               \
 +        return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s);\
 +    }                                                                    \
 +    return false;                                                        \
  }
+ /*
 --
-.40.1
+.41.0

-[PULL 09/54] target/riscv: Make MPV only work when MPP != PRV_M
+[PULL v2 10/45] target/riscv: Remove redundant "cpu_vl == 0" checks
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
+Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.
 when MPP=PRV_M.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
+Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 3 ++-
+ target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
- target/riscv/op_helper.c  | 3 ++-
+file changed, 1 insertion(+), 30 deletions(-)
 files changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
+     TCGv_i32 desc;
-         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
-             mode = get_field(env->mstatus, MSTATUS_MPP);
+     TCGLabel *over = gen_new_label();
--            virt = get_field(env->mstatus, MSTATUS_MPV);
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+            virt = get_field(env->mstatus, MSTATUS_MPV) &&
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+                   (mode != PRV_M);
-             if (virt) {
+     dest = tcg_temp_new_ptr();
-                 status = env->vsstatus;
+@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
-             }
+     TCGv_i32 desc;
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
+     TCGLabel *over = gen_new_label();
---- a/target/riscv/op_helper.c
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+++ b/target/riscv/op_helper.c
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
-         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
+     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
          return false;
      }
--    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+                             (prev_priv != PRV_M);
-     mstatus = set_field(mstatus, MSTATUS_MIE,
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
-                         get_field(mstatus, MSTATUS_MPIE));
+@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
-     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
+     uint32_t data = 0;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
      uint32_t data = 0;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
      if (checkfn(s, a)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
      if (opiwv_widen_check(s, a)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
  {
      uint32_t data = 0;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      data = FIELD_DP32(data, VDATA, VM, vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
              gen_helper_##NAME##_w,                                 \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                  gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
          vext_check_ss(s, a->rd, 0, 1)) {
          TCGv s1;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                  gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      TCGv_i64 t1;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
          };                                                       \
          TCGLabel *over = gen_new_label();                        \
          gen_set_rm(s, RISCV_FRM_DYN);                            \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                   \
          data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
          gen_set_rm_chkfrm(s, rm);
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                  gen_helper_vmv_v_x_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
          uint32_t data = 0;                                         \
          gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
          TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
          require_vm(a->vm, a->rd)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
          TCGv s1;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
          TCGv_i64 t1;
          TCGLabel *over = gen_new_label();
 -        /* if vl == 0 or vstart >= vl, skip vector register write back */
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
 +        /* if vstart >= vl, skip vector register write back */
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
      uint32_t data = 0;
      gen_helper_gvec_3_ptr *fn;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      static gen_helper_gvec_3_ptr * const fns[6][4] = {
 --
-.40.1
+.41.0

-[PULL 54/54] riscv: Add support for the Zfa extension
+[PULL v2 11/45] target/riscv: Add Zvbc ISA extension support
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-This patch introduces the RISC-V Zfa extension, which introduces
+This commit adds support for the Zvbc vector-crypto extension, which
-additional floating-point instructions:
+consists of the following instructions:
-* fli (load-immediate) with pre-defined immediates
-* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
+* vclmulh.[vx,vv]
-* fround/froundmx (round to integer)
+* vclmul.[vx,vv]
-* fcvtmod.w.d (Modular Convert-to-Integer)
-* fmv* to access high bits of float register bigger than XLEN
+Translation functions are defined in
-* Quiet comparison instructions (fleq/fltq)
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
+`target/riscv/vcrypto_helper.c`.
-Zfa defines its instructions in combination with the following extensions:
-* single-precision floating-point (F)
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-* double-precision floating-point (D)
+Co-authored-by: Max Chou <max.chou@sifive.com>
-* quad-precision floating-point (Q)
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-* half-precision floating-point (Zfh)
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Since QEMU does not support the RISC-V quad-precision floating-point
+[max.chou@sifive.com: Exposed x-zvbc property]
-ISA extension (Q), this patch does not include the instructions that
+Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
 depend on this extension. All other instructions are included in this
 patch.
 The Zfa specification can be found here:
   https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
 The Zfa specifciation is frozen and is in public review since May 3, 2023:
   https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg
 The patch also includes a TCG test for the fcvtmod.w.d instruction.
 The test cases test for correct results and flag behaviour.
 Note, that the Zfa specification requires fcvtmod's flag behaviour
 to be identical to a fcvt with the same operands (which is also
 tested).
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.h                             |   3 +
+ target/riscv/cpu_cfg.h                   |  1 +
- target/riscv/cpu_cfg.h                    |   1 +
+ target/riscv/helper.h                    |  6 +++
- target/riscv/helper.h                     |  19 +
+ target/riscv/insn32.decode               |  6 +++
- target/riscv/insn32.decode                |  26 ++
+ target/riscv/cpu.c                       |  9 ++++
- disas/riscv.c                             | 139 ++++++
+ target/riscv/translate.c                 |  1 +
- target/riscv/cpu.c                        |   8 +
+ target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
- target/riscv/fpu_helper.c                 | 154 +++++++
+ target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
- target/riscv/translate.c                  |   1 +
+ target/riscv/meson.build                 |  3 +-
- tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
+files changed, 146 insertions(+), 1 deletion(-)
- target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
+ create mode 100644 target/riscv/vcrypto_helper.c
- tests/tcg/riscv64/Makefile.target         |   6 +
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc
-files changed, 1223 insertions(+)
  create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
  create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc
 diff --git a/disas/riscv.h b/disas/riscv.h
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.h
 +++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      rv_codec_r_imm2,
      rv_codec_r2_immhl,
      rv_codec_r2_imm2_imm5,
 +    rv_codec_fli,
  } rv_codec;
  /* structures */
@@ -XXX,XX +XXX,XX @@ enum {
  #define rv_fmt_rd_offset              "O\t0,o"
  #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
  #define rv_fmt_frd_rs1                "O\t3,1"
 +#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
  #define rv_fmt_frd_frs1               "O\t3,4"
  #define rv_fmt_rd_frs1                "O\t0,4"
  #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
@@ -XXX,XX +XXX,XX @@ enum {
  #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
  #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
  #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
 +#define rv_fmt_fli                    "O\t3,h"
  #endif /* DISAS_RISCV_H */
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svpbmt;
+     bool ext_zve32f;
-     bool ext_zdinx;
+     bool ext_zve64f;
-     bool ext_zawrs;
+     bool ext_zve64d;
-+    bool ext_zfa;
++    bool ext_zvbc;
-     bool ext_zfbfmin;
+     bool ext_zmmul;
-     bool ext_zfh;
+     bool ext_zvfbfmin;
-     bool ext_zfhmin;
+     bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
- DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
- DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+ DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
- DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+ DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
-+DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
++
- DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
++/* Vector crypto functions */
-+DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
++DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
- DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
++DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
- DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
++DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
-+DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
++DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Floating Point - Double Precision */
  DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 +DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Bitmanip */
  DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Cache-block operations */
  DEF_HELPER_2(cbo_clean_flush, void, env, tl)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
+@@ -XXX,XX +XXX,XX @@ vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
- bset       0010100 .......... 001 ..... 0110011 @r
+ # *** Zvfbfwma Standard Extension ***
- bseti      00101. ........... 001 ..... 0010011 @sh
+ vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
+ vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
-+# *** Zfa Standard Extension ***
++
-+fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
++# *** Zvbc vector crypto extension ***
-+fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
++vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
-+fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
++vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
-+fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
++vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
-+fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
++vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 +fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
 +fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
 +fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
 +fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
 +fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
 +fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
 +fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
 +fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
 +fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
 +fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
 +fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
 +fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
 +fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
 +fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
 +fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
 +fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
 +
  # *** RV32 Zfh Extension ***
  flh        ............   ..... 001 ..... 0000111 @i
  fsh        .......  ..... ..... 001 ..... 0100111 @s
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
      rv_op_fsh = 798,
      rv_op_fmv_h_x = 799,
      rv_op_fmv_x_h = 800,
 +    rv_op_fli_s = 801,
 +    rv_op_fli_d = 802,
 +    rv_op_fli_q = 803,
 +    rv_op_fli_h = 804,
 +    rv_op_fminm_s = 805,
 +    rv_op_fmaxm_s = 806,
 +    rv_op_fminm_d = 807,
 +    rv_op_fmaxm_d = 808,
 +    rv_op_fminm_q = 809,
 +    rv_op_fmaxm_q = 810,
 +    rv_op_fminm_h = 811,
 +    rv_op_fmaxm_h = 812,
 +    rv_op_fround_s = 813,
 +    rv_op_froundnx_s = 814,
 +    rv_op_fround_d = 815,
 +    rv_op_froundnx_d = 816,
 +    rv_op_fround_q = 817,
 +    rv_op_froundnx_q = 818,
 +    rv_op_fround_h = 819,
 +    rv_op_froundnx_h = 820,
 +    rv_op_fcvtmod_w_d = 821,
 +    rv_op_fmvh_x_d = 822,
 +    rv_op_fmvp_d_x = 823,
 +    rv_op_fmvh_x_q = 824,
 +    rv_op_fmvp_q_x = 825,
 +    rv_op_fleq_s = 826,
 +    rv_op_fltq_s = 827,
 +    rv_op_fleq_d = 828,
 +    rv_op_fltq_d = 829,
 +    rv_op_fleq_q = 830,
 +    rv_op_fltq_q = 831,
 +    rv_op_fleq_h = 832,
 +    rv_op_fltq_h = 833,
  } rv_op;
  /* register names */
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
      "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
  };
 +/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
 + * The constants use the hex floating-point literal representation
 + * that is printed when using the printf %a format specifier,
 + * which matches the output that is generated by the disassembler.
 + */
 +static const char rv_fli_name_const[32][9] =
 +{
 +    "0x1p+0", "min", "0x1p-16", "0x1p-15",
 +    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
 +    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
 +    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
 +    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
 +    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
 +    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
 +    "0x1p+15", "0x1p+16", "inf", "nan"
 +};
 +
  /* pseudo-instruction constraints */
  static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
      { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
      { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
      { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
  };
  /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_s; break;
                  case 1: op = rv_op_fmax_s; break;
 +                case 2: op = rv_op_fminm_s; break;
 +                case 3: op = rv_op_fmaxm_s; break;
                  }
                  break;
              case 21:
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_d; break;
                  case 1: op = rv_op_fmax_d; break;
 +                case 2: op = rv_op_fminm_d; break;
 +                case 3: op = rv_op_fmaxm_d; break;
 +                }
 +                break;
 +            case 22:
 +                switch (((inst >> 12) & 0b111)) {
 +                case 2: op = rv_op_fminm_h; break;
 +                case 3: op = rv_op_fmaxm_h; break;
                  }
                  break;
              case 23:
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_q; break;
                  case 1: op = rv_op_fmax_q; break;
 +                case 2: op = rv_op_fminm_q; break;
 +                case 3: op = rv_op_fmaxm_q; break;
                  }
                  break;
              case 32:
                  switch ((inst >> 20) & 0b11111) {
                  case 1: op = rv_op_fcvt_s_d; break;
                  case 3: op = rv_op_fcvt_s_q; break;
 +                case 4: op = rv_op_fround_s; break;
 +                case 5: op = rv_op_froundnx_s; break;
                  case 6: op = rv_op_fcvt_s_bf16; break;
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_d_s; break;
                  case 3: op = rv_op_fcvt_d_q; break;
 +                case 4: op = rv_op_fround_d; break;
 +                case 5: op = rv_op_froundnx_d; break;
                  }
                  break;
              case 34:
                  switch (((inst >> 20) & 0b11111)) {
 +                case 4: op = rv_op_fround_h; break;
 +                case 5: op = rv_op_froundnx_h; break;
                  case 8: op = rv_op_fcvt_bf16_s; break;
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_q_s; break;
                  case 1: op = rv_op_fcvt_q_d; break;
 +                case 4: op = rv_op_fround_q; break;
 +                case 5: op = rv_op_froundnx_q; break;
                  }
                  break;
              case 44:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_s; break;
                  case 1: op = rv_op_flt_s; break;
                  case 2: op = rv_op_feq_s; break;
 +                case 4: op = rv_op_fleq_s; break;
 +                case 5: op = rv_op_fltq_s; break;
                  }
                  break;
              case 81:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_d; break;
                  case 1: op = rv_op_flt_d; break;
                  case 2: op = rv_op_feq_d; break;
 +                case 4: op = rv_op_fleq_d; break;
 +                case 5: op = rv_op_fltq_d; break;
 +                }
 +                break;
 +            case 82:
 +                switch (((inst >> 12) & 0b111)) {
 +                case 4: op = rv_op_fleq_h; break;
 +                case 5: op = rv_op_fltq_h; break;
                  }
                  break;
              case 83:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_q; break;
                  case 1: op = rv_op_flt_q; break;
                  case 2: op = rv_op_feq_q; break;
 +                case 4: op = rv_op_fleq_q; break;
 +                case 5: op = rv_op_fltq_q; break;
 +                }
 +                break;
 +            case 89:
 +        switch (((inst >> 12) & 0b111)) {
 +                case 0: op = rv_op_fmvp_d_x; break;
 +                }
 +                break;
 +            case 91:
 +        switch (((inst >> 12) & 0b111)) {
 +                case 0: op = rv_op_fmvp_q_x; break;
                  }
                  break;
              case 96:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 1: op = rv_op_fcvt_wu_d; break;
                  case 2: op = rv_op_fcvt_l_d; break;
                  case 3: op = rv_op_fcvt_lu_d; break;
 +                case 8: op = rv_op_fcvtmod_w_d; break;
                  }
                  break;
              case 99:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_x_d; break;
                  case 1: op = rv_op_fclass_d; break;
 +                case 8: op = rv_op_fmvh_x_d; break;
                  }
                  break;
              case 114:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_x_q; break;
                  case 1: op = rv_op_fclass_q; break;
 +                case 8: op = rv_op_fmvh_x_q; break;
                  }
                  break;
              case 120:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_s_x; break;
 +                case 8: op = rv_op_fli_s; break;
                  }
                  break;
              case 121:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_d_x; break;
 +                case 8: op = rv_op_fli_d; break;
                  }
                  break;
              case 122:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_h_x; break;
 +                case 8: op = rv_op_fli_h; break;
                  }
                  break;
              case 123:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_q_x; break;
 +                case 8: op = rv_op_fli_q; break;
                  }
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
          break;
      case rv_codec_zcmt_jt:
          dec->imm = operand_tbl_index(inst);
 +    break;
 +    case rv_codec_fli:
 +        dec->rd = operand_rd(inst);
 +        dec->imm = operand_rs1(inst);
          break;
      case rv_codec_r2_imm5:
          dec->rd = operand_rd(inst);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
              append(buf, tmp, buflen);
              break;
          }
 +        case 'h':
 +            append(buf, rv_fli_name_const[dec->imm], buflen);
 +            break;
          default:
              break;
          }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
+     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
-     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
-     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
-+    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
++    ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
-     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
      set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
      env->priv_ver = PRIV_VERSION_1_11_0;
 +    cpu->cfg.ext_zfa = true;
      cpu->cfg.ext_zfh = true;
      cpu->cfg.mmu = true;
      cpu->cfg.ext_xtheadba = true;
 @@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-+    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
++    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-+        error_setg(errp, "Zfa extension requires F extension");
++        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +        return;
 +    }
 +
-     if (cpu->cfg.ext_zfh) {
+     if (cpu->cfg.ext_zk) {
-         cpu->cfg.ext_zfhmin = true;
+         cpu->cfg.ext_zkn = true;
-     }
+         cpu->cfg.ext_zkr = true;
 @@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+     DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
-     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
+     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
-     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
-+    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
++    /* Vector cryptography extensions */
-     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
++    DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
-     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
++
-     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
+     DEFINE_PROP_END_OF_LIST(),
-diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
+ };
-index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/fpu_helper.c
 +++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float32_minimum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    float32 ret = float32_min(frs1, frs2, &env->fp_status);
 +    return nanbox_s(env, ret);
 +}
 +
  uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float32_maximum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    float32 ret = float32_max(frs1, frs2, &env->fp_status);
 +    return nanbox_s(env, ret);
 +}
 +
  uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float32_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return float32_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float32_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return float32_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
      return fclass_s(frs1);
  }
 +uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +
 +    frs1 = float32_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return nanbox_s(env, frs1);
 +}
 +
 +uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    frs1 = float32_round_to_int(frs1, &env->fp_status);
 +    return nanbox_s(env, frs1);
 +}
 +
  uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_add(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
             float64_minimum_number(frs1, frs2, &env->fp_status);
  }
 +uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_min(frs1, frs2, &env->fp_status);
 +}
 +
  uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
             float64_maximum_number(frs1, frs2, &env->fp_status);
  }
 +uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_max(frs1, frs2, &env->fp_status);
 +}
 +
  uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
  {
      return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
      return float64_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
      return float64_to_int32(frs1, &env->fp_status);
  }
 +uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
 +{
 +    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
 +}
 +
  target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
  {
      return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
      return fclass_d(frs1);
  }
 +uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +
 +    frs1 = float64_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return frs1;
 +}
 +
 +uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
 +{
 +    return float64_round_to_int(frs1, &env->fp_status);
 +}
 +
  uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float16_minimum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 ret = float16_min(frs1, frs2, &env->fp_status);
 +    return nanbox_h(env, ret);
 +}
 +
  uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float16_maximum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 ret = float16_max(frs1, frs2, &env->fp_status);
 +    return nanbox_h(env, ret);
 +}
 +
  uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float16_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return float16_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float16_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return float16_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
      return fclass_h(frs1);
  }
 +uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +
 +    frs1 = float16_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return nanbox_h(env, frs1);
 +}
 +
 +uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
 +{
 +    float16 frs1 = check_nanbox_s(env, rs1);
 +    frs1 = float16_round_to_int(frs1, &env->fp_status);
 +    return nanbox_h(env, frs1);
 +}
 +
  target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
 @@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
- #include "insn_trans/trans_rvzicond.c.inc"
+ #include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvzawrs.c.inc"
  #include "insn_trans/trans_rvzicbo.c.inc"
 +#include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvzfh.c.inc"
  #include "insn_trans/trans_rvk.c.inc"
++#include "insn_trans/trans_rvvk.c.inc"
  #include "insn_trans/trans_privileged.c.inc"
-diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
+ #include "insn_trans/trans_svinval.c.inc"
  #include "insn_trans/trans_rvbf16.c.inc"
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/tcg/riscv64/test-fcvtmod.c
++++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <stddef.h>
 +#include <stdint.h>
 +
 +#define FFLAG_NX_SHIFT 0 /* inexact */
 +#define FFLAG_UF_SHIFT 1 /* underflow */
 +#define FFLAG_OF_SHIFT 2 /* overflow */
 +#define FFLAG_DZ_SHIFT 3 /* divide by zero */
 +#define FFLAG_NV_SHIFT 4 /* invalid operation */
 +
 +#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
 +#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
 +#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
 +#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
 +#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
 +
 +typedef struct fp64_fcvt_fcvtmod_testcase {
 +    const char* name;
 +    union {
 +        uint64_t inp_lu;
 +        double inp_lf;
 +    };
 +    uint64_t exp_fcvt;
 +    uint8_t exp_fcvt_fflags;
 +    uint64_t exp_fcvtmod;
 +    uint8_t exp_fcvtmod_fflags;
 +} fp64_fcvt_fcvtmod_testcase_t;
 +
 +void print_fflags(uint8_t fflags)
 +{
 +    int set = 0;
 +
 +    if (fflags == 0) {
 +        printf("-");
 +        return;
 +    }
 +
 +    if (fflags & FFLAG_NV) {
 +        printf("%sFFLAG_NV", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_DZ) {
 +        printf("%sFFLAG_DZ", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_OF) {
 +        printf("%sFFLAG_OF", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_UF) {
 +        printf("%sFFLAG_UF", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_NX) {
 +        printf("%sFFLAG_NX", set ? " | " : "");
 +        set = 1;
 +    }
 +}
 +
 +/* Clear all FP flags. */
 +static inline void clear_fflags()
 +{
 +    __asm__ __volatile__("fsflags zero");
 +}
 +
 +/* Read all FP flags. */
 +static inline uint8_t get_fflags()
 +{
 +    uint64_t v;
 +    __asm__ __volatile__("frflags %0" : "=r"(v));
 +    return (uint8_t)v;
 +}
 +
 +/* Move input value (without conversations) into an FP register. */
 +static inline double do_fmv_d_x(uint64_t inp)
 +{
 +    double fpr;
 +    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
 +    return fpr;
 +}
 +
 +static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
 +{
 +    uint64_t ret;
 +    double fpr = do_fmv_d_x(inp);
 +
 +    clear_fflags();
 +
 +    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
 +
 +    *fflags = get_fflags();
 +
 +    return ret;
 +}
 +
 +static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
 +{
 +    uint64_t ret;
 +    double fpr = do_fmv_d_x(inp);
 +
 +    clear_fflags();
 +
 +    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
 +    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
 +
 +    *fflags = get_fflags();
 +
 +    return ret;
 +}
 +
 +static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
 +    /* Zero (exp=0, frac=0) */
 +    { .name = "+0.0",
 +      .inp_lf = 0x0p0,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000000,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-0.0",
 +      .inp_lf = -0x0p0,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000000,
 +      .exp_fcvtmod_fflags = 0 },
 +
 +    /* Subnormal: exp=0 frac!=0 */
 +    { .name = "Subnormal frac=1",
 +      .inp_lu = 0x0000000000000001,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Subnormal frac=0xf..f",
 +      .inp_lu = 0x0000ffffffffffff,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Neg subnormal frac=1",
 +      .inp_lu = 0x0000000000000001,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Neg subnormal frac=0xf..f",
 +      .inp_lu = 0x8000ffffffffffff,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    /* Infinity: exp=0x7ff, frac=0 */
 +    { .name = "+INF",
 +      .inp_lu = 0x7ff0000000000000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 max */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "-INF",
 +      .inp_lu = 0xfff0000000000000,
 +      .exp_fcvt = 0xffffffff80000000, /* int32 min */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    /* NaN: exp=7ff, frac!=0 */
 +    { .name = "canonical NaN",
 +      .inp_lu = 0x7ff8000000000000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 max */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "non-canonical NaN",
 +      .inp_lu = 0x7ff8000000100000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 min */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    /* Normal numbers: exp!=0, exp!=7ff */
 +    { .name = "+smallest normal value",
 +      .inp_lu = 0x0010000000000000,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-smallest normal value",
 +      .inp_lu = 0x8010000000000000,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+0.5",
 +      .inp_lf = 0x1p-1,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-0.5",
 +      .inp_lf = -0x1p-1,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+value just below 1.0",
 +      .inp_lu = 0x3fefffffffffffff,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-value just above -1.0",
 +      .inp_lu = 0xbfefffffffffffff,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+1.0",
 +      .inp_lf = 0x1p0,
 +      .exp_fcvt = 0x0000000000000001,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000001,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-1.0",
 +      .inp_lf = -0x1p0,
 +      .exp_fcvt = 0xffffffffffffffff,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0xffffffffffffffff,
 +      .exp_fcvtmod_fflags = 0 },
 +
 +    { .name = "+1.5",
 +      .inp_lu = 0x3ff8000000000000,
 +      .exp_fcvt = 1,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 1,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-1.5",
 +      .inp_lu = 0xbff8000000000000,
 +      .exp_fcvt = 0xffffffffffffffff,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0xffffffffffffffff,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+max int32 (2147483647)",
 +      .inp_lu = 0x41dfffffffc00000,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x000000007fffffff,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "+max int32 +1 (2147483648)",
 +      .inp_lf = 0x1p31,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "+max int32 +2 (2147483649)",
 +      .inp_lu = 0x41e0000000200000,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    { .name = "-max int32 (-2147483648)",
 +      .inp_lf = -0x1p31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0xffffffff80000000,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-max int32 -1 (-2147483649)",
 +      .inp_lf = -0x1.00000002p+31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 2147483647, /* int32 max */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "-max int32 -2 (-2147483650)",
 +      .inp_lf = -0x1.00000004p+31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 2147483646, /* int32 max -1 */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +};
 +
 +int run_fcvtmod_tests()
 +{
 +    uint64_t act_fcvt;
 +    uint8_t act_fcvt_fflags;
 +    uint64_t act_fcvtmod;
 +    uint8_t act_fcvtmod_fflags;
 +
 +    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
 +        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
 +
 +        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
 +        int fcvt_correct = act_fcvt == t->exp_fcvt &&
 +                    act_fcvt_fflags == t->exp_fcvt_fflags;
 +        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
 +        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
 +                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
 +
 +        if (fcvt_correct && fcvtmod_correct) {
 +            continue;
 +        }
 +
 +        printf("Test %zu (%s) failed!\n", i, t->name);
 +
 +        double fpr = do_fmv_d_x(t->inp_lu);
 +        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
 +        printf("inp_lf: %lf\n", t->inp_lf);
 +
 +        uint32_t sign = (t->inp_lu >> 63);
 +        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
 +        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
 +        int true_exp = exp - 1023;
 +        int shift = true_exp - 52;
 +        uint64_t true_frac = frac | 1ull << 52;
 +
 +        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
 +        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
 +
 +        if (!fcvt_correct) {
 +            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
 +            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
 +            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
 +            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
 +        }
 +
 +        if (!fcvtmod_correct) {
 +            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
 +            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
 +            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
 +            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
 +        }
 +
 +        return 1;
 +    }
 +
 +    return 0;
 +}
 +
 +int main()
 +{
 +    return run_fcvtmod_tests();
 +}
 diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V translation routines for the Zfa Standard Extension.
++ * RISC-V Vector Crypto Extension Helpers for QEMU.
 + *
-+ * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
++ * Copyright (C) 2023 SiFive, Inc.
 + * Written by Codethink Ltd and SiFive.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#define REQUIRE_ZFA(ctx) do {     \
++#include "qemu/osdep.h"
-+    if (!ctx->cfg_ptr->ext_zfa) { \
++#include "qemu/host-utils.h"
-+        return false;             \
++#include "qemu/bitops.h"
-+    }                             \
++#include "cpu.h"
-+} while (0)
++#include "exec/memop.h"
-+
++#include "exec/exec-all.h"
-+#define REQUIRE_ZFH(ctx) do {     \
++#include "exec/helper-proto.h"
-+    if (!ctx->cfg_ptr->ext_zfh) { \
++#include "internals.h"
-+        return false;             \
++#include "vector_internals.h"
-+    }                             \
++
-+} while (0)
++static uint64_t clmul64(uint64_t y, uint64_t x)
-+
++{
-+static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
++    uint64_t result = 0;
-+{
++    for (int j = 63; j >= 0; j--) {
-+    REQUIRE_FPU;
++        if ((y >> j) & 1) {
-+    REQUIRE_ZFA(ctx);
++            result ^= (x << j);
-+    REQUIRE_EXT(ctx, RVF);
++        }
-+
++    }
-+    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
++    return result;
-+    static const uint64_t fli_s_table[] = {
++}
-+        0xffffffffbf800000,  /* -1.0 */
++
-+        0xffffffff00800000,  /* minimum positive normal */
++static uint64_t clmulh64(uint64_t y, uint64_t x)
-+        0xffffffff37800000,  /* 1.0 * 2^-16 */
++{
-+        0xffffffff38000000,  /* 1.0 * 2^-15 */
++    uint64_t result = 0;
-+        0xffffffff3b800000,  /* 1.0 * 2^-8  */
++    for (int j = 63; j >= 1; j--) {
-+        0xffffffff3c000000,  /* 1.0 * 2^-7  */
++        if ((y >> j) & 1) {
-+        0xffffffff3d800000,  /* 1.0 * 2^-4  */
++            result ^= (x >> (64 - j));
-+        0xffffffff3e000000,  /* 1.0 * 2^-3  */
++        }
-+        0xffffffff3e800000,  /* 0.25 */
++    }
-+        0xffffffff3ea00000,  /* 0.3125 */
++    return result;
-+        0xffffffff3ec00000,  /* 0.375 */
++}
-+        0xffffffff3ee00000,  /* 0.4375 */
++
-+        0xffffffff3f000000,  /* 0.5 */
++RVVCALL(OPIVV2, vclmul_vv, OP_UUU_D, H8, H8, H8, clmul64)
-+        0xffffffff3f200000,  /* 0.625 */
++GEN_VEXT_VV(vclmul_vv, 8)
-+        0xffffffff3f400000,  /* 0.75 */
++RVVCALL(OPIVX2, vclmul_vx, OP_UUU_D, H8, H8, clmul64)
-+        0xffffffff3f600000,  /* 0.875 */
++GEN_VEXT_VX(vclmul_vx, 8)
-+        0xffffffff3f800000,  /* 1.0 */
++RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
-+        0xffffffff3fa00000,  /* 1.25 */
++GEN_VEXT_VV(vclmulh_vv, 8)
-+        0xffffffff3fc00000,  /* 1.5 */
++RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
-+        0xffffffff3fe00000,  /* 1.75 */
++GEN_VEXT_VX(vclmulh_vx, 8)
-+        0xffffffff40000000,  /* 2.0 */
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
-+        0xffffffff40200000,  /* 2.5 */
+new file mode 100644
-+        0xffffffff40400000,  /* 3 */
+index XXXXXXX..XXXXXXX
-+        0xffffffff40800000,  /* 4 */
+--- /dev/null
-+        0xffffffff41000000,  /* 8 */
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
-+        0xffffffff41800000,  /* 16 */
+@@ -XXX,XX +XXX,XX @@
-+        0xffffffff43000000,  /* 2^7 */
++/*
-+        0xffffffff43800000,  /* 2^8 */
++ * RISC-V translation routines for the vector crypto extension.
-+        0xffffffff47000000,  /* 2^15 */
++ *
-+        0xffffffff47800000,  /* 2^16 */
++ * Copyright (C) 2023 SiFive, Inc.
-+        0xffffffff7f800000,  /* +inf */
++ * Written by Codethink Ltd and SiFive.
-+        0xffffffff7fc00000,  /* Canonical NaN */
++ *
-+    };
++ * This program is free software; you can redistribute it and/or modify it
-+
++ * under the terms and conditions of the GNU General Public License,
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++ * version 2 or later, as published by the Free Software Foundation.
-+    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
++ *
-+    gen_set_fpr_hs(ctx, a->rd, dest);
++ * This program is distributed in the hope it will be useful, but WITHOUT
-+
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+    mark_fs_dirty(ctx);
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+    return true;
++ * more details.
-+}
++ *
-+
++ * You should have received a copy of the GNU General Public License along with
-+static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+{
++ */
-+    REQUIRE_FPU;
++
-+    REQUIRE_ZFA(ctx);
++/*
-+    REQUIRE_EXT(ctx, RVD);
++ * Zvbc
-+
++ */
-+    static const uint64_t fli_d_table[] = {
++
-+        0xbff0000000000000,  /* -1.0 */
++#define GEN_VV_MASKED_TRANS(NAME, CHECK)                     \
-+        0x0010000000000000,  /* minimum positive normal */
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+        0x3ef0000000000000,  /* 1.0 * 2^-16 */
++    {                                                        \
-+        0x3f00000000000000,  /* 1.0 * 2^-15 */
++        if (CHECK(s, a)) {                                   \
-+        0x3f70000000000000,  /* 1.0 * 2^-8  */
++            return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, \
-+        0x3f80000000000000,  /* 1.0 * 2^-7  */
++                               gen_helper_##NAME, s);        \
-+        0x3fb0000000000000,  /* 1.0 * 2^-4  */
++        }                                                    \
-+        0x3fc0000000000000,  /* 1.0 * 2^-3  */
++        return false;                                        \
-+        0x3fd0000000000000,  /* 0.25 */
++    }
-+        0x3fd4000000000000,  /* 0.3125 */
++
-+        0x3fd8000000000000,  /* 0.375 */
++static bool vclmul_vv_check(DisasContext *s, arg_rmrr *a)
-+        0x3fdc000000000000,  /* 0.4375 */
++{
-+        0x3fe0000000000000,  /* 0.5 */
++    return opivv_check(s, a) &&
-+        0x3fe4000000000000,  /* 0.625 */
++           s->cfg_ptr->ext_zvbc == true &&
-+        0x3fe8000000000000,  /* 0.75 */
++           s->sew == MO_64;
-+        0x3fec000000000000,  /* 0.875 */
++}
-+        0x3ff0000000000000,  /* 1.0 */
++
-+        0x3ff4000000000000,  /* 1.25 */
++GEN_VV_MASKED_TRANS(vclmul_vv, vclmul_vv_check)
-+        0x3ff8000000000000,  /* 1.5 */
++GEN_VV_MASKED_TRANS(vclmulh_vv, vclmul_vv_check)
-+        0x3ffc000000000000,  /* 1.75 */
++
-+        0x4000000000000000,  /* 2.0 */
++#define GEN_VX_MASKED_TRANS(NAME, CHECK)                     \
-+        0x4004000000000000,  /* 2.5 */
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+        0x4008000000000000,  /* 3 */
++    {                                                        \
-+        0x4010000000000000,  /* 4 */
++        if (CHECK(s, a)) {                                   \
-+        0x4020000000000000,  /* 8 */
++            return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, \
-+        0x4030000000000000,  /* 16 */
++                               gen_helper_##NAME, s);        \
-+        0x4060000000000000,  /* 2^7 */
++        }                                                    \
-+        0x4070000000000000,  /* 2^8 */
++        return false;                                        \
-+        0x40e0000000000000,  /* 2^15 */
++    }
-+        0x40f0000000000000,  /* 2^16 */
++
-+        0x7ff0000000000000,  /* +inf */
++static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
-+        0x7ff8000000000000,  /* Canonical NaN */
++{
-+    };
++    return opivx_check(s, a) &&
-+
++           s->cfg_ptr->ext_zvbc == true &&
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++           s->sew == MO_64;
-+    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
++}
-+    gen_set_fpr_d(ctx, a->rd, dest);
++
-+
++GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
-+    mark_fs_dirty(ctx);
++GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
-+    return true;
+diff --git a/target/riscv/meson.build b/target/riscv/meson.build
-+}
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/riscv/meson.build
-+static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
++++ b/target/riscv/meson.build
-+{
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
-+    REQUIRE_FPU;
+   'translate.c',
-+    REQUIRE_ZFA(ctx);
+   'm128_helper.c',
-+    REQUIRE_ZFH(ctx);
+   'crypto_helper.c',
-+
+-  'zce_helper.c'
-+    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
++  'zce_helper.c',
-+    static const uint64_t fli_h_table[] = {
++  'vcrypto_helper.c'
-+        0xffffffffffffbc00,  /* -1.0 */
+ ))
-+        0xffffffffffff0400,  /* minimum positive normal */
+ riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
-+        0xffffffffffff0100,  /* 1.0 * 2^-16 */
 +        0xffffffffffff0200,  /* 1.0 * 2^-15 */
 +        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
 +        0xffffffffffff2000,  /* 1.0 * 2^-7  */
 +        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
 +        0xffffffffffff3000,  /* 1.0 * 2^-3  */
 +        0xffffffffffff3400,  /* 0.25 */
 +        0xffffffffffff3500,  /* 0.3125 */
 +        0xffffffffffff3600,  /* 0.375 */
 +        0xffffffffffff3700,  /* 0.4375 */
 +        0xffffffffffff3800,  /* 0.5 */
 +        0xffffffffffff3900,  /* 0.625 */
 +        0xffffffffffff3a00,  /* 0.75 */
 +        0xffffffffffff3b00,  /* 0.875 */
 +        0xffffffffffff3c00,  /* 1.0 */
 +        0xffffffffffff3d00,  /* 1.25 */
 +        0xffffffffffff3e00,  /* 1.5 */
 +        0xffffffffffff3f00,  /* 1.75 */
 +        0xffffffffffff4000,  /* 2.0 */
 +        0xffffffffffff4100,  /* 2.5 */
 +        0xffffffffffff4200,  /* 3 */
 +        0xffffffffffff4400,  /* 4 */
 +        0xffffffffffff4800,  /* 8 */
 +        0xffffffffffff4c00,  /* 16 */
 +        0xffffffffffff5800,  /* 2^7 */
 +        0xffffffffffff5c00,  /* 2^8 */
 +        0xffffffffffff7800,  /* 2^15 */
 +        0xffffffffffff7c00,  /* 2^16 */
 +        0xffffffffffff7c00,  /* +inf */
 +        0xffffffffffff7e00,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fminm_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +
 +    gen_helper_fminm_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fminm_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dst = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 t1 = tcg_temp_new_i64();
 +
 +    /* Rounding mode is RTZ. */
 +    gen_set_rm(ctx, RISCV_FRM_RTZ);
 +    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
 +    tcg_gen_trunc_i64_tl(dst, t1);
 +    gen_set_gpr(ctx, a->rd, dst);
 +
 +    return true;
 +}
 +
 +bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_32BIT(ctx);
 +
 +    TCGv dst = dest_gpr(ctx, a->rd);
 +    TCGv_i64 t1 = tcg_temp_new_i64();
 +    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
 +    tcg_gen_trunc_i64_tl(dst, t1);
 +    gen_set_gpr(ctx, a->rd, dst);
 +    return true;
 +}
 +
 +bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_32BIT(ctx);
 +
 +    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
 +    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 +    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fleq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fleq_h(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_h(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/riscv64/Makefile.target
 +++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
  TESTS += test-aes
  run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
 +
 +# Test for fcvtmod
 +TESTS += test-fcvtmod
 +test-fcvtmod: CFLAGS += -march=rv64imafdc
 +test-fcvtmod: LDFLAGS += -static
 +run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
 --
-.40.1
+.41.0

-[PULL 13/54] target/riscv: Add additional xlen for address when MPRV=1
+[PULL v2 12/45] target/riscv: Move vector translation checks
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-As specified in privilege spec:"When MPRV=1, load and store memory
+Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
-addresses are treated as though the current XLEN were set to MPP’s
+and into the corresponding macros. This enables the functions to be
-XLEN". So the xlen for address may be different from current xlen.
+reused in proceeding commits without check duplication.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
+ target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
- target/riscv/cpu_helper.c |  1 +
+file changed, 12 insertions(+), 16 deletions(-)
  target/riscv/translate.c  | 13 ++++++++++-
 files changed, 55 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
+@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
- /* Virtual mode enabled */
+               gen_helper_gvec_4_ptr *fn)
- FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
+ {
- FIELD(TB_FLAGS, PRIV, 24, 2)
+     TCGLabel *over = gen_new_label();
-+FIELD(TB_FLAGS, AXL, 26, 2)
+-    if (!opivv_check(s, a)) {
+-        return false;
- #ifdef TARGET_RISCV32
+-    }
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-@@ -XXX,XX +XXX,XX @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-     return &env_archcpu(env)->cfg;
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
      };                                                             \
 +    if (!opivv_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
  }
--#if defined(TARGET_RISCV32)
+@@ -XXX,XX +XXX,XX @@ static inline bool
--#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+ do_opivx_gvec(DisasContext *s, arg_rmrr *a, GVecGen2sFn *gvec_fn,
--#else
+               gen_helper_opivx *fn)
 -static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
 +#if !defined(CONFIG_USER_ONLY)
 +static inline int cpu_address_mode(CPURISCVState *env)
 +{
 +    int mode = env->priv;
 +
 +    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
 +        mode = get_field(env->mstatus, MSTATUS_MPP);
 +    }
 +    return mode;
 +}
 +
 +static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
  {
-     RISCVMXL xl = env->misa_mxl;
+-    if (!opivx_check(s, a)) {
--#if !defined(CONFIG_USER_ONLY)
+-        return false;
-     /*
+-    }
-      * When emulating a 32-bit-only cpu, use RV32.
+-
-      * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
-@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+         TCGv_i64 src1 = tcg_temp_new_i64();
-      * back to RV64 for lower privs.
-      */
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
-     if (xl != MXL_RV32) {
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
--        switch (env->priv) {
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
-+        switch (mode) {
+     };                                                             \
-         case PRV_M:
++    if (!opivx_check(s, a)) {                                      \
-             break;
++        return false;                                              \
-         case PRV_U:
++    }                                                              \
-@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+     return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
              break;
          }
      }
 -#endif
      return xl;
  }
- #endif
+@@ -XXX,XX +XXX,XX @@ static inline bool
-+#if defined(TARGET_RISCV32)
+ do_opivi_gvec(DisasContext *s, arg_rmrr *a, GVecGen2iFn *gvec_fn,
-+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+               gen_helper_opivx *fn, imm_mode_t imm_mode)
 +#else
 +static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
 +{
 +#if !defined(CONFIG_USER_ONLY)
 +    return cpu_get_xl(env, env->priv);
 +#else
 +    return env->misa_mxl;
 +#endif
 +}
 +#endif
 +
 +#if defined(TARGET_RISCV32)
 +#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
 +#else
 +static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
 +{
 +#ifdef CONFIG_USER_ONLY
 +    return env->xl;
 +#else
 +    int mode = cpu_address_mode(env);
 +
 +    return cpu_get_xl(env, mode);
 +#endif
 +}
 +#endif
 +
  static inline int riscv_cpu_xlen(CPURISCVState *env)
  {
-     return 16 << env->xl;
+-    if (!opivx_check(s, a)) {
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+-        return false;
-index XXXXXXX..XXXXXXX 100644
+-    }
---- a/target/riscv/cpu_helper.c
+-
-+++ b/target/riscv/cpu_helper.c
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+         gvec_fn(s->sew, vreg_ofs(s, a->rd), vreg_ofs(s, a->rs2),
-     flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
+                 extract_imm(s, a->rs1, imm_mode), MAXSZ(s), MAXSZ(s));
-     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
-     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+         gen_helper_##OPIVX##_b, gen_helper_##OPIVX##_h,            \
-+    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
+         gen_helper_##OPIVX##_w, gen_helper_##OPIVX##_d,            \
-     if (env->cur_pmmask != 0) {
+     };                                                             \
-         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
++    if (!opivx_check(s, a)) {                                      \
-     }
++        return false;                                              \
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
++    }                                                              \
-index XXXXXXX..XXXXXXX 100644
+     return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF,                 \
---- a/target/riscv/translate.c
+                          fns[s->sew], IMM_MODE);                   \
-+++ b/target/riscv/translate.c
+ }
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ static inline bool
-     target_ulong priv_ver;
+ do_opivx_gvec_shift(DisasContext *s, arg_rmrr *a, GVecGen2sFn32 *gvec_fn,
-     RISCVMXL misa_mxl_max;
+                     gen_helper_opivx *fn)
      RISCVMXL xl;
 +    RISCVMXL address_xl;
      uint32_t misa_ext;
      uint32_t opcode;
      RISCVExtStatus mstatus_fs;
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
  #define get_xl(ctx)    ((ctx)->xl)
  #endif
 +#ifdef TARGET_RISCV32
 +#define get_address_xl(ctx)    MXL_RV32
 +#elif defined(CONFIG_USER_ONLY)
 +#define get_address_xl(ctx)    MXL_RV64
 +#else
 +#define get_address_xl(ctx)    ((ctx)->address_xl)
 +#endif
 +
  /* The word size for this machine mode. */
  static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
  {
-@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
+-    if (!opivx_check(s, a)) {
-     tcg_gen_addi_tl(addr, src1, imm);
+-        return false;
-     if (ctx->pm_mask_enabled) {
+-    }
-         tcg_gen_andc_tl(addr, addr, pm_mask);
+-
--    } else if (get_xl(ctx) == MXL_RV32) {
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
-+    } else if (get_address_xl(ctx) == MXL_RV32) {
+         TCGv_i32 src1 = tcg_temp_new_i32();
-         tcg_gen_ext32u_tl(addr, addr);
-     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
-     if (ctx->pm_base_enabled) {
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,                     \
-         tcg_gen_or_tl(addr, addr, pm_base);
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,                     \
-     }
+     };                                                                    \
-+
+-                                                                          \
-     return addr;
++    if (!opivx_check(s, a)) {                                             \
 +        return false;                                                     \
 +    }                                                                     \
      return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);    \
  }
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
-     ctx->misa_mxl_max = env->misa_mxl_max;
-     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
-+    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
-     ctx->cs = cs;
-     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
-     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
 --
-.40.1
+.41.0

-[PULL 42/54] target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
+[PULL v2 13/45] target/riscv: Refactor translation of vector-widening instruction
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-After changing user validation for mvendorid/marchid/mimpid to guarantee
+Zvbb (implemented in later commit) has a widening instruction, which
-that the value is validated on user input time, coupled with the work in
+requires an extra check on the enabled extensions.  Refactor
-fetching KVM default values for them by using a scratch CPU, we're
+GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
-certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
+it.
 already good to be written back to KVM.
-There's no need to write the values back for 'host' type CPUs since the
+Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
-values can't be changed, so let's do that just for generic CPUs.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
-file changed, 31 insertions(+)
+file changed, 23 insertions(+), 29 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
+@@ -XXX,XX +XXX,XX @@ static bool opivx_widen_check(DisasContext *s, arg_rmrr *a)
- {
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
  }
-+static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+-static bool do_opivx_widen(DisasContext *s, arg_rmrr *a,
-+{
+-                           gen_helper_opivx *fn)
-+    CPURISCVState *env = &cpu->env;
+-{
-+    uint64_t id;
+-    if (opivx_widen_check(s, a)) {
-+    int ret;
+-        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fn, s);
-+
+-    }
-+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+-    return false;
-+                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+-}
-+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
+-
-+    if (ret != 0) {
+-#define GEN_OPIVX_WIDEN_TRANS(NAME) \
-+        return ret;
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
-+    }
+-{                                                            \
-+
+-    static gen_helper_opivx * const fns[3] = {               \
-+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+-        gen_helper_##NAME##_b,                               \
-+                          KVM_REG_RISCV_CONFIG_REG(marchid));
+-        gen_helper_##NAME##_h,                               \
-+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
+-        gen_helper_##NAME##_w                                \
-+    if (ret != 0) {
+-    };                                                       \
-+        return ret;
+-    return do_opivx_widen(s, a, fns[s->sew]);                \
-+    }
++#define GEN_OPIVX_WIDEN_TRANS(NAME, CHECK) \
-+
++static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
-+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++{                                                                         \
-+                          KVM_REG_RISCV_CONFIG_REG(mimpid));
++    if (CHECK(s, a)) {                                                    \
-+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
++        static gen_helper_opivx * const fns[3] = {                        \
-+
++            gen_helper_##NAME##_b,                                        \
-+    return ret;
++            gen_helper_##NAME##_h,                                        \
-+}
++            gen_helper_##NAME##_w                                         \
-+
++        };                                                                \
- int kvm_arch_init_vcpu(CPUState *cs)
++        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s); \
- {
++    }                                                                     \
-     int ret = 0;
++    return false;                                                         \
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      }
      env->misa_ext = isa;
 +    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
 +        ret = kvm_vcpu_set_machine_ids(cpu, cs);
 +    }
 +
      return ret;
  }
+-GEN_OPIVX_WIDEN_TRANS(vwaddu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwadd_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwsubu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwsub_vx)
++GEN_OPIVX_WIDEN_TRANS(vwaddu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwadd_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsubu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsub_vx, opivx_widen_check)
+ /* WIDEN OPIVV with WIDEN */
+ static bool opiwv_widen_check(DisasContext *s, arg_rmrr *a)
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vrem_vx, opivx_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmul_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmulu_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmulsu_vv, opivv_widen_check)
+-GEN_OPIVX_WIDEN_TRANS(vwmul_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmulu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx)
++GEN_OPIVX_WIDEN_TRANS(vwmul_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmulu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx, opivx_widen_check)
+ /* Vector Single-Width Integer Multiply-Add Instructions */
+ GEN_OPIVV_TRANS(vmacc_vv, opivv_check)
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vnmsub_vx, opivx_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_widen_check)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmacc_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx)
++GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_widen_check)
+ /* Vector Integer Merge and Move Instructions */
+ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
 --
-.40.1
+.41.0

-[PULL 02/54] target/riscv: Factor out extension tests to cpu_cfg.h
+[PULL v2 14/45] target/riscv: Refactor some of the generic vector functionality
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-This patch moves the extension test functions that are used
+Move some macros out of `vector_helper` and into `vector_internals`.
-to gate vendor extension decoders, into cpu_cfg.h.
+This ensures they can be used by both vector and vector-crypto helpers
-This allows to reuse them in the disassembler.
+(latter implemented in proceeding commits).
-This patch does not introduce new functionality.
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 However, the patch includes a small change:
 The parameter for the extension test functions has been changed
 from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
 the code in cpu_cfg.h self-contained.
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
+Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
+ target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
- target/riscv/translate.c | 27 ++-------------------------
+ target/riscv/vector_helper.c    | 42 ------------------------------
-files changed, 28 insertions(+), 25 deletions(-)
+files changed, 46 insertions(+), 42 deletions(-)
-diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_cfg.h
+--- a/target/riscv/vector_internals.h
-+++ b/target/riscv/cpu_cfg.h
++++ b/target/riscv/vector_internals.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
- };
+ /* expand macro args before macro */
+ #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
- typedef struct RISCVCPUConfig RISCVCPUConfig;
 +/* (TD, T2, TX2) */
 +#define OP_UU_B uint8_t, uint8_t, uint8_t
 +#define OP_UU_H uint16_t, uint16_t, uint16_t
 +#define OP_UU_W uint32_t, uint32_t, uint32_t
 +#define OP_UU_D uint64_t, uint64_t, uint64_t
 +
-+/* Helper functions to test for extensions.  */
+ /* (TD, T1, T2, TX1, TX2) */
-+
+ #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
-+static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
+ #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
-+{
+ #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
-+    return true;
+ #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 +#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 +static void do_##NAME(void *vd, void *vs2, int i)      \
 +{                                                      \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
 +    *((TD *)vd + HD(i)) = OP(s2);                      \
 +}
 +
-+static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
++#define GEN_VEXT_V(NAME, ESZ)                          \
-+{
++void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-+    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
++                  CPURISCVState *env, uint32_t desc)   \
-+           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
++{                                                      \
-+           cfg->ext_xtheadcondmov ||
++    uint32_t vm = vext_vm(desc);                       \
-+           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
++    uint32_t vl = env->vl;                             \
-+           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
++    uint32_t total_elems =                             \
-+           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
++        vext_get_total_elems(env, desc, ESZ);          \
 +    uint32_t vta = vext_vta(desc);                     \
 +    uint32_t vma = vext_vma(desc);                     \
 +    uint32_t i;                                        \
 +                                                       \
 +    for (i = env->vstart; i < vl; i++) {               \
 +        if (!vm && !vext_elem_mask(v0, i)) {           \
 +            /* set masked-off elements to 1s */        \
 +            vext_set_elems_1s(vd, vma, i * ESZ,        \
 +                              (i + 1) * ESZ);          \
 +            continue;                                  \
 +        }                                              \
 +        do_##NAME(vd, vs2, i);                         \
 +    }                                                  \
 +    env->vstart = 0;                                   \
 +    /* set tail elements to 1s */                      \
 +    vext_set_elems_1s(vd, vta, vl * ESZ,               \
 +                      total_elems * ESZ);              \
 +}
 +
-+#define MATERIALISE_EXT_PREDICATE(ext) \
+ /* operation of two vector elements */
-+    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
+ typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
-+    { \
-+        return cfg->ext_ ## ext ; \
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-+    }
+                do_##NAME, ESZ);                           \
  }
 +/* Three of the widening shortening macros: */
 +/* (TD, T1, T2, TX1, TX2) */
 +#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
 +#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
 +#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 +
-+MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
+ #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
-+
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
  #endif
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/translate.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
-     return ctx->misa_ext & ext;
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
- }
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
+ #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
--static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
+-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
--{
+-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
--    return true;
+-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
  #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
  #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
  #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
  GEN_VEXT_VF(vfwnmsac_vf_w, 8)
  /* Vector Floating-Point Square-Root Instruction */
 -/* (TD, T2, TX2) */
 -#define OP_UU_H uint16_t, uint16_t, uint16_t
 -#define OP_UU_W uint32_t, uint32_t, uint32_t
 -#define OP_UU_D uint64_t, uint64_t, uint64_t
 -
  #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
  static void do_##NAME(void *vd, void *vs2, int i,      \
                        CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
  GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
  /* Vector Floating-Point Classify Instruction */
 -#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 -static void do_##NAME(void *vd, void *vs2, int i)      \
 -{                                                      \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
 -    *((TD *)vd + HD(i)) = OP(s2);                      \
 -}
 -
--static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
+-#define GEN_VEXT_V(NAME, ESZ)                          \
--{
+-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
--    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
+-                  CPURISCVState *env, uint32_t desc)   \
--           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
+-{                                                      \
--           ctx->cfg_ptr->ext_xtheadcondmov ||
+-    uint32_t vm = vext_vm(desc);                       \
--           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
+-    uint32_t vl = env->vl;                             \
--           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
+-    uint32_t total_elems =                             \
--           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
+-        vext_get_total_elems(env, desc, ESZ);          \
 -    uint32_t vta = vext_vta(desc);                     \
 -    uint32_t vma = vext_vma(desc);                     \
 -    uint32_t i;                                        \
 -                                                       \
 -    for (i = env->vstart; i < vl; i++) {               \
 -        if (!vm && !vext_elem_mask(v0, i)) {           \
 -            /* set masked-off elements to 1s */        \
 -            vext_set_elems_1s(vd, vma, i * ESZ,        \
 -                              (i + 1) * ESZ);          \
 -            continue;                                  \
 -        }                                              \
 -        do_##NAME(vd, vs2, i);                         \
 -    }                                                  \
 -    env->vstart = 0;                                   \
 -    /* set tail elements to 1s */                      \
 -    vext_set_elems_1s(vd, vta, vl * ESZ,               \
 -                      total_elems * ESZ);              \
 -}
 -
--#define MATERIALISE_EXT_PREDICATE(ext)  \
+ target_ulong fclass_h(uint64_t frs1)
--    static bool has_ ## ext ## _p(DisasContext *ctx)    \
+ {
--    { \
+     float16 f = frs1;
 -        return ctx->cfg_ptr->ext_ ## ext ; \
 -    }
 -
 -MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
 -
  #ifdef TARGET_RISCV32
  #define get_xl(ctx)    MXL_RV32
  #elif defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
       * that are tested in-order until a decoder matches onto the opcode.
       */
      static const struct {
 -        bool (*guard_func)(DisasContext *);
 +        bool (*guard_func)(const RISCVCPUConfig *);
          bool (*decode_func)(DisasContext *, uint32_t);
      } decoders[] = {
          { always_true_p,  decode_insn32 },
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
          ctx->opcode = opcode32;
          for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
 -            if (decoders[i].guard_func(ctx) &&
 +            if (decoders[i].guard_func(ctx->cfg_ptr) &&
                  decoders[i].decode_func(ctx, opcode32)) {
                  return;
              }
 --
-.40.1
+.41.0

-[PULL 25/54] target/riscv: Add properties for BF16 extensions
+[PULL v2 15/45] target/riscv: Add Zvbb ISA extension support
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
+This commit adds support for the Zvbb vector-crypto extension, which
-Add require check for BF16 extensions.
+consists of the following instructions:
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+* vrol.[vv,vx]
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+* vror.[vv,vx,vi]
 * vbrev8.v
 * vrev8.v
 * vandn.[vv,vx]
 * vbrev.v
 * vclz.v
 * vctz.v
 * vcpop.v
 * vwsll.[vv,vx,vi]
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
 Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Fix imm mode of vror.vi]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
+[max.chou@sifive.com: Exposed x-zvbb property]
 Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h |  3 +++
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/cpu.c     | 20 ++++++++++++++++++++
+ target/riscv/helper.h                    |  62 +++++++++
-files changed, 23 insertions(+)
+ target/riscv/insn32.decode               |  20 +++
  target/riscv/cpu.c                       |  12 ++
  target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 files changed, 397 insertions(+)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svpbmt;
+     bool ext_zve32f;
      bool ext_zdinx;
      bool ext_zawrs;
 +    bool ext_zfbfmin;
      bool ext_zfh;
      bool ext_zfhmin;
      bool ext_zfinx;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64f;
      bool ext_zve64d;
++    bool ext_zvbb;
+     bool ext_zvbc;
      bool ext_zmmul;
-+    bool ext_zvfbfmin;
+     bool ext_zvfbfmin;
-+    bool ext_zvfbfwma;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-     bool ext_zvfh;
+index XXXXXXX..XXXXXXX 100644
-     bool ext_zvfhmin;
+--- a/target/riscv/helper.h
-     bool ext_smaia;
++++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
  %imm_u    12:s20                 !function=ex_shift_12
  %imm_bs   30:2                   !function=ex_shift_3
  %imm_rnum 20:4
 +%imm_z6   26:1 15:5
  # Argument sets:
  &empty
@@ -XXX,XX +XXX,XX @@
  @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
  @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
  @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
 +@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
  @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
  @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
  @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
  vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
  vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
  vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 +
 +# *** Zvbb vector crypto extension ***
 +vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
 +vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
 +vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
 +vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
 +vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
 +vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
 +vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
 +vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
 +vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
 +vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
 +vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
 +vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
 +vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 +vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 +vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 +vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
+     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
+     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
++    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
+     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
 @@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-+    if (cpu->cfg.ext_zfbfmin && !riscv_has_ext(env, RVF)) {
++    /*
-+        error_setg(errp, "Zfbfmin extension depends on F extension");
++     * In principle Zve*x would also suffice here, were they supported
 +     * in qemu
 +     */
 +    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
 +        error_setg(errp,
 +                   "Vector crypto extensions require V or Zve* extensions");
 +        return;
 +    }
 +
-     if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
+     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-         error_setg(errp, "D extension requires F extension");
+         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
          return;
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-         return;
+     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
-     }
+     /* Vector cryptography extensions */
-+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zfbfmin) {
++    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
-+        error_setg(errp, "Zvfbfmin extension depends on Zfbfmin extension");
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
-+        return;
-+    }
+     DEFINE_PROP_END_OF_LIST(),
-+
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
-+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zve32f) {
+index XXXXXXX..XXXXXXX 100644
-+        error_setg(errp, "Zvfbfmin extension depends on Zve32f extension");
+--- a/target/riscv/vcrypto_helper.c
-+        return;
++++ b/target/riscv/vcrypto_helper.c
-+    }
+@@ -XXX,XX +XXX,XX @@
-+
+ #include "qemu/osdep.h"
-+    if (cpu->cfg.ext_zvfbfwma && !cpu->cfg.ext_zvfbfmin) {
+ #include "qemu/host-utils.h"
-+        error_setg(errp, "Zvfbfwma extension depends on Zvfbfmin extension");
+ #include "qemu/bitops.h"
-+        return;
++#include "qemu/bswap.h"
-+    }
+ #include "cpu.h"
-+
+ #include "exec/memop.h"
-     /* Set the ISA extensions, checks should have happened above */
+ #include "exec/exec-all.h"
-     if (cpu->cfg.ext_zhinx) {
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
-         cpu->cfg.ext_zhinxmin = true;
+ GEN_VEXT_VV(vclmulh_vv, 8)
  RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
  GEN_VEXT_VX(vclmulh_vx, 8)
 +
 +RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
 +RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
 +RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
 +RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
 +GEN_VEXT_VV(vror_vv_b, 1)
 +GEN_VEXT_VV(vror_vv_h, 2)
 +GEN_VEXT_VV(vror_vv_w, 4)
 +GEN_VEXT_VV(vror_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
 +RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
 +RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
 +RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
 +GEN_VEXT_VX(vror_vx_b, 1)
 +GEN_VEXT_VX(vror_vx_h, 2)
 +GEN_VEXT_VX(vror_vx_w, 4)
 +GEN_VEXT_VX(vror_vx_d, 8)
 +
 +RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
 +RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
 +RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
 +RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
 +GEN_VEXT_VV(vrol_vv_b, 1)
 +GEN_VEXT_VV(vrol_vv_h, 2)
 +GEN_VEXT_VV(vrol_vv_w, 4)
 +GEN_VEXT_VV(vrol_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
 +RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
 +RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
 +RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
 +GEN_VEXT_VX(vrol_vx_b, 1)
 +GEN_VEXT_VX(vrol_vx_h, 2)
 +GEN_VEXT_VX(vrol_vx_w, 4)
 +GEN_VEXT_VX(vrol_vx_d, 8)
 +
 +static uint64_t brev8(uint64_t val)
 +{
 +    val = ((val & 0x5555555555555555ull) << 1) |
 +          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
 +    val = ((val & 0x3333333333333333ull) << 2) |
 +          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
 +    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
 +          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
 +
 +    return val;
 +}
 +
 +RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
 +GEN_VEXT_V(vbrev8_v_b, 1)
 +GEN_VEXT_V(vbrev8_v_h, 2)
 +GEN_VEXT_V(vbrev8_v_w, 4)
 +GEN_VEXT_V(vbrev8_v_d, 8)
 +
 +#define DO_IDENTITY(a) (a)
 +RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
 +RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
 +RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
 +RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
 +GEN_VEXT_V(vrev8_v_b, 1)
 +GEN_VEXT_V(vrev8_v_h, 2)
 +GEN_VEXT_V(vrev8_v_w, 4)
 +GEN_VEXT_V(vrev8_v_d, 8)
 +
 +#define DO_ANDN(a, b) ((a) & ~(b))
 +RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
 +GEN_VEXT_VV(vandn_vv_b, 1)
 +GEN_VEXT_VV(vandn_vv_h, 2)
 +GEN_VEXT_VV(vandn_vv_w, 4)
 +GEN_VEXT_VV(vandn_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
 +GEN_VEXT_VX(vandn_vx_b, 1)
 +GEN_VEXT_VX(vandn_vx_h, 2)
 +GEN_VEXT_VX(vandn_vx_w, 4)
 +GEN_VEXT_VX(vandn_vx_d, 8)
 +
 +RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
 +RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
 +RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
 +RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
 +GEN_VEXT_V(vbrev_v_b, 1)
 +GEN_VEXT_V(vbrev_v_h, 2)
 +GEN_VEXT_V(vbrev_v_w, 4)
 +GEN_VEXT_V(vbrev_v_d, 8)
 +
 +RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
 +RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
 +RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
 +RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
 +GEN_VEXT_V(vclz_v_b, 1)
 +GEN_VEXT_V(vclz_v_h, 2)
 +GEN_VEXT_V(vclz_v_w, 4)
 +GEN_VEXT_V(vclz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
 +RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
 +RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
 +RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
 +GEN_VEXT_V(vctz_v_b, 1)
 +GEN_VEXT_V(vctz_v_h, 2)
 +GEN_VEXT_V(vctz_v_w, 4)
 +GEN_VEXT_V(vctz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
 +RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
 +RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
 +RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
 +GEN_VEXT_V(vcpop_v_b, 1)
 +GEN_VEXT_V(vcpop_v_h, 2)
 +GEN_VEXT_V(vcpop_v_w, 4)
 +GEN_VEXT_V(vcpop_v_d, 8)
 +
 +#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
 +RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
 +GEN_VEXT_VV(vwsll_vv_b, 2)
 +GEN_VEXT_VV(vwsll_vv_h, 4)
 +GEN_VEXT_VV(vwsll_vv_w, 8)
 +
 +RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 +GEN_VEXT_VX(vwsll_vx_b, 2)
 +GEN_VEXT_VX(vwsll_vx_h, 4)
 +GEN_VEXT_VX(vwsll_vx_w, 8)
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
  GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 +
 +/*
 + * Zvbb
 + */
 +
 +#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
 +    {                                                                   \
 +        if (CHECK(s, a)) {                                              \
 +            static gen_helper_opivx *const fns[4] = {                   \
 +                gen_helper_##OPIVX##_b,                                 \
 +                gen_helper_##OPIVX##_h,                                 \
 +                gen_helper_##OPIVX##_w,                                 \
 +                gen_helper_##OPIVX##_d,                                 \
 +            };                                                          \
 +            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
 +                                 IMM_MODE);                             \
 +        }                                                               \
 +        return false;                                                   \
 +    }
 +
 +#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_gvec_4_ptr *const fns[4] = {               \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
 +    {                                                            \
 +        if (CHECK(s, a)) {                                       \
 +            static gen_helper_opivx *const fns[4] = {            \
 +                gen_helper_##NAME##_b,                           \
 +                gen_helper_##NAME##_h,                           \
 +                gen_helper_##NAME##_w,                           \
 +                gen_helper_##NAME##_d,                           \
 +            };                                                   \
 +            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
 +                                       fns[s->sew]);             \
 +        }                                                        \
 +        return false;                                            \
 +    }
 +
 +static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +}
 +
 +static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +}
 +
 +/* vrol.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
 +
 +/* vror.v[vxi] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
 +GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
 +
 +#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_opivx *const fns[4] = {                    \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +/* vandn.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
 +GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
 +
 +#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
 +    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
 +    {                                                                      \
 +        if (CHECK(s, a)) {                                                 \
 +            uint32_t data = 0;                                             \
 +            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
 +                gen_helper_##NAME##_b,                                     \
 +                gen_helper_##NAME##_h,                                     \
 +                gen_helper_##NAME##_w,                                     \
 +                gen_helper_##NAME##_d,                                     \
 +            };                                                             \
 +            TCGLabel *over = gen_new_label();                              \
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
 +                                                                           \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
 +                               vreg_ofs(s, a->rs2), cpu_env,               \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
 +                               data, fns[s->sew]);                         \
 +            mark_vs_dirty(s);                                              \
 +            gen_set_label(over);                                           \
 +            return true;                                                   \
 +        }                                                                  \
 +        return false;                                                      \
 +    }
 +
 +static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
 +{
 +    return s->cfg_ptr->ext_zvbb == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
 +GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
 +
 +static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
 +}
 +
 +static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
 +}
 +
 +/* OPIVI without GVEC IR */
 +#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
 +    {                                                                        \
 +        if (CHECK(s, a)) {                                                   \
 +            static gen_helper_opivx *const fns[3] = {                        \
 +                gen_helper_##OPIVX##_b,                                      \
 +                gen_helper_##OPIVX##_h,                                      \
 +                gen_helper_##OPIVX##_w,                                      \
 +            };                                                               \
 +            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
 +                               IMM_MODE);                                    \
 +        }                                                                    \
 +        return false;                                                        \
 +    }
 +
 +GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 +GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 +GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
 --
-.40.1
+.41.0

-[PULL 29/54] target/riscv: Expose properties for BF16 extensions
+[PULL v2 16/45] target/riscv: Add Zvkned ISA extension support
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+This commit adds support for the Zvkned vector-crypto extension, which
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+consists of the following instructions:
 * vaesef.[vv,vs]
 * vaesdf.[vv,vs]
 * vaesdm.[vv,vs]
 * vaesz.vs
 * vaesem.[vv,vs]
 * vaeskf1.vi
 * vaeskf2.vi
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
+[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
 property]
 [max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
 egs checking by helper function]
 [max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
 Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 7 +++++++
+ target/riscv/cpu_cfg.h                   |   1 +
-file changed, 7 insertions(+)
+ target/riscv/helper.h                    |  14 ++
  target/riscv/insn32.decode               |  14 ++
  target/riscv/cpu.c                       |   4 +-
  target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 files changed, 381 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zve64d;
+     bool ext_zvbb;
+     bool ext_zvbc;
++    bool ext_zvkned;
+     bool ext_zmmul;
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
++
++DEF_HELPER_2(egs_check, void, i32, env)
++
++DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
++DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@
+ @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
+ @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
+ @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
++@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
+ @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
+ @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
+ @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
+@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+ vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+ vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+ vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
++
++# *** Zvkned vector crypto extension ***
++vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
++vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
++vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
++vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
++vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
++vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
++vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
++vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
++vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
++vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
++vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
      ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
      ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
 +    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
      ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
      ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
      ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
      ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
      ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
 +    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
 +    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
      ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
++    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+      * In principle Zve*x would also suffice here, were they supported
+      * in qemu
+      */
+-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+         error_setg(errp,
+                    "Vector crypto extensions require V or Zve* extensions");
+         return;
 @@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
+     /* Vector cryptography extensions */
-     DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
+     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
-+    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
++    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
-+    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
 +    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 +
      DEFINE_PROP_END_OF_LIST(),
  };
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bitops.h"
  #include "qemu/bswap.h"
  #include "cpu.h"
 +#include "crypto/aes.h"
 +#include "crypto/aes-round.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
  GEN_VEXT_VX(vwsll_vx_b, 2)
  GEN_VEXT_VX(vwsll_vx_h, 4)
  GEN_VEXT_VX(vwsll_vx_w, 8)
 +
 +void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
 +{
 +    uint32_t vl = env->vl;
 +    uint32_t vstart = env->vstart;
 +
 +    if (vl % egs != 0 || vstart % egs != 0) {
 +        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 +    }
 +}
 +
 +static inline void xor_round_key(AESState *round_state, AESState *round_key)
 +{
 +    round_state->v = round_state->v ^ round_key->v;
 +}
 +
 +#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
 +    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
 +                      uint32_t desc)                                      \
 +    {                                                                     \
 +        uint32_t vl = env->vl;                                            \
 +        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
 +        uint32_t vta = vext_vta(desc);                                    \
 +                                                                          \
 +        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
 +            AESState round_key;                                           \
 +            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
 +            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
 +            AESState round_state;                                         \
 +            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
 +            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
 +            __VA_ARGS__;                                                  \
 +            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
 +            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
 +        }                                                                 \
 +        env->vstart = 0;                                                  \
 +        /* set tail elements to 1s */                                     \
 +        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
 +    }
 +
 +#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
 +    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
 +                      uint32_t desc)                                      \
 +    {                                                                     \
 +        uint32_t vl = env->vl;                                            \
 +        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
 +        uint32_t vta = vext_vta(desc);                                    \
 +                                                                          \
 +        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
 +            AESState round_key;                                           \
 +            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
 +            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
 +            AESState round_state;                                         \
 +            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
 +            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
 +            __VA_ARGS__;                                                  \
 +            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
 +            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
 +        }                                                                 \
 +        env->vstart = 0;                                                  \
 +        /* set tail elements to 1s */                                     \
 +        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
 +    }
 +
 +GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
 +                                                &round_state,
 +                                                &round_key,
 +                                                false);)
 +GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
 +                                                &round_state,
 +                                                &round_key,
 +                                                false);)
 +GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
 +                                                  &round_state,
 +                                                  &round_key,
 +                                                  false);)
 +GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
 +                                                  &round_state,
 +                                                  &round_key,
 +                                                  false);)
 +GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
 +                                                   &round_state,
 +                                                   &round_key,
 +                                                   false);)
 +GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
 +                                                   &round_state,
 +                                                   &round_key,
 +                                                   false);)
 +GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
 +                                                      &round_state,
 +                                                      &round_key,
 +                                                      false);)
 +GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
 +                                                      &round_state,
 +                                                      &round_key,
 +                                                      false);)
 +GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
 +
 +void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                        CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +    uint32_t vta = vext_vta(desc);
 +
 +    uimm &= 0b1111;
 +    if (uimm > 10 || uimm == 0) {
 +        uimm ^= 0b1000;
 +    }
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint32_t rk[8], tmp;
 +        static const uint32_t rcon[] = {
 +            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
 +            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
 +        };
 +
 +        rk[0] = vs2[i * 4 + H4(0)];
 +        rk[1] = vs2[i * 4 + H4(1)];
 +        rk[2] = vs2[i * 4 + H4(2)];
 +        rk[3] = vs2[i * 4 + H4(3)];
 +        tmp = ror32(rk[3], 8);
 +
 +        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
 +                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
 +                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
 +                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
 +                      ^ rcon[uimm - 1];
 +        rk[5] = rk[1] ^ rk[4];
 +        rk[6] = rk[2] ^ rk[5];
 +        rk[7] = rk[3] ^ rk[6];
 +
 +        vd[i * 4 + H4(0)] = rk[4];
 +        vd[i * 4 + H4(1)] = rk[5];
 +        vd[i * 4 + H4(2)] = rk[6];
 +        vd[i * 4 + H4(3)] = rk[7];
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +}
 +
 +void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                        CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +    uint32_t vta = vext_vta(desc);
 +
 +    uimm &= 0b1111;
 +    if (uimm > 14 || uimm < 2) {
 +        uimm ^= 0b1000;
 +    }
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint32_t rk[12], tmp;
 +        static const uint32_t rcon[] = {
 +            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
 +            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
 +        };
 +
 +        rk[0] = vd[i * 4 + H4(0)];
 +        rk[1] = vd[i * 4 + H4(1)];
 +        rk[2] = vd[i * 4 + H4(2)];
 +        rk[3] = vd[i * 4 + H4(3)];
 +        rk[4] = vs2[i * 4 + H4(0)];
 +        rk[5] = vs2[i * 4 + H4(1)];
 +        rk[6] = vs2[i * 4 + H4(2)];
 +        rk[7] = vs2[i * 4 + H4(3)];
 +
 +        if (uimm % 2 == 0) {
 +            tmp = ror32(rk[7], 8);
 +            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
 +                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
 +                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
 +                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
 +                          ^ rcon[(uimm - 1) / 2];
 +        } else {
 +            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
 +        }
 +        rk[9] = rk[1] ^ rk[8];
 +        rk[10] = rk[2] ^ rk[9];
 +        rk[11] = rk[3] ^ rk[10];
 +
 +        vd[i * 4 + H4(0)] = rk[8];
 +        vd[i * 4 + H4(1)] = rk[9];
 +        vd[i * 4 + H4(2)] = rk[10];
 +        vd[i * 4 + H4(3)] = rk[11];
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
  GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
  GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
 +
 +/*
 + * Zvkned
 + */
 +
 +#define ZVKNED_EGS 4
 +
 +#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
 +    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            TCGv_ptr rd_v, rs2_v;                                             \
 +            TCGv_i32 desc, egs;                                               \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +            rd_v = tcg_temp_new_ptr();                                        \
 +            rs2_v = tcg_temp_new_ptr();                                       \
 +            desc = tcg_constant_i32(                                          \
 +                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
 +            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
 +            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
 +            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul) &&
 +           s->sew == MO_32;
 +}
 +
 +static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
 +{
 +    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
 +    return !is_overlapped(vd, op_size, vs2, 1);
 +}
 +
 +static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return vaes_check_overlap(s, a->rd, a->rs2) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
 +
 +#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
 +    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            TCGv_ptr rd_v, rs2_v;                                             \
 +            TCGv_i32 uimm_v, desc, egs;                                       \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +                                                                              \
 +            rd_v = tcg_temp_new_ptr();                                        \
 +            rs2_v = tcg_temp_new_ptr();                                       \
 +            uimm_v = tcg_constant_i32(a->rs1);                                \
 +            desc = tcg_constant_i32(                                          \
 +                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
 +            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
 +            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
 +            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32 &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32 &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 +GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
 --
-.40.1
+.41.0

-[PULL 27/54] target/riscv: Add support for Zvfbfmin extension
+[PULL v2 17/45] target/riscv: Add Zvknh ISA extension support
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Add trans_* and helper function for Zvfbfmin instructions.
+This commit adds support for the Zvknh vector-crypto extension, which
 consists of the following instructions:
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+* vsha2ms.vv
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+* vsha2c[hl].vv
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
+Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
 [max.chou@sifive.com: Replaced SEW selection to happened during
 translation]
 Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                      |  3 +
+ target/riscv/cpu_cfg.h                   |   2 +
- target/riscv/insn32.decode                 |  4 ++
+ target/riscv/helper.h                    |   6 +
- target/riscv/vector_helper.c               |  6 ++
+ target/riscv/insn32.decode               |   5 +
- target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
+ target/riscv/cpu.c                       |  13 +-
-files changed, 77 insertions(+)
+ target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 files changed, 390 insertions(+), 3 deletions(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zvbb;
+     bool ext_zvbc;
+     bool ext_zvkned;
++    bool ext_zvknha;
++    bool ext_zvknhb;
+     bool ext_zmmul;
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
- /* BF16 functions */
+ DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
- DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
+ DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
- DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+ DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
 +
-+DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
-+DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
- # *** Zfbfmin Standard Extension ***
+ vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
- fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
+ vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
- fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
-+# *** Zvfbfmin Standard Extension ***
++# *** Zvknh vector crypto extension ***
-+vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
++vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
-+vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
++vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
++vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/vector_helper.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
- GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
- GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-+RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
++    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-+GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
++    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-+
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
- /* Narrowing Floating-Point/Integer Type-Convert Instructions */
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
- /* (TD, T2, TX2) */
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
- #define NOP_UU_B uint8_t,  uint16_t, uint32_t
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
+      * In principle Zve*x would also suffice here, were they supported
- GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
+      * in qemu
- GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
+      */
+-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
-+RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
-+GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
++        !cpu->cfg.ext_zve32f) {
-+
+         error_setg(errp,
- /*
+                    "Vector crypto extensions require V or Zve* extensions");
-  * Vector Reduction Operations
+         return;
-  */
+     }
-diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
 -    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
 -        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
 +        error_setg(
 +            errp,
 +            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
          return;
      }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 +    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
 +    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+--- a/target/riscv/vcrypto_helper.c
-+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
++++ b/target/riscv/vcrypto_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
-     } \
+     /* set tail elements to 1s */
- } while (0)
+     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +#define REQUIRE_ZVFBFMIN(ctx) do { \
 +    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
 +        return false; \
 +    } \
 +} while (0)
 +
  static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
  {
      REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
      mark_fs_dirty(ctx);
      return true;
  }
 +
-+static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
++static inline uint32_t sig0_sha256(uint32_t x)
 +{
-+    REQUIRE_FPU;
++    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
-+    REQUIRE_ZVFBFMIN(ctx);
++}
 +
-+    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
++static inline uint32_t sig1_sha256(uint32_t x)
 +{
 +    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
 +}
 +
 +static inline uint64_t sig0_sha512(uint64_t x)
 +{
 +    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
 +}
 +
 +static inline uint64_t sig1_sha512(uint64_t x)
 +{
 +    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
 +}
 +
 +static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
 +{
 +    uint32_t res[4];
 +    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
 +             vd[H4(0)];
 +    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
 +             vd[H4(1)];
 +    res[2] =
 +        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
 +    res[3] =
 +        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
 +    vd[H4(3)] = res[3];
 +    vd[H4(2)] = res[2];
 +    vd[H4(1)] = res[1];
 +    vd[H4(0)] = res[0];
 +}
 +
 +static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
 +{
 +    uint64_t res[4];
 +    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
 +    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
 +    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
 +    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
 +    vd[3] = res[3];
 +    vd[2] = res[2];
 +    vd[1] = res[1];
 +    vd[0] = res[0];
 +}
 +
 +void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                        uint32_t desc)
 +{
 +    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
 +    uint32_t esz = sew == MO_32 ? 4 : 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        if (sew == MO_32) {
 +            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
 +                        ((uint32_t *)vs2) + i * 4);
 +        } else {
 +            /* If not 32 then SEW should be 64 */
 +            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
 +                        ((uint64_t *)vs2) + i * 4);
 +        }
 +    }
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint64_t sum0_64(uint64_t x)
 +{
 +    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
 +}
 +
 +static inline uint32_t sum0_32(uint32_t x)
 +{
 +    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
 +}
 +
 +static inline uint64_t sum1_64(uint64_t x)
 +{
 +    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
 +}
 +
 +static inline uint32_t sum1_32(uint32_t x)
 +{
 +    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
 +}
 +
 +#define ch(x, y, z) ((x & y) ^ ((~x) & z))
 +
 +#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
 +
 +static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
 +{
 +    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
 +    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
 +    uint64_t W0 = vs1[0], W1 = vs1[1];
 +    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
 +    uint64_t T2 = sum0_64(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
 +    T2 = sum0_64(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[0] = f;
 +    vd[1] = e;
 +    vd[2] = b;
 +    vd[3] = a;
 +}
 +
 +static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
 +{
 +    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
 +    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
 +    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
 +    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
 +    uint32_t T2 = sum0_32(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
 +    T2 = sum0_32(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[H4(0)] = f;
 +    vd[H4(1)] = e;
 +    vd[H4(2)] = b;
 +    vd[H4(3)] = a;
 +}
 +
 +void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  ((uint32_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  ((uint64_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  (((uint32_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  (((uint64_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
  GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
  GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
 +
 +/*
 + * Zvknh
 + */
 +
 +#define ZVKNH_EGS 4
 +
 +#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +            TCGv_i32 egs;                                                     \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +                                                                              \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
 +                               vreg_ofs(s, a->rs2), cpu_env,                  \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
 +                               data, gen_helper_##NAME);                      \
 +                                                                              \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vsha_check_sew(DisasContext *s)
 +{
 +    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
 +           (s->cfg_ptr->ext_zvknhb == true &&
 +            (s->sew == MO_32 || s->sew == MO_64));
 +}
 +
 +static bool vsha_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKNH_EGS << s->sew;
 +    int mult = 1 << MAX(s->lmul, 0);
 +    return opivv_check(s, a) &&
 +           vsha_check_sew(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           !is_overlapped(a->rd, mult, a->rs1, mult) &&
 +           !is_overlapped(a->rd, mult, a->rs2, mult) &&
 +           s->lmul >= 0;
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
 +
 +static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
 +{
 +    if (vsha_check(s, a)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
-+
++        TCGv_i32 egs;
-+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
++
-+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
-+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++            /* save opcode for unwinding in case we throw an exception */
 +            decode_save_opc(s);
 +            egs = tcg_constant_i32(ZVKNH_EGS);
 +            gen_helper_egs_check(egs, cpu_env);
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
-+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++        data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
++        data = FIELD_DP32(data, VDATA, VMA, s->vma);
-+                           vreg_ofs(ctx, a->rs2), cpu_env,
++
-+                           ctx->cfg_ptr->vlen / 8,
++        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
-+                           ctx->cfg_ptr->vlen / 8, data,
++            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
-+                           gen_helper_vfncvtbf16_f_f_w);
++            s->cfg_ptr->vlen / 8, data,
-+        mark_vs_dirty(ctx);
++            s->sew == MO_32 ?
 +                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 +
-+static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
++static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
 +{
-+    REQUIRE_FPU;
++    if (vsha_check(s, a)) {
 +    REQUIRE_ZVFBFMIN(ctx);
 +
 +    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
-+
++        TCGv_i32 egs;
-+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
++
-+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
-+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++            /* save opcode for unwinding in case we throw an exception */
 +            decode_save_opc(s);
 +            egs = tcg_constant_i32(ZVKNH_EGS);
 +            gen_helper_egs_check(egs, cpu_env);
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
-+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++        data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
++        data = FIELD_DP32(data, VDATA, VMA, s->vma);
-+                           vreg_ofs(ctx, a->rs2), cpu_env,
++
-+                           ctx->cfg_ptr->vlen / 8,
++        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
-+                           ctx->cfg_ptr->vlen / 8, data,
++            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
-+                           gen_helper_vfwcvtbf16_f_f_v);
++            s->cfg_ptr->vlen / 8, data,
-+        mark_vs_dirty(ctx);
++            s->sew == MO_32 ?
 +                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 --
-.40.1
+.41.0

-[PULL 28/54] target/riscv: Add support for Zvfbfwma extension
+[PULL v2 18/45] target/riscv: Add Zvksh ISA extension support
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-Add trans_* and helper function for Zvfbfwma instructions.
+This commit adds support for the Zvksh vector-crypto extension, which
+consists of the following instructions:
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+* vsm3me.vv
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+* vsm3c.vi
-Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvksh property]
 Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                      |  3 ++
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/insn32.decode                 |  4 ++
+ target/riscv/helper.h                    |   3 +
- target/riscv/vector_helper.c               | 11 ++++
+ target/riscv/insn32.decode               |   4 +
- target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
+ target/riscv/cpu.c                       |   6 +-
-files changed, 76 insertions(+)
+ target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 files changed, 177 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 +    bool ext_zvksh;
      bool ext_zmmul;
      bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
- DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
- DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 +
-+DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
-+DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
++DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+@@ -XXX,XX +XXX,XX @@ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
- # *** Zvfbfmin Standard Extension ***
+ vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
- vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+ vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
- vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
+ vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
-+# *** Zvfbfwma Standard Extension ***
++# *** Zvksh vector crypto extension ***
-+vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
++vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
-+vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
++vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/vector_helper.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
- GEN_VEXT_VF(vfwmacc_vf_h, 4)
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
- GEN_VEXT_VF(vfwmacc_vf_w, 8)
+     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-+static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
++    ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
-+{
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-+    return float32_muladd(bfloat16_to_float32(a, s),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-+                          bfloat16_to_float32(b, s), d, 0, s);
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+}
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-+
+      * In principle Zve*x would also suffice here, were they supported
-+RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
+      * in qemu
-+GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
+      */
-+RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
+-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
-+GEN_VEXT_VF(vfwmaccbf16_vf, 4)
+-        !cpu->cfg.ext_zve32f) {
-+
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
- static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
++         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
- {
+         error_setg(errp,
-     return float32_muladd(float16_to_float32(a, true, s),
+                    "Vector crypto extensions require V or Zve* extensions");
-diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
+         return;
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
---- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
-+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
+     DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
-@@ -XXX,XX +XXX,XX @@
+     DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
-     } \
++    DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
- } while (0)
+     DEFINE_PROP_END_OF_LIST(),
-+#define REQUIRE_ZVFBFWMA(ctx) do { \
+ };
-+    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
-+        return false; \
+index XXXXXXX..XXXXXXX 100644
-+    } \
+--- a/target/riscv/vcrypto_helper.c
-+} while (0)
++++ b/target/riscv/vcrypto_helper.c
-+
+@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
- static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+     vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
- {
+     env->vstart = 0;
-     REQUIRE_FPU;
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
++
 +static inline uint32_t p1(uint32_t x)
 +{
 +    return x ^ rol32(x, 15) ^ rol32(x, 23);
 +}
 +
 +static inline uint32_t zvksh_w(uint32_t m16, uint32_t m9, uint32_t m3,
 +                               uint32_t m13, uint32_t m6)
 +{
 +    return p1(m16 ^ m9 ^ rol32(m3, 15)) ^ rol32(m13, 7) ^ m6;
 +}
 +
 +void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
 +                       CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs1 = vs1_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        uint32_t w[24];
 +        for (int j = 0; j < 8; j++) {
 +            w[j] = bswap32(vs1[H4((i * 8) + j)]);
 +            w[j + 8] = bswap32(vs2[H4((i * 8) + j)]);
 +        }
 +        for (int j = 0; j < 8; j++) {
 +            w[j + 16] =
 +                zvksh_w(w[j], w[j + 7], w[j + 13], w[j + 3], w[j + 10]);
 +        }
 +        for (int j = 0; j < 8; j++) {
 +            vd[(i * 8) + j] = bswap32(w[H4(j + 16)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint32_t ff1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t ff2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (x & z) | (y & z);
 +}
 +
 +static inline uint32_t ff_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? ff1(x, y, z) : ff2(x, y, z);
 +}
 +
 +static inline uint32_t gg1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t gg2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (~x & z);
 +}
 +
 +static inline uint32_t gg_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? gg1(x, y, z) : gg2(x, y, z);
 +}
 +
 +static inline uint32_t t_j(uint32_t j)
 +{
 +    return (j <= 15) ? 0x79cc4519 : 0x7a879d8a;
 +}
 +
 +static inline uint32_t p_0(uint32_t x)
 +{
 +    return x ^ rol32(x, 9) ^ rol32(x, 17);
 +}
 +
 +static void sm3c(uint32_t *vd, uint32_t *vs1, uint32_t *vs2, uint32_t uimm)
 +{
 +    uint32_t x0, x1;
 +    uint32_t j;
 +    uint32_t ss1, ss2, tt1, tt2;
 +    x0 = vs2[0] ^ vs2[4];
 +    x1 = vs2[1] ^ vs2[5];
 +    j = 2 * uimm;
 +    ss1 = rol32(rol32(vs1[0], 12) + vs1[4] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vs1[0], 12);
 +    tt1 = ff_j(vs1[0], vs1[1], vs1[2], j) + vs1[3] + ss2 + x0;
 +    tt2 = gg_j(vs1[4], vs1[5], vs1[6], j) + vs1[7] + ss1 + vs2[0];
 +    vs1[3] = vs1[2];
 +    vd[3] = rol32(vs1[1], 9);
 +    vs1[1] = vs1[0];
 +    vd[1] = tt1;
 +    vs1[7] = vs1[6];
 +    vd[7] = rol32(vs1[5], 19);
 +    vs1[5] = vs1[4];
 +    vd[5] = p_0(tt2);
 +    j = 2 * uimm + 1;
 +    ss1 = rol32(rol32(vd[1], 12) + vd[5] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vd[1], 12);
 +    tt1 = ff_j(vd[1], vs1[1], vd[3], j) + vs1[3] + ss2 + x1;
 +    tt2 = gg_j(vd[5], vs1[5], vd[7], j) + vs1[7] + ss1 + vs2[1];
 +    vd[2] = rol32(vs1[1], 9);
 +    vd[0] = tt1;
 +    vd[6] = rol32(vs1[5], 19);
 +    vd[4] = p_0(tt2);
 +}
 +
 +void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t v1[8], v2[8], v3[8];
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        for (int k = 0; k < 8; k++) {
 +            v2[k] = bswap32(vd[H4(i * 8 + k)]);
 +            v3[k] = bswap32(vs2[H4(i * 8 + k)]);
 +        }
 +        sm3c(v1, v2, v3, uimm);
 +        for (int k = 0; k < 8; k++) {
 +            vd[i * 8 + k] = bswap32(v1[H4(k)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
      }
      return false;
  }
 +
-+static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
++/*
-+{
++ * Zvksh
-+    REQUIRE_FPU;
++ */
-+    REQUIRE_ZVFBFWMA(ctx);
++
-+
++#define ZVKSH_EGS 8
-+    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
++
-+        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
++static inline bool vsm3_check(DisasContext *s, arg_rmrr *a)
-+        uint32_t data = 0;
++{
-+        TCGLabel *over = gen_new_label();
++    int egw_bytes = ZVKSH_EGS << s->sew;
-+
++    int mult = 1 << MAX(s->lmul, 0);
-+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
++    return s->cfg_ptr->ext_zvksh == true &&
-+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++           require_rvv(s) &&
-+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++           vext_check_isa_ill(s) &&
-+
++           !is_overlapped(a->rd, mult, a->rs2, mult) &&
-+        data = FIELD_DP32(data, VDATA, VM, a->vm);
++           MAXSZ(s) >= egw_bytes &&
-+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++           s->sew == MO_32;
-+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++}
-+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++
-+        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
++static inline bool vsm3me_check(DisasContext *s, arg_rmrr *a)
-+                           vreg_ofs(ctx, a->rs1),
++{
-+                           vreg_ofs(ctx, a->rs2), cpu_env,
++    return vsm3_check(s, a) && vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm);
-+                           ctx->cfg_ptr->vlen / 8,
++}
-+                           ctx->cfg_ptr->vlen / 8, data,
++
-+                           gen_helper_vfwmaccbf16_vv);
++static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
-+        mark_vs_dirty(ctx);
++{
-+        gen_set_label(over);
++    return vsm3_check(s, a) && vext_check_ss(s, a->rd, a->rs2, a->vm);
-+        return true;
++}
-+    }
++
-+    return false;
++GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
-+}
++GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 +
 +static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZVFBFWMA(ctx);
 +
 +    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
 +        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
 +        uint32_t data = 0;
 +
 +        gen_set_rm(ctx, RISCV_FRM_DYN);
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
 +        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
 +                           gen_helper_vfwmaccbf16_vf, ctx);
 +    }
 +
 +    return false;
 +}
 --
-.40.1
+.41.0

-[PULL 26/54] target/riscv: Add support for Zfbfmin extension
+[PULL v2 19/45] target/riscv: Add Zvkg ISA extension support
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Add trans_* and helper function for Zfbfmin instructions.
+This commit adds support for the Zvkg vector-crypto extension, which
+consists of the following instructions:
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+* vgmul.vv
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+* vghsh.vv
-Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvkg property]
 [max.chou@sifive.com: Replaced uint by int for cross win32 build]
 Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                      |  4 ++
+ target/riscv/cpu_cfg.h                   |  1 +
- target/riscv/insn32.decode                 |  4 ++
+ target/riscv/helper.h                    |  3 +
- target/riscv/fpu_helper.c                  | 12 +++++
+ target/riscv/insn32.decode               |  4 ++
- target/riscv/translate.c                   |  1 +
+ target/riscv/cpu.c                       |  6 +-
- target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
+ target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
- target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
+ target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
-files changed, 80 insertions(+), 6 deletions(-)
+files changed, 114 insertions(+), 2 deletions(-)
- create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64d;
      bool ext_zvbb;
      bool ext_zvbc;
 +    bool ext_zvkg;
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
- /* Zce helper */
+ DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
- DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 +
-+/* BF16 functions */
++DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
-+DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
++DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
+@@ -XXX,XX +XXX,XX @@ vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
- # *** RV32 Zicond Standard Extension ***
+ # *** Zvksh vector crypto extension ***
- czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
+ vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
- czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
-+# *** Zfbfmin Standard Extension ***
++# *** Zvkg vector crypto extension ***
-+fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
++vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
-+fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
++vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
-diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/fpu_helper.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/fpu_helper.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     float16 frs1 = check_nanbox_h(env, rs1);
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
-     return float16_to_float64(frs1, true, &env->fp_status);
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
 +    ISA_EXT_DATA_ENTRY(zvkg, PRIV_VERSION_1_12_0, ext_zvkg),
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* Vector cryptography extensions */
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +    DEFINE_PROP_BOOL("x-zvkg", RISCVCPU, cfg.ext_zvkg, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
 +
-+uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
++void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
-+{
++                      CPURISCVState *env, uint32_t desc)
-+    float32 frs1 = check_nanbox_s(env, rs1);
++{
-+    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
++    uint64_t *vd = vd_vptr;
-+}
++    uint64_t *vs1 = vs1_vptr;
-+
++    uint64_t *vs2 = vs2_vptr;
-+uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
++    uint32_t vta = vext_vta(desc);
-+{
++    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
-+    float16 frs1 = check_nanbox_h(env, rs1);
++
-+    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
-+}
++        uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
++        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
-index XXXXXXX..XXXXXXX 100644
++        uint64_t X[2] = {vs1[i * 2 + 0], vs1[i * 2 + 1]};
---- a/target/riscv/translate.c
++        uint64_t Z[2] = {0, 0};
-+++ b/target/riscv/translate.c
++
-@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
++        uint64_t S[2] = {brev8(Y[0] ^ X[0]), brev8(Y[1] ^ X[1])};
- #include "insn_trans/trans_rvk.c.inc"
++
- #include "insn_trans/trans_privileged.c.inc"
++        for (int j = 0; j < 128; j++) {
- #include "insn_trans/trans_svinval.c.inc"
++            if ((S[j / 64] >> (j % 64)) & 1) {
-+#include "insn_trans/trans_rvbf16.c.inc"
++                Z[0] ^= H[0];
- #include "decode-xthead.c.inc"
++                Z[1] ^= H[1];
- #include "insn_trans/trans_xthead.c.inc"
++            }
- #include "insn_trans/trans_xventanacondops.c.inc"
++            bool reduce = ((H[1] >> 63) & 1);
-diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
++            H[1] = H[1] << 1 | H[0] >> 63;
-new file mode 100644
++            H[0] = H[0] << 1;
-index XXXXXXX..XXXXXXX
++            if (reduce) {
---- /dev/null
++                H[0] ^= 0x87;
-+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
++            }
-@@ -XXX,XX +XXX,XX @@
++        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t Z[2] = {0, 0};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((Y[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
  GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
  GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 +
 +/*
-+ * RISC-V translation routines for the BF16 Standard Extensions.
++ * Zvkg
 + *
 + * Copyright (c) 2020-2023 PLCT Lab
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#define REQUIRE_ZFBFMIN(ctx) do { \
++#define ZVKG_EGS 4
-+    if (!ctx->cfg_ptr->ext_zfbfmin) { \
++
-+        return false; \
++static bool vgmul_check(DisasContext *s, arg_rmr *a)
-+    } \
++{
-+} while (0)
++    int egw_bytes = ZVKG_EGS << s->sew;
-+
++    return s->cfg_ptr->ext_zvkg == true &&
-+static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
++           vext_check_isa_ill(s) &&
-+{
++           require_rvv(s) &&
-+    REQUIRE_FPU;
++           MAXSZ(s) >= egw_bytes &&
-+    REQUIRE_ZFBFMIN(ctx);
++           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
-+
++           s->sew == MO_32;
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++}
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++
-+
++GEN_V_UNMASKED_TRANS(vgmul_vv, vgmul_check, ZVKG_EGS)
-+    gen_set_rm(ctx, a->rm);
++
-+    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
++static bool vghsh_check(DisasContext *s, arg_rmrr *a)
-+    gen_set_fpr_hs(ctx, a->rd, dest);
++{
-+    mark_fs_dirty(ctx);
++    int egw_bytes = ZVKG_EGS << s->sew;
-+    return true;
++    return s->cfg_ptr->ext_zvkg == true &&
-+}
++           opivv_check(s, a) &&
-+
++           MAXSZ(s) >= egw_bytes &&
-+static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
++           s->sew == MO_32;
-+{
++}
-+    REQUIRE_FPU;
++
-+    REQUIRE_ZFBFMIN(ctx);
++GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvzfh.c.inc
 +++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -XXX,XX +XXX,XX @@
      }                                  \
  } while (0)
 -#define REQUIRE_ZFHMIN(ctx) do {              \
 -    if (!ctx->cfg_ptr->ext_zfhmin) {          \
 +#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
 +    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
          return false;                         \
      }                                         \
  } while (0)
@@ -XXX,XX +XXX,XX @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
      TCGv t0;
      REQUIRE_FPU;
 -    REQUIRE_ZFHMIN(ctx);
 +    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
      decode_save_opc(ctx);
      t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
      TCGv t0;
      REQUIRE_FPU;
 -    REQUIRE_ZFHMIN(ctx);
 +    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
      decode_save_opc(ctx);
      t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
  static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFHMIN(ctx);
 +    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
  static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFHMIN(ctx);
 +    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
      TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
 --
-.40.1
+.41.0

-[PULL 43/54] target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
+[PULL v2 20/45] crypto: Create sm4_subword
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Max Chou <max.chou@sifive.com>
-At this moment we're retrieving env->misa_ext during
+Allows sharing of sm4_subword between different targets.
 kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.
-We want to set env->misa_ext_mask, and we want to set it as early as
+Signed-off-by: Max Chou <max.chou@sifive.com>
-possible. The reason is that we're going to use it in the validation
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-process of the KVM MISA properties we're going to add next. Setting it
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-during arch_init_cpu() is too late for user validation.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
 Move the code to a new helper that is going to be called during init()
 time, via kvm_riscv_init_user_properties(), like we're already doing for
 the machine ID properties. Set both misa_ext and misa_ext_mask to the
 same value retrieved by the 'isa' config reg.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
+ include/crypto/sm4.h           |  8 ++++++++
-file changed, 23 insertions(+), 11 deletions(-)
+ target/arm/tcg/crypto_helper.c | 10 ++--------
 files changed, 10 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/include/crypto/sm4.h
-+++ b/target/riscv/kvm.c
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+@@ -XXX,XX +XXX,XX @@
-     }
- }
+ extern const uint8_t sm4_sbox[256];
-+static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
++static inline uint32_t sm4_subword(uint32_t word)
 +                                         KVMScratchCPU *kvmcpu)
 +{
-+    CPURISCVState *env = &cpu->env;
++    return sm4_sbox[word & 0xff] |
-+    struct kvm_one_reg reg;
++           sm4_sbox[(word >> 8) & 0xff] << 8 |
-+    int ret;
++           sm4_sbox[(word >> 16) & 0xff] << 16 |
-+
++           sm4_sbox[(word >> 24) & 0xff] << 24;
 +    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 +                              KVM_REG_RISCV_CONFIG_REG(isa));
 +    reg.addr = (uint64_t)&env->misa_ext_mask;
 +    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +
 +    if (ret) {
 +        error_report("Unable to fetch ISA register from KVM, "
 +                     "error %d", ret);
 +        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    env->misa_ext = env->misa_ext_mask;
 +}
 +
- void kvm_riscv_init_user_properties(Object *cpu_obj)
+ #endif
- {
+diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
-     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
+--- a/target/arm/tcg/crypto_helper.c
-     }
++++ b/target/arm/tcg/crypto_helper.c
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
-     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+             CR_ST_WORD(d, (i + 3) % 4) ^
-+    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+             CR_ST_WORD(n, i);
-     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+-        t = sm4_sbox[t & 0xff] |
- }
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
- int kvm_arch_init_vcpu(CPUState *cs)
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
- {
++        t = sm4_subword(t);
-     int ret = 0;
--    target_ulong isa;
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
-     RISCVCPU *cpu = RISCV_CPU(cs);
+                             rol32(t, 24);
--    CPURISCVState *env = &cpu->env;
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
--    uint64_t id;
+             CR_ST_WORD(d, (i + 3) % 4) ^
+             CR_ST_WORD(m, i);
-     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
+-        t = sm4_sbox[t & 0xff] |
--    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
--                          KVM_REG_RISCV_CONFIG_REG(isa));
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
--    ret = kvm_get_one_reg(cs, id, &isa);
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
--    if (ret) {
++        t = sm4_subword(t);
--        return ret;
--    }
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
 -    env->misa_ext = isa;
 -
      if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
          ret = kvm_vcpu_set_machine_ids(cpu, cs);
      }
 --
-.40.1
+.41.0

-[PULL 31/54] target/riscv: Add disas support for BF16 extensions
+[PULL v2 21/45] crypto: Add SM4 constant parameter CK
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Max Chou <max.chou@sifive.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Adds sm4_ck constant for use in sm4 cryptography across different targets.
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ include/crypto/sm4.h |  1 +
-file changed, 44 insertions(+)
+ crypto/sm4.c         | 10 ++++++++++
 files changed, 11 insertions(+)
-diff --git a/disas/riscv.c b/disas/riscv.c
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
+--- a/include/crypto/sm4.h
-+++ b/disas/riscv.c
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@
-     rv_op_cm_jalt = 788,
+ #define QEMU_SM4_H
-     rv_op_czero_eqz = 789,
-     rv_op_czero_nez = 790,
+ extern const uint8_t sm4_sbox[256];
-+    rv_op_fcvt_bf16_s = 791,
++extern const uint32_t sm4_ck[32];
-+    rv_op_fcvt_s_bf16 = 792,
-+    rv_op_vfncvtbf16_f_f_w = 793,
+ static inline uint32_t sm4_subword(uint32_t word)
-+    rv_op_vfwcvtbf16_f_f_v = 794,
+ {
-+    rv_op_vfwmaccbf16_vv = 795,
+diff --git a/crypto/sm4.c b/crypto/sm4.c
-+    rv_op_vfwmaccbf16_vf = 796,
+index XXXXXXX..XXXXXXX 100644
-+    rv_op_flh = 797,
+--- a/crypto/sm4.c
-+    rv_op_fsh = 798,
++++ b/crypto/sm4.c
-+    rv_op_fmv_h_x = 799,
+@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
-+    rv_op_fmv_x_h = 800,
+x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
  } rv_op;
  /* register names */
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
      { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
      { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
      { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
 +    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
 +    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
 +    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
 +    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
 +    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
 +    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
 +    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
  };
- /* CSR names */
++uint32_t const sm4_ck[] = {
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
-                 case 3: op = rv_op_vloxei8_v; break;
++    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
-                 }
++    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
-                 break;
++    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
-+            case 1: op = rv_op_flh; break;
++    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
-             case 2: op = rv_op_flw; break;
++    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
-             case 3: op = rv_op_fld; break;
++    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
-             case 4: op = rv_op_flq; break;
++    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++};
                  case 3: op = rv_op_vsoxei8_v; break;
                  }
                  break;
 +            case 1: op = rv_op_fsh; break;
              case 2: op = rv_op_fsw; break;
              case 3: op = rv_op_fsd; break;
              case 4: op = rv_op_fsq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 1: op = rv_op_fcvt_s_d; break;
                  case 3: op = rv_op_fcvt_s_q; break;
 +                case 6: op = rv_op_fcvt_s_bf16; break;
                  }
                  break;
              case 33:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 3: op = rv_op_fcvt_d_q; break;
                  }
                  break;
 +            case 34:
 +                switch (((inst >> 20) & 0b11111)) {
 +                case 8: op = rv_op_fcvt_bf16_s; break;
 +                }
 +                break;
              case 35:
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_q_s; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 1: op = rv_op_fclass_d; break;
                  }
                  break;
 +            case 114:
 +                switch (((inst >> 17) & 0b11111000) |
 +                        ((inst >> 12) & 0b00000111)) {
 +                case 0: op = rv_op_fmv_x_h; break;
 +                }
 +                break;
              case 115:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fmv_d_x; break;
                  }
                  break;
 +            case 122:
 +                switch (((inst >> 17) & 0b11111000) |
 +                        ((inst >> 12) & 0b00000111)) {
 +                case 0: op = rv_op_fmv_h_x; break;
 +                }
 +                break;
              case 123:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                      case 10: op = rv_op_vfwcvt_f_xu_v; break;
                      case 11: op = rv_op_vfwcvt_f_x_v; break;
                      case 12: op = rv_op_vfwcvt_f_f_v; break;
 +                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
                      case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
                      case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
                      case 16: op = rv_op_vfncvt_xu_f_w; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                      case 21: op = rv_op_vfncvt_rod_f_f_w; break;
                      case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
                      case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
 +                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
                      }
                      break;
                  case 19:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 52: op = rv_op_vfwadd_wv; break;
                  case 54: op = rv_op_vfwsub_wv; break;
                  case 56: op = rv_op_vfwmul_vv; break;
 +                case 59: op = rv_op_vfwmaccbf16_vv; break;
                  case 60: op = rv_op_vfwmacc_vv; break;
                  case 61: op = rv_op_vfwnmacc_vv; break;
                  case 62: op = rv_op_vfwmsac_vv; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 52: op = rv_op_vfwadd_wf; break;
                  case 54: op = rv_op_vfwsub_wf; break;
                  case 56: op = rv_op_vfwmul_vf; break;
 +                case 59: op = rv_op_vfwmaccbf16_vf; break;
                  case 60: op = rv_op_vfwmacc_vf; break;
                  case 61: op = rv_op_vfwnmacc_vf; break;
                  case 62: op = rv_op_vfwmsac_vf; break;
 --
-.40.1
+.41.0

-[PULL 39/54] target/riscv/cpu.c: restrict 'marchid' value
+[PULL v2 22/45] target/riscv: Add Zvksed ISA extension support
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Max Chou <max.chou@sifive.com>
-'marchid' shouldn't be set to a different value as previously set for
+This commit adds support for the Zvksed vector-crypto extension, which
-named CPUs.
+consists of the following instructions:
-For all other CPUs it shouldn't be freely set either - the spec requires
+* vsm4k.vi
-that 'marchid' can't have the MSB (most significant bit) set and every
+* vsm4r.[vv,vs]
-other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
-bit CPUs.
+Translation functions are defined in
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-As with 'mimpid', setting a default value based on the current QEMU
+`target/riscv/vcrypto_helper.c`.
-version is not a good idea because it implies that the CPU
-implementation changes from one QEMU version to the other. Named CPUs
+Signed-off-by: Max Chou <max.chou@sifive.com>
-should set 'marchid' to a meaningful value instead, and generic CPUs can
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-set to any valid value.
+[lawrence.hunter@codethink.co.uk: Moved SM4 functions from
+crypto_helper.c to vcrypto_helper.c]
-For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
+[nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
-a different val:
+use macros, and minor style changes]
+Signed-off-by: Max Chou <max.chou@sifive.com>
-$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
+Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
 qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
     Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)
 And, for generics CPUs, this is the error when trying to set to an
 invalid val:
 $ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
 qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
     Unable to set marchid with MSB (64) bit set and the remaining bits zero
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
+ target/riscv/cpu_cfg.h                   |   1 +
-file changed, 53 insertions(+), 7 deletions(-)
+ target/riscv/helper.h                    |   4 +
+ target/riscv/insn32.decode               |   5 +
  target/riscv/cpu.c                       |   5 +-
  target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 files changed, 184 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 +    bool ext_zvksed;
      bool ext_zvksh;
      bool ext_zmmul;
      bool ext_zvfbfmin;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
  DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
 +DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvkg vector crypto extension ***
  vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 +
 +# *** Zvksed vector crypto extension ***
 +vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
++    ISA_EXT_DATA_ENTRY(zvksed, PRIV_VERSION_1_12_0, ext_zvksed),
+     ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+      * in qemu
+      */
+     if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
+-         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
++         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed || cpu->cfg.ext_zvksh) &&
++        !cpu->cfg.ext_zve32f) {
+         error_setg(errp,
+                    "Vector crypto extensions require V or Zve* extensions");
+         return;
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+     DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
+     DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
++    DEFINE_PROP_BOOL("x-zvksed", RISCVCPU, cfg.ext_zvksed, false),
+     DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
+     DEFINE_PROP_END_OF_LIST(),
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vcrypto_helper.c
++++ b/target/riscv/vcrypto_helper.c
 @@ -XXX,XX +XXX,XX @@
- #include "tcg/tcg.h"
+ #include "cpu.h"
+ #include "crypto/aes.h"
- /* RISC-V CPU definitions */
+ #include "crypto/aes-round.h"
--
++#include "crypto/sm4.h"
--#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
+ #include "exec/memop.h"
--                             (QEMU_VERSION_MINOR << 8)  | \
+ #include "exec/exec-all.h"
--                             (QEMU_VERSION_MICRO))
+ #include "exec/helper-proto.h"
--
+@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
- static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
+     vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
+     env->vstart = 0;
  struct isa_ext_data {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
  static Property riscv_cpu_properties[] = {
      DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 -    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
 -
  #ifndef CONFIG_USER_ONLY
      DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
  #endif
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
      visit_type_bool(v, name, &value, errp);
  }
++
-+static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
++void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
-+                            void *opaque, Error **errp)
++                      uint32_t desc)
 +{
-+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
++    const uint32_t egs = 4;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    uint32_t rnd = uimm5 & 0x7;
-+    uint64_t prev_val = cpu->cfg.marchid;
++    uint32_t group_start = env->vstart / egs;
-+    uint64_t value, invalid_val;
++    uint32_t group_end = env->vl / egs;
-+    uint32_t mxlen = 0;
++    uint32_t esz = sizeof(uint32_t);
-+
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-+    if (!visit_type_uint64(v, name, &value, errp)) {
++
-+        return;
++    for (uint32_t i = group_start; i < group_end; ++i) {
-+    }
++        uint32_t vstart = i * egs;
-+
++        uint32_t vend = (i + 1) * egs;
-+    if (!dynamic_cpu && prev_val != value) {
++        uint32_t rk[4] = {0};
-+        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
++        uint32_t tmp[8] = {0};
-+                   object_get_typename(obj), prev_val);
++
-+        return;
++        for (uint32_t j = vstart; j < vend; ++j) {
-+    }
++            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
-+
++        }
-+    switch (riscv_cpu_mxl(&cpu->env)) {
++
-+    case MXL_RV32:
++        for (uint32_t j = 0; j < egs; ++j) {
-+        mxlen = 32;
++            tmp[j] = rk[j];
-+        break;
++        }
-+    case MXL_RV64:
++
-+    case MXL_RV128:
++        for (uint32_t j = 0; j < egs; ++j) {
-+        mxlen = 64;
++            uint32_t b, s;
-+        break;
++            b = tmp[j + 1] ^ tmp[j + 2] ^ tmp[j + 3] ^ sm4_ck[rnd * 4 + j];
-+    default:
++
-+        g_assert_not_reached();
++            s = sm4_subword(b);
-+    }
++
-+
++            tmp[j + 4] = tmp[j] ^ (s ^ rol32(s, 13) ^ rol32(s, 23));
-+    invalid_val = 1LL << (mxlen - 1);
++        }
 +
-+    if (value == invalid_val) {
++        for (uint32_t j = vstart; j < vend; ++j) {
-+        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
++            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
-+                         "and the remaining bits zero", mxlen);
++        }
-+        return;
++    }
-+    }
++
-+
++    env->vstart = 0;
-+    cpu->cfg.marchid = value;
++    /* set tail elements to 1s */
-+}
++    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
-+
++}
-+static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
++
-+                           void *opaque, Error **errp)
++static void do_sm4_round(uint32_t *rk, uint32_t *buf)
 +{
-+    bool value = RISCV_CPU(obj)->cfg.marchid;
++    const uint32_t egs = 4;
-+
++    uint32_t s, b;
-+    visit_type_bool(v, name, &value, errp);
++
-+}
++    for (uint32_t j = egs; j < egs * 2; ++j) {
-+
++        b = buf[j - 3] ^ buf[j - 2] ^ buf[j - 1] ^ rk[j - 4];
- static void riscv_cpu_class_init(ObjectClass *c, void *data)
++
- {
++        s = sm4_subword(b);
-     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
++
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
++        buf[j] = buf[j - 4] ^ (s ^ rol32(s, 2) ^ rol32(s, 10) ^ rol32(s, 18) ^
-     object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
++                               rol32(s, 24));
-                               cpu_set_mimpid, NULL, NULL);
++    }
++}
-+    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
++
-+                              cpu_set_marchid, NULL, NULL);
++void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
-+
++{
-     device_class_set_props(dc, riscv_cpu_properties);
++    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            rk[j] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vghsh_check(DisasContext *s, arg_rmrr *a)
  }
+ GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
++
++/*
++ * Zvksed
++ */
++
++#define ZVKSED_EGS 4
++
++static bool zvksed_check(DisasContext *s)
++{
++    int egw_bytes = ZVKSED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvksed == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->sew == MO_32;
++}
++
++static bool vsm4k_vi_check(DisasContext *s, arg_rmrr *a)
++{
++    return zvksed_check(s) &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul);
++}
++
++GEN_VI_UNMASKED_TRANS(vsm4k_vi, vsm4k_vi_check, ZVKSED_EGS)
++
++static bool vsm4r_vv_check(DisasContext *s, arg_rmr *a)
++{
++    return zvksed_check(s) &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul);
++}
++
++GEN_V_UNMASKED_TRANS(vsm4r_vv, vsm4r_vv_check, ZVKSED_EGS)
++
++static bool vsm4r_vs_check(DisasContext *s, arg_rmr *a)
++{
++    return zvksed_check(s) &&
++           !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
++           require_align(a->rd, s->lmul);
++}
++
++GEN_V_UNMASKED_TRANS(vsm4r_vs, vsm4r_vs_check, ZVKSED_EGS)
 --
-.40.1
+.41.0

-[PULL 11/54] target/riscv: Remove redundant assignment to SXL
+[PULL v2 23/45] target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Rob Bradford <rbradford@rivosinc.com>
-SXL is initialized as env->misa_mxl which is also the mxl value.
+These are WARL fields - zero out the bits for unavailable counters and
-So we can just remain it unchanged to keep it read-only.
+special case the TM bit in mcountinhibit which is hardwired to zero.
 This patch achieves this by modifying the value written so that any use
 of the field will see the correctly masked bits.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Tested by modifying OpenSBI to write max value to these CSRs and upon
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+subsequent read the appropriate number of bits for number of PMUs is
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+enabled and the TM bit is zero in mcountinhibit.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 4 ----
+ target/riscv/csr.c | 11 +++++++++--
-file changed, 4 deletions(-)
+file changed, 9 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
+ {
-     mstatus = (mstatus & ~mask) | (val & mask);
+     int cidx;
+     PMUCTRState *counter;
--    if (xl > MXL_RV32) {
++    RISCVCPU *cpu = env_archcpu(env);
--        /* SXL field is for now read only */
--        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
+-    env->mcountinhibit = val;
--    }
++    /* WARL register - disable unavailable counters; TM bit is always 0 */
-     env->mstatus = mstatus;
++    env->mcountinhibit =
++        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
-     /*
      /* Check if any other counter is also monitoring cycles/instructions */
      for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
  static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                         target_ulong val)
  {
 -    env->mcounteren = val;
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    /* WARL register - disable unavailable counters */
 +    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
 +                             COUNTEREN_IR);
      return RISCV_EXCP_NONE;
  }
 --
-.40.1
+.41.0

-[PULL 12/54] target/riscv/cpu.c: fix veyron-v1 CPU properties
+[PULL v2 24/45] target/riscv: Add Zihintntl extension ISA string to DTS
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Jason Chien <jason.chien@sifive.com>
-Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
+RVA23 Profiles states:
-riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
+The RVA23 profiles are intended to be used for 64-bit application
-and ext_icsr from riscv_cpu_init(), the init() function of
+processors that will run rich OS stacks from standard binary OS
-TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
+distributions and with a substantial number of third-party binary user
-CPUs to explictly enable all extensions and features it requires,
+applications that will be supported over a considerable length of time
-without any 'magic values' that were inherited by the parent type.
+in the field.
-This commit failed to make appropriate changes in the 'veyron-v1' CPU,
+The chapter 4 of the unprivileged spec introduces the Zihintntl extension
-added earlier by commit e1d084a8524a. The result is that the veyron-v1
+and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
-CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
+purpose is to enable application and operating system portability across
-case.
+different implementations. Thus the DTS should contain the Zihintntl ISA
 string in order to pass to software.
-The reason why it took this long to notice (thanks LIU Zhiwei for
+The unprivileged spec states:
-reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
+Like any HINTs, these instructions may be freely ignored. Hence, although
-absent in the 'riscv,isa' DT, implying that they're both present if the
+they are described in terms of cache-based memory hierarchies, they do not
-'i' extension is enabled. OpenSBI also doesn't error out or warns about
+mandate the provision of caches.
 the lack of 'pmp', it'll just not protect memory pages.
-Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
+These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
-f0bdfb5bfc2 already did with other CPUs.
+which QEMU already supports, and QEMU does not emulate cache. Therefore
 these instructions can be considered as a no-op, and we only need to add
 a new property for the Zihintntl extension.
-Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
+Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 3 +++
+ target/riscv/cpu_cfg.h | 1 +
-file changed, 3 insertions(+)
+ target/riscv/cpu.c     | 2 ++
 files changed, 3 insertions(+)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_icbom;
+     bool ext_icboz;
+     bool ext_zicond;
++    bool ext_zihintntl;
+     bool ext_zihintpause;
+     bool ext_smstateen;
+     bool ext_sstc;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
-     /* Enable ISA extensions */
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
-     cpu->cfg.mmu = true;
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-+    cpu->cfg.ext_ifencei = true;
++    ISA_EXT_DATA_ENTRY(zihintntl, PRIV_VERSION_1_10_0, ext_zihintntl),
-+    cpu->cfg.ext_icsr = true;
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-+    cpu->cfg.pmp = true;
+     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
-     cpu->cfg.ext_icbom = true;
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-     cpu->cfg.cbom_blocksize = 64;
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     cpu->cfg.cboz_blocksize = 64;
+     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
      DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
      DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 +    DEFINE_PROP_BOOL("Zihintntl", RISCVCPU, cfg.ext_zihintntl, true),
      DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
      DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
      DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
 --
-.40.1
+.41.0

-[PULL 51/54] target/riscv: update multi-letter extension KVM properties
+[PULL v2 25/45] target/riscv: Fix zfa fleq.d and fltq.d
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-We're now ready to update the multi-letter extensions status for KVM.
+Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
 However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
 helper function.
-kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
+Fixes: a47842d ("riscv: Add support for the Zfa extension")
-time to verify which user options changes host defaults (via the 'user_set'
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-flag) and tries to write them back to KVM.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Failure to commit a change to KVM is only ignored in case KVM doesn't
+Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
 know about the extension (-EINVAL error code) and the user wanted to
 disable the given extension. Otherwise we're going to abort the boot
 process.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
-file changed, 27 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
-     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_helper_fleq_d(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
+@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
-+static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
-+{
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
-+    CPURISCVState *env = &cpu->env;
-+    uint64_t id, reg;
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
-+    int i, ret;
++    gen_helper_fltq_d(dest, cpu_env, src1, src2);
-+
+     gen_set_gpr(ctx, a->rd, dest);
-+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+     return true;
 +        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
 +
 +        if (!multi_ext_cfg->user_set) {
 +            continue;
 +        }
 +
 +        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
 +                              multi_ext_cfg->kvm_reg_id);
 +        reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
 +        ret = kvm_set_one_reg(cs, id, &reg);
 +        if (ret != 0) {
 +            error_report("Unable to %s extension %s in KVM, error %d",
 +                         reg ? "enable" : "disable",
 +                         multi_ext_cfg->name, ret);
 +            exit(EXIT_FAILURE);
 +        }
 +    }
 +}
 +
  static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
  {
      int i;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      }
      kvm_riscv_update_cpu_misa_ext(cpu, cs);
 +    kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
      return ret;
  }
 --
-.40.1
+.41.0

-[PULL 30/54] target/riscv: Set the correct exception for implict G-stage translation fail
+[PULL v2 26/45] hw/intc: Fix upper/lower mtime write calculation
 From: Jason Chien <jason.chien@sifive.com>
-The privileged spec states:
+When writing the upper mtime, we should keep the original lower mtime
-For a memory access made to support VS-stage address translation (such as
+whose value is given by cpu_riscv_read_rtc() instead of
-to read/write a VS-level page table), permissions are checked as though
+cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.
 for a load or store, not for the original access type. However, any
 exception is always reported for the original access type (instruction,
 load, or store/AMO).
 The current implementation converts the access type to LOAD if implicit
 G-stage translation fails which results in only reporting "Load guest-page
 fault". This commit removes the convertion of access type, so the reported
 exception conforms to the spec.
 Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
+Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 1 -
+ hw/intc/riscv_aclint.c | 5 +++--
-file changed, 1 deletion(-)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/hw/intc/riscv_aclint.c
-+++ b/target/riscv/cpu_helper.c
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
-         if (ret == TRANSLATE_G_STAGE_FAIL) {
+         return;
-             first_stage_error = false;
+     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
-             two_stage_indirect_error = true;
+         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
--            access_type = MMU_DATA_LOAD;
++        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
-         }
+         if (addr == mtimer->time_base) {
-         qemu_log_mask(CPU_LOG_MMU,
+             if (size == 4) {
                  /* time_lo for RV32/RV64 */
 -                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
 +                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
              } else {
                  /* time for RV64 */
                  mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
          } else {
              if (size == 4) {
                  /* time_hi for RV32/RV64 */
 -                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
 +                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
              } else {
                  qemu_log_mask(LOG_GUEST_ERROR,
                                "aclint-mtimer: invalid time_hi write: %08x",
 --
-.40.1
+.41.0

-[PULL 38/54] target/riscv/cpu.c: restrict 'mimpid' value
+[PULL v2 27/45] hw/intc: Make rtc variable names consistent
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Jason Chien <jason.chien@sifive.com>
-Following the same logic used with 'mvendorid' let's also restrict
+The variables whose values are given by cpu_riscv_read_rtc() should be named
-'mimpid' for named CPUs. Generic CPUs keep setting the value freely.
+"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
 should be named "rtc_r".
-Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 reason is that this is not a good default since it's dynamic, changing
 with with every QEMU version, regardless of whether the actual
 implementation of the CPU changed from one QEMU version to the other.
 Named CPU should set it to a meaningful value instead and generic CPUs
 can set whatever they want.
 This is the error thrown for an invalid 'mimpid' value for the veyron-v1
 CPU:
 $ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
 qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
     Unable to change veyron-v1-riscv-cpu mimpid (0x111)
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
+Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
+ hw/intc/riscv_aclint.c | 6 +++---
-file changed, 32 insertions(+), 2 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/hw/intc/riscv_aclint.c
-+++ b/target/riscv/cpu.c
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
- #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
+     uint64_t next;
-                              (QEMU_VERSION_MINOR << 8)  | \
+     uint64_t diff;
-                              (QEMU_VERSION_MICRO))
--#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
+-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
++    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
- static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
+     /* Compute the relative hartid w.r.t the socket */
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+     hartid = hartid - mtimer->hartid_base;
-     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
+     mtimer->timecmp[hartid] = value;
-     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
+-    if (mtimer->timecmp[hartid] <= rtc_r) {
--    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
++    if (mtimer->timecmp[hartid] <= rtc) {
+         /*
- #ifndef CONFIG_USER_ONLY
+          * If we're setting an MTIMECMP value in the "past",
-     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
+          * immediately raise the timer interrupt
-@@ -XXX,XX +XXX,XX @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
-     visit_type_bool(v, name, &value, errp);
- }
+     /* otherwise, set up the future timer interrupt */
+     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-+static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
+-    diff = mtimer->timecmp[hartid] - rtc_r;
-+                           void *opaque, Error **errp)
++    diff = mtimer->timecmp[hartid] - rtc;
-+{
+     /* back to ns (note args switched in muldiv64) */
-+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    uint64_t prev_val = cpu->cfg.mimpid;
 +    uint64_t value;
 +
 +    if (!visit_type_uint64(v, name, &value, errp)) {
 +        return;
 +    }
 +
 +    if (!dynamic_cpu && prev_val != value) {
 +        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
 +                   object_get_typename(obj), prev_val);
 +        return;
 +    }
 +
 +    cpu->cfg.mimpid = value;
 +}
 +
 +static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
 +                           void *opaque, Error **errp)
 +{
 +    bool value = RISCV_CPU(obj)->cfg.mimpid;
 +
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
                                cpu_set_mvendorid, NULL, NULL);
 +    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
 +                              cpu_set_mimpid, NULL, NULL);
 +
      device_class_set_props(dc, riscv_cpu_properties);
  }
 --
-.40.1
+.41.0

-[PULL 01/54] target/riscv: Use xl instead of mxl for disassemble
+[PULL v2 28/45] linux-user/riscv: Use abi type for target_ucontext
 From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Disassemble function(plugin_disas, target_disas, monitor_disas) will
+We should not use types dependend on host arch for target_ucontext.
-always call set_disas_info before disassembling instructions.
+This bug is found when run rv32 applications.
 plugin_disas  and target_disas will always be called under a TB, which
 has the same XLEN.
 We can't ensure that monitor_disas will always be called under a TB,
 but current XLEN will still be a better choice, thus we can ensure at
 least the disassemble of the nearest one TB is right.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
+Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 3 ++-
+ linux-user/riscv/signal.c | 4 ++--
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/linux-user/riscv/signal.c
-+++ b/target/riscv/cpu.c
++++ b/linux-user/riscv/signal.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
- static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
+ }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
- {
-     RISCVCPU *cpu = RISCV_CPU(s);
+ struct target_ucontext {
-+    CPURISCVState *env = &cpu->env;
+-    unsigned long uc_flags;
-     info->target_info = &cpu->cfg;
+-    struct target_ucontext *uc_link;
++    abi_ulong uc_flags;
--    switch (riscv_cpu_mxl(&cpu->env)) {
++    abi_ptr uc_link;
-+    switch (env->xl) {
+     target_stack_t uc_stack;
-     case MXL_RV32:
+     target_sigset_t uc_sigmask;
-         info->print_insn = print_insn_riscv32;
+     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
          break;
 --
-.40.1
+.41.0

-[PULL 03/54] disas/riscv: Move types/constants to new header file
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-In order to enable vendor disassembler support, we need to
-move types and constants into a header file so that other
-compilation units can use them as well.
-This patch does not introduce any functional changes.
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
- disas/riscv.c | 270 +----------------------------------------------
-files changed, 283 insertions(+), 269 deletions(-)
- create mode 100644 disas/riscv.h
-diff --git a/disas/riscv.h b/disas/riscv.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU disassembler -- RISC-V specific header.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef DISAS_RISCV_H
-+#define DISAS_RISCV_H
-+
-+#include "qemu/osdep.h"
-+#include "target/riscv/cpu_cfg.h"
-+
-+/* types */
-+
-+typedef uint64_t rv_inst;
-+typedef uint16_t rv_opcode;
-+
-+/* enums */
-+
-+typedef enum {
-+    rv32,
-+    rv64,
-+    rv128
-+} rv_isa;
-+
-+typedef enum {
-+    rv_rm_rne = 0,
-+    rv_rm_rtz = 1,
-+    rv_rm_rdn = 2,
-+    rv_rm_rup = 3,
-+    rv_rm_rmm = 4,
-+    rv_rm_dyn = 7,
-+} rv_rm;
-+
-+typedef enum {
-+    rv_fence_i = 8,
-+    rv_fence_o = 4,
-+    rv_fence_r = 2,
-+    rv_fence_w = 1,
-+} rv_fence;
-+
-+typedef enum {
-+    rv_ireg_zero,
-+    rv_ireg_ra,
-+    rv_ireg_sp,
-+    rv_ireg_gp,
-+    rv_ireg_tp,
-+    rv_ireg_t0,
-+    rv_ireg_t1,
-+    rv_ireg_t2,
-+    rv_ireg_s0,
-+    rv_ireg_s1,
-+    rv_ireg_a0,
-+    rv_ireg_a1,
-+    rv_ireg_a2,
-+    rv_ireg_a3,
-+    rv_ireg_a4,
-+    rv_ireg_a5,
-+    rv_ireg_a6,
-+    rv_ireg_a7,
-+    rv_ireg_s2,
-+    rv_ireg_s3,
-+    rv_ireg_s4,
-+    rv_ireg_s5,
-+    rv_ireg_s6,
-+    rv_ireg_s7,
-+    rv_ireg_s8,
-+    rv_ireg_s9,
-+    rv_ireg_s10,
-+    rv_ireg_s11,
-+    rv_ireg_t3,
-+    rv_ireg_t4,
-+    rv_ireg_t5,
-+    rv_ireg_t6,
-+} rv_ireg;
-+
-+typedef enum {
-+    rvc_end,
-+    rvc_rd_eq_ra,
-+    rvc_rd_eq_x0,
-+    rvc_rs1_eq_x0,
-+    rvc_rs2_eq_x0,
-+    rvc_rs2_eq_rs1,
-+    rvc_rs1_eq_ra,
-+    rvc_imm_eq_zero,
-+    rvc_imm_eq_n1,
-+    rvc_imm_eq_p1,
-+    rvc_csr_eq_0x001,
-+    rvc_csr_eq_0x002,
-+    rvc_csr_eq_0x003,
-+    rvc_csr_eq_0xc00,
-+    rvc_csr_eq_0xc01,
-+    rvc_csr_eq_0xc02,
-+    rvc_csr_eq_0xc80,
-+    rvc_csr_eq_0xc81,
-+    rvc_csr_eq_0xc82,
-+} rvc_constraint;
-+
-+typedef enum {
-+    rv_codec_illegal,
-+    rv_codec_none,
-+    rv_codec_u,
-+    rv_codec_uj,
-+    rv_codec_i,
-+    rv_codec_i_sh5,
-+    rv_codec_i_sh6,
-+    rv_codec_i_sh7,
-+    rv_codec_i_csr,
-+    rv_codec_s,
-+    rv_codec_sb,
-+    rv_codec_r,
-+    rv_codec_r_m,
-+    rv_codec_r4_m,
-+    rv_codec_r_a,
-+    rv_codec_r_l,
-+    rv_codec_r_f,
-+    rv_codec_cb,
-+    rv_codec_cb_imm,
-+    rv_codec_cb_sh5,
-+    rv_codec_cb_sh6,
-+    rv_codec_ci,
-+    rv_codec_ci_sh5,
-+    rv_codec_ci_sh6,
-+    rv_codec_ci_16sp,
-+    rv_codec_ci_lwsp,
-+    rv_codec_ci_ldsp,
-+    rv_codec_ci_lqsp,
-+    rv_codec_ci_li,
-+    rv_codec_ci_lui,
-+    rv_codec_ci_none,
-+    rv_codec_ciw_4spn,
-+    rv_codec_cj,
-+    rv_codec_cj_jal,
-+    rv_codec_cl_lw,
-+    rv_codec_cl_ld,
-+    rv_codec_cl_lq,
-+    rv_codec_cr,
-+    rv_codec_cr_mv,
-+    rv_codec_cr_jalr,
-+    rv_codec_cr_jr,
-+    rv_codec_cs,
-+    rv_codec_cs_sw,
-+    rv_codec_cs_sd,
-+    rv_codec_cs_sq,
-+    rv_codec_css_swsp,
-+    rv_codec_css_sdsp,
-+    rv_codec_css_sqsp,
-+    rv_codec_k_bs,
-+    rv_codec_k_rnum,
-+    rv_codec_v_r,
-+    rv_codec_v_ldst,
-+    rv_codec_v_i,
-+    rv_codec_vsetvli,
-+    rv_codec_vsetivli,
-+    rv_codec_zcb_ext,
-+    rv_codec_zcb_mul,
-+    rv_codec_zcb_lb,
-+    rv_codec_zcb_lh,
-+    rv_codec_zcmp_cm_pushpop,
-+    rv_codec_zcmp_cm_mv,
-+    rv_codec_zcmt_jt,
-+} rv_codec;
-+
-+/* structures */
-+
-+typedef struct {
-+    RISCVCPUConfig *cfg;
-+    uint64_t  pc;
-+    uint64_t  inst;
-+    int32_t   imm;
-+    uint16_t  op;
-+    uint8_t   codec;
-+    uint8_t   rd;
-+    uint8_t   rs1;
-+    uint8_t   rs2;
-+    uint8_t   rs3;
-+    uint8_t   rm;
-+    uint8_t   pred;
-+    uint8_t   succ;
-+    uint8_t   aq;
-+    uint8_t   rl;
-+    uint8_t   bs;
-+    uint8_t   rnum;
-+    uint8_t   vm;
-+    uint32_t  vzimm;
-+    uint8_t   rlist;
-+} rv_decode;
-+
-+typedef struct {
-+    const int op;
-+    const rvc_constraint *constraints;
-+} rv_comp_data;
-+
-+enum {
-+    rvcd_imm_nz = 0x1
-+};
-+
-+typedef struct {
-+    const char * const name;
-+    const rv_codec codec;
-+    const char * const format;
-+    const rv_comp_data *pseudo;
-+    const short decomp_rv32;
-+    const short decomp_rv64;
-+    const short decomp_rv128;
-+    const short decomp_data;
-+} rv_opcode_data;
-+
-+/* instruction formats */
-+
-+#define rv_fmt_none                   "O\t"
-+#define rv_fmt_rs1                    "O\t1"
-+#define rv_fmt_offset                 "O\to"
-+#define rv_fmt_pred_succ              "O\tp,s"
-+#define rv_fmt_rs1_rs2                "O\t1,2"
-+#define rv_fmt_rd_imm                 "O\t0,i"
-+#define rv_fmt_rd_offset              "O\t0,o"
-+#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
-+#define rv_fmt_frd_rs1                "O\t3,1"
-+#define rv_fmt_frd_frs1               "O\t3,4"
-+#define rv_fmt_rd_frs1                "O\t0,4"
-+#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-+#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
-+#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
-+#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
-+#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
-+#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
-+#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
-+#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
-+#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
-+#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
-+#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
-+#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
-+#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
-+#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
-+#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
-+#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
-+#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
-+#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
-+#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
-+#define rv_fmt_rd                     "O\t0"
-+#define rv_fmt_rd_zimm                "O\t0,7"
-+#define rv_fmt_rd_rs1                 "O\t0,1"
-+#define rv_fmt_rd_rs2                 "O\t0,2"
-+#define rv_fmt_rs1_offset             "O\t1,o"
-+#define rv_fmt_rs2_offset             "O\t2,o"
-+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
-+#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
-+#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
-+#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
-+#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
-+#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
-+#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
-+#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
-+#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
-+#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
-+#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
-+#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
-+#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
-+#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
-+#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
-+#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
-+#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
-+#define rv_fmt_vd_vs1                 "O\tD,E"
-+#define rv_fmt_vd_rs1                 "O\tD,1"
-+#define rv_fmt_vd_fs1                 "O\tD,4"
-+#define rv_fmt_vd_imm                 "O\tD,i"
-+#define rv_fmt_vd_vs2                 "O\tD,F"
-+#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
-+#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
-+#define rv_fmt_rd_vs2                 "O\t0,F"
-+#define rv_fmt_fd_vs2                 "O\t3,F"
-+#define rv_fmt_vd_vm                  "O\tDm"
-+#define rv_fmt_vsetvli                "O\t0,1,v"
-+#define rv_fmt_vsetivli               "O\t0,u,v"
-+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-+#define rv_fmt_push_rlist             "O\tx,-i"
-+#define rv_fmt_pop_rlist              "O\tx,i"
-+#define rv_fmt_zcmt_index             "O\ti"
-+
-+#endif /* DISAS_RISCV_H */
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "disas/dis-asm.h"
- #include "target/riscv/cpu_cfg.h"
--
--/* types */
--
--typedef uint64_t rv_inst;
--typedef uint16_t rv_opcode;
--
--/* enums */
--
--typedef enum {
--    rv32,
--    rv64,
--    rv128
--} rv_isa;
--
--typedef enum {
--    rv_rm_rne = 0,
--    rv_rm_rtz = 1,
--    rv_rm_rdn = 2,
--    rv_rm_rup = 3,
--    rv_rm_rmm = 4,
--    rv_rm_dyn = 7,
--} rv_rm;
--
--typedef enum {
--    rv_fence_i = 8,
--    rv_fence_o = 4,
--    rv_fence_r = 2,
--    rv_fence_w = 1,
--} rv_fence;
--
--typedef enum {
--    rv_ireg_zero,
--    rv_ireg_ra,
--    rv_ireg_sp,
--    rv_ireg_gp,
--    rv_ireg_tp,
--    rv_ireg_t0,
--    rv_ireg_t1,
--    rv_ireg_t2,
--    rv_ireg_s0,
--    rv_ireg_s1,
--    rv_ireg_a0,
--    rv_ireg_a1,
--    rv_ireg_a2,
--    rv_ireg_a3,
--    rv_ireg_a4,
--    rv_ireg_a5,
--    rv_ireg_a6,
--    rv_ireg_a7,
--    rv_ireg_s2,
--    rv_ireg_s3,
--    rv_ireg_s4,
--    rv_ireg_s5,
--    rv_ireg_s6,
--    rv_ireg_s7,
--    rv_ireg_s8,
--    rv_ireg_s9,
--    rv_ireg_s10,
--    rv_ireg_s11,
--    rv_ireg_t3,
--    rv_ireg_t4,
--    rv_ireg_t5,
--    rv_ireg_t6,
--} rv_ireg;
--
--typedef enum {
--    rvc_end,
--    rvc_rd_eq_ra,
--    rvc_rd_eq_x0,
--    rvc_rs1_eq_x0,
--    rvc_rs2_eq_x0,
--    rvc_rs2_eq_rs1,
--    rvc_rs1_eq_ra,
--    rvc_imm_eq_zero,
--    rvc_imm_eq_n1,
--    rvc_imm_eq_p1,
--    rvc_csr_eq_0x001,
--    rvc_csr_eq_0x002,
--    rvc_csr_eq_0x003,
--    rvc_csr_eq_0xc00,
--    rvc_csr_eq_0xc01,
--    rvc_csr_eq_0xc02,
--    rvc_csr_eq_0xc80,
--    rvc_csr_eq_0xc81,
--    rvc_csr_eq_0xc82,
--} rvc_constraint;
--
--typedef enum {
--    rv_codec_illegal,
--    rv_codec_none,
--    rv_codec_u,
--    rv_codec_uj,
--    rv_codec_i,
--    rv_codec_i_sh5,
--    rv_codec_i_sh6,
--    rv_codec_i_sh7,
--    rv_codec_i_csr,
--    rv_codec_s,
--    rv_codec_sb,
--    rv_codec_r,
--    rv_codec_r_m,
--    rv_codec_r4_m,
--    rv_codec_r_a,
--    rv_codec_r_l,
--    rv_codec_r_f,
--    rv_codec_cb,
--    rv_codec_cb_imm,
--    rv_codec_cb_sh5,
--    rv_codec_cb_sh6,
--    rv_codec_ci,
--    rv_codec_ci_sh5,
--    rv_codec_ci_sh6,
--    rv_codec_ci_16sp,
--    rv_codec_ci_lwsp,
--    rv_codec_ci_ldsp,
--    rv_codec_ci_lqsp,
--    rv_codec_ci_li,
--    rv_codec_ci_lui,
--    rv_codec_ci_none,
--    rv_codec_ciw_4spn,
--    rv_codec_cj,
--    rv_codec_cj_jal,
--    rv_codec_cl_lw,
--    rv_codec_cl_ld,
--    rv_codec_cl_lq,
--    rv_codec_cr,
--    rv_codec_cr_mv,
--    rv_codec_cr_jalr,
--    rv_codec_cr_jr,
--    rv_codec_cs,
--    rv_codec_cs_sw,
--    rv_codec_cs_sd,
--    rv_codec_cs_sq,
--    rv_codec_css_swsp,
--    rv_codec_css_sdsp,
--    rv_codec_css_sqsp,
--    rv_codec_k_bs,
--    rv_codec_k_rnum,
--    rv_codec_v_r,
--    rv_codec_v_ldst,
--    rv_codec_v_i,
--    rv_codec_vsetvli,
--    rv_codec_vsetivli,
--    rv_codec_zcb_ext,
--    rv_codec_zcb_mul,
--    rv_codec_zcb_lb,
--    rv_codec_zcb_lh,
--    rv_codec_zcmp_cm_pushpop,
--    rv_codec_zcmp_cm_mv,
--    rv_codec_zcmt_jt,
--} rv_codec;
-+#include "disas/riscv.h"
- typedef enum {
-     rv_op_illegal = 0,
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_op_czero_nez = 790,
- } rv_op;
--/* structures */
--
--typedef struct {
--    RISCVCPUConfig *cfg;
--    uint64_t  pc;
--    uint64_t  inst;
--    int32_t   imm;
--    uint16_t  op;
--    uint8_t   codec;
--    uint8_t   rd;
--    uint8_t   rs1;
--    uint8_t   rs2;
--    uint8_t   rs3;
--    uint8_t   rm;
--    uint8_t   pred;
--    uint8_t   succ;
--    uint8_t   aq;
--    uint8_t   rl;
--    uint8_t   bs;
--    uint8_t   rnum;
--    uint8_t   vm;
--    uint32_t  vzimm;
--    uint8_t   rlist;
--} rv_decode;
--
--typedef struct {
--    const int op;
--    const rvc_constraint *constraints;
--} rv_comp_data;
--
--enum {
--    rvcd_imm_nz = 0x1
--};
--
--typedef struct {
--    const char * const name;
--    const rv_codec codec;
--    const char * const format;
--    const rv_comp_data *pseudo;
--    const short decomp_rv32;
--    const short decomp_rv64;
--    const short decomp_rv128;
--    const short decomp_data;
--} rv_opcode_data;
--
- /* register names */
- static const char rv_ireg_name_sym[32][5] = {
-@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
-     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
- };
--/* instruction formats */
--
--#define rv_fmt_none                   "O\t"
--#define rv_fmt_rs1                    "O\t1"
--#define rv_fmt_offset                 "O\to"
--#define rv_fmt_pred_succ              "O\tp,s"
--#define rv_fmt_rs1_rs2                "O\t1,2"
--#define rv_fmt_rd_imm                 "O\t0,i"
--#define rv_fmt_rd_offset              "O\t0,o"
--#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
--#define rv_fmt_frd_rs1                "O\t3,1"
--#define rv_fmt_frd_frs1               "O\t3,4"
--#define rv_fmt_rd_frs1                "O\t0,4"
--#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
--#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
--#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
--#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
--#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
--#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
--#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
--#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
--#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
--#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
--#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
--#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
--#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
--#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
--#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
--#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
--#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
--#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
--#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
--#define rv_fmt_rd                     "O\t0"
--#define rv_fmt_rd_zimm                "O\t0,7"
--#define rv_fmt_rd_rs1                 "O\t0,1"
--#define rv_fmt_rd_rs2                 "O\t0,2"
--#define rv_fmt_rs1_offset             "O\t1,o"
--#define rv_fmt_rs2_offset             "O\t2,o"
--#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
--#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
--#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
--#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
--#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
--#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
--#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
--#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
--#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
--#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
--#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
--#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
--#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
--#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
--#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
--#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
--#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
--#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
--#define rv_fmt_vd_vs1                 "O\tD,E"
--#define rv_fmt_vd_rs1                 "O\tD,1"
--#define rv_fmt_vd_fs1                 "O\tD,4"
--#define rv_fmt_vd_imm                 "O\tD,i"
--#define rv_fmt_vd_vs2                 "O\tD,F"
--#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
--#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
--#define rv_fmt_rd_vs2                 "O\t0,F"
--#define rv_fmt_fd_vs2                 "O\t3,F"
--#define rv_fmt_vd_vm                  "O\tDm"
--#define rv_fmt_vsetvli                "O\t0,1,v"
--#define rv_fmt_vsetivli               "O\t0,u,v"
--#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
--#define rv_fmt_push_rlist             "O\tx,-i"
--#define rv_fmt_pop_rlist              "O\tx,i"
--#define rv_fmt_zcmt_index             "O\ti"
--
- /* pseudo-instruction constraints */
- static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
---
-.40.1

-[PULL 04/54] disas/riscv: Make rv_op_illegal a shared enum value
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-The enum value 'rv_op_illegal' does not represent an
-instruction, but is a catch-all value in case we have
-no match in the decoder. Let's make the value a shared
-one, so that other compile units can reuse it.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.h | 4 ++++
- disas/riscv.c | 2 +-
-files changed, 5 insertions(+), 1 deletion(-)
-diff --git a/disas/riscv.h b/disas/riscv.h
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     const rvc_constraint *constraints;
- } rv_comp_data;
-+enum {
-+    rv_op_illegal = 0
-+};
-+
- enum {
-     rvcd_imm_nz = 0x1
- };
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
- #include "disas/riscv.h"
- typedef enum {
--    rv_op_illegal = 0,
-+    /* 0 is reserved for rv_op_illegal. */
-     rv_op_lui = 1,
-     rv_op_auipc = 2,
-     rv_op_jal = 3,
---
-.40.1

-[PULL 05/54] disas/riscv: Encapsulate opcode_data into decode
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-This patch adds a reference to a struct rv_opcode_data object
-into struct rv_decode. This further allows to remove all references
-to the global variable opcode_data (which is renamed to rvi_opcode_data).
-This patch does not introduce any functional change, but prepares
-the code for more struct rv_opcode_data objects in the future.
-This patch is based on previous work from Liu Zhiwei:
-  https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html
-Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.h | 33 +++++++++++++++++----------------
- disas/riscv.c |  9 ++++++++-
-files changed, 25 insertions(+), 17 deletions(-)
-diff --git a/disas/riscv.h b/disas/riscv.h
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- /* structures */
-+typedef struct {
-+    const int op;
-+    const rvc_constraint *constraints;
-+} rv_comp_data;
-+
-+typedef struct {
-+    const char * const name;
-+    const rv_codec codec;
-+    const char * const format;
-+    const rv_comp_data *pseudo;
-+    const short decomp_rv32;
-+    const short decomp_rv64;
-+    const short decomp_rv128;
-+    const short decomp_data;
-+} rv_opcode_data;
-+
- typedef struct {
-     RISCVCPUConfig *cfg;
-     uint64_t  pc;
-     uint64_t  inst;
-+    const rv_opcode_data *opcode_data;
-     int32_t   imm;
-     uint16_t  op;
-     uint8_t   codec;
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint8_t   rlist;
- } rv_decode;
--typedef struct {
--    const int op;
--    const rvc_constraint *constraints;
--} rv_comp_data;
--
- enum {
-     rv_op_illegal = 0
- };
-@@ -XXX,XX +XXX,XX @@ enum {
-     rvcd_imm_nz = 0x1
- };
--typedef struct {
--    const char * const name;
--    const rv_codec codec;
--    const char * const format;
--    const rv_comp_data *pseudo;
--    const short decomp_rv32;
--    const short decomp_rv64;
--    const short decomp_rv128;
--    const short decomp_data;
--} rv_opcode_data;
--
- /* instruction formats */
- #define rv_fmt_none                   "O\t"
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
- /* instruction metadata */
--const rv_opcode_data opcode_data[] = {
-+const rv_opcode_data rvi_opcode_data[] = {
-     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
-     { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
-@@ -XXX,XX +XXX,XX @@ static uint32_t operand_tbl_index(rv_inst inst)
- static void decode_inst_operands(rv_decode *dec, rv_isa isa)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     rv_inst inst = dec->inst;
-     dec->codec = opcode_data[dec->op].codec;
-     switch (dec->codec) {
-@@ -XXX,XX +XXX,XX @@ static void append(char *s1, const char *s2, size_t n)
- static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     char tmp[64];
-     const char *fmt;
-@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
- static void decode_inst_lift_pseudo(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
-     if (!comp_data) {
-         return;
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_lift_pseudo(rv_decode *dec)
- static void decode_inst_decompress_rv32(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     int decomp_op = opcode_data[dec->op].decomp_rv32;
-     if (decomp_op != rv_op_illegal) {
-         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv32(rv_decode *dec)
- static void decode_inst_decompress_rv64(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     int decomp_op = opcode_data[dec->op].decomp_rv64;
-     if (decomp_op != rv_op_illegal) {
-         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv64(rv_decode *dec)
- static void decode_inst_decompress_rv128(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     int decomp_op = opcode_data[dec->op].decomp_rv128;
-     if (decomp_op != rv_op_illegal) {
-         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-     rv_decode dec = { 0 };
-     dec.pc = pc;
-     dec.inst = inst;
-+    dec.opcode_data = rvi_opcode_data;
-     dec.cfg = cfg;
-     decode_inst_opcode(&dec, isa);
-     decode_inst_operands(&dec, isa);
---
-.40.1

-[PULL 06/54] disas/riscv: Provide infrastructure for vendor extensions
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-A previous patch provides a pointer to the RISCVCPUConfig data.
-Let's use this to add the necessary code for vendor extensions.
-This patch does not change the current behaviour, but clearly
-defines how vendor extension support can be added to the disassembler.
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.c | 28 ++++++++++++++++++++++++++--
-file changed, 26 insertions(+), 2 deletions(-)
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-     rv_decode dec = { 0 };
-     dec.pc = pc;
-     dec.inst = inst;
--    dec.opcode_data = rvi_opcode_data;
-     dec.cfg = cfg;
--    decode_inst_opcode(&dec, isa);
-+
-+    static const struct {
-+        bool (*guard_func)(const RISCVCPUConfig *);
-+        const rv_opcode_data *opcode_data;
-+        void (*decode_func)(rv_decode *, rv_isa);
-+    } decoders[] = {
-+        { always_true_p, rvi_opcode_data, decode_inst_opcode },
-+    };
-+
-+    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
-+        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
-+        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
-+        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
-+
-+        if (guard_func(cfg)) {
-+            dec.opcode_data = opcode_data;
-+            decode_func(&dec, isa);
-+            if (dec.op != rv_op_illegal)
-+                break;
-+        }
-+    }
-+
-+    if (dec.op == rv_op_illegal) {
-+        dec.opcode_data = rvi_opcode_data;
-+    }
-+
-     decode_inst_operands(&dec, isa);
-     decode_inst_decompress(&dec, isa);
-     decode_inst_lift_pseudo(&dec);
---
-.40.1

-[PULL 07/54] disas/riscv: Add support for XVentanaCondOps
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-This patch adds XVentanaCondOps support to the RISC-V disassembler.
-Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv-xventana.h | 18 ++++++++++++++++++
- disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
- disas/riscv.c          |  4 ++++
- disas/meson.build      |  5 ++++-
-files changed, 67 insertions(+), 1 deletion(-)
- create mode 100644 disas/riscv-xventana.h
- create mode 100644 disas/riscv-xventana.c
-diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv-xventana.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU disassembler -- RISC-V specific header (xventana*).
-+ *
-+ * Copyright (c) 2023 VRULL GmbH
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef DISAS_RISCV_XVENTANA_H
-+#define DISAS_RISCV_XVENTANA_H
-+
-+#include "disas/riscv.h"
-+
-+extern const rv_opcode_data ventana_opcode_data[];
-+
-+void decode_xventanacondops(rv_decode*, rv_isa);
-+
-+#endif /* DISAS_RISCV_XVENTANA_H */
-diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv-xventana.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU RISC-V Disassembler for xventana.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "disas/riscv.h"
-+#include "disas/riscv-xventana.h"
-+
-+typedef enum {
-+    /* 0 is reserved for rv_op_illegal. */
-+    ventana_op_vt_maskc = 1,
-+    ventana_op_vt_maskcn = 2,
-+} rv_ventana_op;
-+
-+const rv_opcode_data ventana_opcode_data[] = {
-+    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+};
-+
-+void decode_xventanacondops(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 30:
-+            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
-+            case 6: op = ventana_op_vt_maskc; break;
-+            case 7: op = ventana_op_vt_maskcn; break;
-+            }
-+            break;
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu_cfg.h"
- #include "disas/riscv.h"
-+/* Vendor extensions */
-+#include "disas/riscv-xventana.h"
-+
- typedef enum {
-     /* 0 is reserved for rv_op_illegal. */
-     rv_op_lui = 1,
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-         void (*decode_func)(rv_decode *, rv_isa);
-     } decoders[] = {
-         { always_true_p, rvi_opcode_data, decode_inst_opcode },
-+        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
-     };
-     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
-diff --git a/disas/meson.build b/disas/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/disas/meson.build
-+++ b/disas/meson.build
-@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
- common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
- common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
- common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
--common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
-+common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
-+    'riscv.c',
-+    'riscv-xventana.c'
-+))
- common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
- common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
- common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
---
-.40.1

-[PULL 53/54] target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM
+[PULL v2 29/45] target/riscv: support the AIA device emulation with KVM enabled
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
+In this patch, we create the APLIC and IMSIC FDT helper functions and
-Linux Kernel will fail to detect the availability of the CBOM/CBOZ
+remove M mode AIA devices when using KVM acceleration.
 extensions, regardless of the contents of the 'riscv,isa' DT prop.
-The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-so let's expose them as user properties like it is already done with
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-TCG.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 This will also require us to determine proper blocksize values during
 init() time since the FDT is already created during realize(). We'll
 take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
 don't need to fetch both cbom and cboz blocksizes every time: check for
 their parent extensions (icbom and icboz) and only read the blocksizes
 if needed.
 In contrast with cbom|z_blocksize properties from TCG, the user is not
 able to set any value that is different from the 'host' value when
 running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
 can be thrown for the mere attempt of executing kvm_set_one_reg() for
 these 2 regs.
 Hopefully we don't need to call kvm_set_one_reg() for these regs.
 We'll check if the user input matches the host value in
 kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
 properties. We'll fail fast since it's already known to not be
 supported.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
 Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
+ hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
-file changed, 70 insertions(+)
+file changed, 137 insertions(+), 153 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/hw/riscv/virt.c
-+++ b/target/riscv/kvm.c
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
-     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+     return ret;
  }
-+static KVMCPUConfig kvm_cbom_blocksize = {
+-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-+    .name = "cbom_blocksize",
+-                             uint32_t *phandle, uint32_t *intc_phandles,
-+    .offset = CPUCFG(cbom_blocksize),
+-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
-+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
++static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
-+};
++                                 uint32_t *intc_phandles, uint32_t msi_phandle,
-+
++                                 bool m_mode, uint32_t imsic_guest_bits)
-+static KVMCPUConfig kvm_cboz_blocksize = {
+ {
-+    .name = "cboz_blocksize",
+     int cpu, socket;
-+    .offset = CPUCFG(cboz_blocksize),
+     char *imsic_name;
-+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
+     MachineState *ms = MACHINE(s);
-+};
+     int socket_count = riscv_socket_count(ms);
-+
+-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
-+static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
++    uint32_t imsic_max_hart_per_socket;
-+                                      const char *name,
+     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
-+                                      void *opaque, Error **errp)
 -    *msi_m_phandle = (*phandle)++;
 -    *msi_s_phandle = (*phandle)++;
      imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
      imsic_regs = g_new0(uint32_t, socket_count * 4);
 -    /* M-level IMSIC node */
      for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
          imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    imsic_max_hart_per_socket = 0;
 -    for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_M].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
 -        imsic_regs[socket * 4 + 0] = 0;
 -        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
 -        imsic_regs[socket * 4 + 2] = 0;
 -        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
 -        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
 -            imsic_max_hart_per_socket = s->soc[socket].num_harts;
 -        }
 -    }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_M].base);
 -    qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 -    if (socket_count > 1) {
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 -    }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
 -
 -    g_free(imsic_name);
 -    /* S-level IMSIC node */
 -    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
 -        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 -    }
 -    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
      imsic_max_hart_per_socket = 0;
      for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_S].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
          imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                       s->soc[socket].num_harts;
          imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
              imsic_max_hart_per_socket = s->soc[socket].num_harts;
          }
      }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_S].base);
 +
 +    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
      qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 +    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 +                          FDT_IMSIC_INT_CELLS);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
      qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 +                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
      qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 +                     socket_count * sizeof(uint32_t) * 4);
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 +                     VIRT_IRQCHIP_NUM_MSIS);
 +
      if (imsic_guest_bits) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
 -            imsic_guest_bits);
 +                              imsic_guest_bits);
      }
 +
      if (socket_count > 1) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 +                              imsic_num_bits(imsic_max_hart_per_socket));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 +                              imsic_num_bits(socket_count));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 +                              IMSIC_MMIO_GROUP_MIN_SHIFT);
      }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
 -    g_free(imsic_name);
 +    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 +    g_free(imsic_name);
      g_free(imsic_regs);
      g_free(imsic_cells);
  }
 -static void create_fdt_socket_aplic(RISCVVirtState *s,
 -                                    const MemMapEntry *memmap, int socket,
 -                                    uint32_t msi_m_phandle,
 -                                    uint32_t msi_s_phandle,
 -                                    uint32_t *phandle,
 -                                    uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 +                             uint32_t *phandle, uint32_t *intc_phandles,
 +                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +{
-+    KVMCPUConfig *cbomz_cfg = opaque;
++    *msi_m_phandle = (*phandle)++;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    *msi_s_phandle = (*phandle)++;
-+    uint16_t value, *host_val;
++
-+
++    if (!kvm_enabled()) {
-+    if (!visit_type_uint16(v, name, &value, errp)) {
++        /* M-level IMSIC node */
-+        return;
++        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
 +                             *msi_m_phandle, true, 0);
 +    }
 +
-+    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
++    /* S-level IMSIC node */
-+
++    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
-+    if (value != *host_val) {
++                         *msi_s_phandle, false,
-+        error_report("Unable to set %s to a different value than "
++                         imsic_num_bits(s->aia_guests + 1));
-+                     "the host (%u)",
++
-+                     cbomz_cfg->name, *host_val);
++}
-+        exit(EXIT_FAILURE);
++
 +static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 +                                 unsigned long aplic_addr, uint32_t aplic_size,
 +                                 uint32_t msi_phandle,
 +                                 uint32_t *intc_phandles,
 +                                 uint32_t aplic_phandle,
 +                                 uint32_t aplic_child_phandle,
 +                                 bool m_mode)
  {
      int cpu;
      char *aplic_name;
      uint32_t *aplic_cells;
 -    unsigned long aplic_addr;
      MachineState *ms = MACHINE(s);
 -    uint32_t aplic_m_phandle, aplic_s_phandle;
 -    aplic_m_phandle = (*phandle)++;
 -    aplic_s_phandle = (*phandle)++;
      aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 -    /* M-level APLIC node */
      for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    aplic_addr = memmap[VIRT_APLIC_M].base +
 -                 (memmap[VIRT_APLIC_M].size * socket);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
      qemu_fdt_add_subnode(ms->fdt, aplic_name);
      qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
      qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 +                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
      qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 +
      if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
          qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +                         aplic_cells,
 +                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
      } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_m_phandle);
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
 +
      qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
 +                           0x0, aplic_addr, 0x0, aplic_size);
      qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 -        aplic_s_phandle);
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 -        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
 +                          VIRT_IRQCHIP_NUM_SOURCES);
 +
 +    if (aplic_child_phandle) {
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 +                              aplic_child_phandle);
 +        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 +                               aplic_child_phandle, 0x1,
 +                               VIRT_IRQCHIP_NUM_SOURCES);
 +    }
 +
-+    cbomz_cfg->user_set = true;
+     riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
 +
      g_free(aplic_name);
 +    g_free(aplic_cells);
 +}
-+
- static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
+-    /* S-level APLIC node */
- {
+-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-     CPURISCVState *env = &cpu->env;
+-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-                             kvm_cpu_set_multi_ext_cfg,
++static void create_fdt_socket_aplic(RISCVVirtState *s,
-                             NULL, multi_cfg);
++                                    const MemMapEntry *memmap, int socket,
-     }
++                                    uint32_t msi_m_phandle,
-+
++                                    uint32_t msi_s_phandle,
-+    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
++                                    uint32_t *phandle,
-+                        NULL, kvm_cpu_set_cbomz_blksize,
++                                    uint32_t *intc_phandles,
-+                        NULL, &kvm_cbom_blocksize);
++                                    uint32_t *aplic_phandles)
-+
++{
-+    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
++    char *aplic_name;
-+                        NULL, kvm_cpu_set_cbomz_blksize,
++    unsigned long aplic_addr;
-+                        NULL, &kvm_cboz_blocksize);
++    MachineState *ms = MACHINE(s);
 +    uint32_t aplic_m_phandle, aplic_s_phandle;
 +
 +    aplic_m_phandle = (*phandle)++;
 +    aplic_s_phandle = (*phandle)++;
 +
 +    if (!kvm_enabled()) {
 +        /* M-level APLIC node */
 +        aplic_addr = memmap[VIRT_APLIC_M].base +
 +                     (memmap[VIRT_APLIC_M].size * socket);
 +        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
 +                             msi_m_phandle, intc_phandles,
 +                             aplic_m_phandle, aplic_s_phandle,
 +                             true);
      }
 +
 +    /* S-level APLIC node */
      aplic_addr = memmap[VIRT_APLIC_S].base +
                   (memmap[VIRT_APLIC_S].size * socket);
 +    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
 +                         msi_s_phandle, intc_phandles,
 +                         aplic_s_phandle, 0,
 +                         false);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 -    qemu_fdt_add_subnode(ms->fdt, aplic_name);
 -    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 -    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
 -        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 -    } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_s_phandle);
 -    }
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
      if (!socket) {
          platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      g_free(aplic_name);
 -    g_free(aplic_cells);
      aplic_phandles[socket] = aplic_s_phandle;
  }
- static int kvm_riscv_get_regs_core(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
+     int i;
-     env->misa_ext = env->misa_ext_mask;
+     hwaddr addr;
      uint32_t guest_bits;
 -    DeviceState *aplic_m;
 -    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
 +    DeviceState *aplic_s = NULL;
 +    DeviceState *aplic_m = NULL;
 +    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
      if (msimode) {
 -        /* Per-socket M-level IMSICs */
 -        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        for (i = 0; i < hart_count; i++) {
 -            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 -                               base_hartid + i, true, 1,
 -                               VIRT_IRQCHIP_NUM_MSIS);
 +        if (!kvm_enabled()) {
 +            /* Per-socket M-level IMSICs */
 +            addr = memmap[VIRT_IMSIC_M].base +
 +                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +            for (i = 0; i < hart_count; i++) {
 +                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 +                                   base_hartid + i, true, 1,
 +                                   VIRT_IRQCHIP_NUM_MSIS);
 +            }
          }
          /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
          }
      }
 -    /* Per-socket M-level APLIC */
 -    aplic_m = riscv_aplic_create(
 -        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
 -        memmap[VIRT_APLIC_M].size,
 -        (msimode) ? 0 : base_hartid,
 -        (msimode) ? 0 : hart_count,
 -        VIRT_IRQCHIP_NUM_SOURCES,
 -        VIRT_IRQCHIP_NUM_PRIO_BITS,
 -        msimode, true, NULL);
 -
 -    if (aplic_m) {
 -        /* Per-socket S-level APLIC */
 -        riscv_aplic_create(
 -            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
 -            memmap[VIRT_APLIC_S].size,
 -            (msimode) ? 0 : base_hartid,
 -            (msimode) ? 0 : hart_count,
 -            VIRT_IRQCHIP_NUM_SOURCES,
 -            VIRT_IRQCHIP_NUM_PRIO_BITS,
 -            msimode, false, aplic_m);
 +    if (!kvm_enabled()) {
 +        /* Per-socket M-level APLIC */
 +        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
 +                                     socket * memmap[VIRT_APLIC_M].size,
 +                                     memmap[VIRT_APLIC_M].size,
 +                                     (msimode) ? 0 : base_hartid,
 +                                     (msimode) ? 0 : hart_count,
 +                                     VIRT_IRQCHIP_NUM_SOURCES,
 +                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                     msimode, true, NULL);
      }
 -    return aplic_m;
 +    /* Per-socket S-level APLIC */
 +    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
 +                                 socket * memmap[VIRT_APLIC_S].size,
 +                                 memmap[VIRT_APLIC_S].size,
 +                                 (msimode) ? 0 : base_hartid,
 +                                 (msimode) ? 0 : hart_count,
 +                                 VIRT_IRQCHIP_NUM_SOURCES,
 +                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                 msimode, false, aplic_m);
 +
 +    return kvm_enabled() ? aplic_s : aplic_m;
  }
-+static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
+ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
 +                                         KVMCPUConfig *cbomz_cfg)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    struct kvm_one_reg reg;
 +    int ret;
 +
 +    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 +                              cbomz_cfg->kvm_reg_id);
 +    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
 +    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +    if (ret != 0) {
 +        error_report("Unable to read KVM reg %s, error %d",
 +                     cbomz_cfg->name, ret);
 +        exit(EXIT_FAILURE);
 +    }
 +}
 +
  static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
  {
      CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
          kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
      }
 +
 +    if (cpu->cfg.ext_icbom) {
 +        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
 +    }
 +
 +    if (cpu->cfg.ext_icboz) {
 +        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
 +    }
  }
  void kvm_riscv_init_user_properties(Object *cpu_obj)
 --
-.40.1
+.41.0

-[PULL 41/54] target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
+[PULL v2 30/45] target/riscv: check the in-kernel irqchip support
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Allow 'marchid' and 'mimpid' to also be initialized in
+We check the in-kernel irqchip support when using KVM acceleration.
 kvm_riscv_init_machine_ids().
-After this change, the handling of mvendorid/marchid/mimpid for the
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-'host' CPU type will be equal to what we already have for TCG named
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-CPUs, i.e. the user is not able to set these values to a different val
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 than the one that is already preset.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
 Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 16 ++++++++++++++++
+ target/riscv/kvm.c | 10 +++++++++-
-file changed, 16 insertions(+)
+file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
-     if (ret != 0) {
-         error_report("Unable to retrieve mvendorid from host, error %d", ret);
+ int kvm_arch_irqchip_create(KVMState *s)
-     }
+ {
-+
+-    return 0;
-+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    if (kvm_kernel_irqchip_split()) {
-+                              KVM_REG_RISCV_CONFIG_REG(marchid));
++        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
-+    reg.addr = (uint64_t)&cpu->cfg.marchid;
++        exit(1);
 +    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +    if (ret != 0) {
 +        error_report("Unable to retrieve marchid from host, error %d", ret);
 +    }
 +
-+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    /*
-+                              KVM_REG_RISCV_CONFIG_REG(mimpid));
++     * We can create the VAIA using the newer device control API.
-+    reg.addr = (uint64_t)&cpu->cfg.mimpid;
++     */
-+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
++    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 +    if (ret != 0) {
 +        error_report("Unable to retrieve mimpid from host, error %d", ret);
 +    }
  }
- void kvm_riscv_init_user_properties(Object *cpu_obj)
+ int kvm_arch_process_async_events(CPUState *cs)
 --
-.40.1
+.41.0

-[PULL 40/54] target/riscv: use KVM scratch CPUs to init KVM properties
+[PULL v2 31/45] target/riscv: Create an KVM AIA irqchip
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Certain validations, such as the validations done for the machine IDs
+We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
-(mvendorid/marchid/mimpid), are done before starting the CPU.
+the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
-Non-dynamic (named) CPUs tries to match user input with a preset
+We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
-default. As it is today we can't prefetch a KVM default for these cases
+parameter is passed along with --accel in QEMU command-line.
-because we're only able to read/write KVM regs after the vcpu is
+) "riscv-aia=emul": IMSIC is emulated by hypervisor
-spinning.
+) "riscv-aia=hwaccel": use hardware guest IMSIC
 ) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                      otherwise we fallback to software emulation.
-Our target/arm friends use a concept called "scratch CPU", which
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-consists of creating a vcpu for doing queries and validations and so on,
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-which is discarded shortly after use [1]. This is a suitable solution
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 for what we need so let's implement it in target/riscv as well.
 kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
 KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
 a KVM scratch CPU, fetch KVM regs that work as default values for user
 properties, and then discard the scratch CPU afterwards.
 We're starting by initializing 'mvendorid'. This concept will be used to
 init other KVM specific properties in the next patches as well.
 [1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
 Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm_riscv.h |  1 +
+ target/riscv/kvm_riscv.h |   4 +
- target/riscv/cpu.c       |  6 +++
+ target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
- target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
+files changed, 190 insertions(+)
 files changed, 92 insertions(+)
 diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm_riscv.h
 +++ b/target/riscv/kvm_riscv.h
 @@ -XXX,XX +XXX,XX @@
- #ifndef QEMU_KVM_RISCV_H
+ void kvm_riscv_init_user_properties(Object *cpu_obj);
  #define QEMU_KVM_RISCV_H
 +void kvm_riscv_init_user_properties(Object *cpu_obj);
  void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
  void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
++void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
++                          uint64_t aia_irq_num, uint64_t aia_msi_num,
-index XXXXXXX..XXXXXXX 100644
++                          uint64_t aplic_base, uint64_t imsic_base,
---- a/target/riscv/cpu.c
++                          uint64_t guest_num);
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+ #endif
      Property *prop;
      DeviceState *dev = DEVICE(obj);
 +#ifndef CONFIG_USER_ONLY
 +    if (kvm_enabled()) {
 +        kvm_riscv_init_user_properties(obj);
 +    }
 +#endif
 +
      riscv_cpu_add_misa_properties(obj);
      for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@
-     env->kvm_timer_dirty = false;
+ #include "exec/address-spaces.h"
  #include "hw/boards.h"
  #include "hw/irq.h"
 +#include "hw/intc/riscv_imsic.h"
  #include "qemu/log.h"
  #include "hw/loader.h"
  #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
  #include "chardev/char-fe.h"
  #include "migration/migration.h"
  #include "sysemu/runstate.h"
 +#include "hw/riscv/numa.h"
  static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                   uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
      return true;
  }
-+typedef struct KVMScratchCPU {
++static int aia_mode;
-+    int kvmfd;
++
-+    int vmfd;
++static const char *kvm_aia_mode_str(uint64_t mode)
-+    int cpufd;
++{
-+} KVMScratchCPU;
++    switch (mode) {
-+
++    case KVM_DEV_RISCV_AIA_MODE_EMUL:
-+/*
++        return "emul";
-+ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
++    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
-+ * from target/arm/kvm.c.
++        return "hwaccel";
-+ */
++    case KVM_DEV_RISCV_AIA_MODE_AUTO:
-+static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
++    default:
-+{
++        return "auto";
-+    int kvmfd = -1, vmfd = -1, cpufd = -1;
++    };
-+
++}
-+    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
++
-+    if (kvmfd < 0) {
++static char *riscv_get_kvm_aia(Object *obj, Error **errp)
-+        goto err;
++{
-+    }
++    return g_strdup(kvm_aia_mode_str(aia_mode));
-+    do {
++}
-+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
++
-+    } while (vmfd == -1 && errno == EINTR);
++static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
-+    if (vmfd < 0) {
++{
-+        goto err;
++    if (!strcmp(val, "emul")) {
-+    }
++        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
-+    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
++    } else if (!strcmp(val, "hwaccel")) {
-+    if (cpufd < 0) {
++        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
-+        goto err;
++    } else if (!strcmp(val, "auto")) {
-+    }
++        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
-+
++    } else {
-+    scratch->kvmfd =  kvmfd;
++        error_setg(errp, "Invalid KVM AIA mode");
-+    scratch->vmfd = vmfd;
++        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
-+    scratch->cpufd = cpufd;
++    }
-+
++}
-+    return true;
++
-+
+ void kvm_arch_accel_class_init(ObjectClass *oc)
-+ err:
+ {
-+    if (cpufd >= 0) {
++    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
-+        close(cpufd);
++                                  riscv_set_kvm_aia);
-+    }
++    object_class_property_set_description(oc, "riscv-aia",
-+    if (vmfd >= 0) {
++                                          "Set KVM AIA mode. Valid values are "
-+        close(vmfd);
++                                          "emul, hwaccel, and auto. Default "
-+    }
++                                          "is auto.");
-+    if (kvmfd >= 0) {
++    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
-+        close(kvmfd);
++                                    "auto");
-+    }
++}
 +
-+    return false;
++void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-+}
++                          uint64_t aia_irq_num, uint64_t aia_msi_num,
-+
++                          uint64_t aplic_base, uint64_t imsic_base,
-+static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
++                          uint64_t guest_num)
 +{
-+    close(scratch->cpufd);
++    int ret, i;
-+    close(scratch->vmfd);
++    int aia_fd = -1;
-+    close(scratch->kvmfd);
++    uint64_t default_aia_mode;
-+}
++    uint64_t socket_count = riscv_socket_count(machine);
-+
++    uint64_t max_hart_per_socket = 0;
-+static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
++    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
-+{
++    uint64_t socket_bits, hart_bits, guest_bits;
-+    CPURISCVState *env = &cpu->env;
++
-+    struct kvm_one_reg reg;
++    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
-+    int ret;
++
-+
++    if (aia_fd < 0) {
-+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++        error_report("Unable to create in-kernel irqchip");
-+                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
++        exit(1);
-+    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
++    }
-+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
++
-+    if (ret != 0) {
++    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+        error_report("Unable to retrieve mvendorid from host, error %d", ret);
++                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
-+    }
++                            &default_aia_mode, false, NULL);
-+}
++    if (ret < 0) {
-+
++        error_report("KVM AIA: failed to get current KVM AIA mode");
-+void kvm_riscv_init_user_properties(Object *cpu_obj)
++        exit(1);
-+{
++    }
-+    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
++    qemu_log("KVM AIA: default mode is %s\n",
-+    KVMScratchCPU kvmcpu;
++             kvm_aia_mode_str(default_aia_mode));
 +
-+    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
++    if (default_aia_mode != aia_mode) {
-+        return;
++        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+    }
++                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
-+
++                                &aia_mode, true, NULL);
-+    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
++        if (ret < 0)
-+
++            warn_report("KVM AIA: failed to set KVM AIA mode");
-+    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
++        else
-+}
++            qemu_log("KVM AIA: set current mode to %s\n",
-+
++                     kvm_aia_mode_str(aia_mode));
- const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
++    }
-     KVM_CAP_LAST_INFO
++
- };
++    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
 +                            &aia_irq_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of input irq lines");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
 +                            &aia_msi_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of msi");
 +        exit(1);
 +    }
 +
 +    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
 +                            &socket_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
 +                            &group_shift, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_shift");
 +        exit(1);
 +    }
 +
 +    guest_bits = guest_num == 0 ? 0 :
 +                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
 +                            &guest_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set guest_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 +                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
 +                            &aplic_base, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set the base address of APLIC");
 +        exit(1);
 +    }
 +
 +    for (socket = 0; socket < socket_count; socket++) {
 +        socket_imsic_base = imsic_base + socket * (1U << group_shift);
 +        hart_count = riscv_socket_hart_count(machine, socket);
 +        base_hart = riscv_socket_first_hartid(machine, socket);
 +
 +        if (max_hart_per_socket < hart_count) {
 +            max_hart_per_socket = hart_count;
 +        }
 +
 +        for (i = 0; i < hart_count; i++) {
 +            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
 +            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 +                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
 +                                    &imsic_addr, true, NULL);
 +            if (ret < 0) {
 +                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
 +                exit(1);
 +            }
 +        }
 +    }
 +
 +    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
 +                            &hart_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set hart_bits");
 +        exit(1);
 +    }
 +
 +    if (kvm_has_gsi_routing()) {
 +        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
 +            /* KVM AIA only has one APLIC instance */
 +            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
 +        }
 +        kvm_gsi_routing_allowed = true;
 +        kvm_irqchip_commit_routes(kvm_state);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
 +                            KVM_DEV_RISCV_AIA_CTRL_INIT,
 +                            NULL, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: initialized fail");
 +        exit(1);
 +    }
 +
 +    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
  }
 --
-.40.1
+.41.0

-[PULL 47/54] target/riscv/kvm.c: add multi-letter extension KVM properties
+[PULL v2 32/45] target/riscv: update APLIC and IMSIC to support KVM AIA
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Let's add KVM user properties for the multi-letter extensions that KVM
+KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
-currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
+APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
-svinval and svpbmt.
+mmio operations of APLIC when using KVM AIA and send wired interrupt
 signal via KVM_IRQ_LINE API.
 After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
 when the IMSICs receive mmio write requests.
-As with MISA extensions, we're using the KVMCPUConfig type to hold
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-information about the state of each extension. However, multi-letter
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-extensions have more cases to cover than MISA extensions, so we're
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 adding an extra 'supported' flag as well. This flag will reflect if a
 given extension is supported by KVM, i.e. KVM knows how to handle it.
 This is determined during KVM extension discovery in
 kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
 other error will cause an abort.
 The use of the 'user_set' is similar to what we already do with MISA
 extensions: the flag set only if the user is changing the extension
 state.
 The 'supported' flag will be used later on to make an exception for
 users that are disabling multi-letter extensions that are unknown to
 KVM.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
+Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c |   8 +++
+ hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
- target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
+ hw/intc/riscv_imsic.c | 25 +++++++++++++++----
-files changed, 127 insertions(+)
+files changed, 61 insertions(+), 20 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/target/riscv/cpu.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@
-     riscv_cpu_add_misa_properties(obj);
+ #include "hw/irq.h"
+ #include "target/riscv/cpu.h"
-     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+ #include "sysemu/sysemu.h"
-+#ifndef CONFIG_USER_ONLY
++#include "sysemu/kvm.h"
-+        if (kvm_enabled()) {
+ #include "migration/vmstate.h"
-+            /* Check if KVM created the property already */
-+            if (object_property_find(obj, prop->name)) {
+ #define APLIC_MAX_IDC                  (1UL << 14)
-+                continue;
+@@ -XXX,XX +XXX,XX @@
-+            }
-+        }
+ #define APLIC_IDC_CLAIMI               0x1c
-+#endif
-         qdev_property_add_static(dev, prop);
++/*
-     }
++ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
++ * APLIC Wired.
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
++ */
-index XXXXXXX..XXXXXXX 100644
++static bool is_kvm_aia(bool msimode)
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ typedef struct KVMCPUConfig {
      target_ulong offset;
      int kvm_reg_id;
      bool user_set;
 +    bool supported;
  } KVMCPUConfig;
  #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
      }
  }
 +#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
 +
 +#define KVM_EXT_CFG(_name, _prop, _reg_id) \
 +    {.name = _name, .offset = CPUCFG(_prop), \
 +     .kvm_reg_id = _reg_id}
 +
 +static KVMCPUConfig kvm_multi_ext_cfgs[] = {
 +    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
 +    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
 +    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
 +    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
 +    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
 +    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
 +    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
 +    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 +};
 +
 +static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 +                            uint32_t val)
 +{
-+    int cpu_cfg_offset = multi_ext->offset;
++    return kvm_irqchip_in_kernel() && msimode;
 +    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
 +
 +    *ext_enabled = val;
 +}
 +
-+static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
+ static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
-+                                KVMCPUConfig *multi_ext)
+                                             uint32_t word)
  {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
      return topi;
  }
 +static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 +{
-+    int cpu_cfg_offset = multi_ext->offset;
++    kvm_set_irq(kvm_state, irq, !!level);
 +    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
 +
 +    return *ext_enabled;
 +}
 +
-+static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+ static void riscv_aplic_request(void *opaque, int irq, int level)
-+                                      const char *name,
+ {
-+                                      void *opaque, Error **errp)
+     bool update = false;
-+{
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-+    KVMCPUConfig *multi_ext_cfg = opaque;
+     uint32_t i;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
+     RISCVAPLICState *aplic = RISCV_APLIC(dev);
-+    bool value, host_val;
 -    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 -    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->state = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->target = g_new0(uint32_t, aplic->num_irqs);
 -    if (!aplic->msimode) {
 -        for (i = 0; i < aplic->num_irqs; i++) {
 -            aplic->target[i] = 1;
 +    if (!is_kvm_aia(aplic->msimode)) {
 +        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 +        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->state = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->target = g_new0(uint32_t, aplic->num_irqs);
 +        if (!aplic->msimode) {
 +            for (i = 0; i < aplic->num_irqs; i++) {
 +                aplic->target[i] = 1;
 +            }
          }
 -    }
 -    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 -    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 -    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 +        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 +        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 +        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 -    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
 -                          TYPE_RISCV_APLIC, aplic->aperture_size);
 -    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
 +                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
 +        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +    }
      /*
       * Only root APLICs have hardware IRQ lines. All non-root APLICs
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        if (is_kvm_aia(aplic->msimode)) {
 +            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
 +        } else {
 +            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        }
      }
      /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      qdev_prop_set_bit(dev, "mmode", mmode);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
-+    if (!visit_type_bool(v, name, &value, errp)) {
++    if (!is_kvm_aia(msimode)) {
-+        return;
++        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +    }
+     if (parent) {
+         riscv_aplic_add_child(parent, dev);
+diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_imsic.c
++++ b/hw/intc/riscv_imsic.c
+@@ -XXX,XX +XXX,XX @@
+ #include "target/riscv/cpu.h"
+ #include "target/riscv/cpu_bits.h"
+ #include "sysemu/sysemu.h"
++#include "sysemu/kvm.h"
+ #include "migration/vmstate.h"
+ #define IMSIC_MMIO_PAGE_LE             0x00
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
+         goto err;
+     }
++#if defined(CONFIG_KVM)
++    if (kvm_irqchip_in_kernel()) {
++        struct kvm_msi msi;
 +
-+    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
++        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
 +        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
 +        msi.data = le32_to_cpu(value);
 +
-+    /*
++        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
 +     * Ignore if the user is setting the same value
 +     * as the host.
 +     */
 +    if (value == host_val) {
 +        return;
 +    }
 +
 +    if (!multi_ext_cfg->supported) {
 +        /*
 +         * Error out if the user is trying to enable an
 +         * extension that KVM doesn't support. Ignore
 +         * option otherwise.
 +         */
 +        if (value) {
 +            error_setg(errp, "KVM does not support disabling extension %s",
 +                       multi_ext_cfg->name);
 +        }
 +
 +        return;
 +    }
++#endif
 +
-+    multi_ext_cfg->user_set = true;
+     /* Writes only supported for MSI little-endian registers */
-+    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
-+}
+     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
-+
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
- static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
- {
+     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-         object_property_set_description(cpu_obj, misa_cfg->name,
+-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-                                         misa_cfg->description);
+-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-     }
+-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
-+
++    if (!kvm_irqchip_in_kernel()) {
-+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
++        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-+        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
++        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-+
++        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-+        object_property_add(cpu_obj, multi_cfg->name, "bool",
++        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +                            NULL,
 +                            kvm_cpu_set_multi_ext_cfg,
 +                            NULL, multi_cfg);
 +    }
- }
+     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
- static int kvm_riscv_get_regs_core(CPUState *cs)
+                           imsic, TYPE_RISCV_IMSIC,
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
      env->misa_ext = env->misa_ext_mask;
  }
 +static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    uint64_t val;
 +    int i, ret;
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
 +        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
 +        struct kvm_one_reg reg;
 +
 +        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
 +                                  multi_ext_cfg->kvm_reg_id);
 +        reg.addr = (uint64_t)&val;
 +        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +        if (ret != 0) {
 +            if (errno == EINVAL) {
 +                /* Silently default to 'false' if KVM does not support it. */
 +                multi_ext_cfg->supported = false;
 +                val = false;
 +            } else {
 +                error_report("Unable to read ISA_EXT KVM register %s, "
 +                             "error %d", multi_ext_cfg->name, ret);
 +                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
 +                exit(EXIT_FAILURE);
 +            }
 +        } else {
 +            multi_ext_cfg->supported = true;
 +        }
 +
 +        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
 +    }
 +}
 +
  void kvm_riscv_init_user_properties(Object *cpu_obj)
  {
      RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
      kvm_riscv_add_cpu_user_properties(cpu_obj);
      kvm_riscv_init_machine_ids(cpu, &kvmcpu);
      kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 +    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
      kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
  }
 --
-.40.1
+.41.0

-[PULL 23/54] hw/riscv/virt: Restrict ACLINT to TCG
+[PULL v2 33/45] target/riscv: select KVM AIA in riscv virt machine
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The Advanced Core Local Interruptor (ACLINT) device can
+Select KVM AIA when the host kernel has in-kernel AIA chip support.
-only be used with TCG. Check for TCG enabled instead of
+Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
-KVM being not. Only add the property when TCG is used.
+devices to KVM APLIC.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
 Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-Id: <20230629121103.87733-3-philmd@linaro.org>
+Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/virt.rst |  1 +
+ hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
- hw/riscv/virt.c            | 18 ++++++++++--------
+file changed, 63 insertions(+), 31 deletions(-)
 files changed, 11 insertions(+), 8 deletions(-)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
-+++ b/docs/system/riscv/virt.rst
-@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
-   When this option is "on", ACLINT devices will be emulated instead of
-   SiFive CLINT. When not specified, this option is assumed to be "off".
-+  This option is restricted to the TCG accelerator.
- - aia=[none|aplic|aplic-imsic]
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
 @@ -XXX,XX +XXX,XX @@
- #include "chardev/char.h"
+ #include "hw/riscv/virt.h"
- #include "sysemu/device_tree.h"
+ #include "hw/riscv/boot.h"
- #include "sysemu/sysemu.h"
+ #include "hw/riscv/numa.h"
-+#include "sysemu/tcg.h"
++#include "kvm_riscv.h"
- #include "sysemu/kvm.h"
+ #include "hw/intc/riscv_aclint.h"
- #include "sysemu/tpm.h"
+ #include "hw/intc/riscv_aplic.h"
- #include "hw/pci/pci.h"
+ #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
  #error "Can't accommodate all IMSIC groups in address space"
  #endif
 +/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 +static bool virt_use_kvm_aia(RISCVVirtState *s)
 +{
 +    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +}
 +
  static const MemMapEntry virt_memmap[] = {
      [VIRT_DEBUG] =        {        0x0,         0x100 },
      [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                   uint32_t *intc_phandles,
                                   uint32_t aplic_phandle,
                                   uint32_t aplic_child_phandle,
 -                                 bool m_mode)
 +                                 bool m_mode, int num_harts)
  {
      int cpu;
      char *aplic_name;
      uint32_t *aplic_cells;
      MachineState *ms = MACHINE(s);
 -    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +    aplic_cells = g_new0(uint32_t, num_harts * 2);
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +    for (cpu = 0; cpu < num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
          aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
      if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
          qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -                         aplic_cells,
 -                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
      } else {
          qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                      uint32_t msi_s_phandle,
                                      uint32_t *phandle,
                                      uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +                                    uint32_t *aplic_phandles,
 +                                    int num_harts)
  {
      char *aplic_name;
      unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
          create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                               msi_m_phandle, intc_phandles,
                               aplic_m_phandle, aplic_s_phandle,
 -                             true);
 +                             true, num_harts);
      }
      /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                           msi_s_phandle, intc_phandles,
                           aplic_s_phandle, 0,
 -                         false);
 +                         false, num_harts);
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 @@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+         *msi_pcie_phandle = msi_s_phandle;
-         g_free(clust_name);
+     }
--        if (!kvm_enabled()) {
+-    phandle_pos = ms->smp.cpus;
-+        if (tcg_enabled()) {
+-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-             if (s->have_aclint) {
+-        phandle_pos -= s->soc[socket].num_harts;
-                 create_fdt_socket_aclint(s, memmap, socket,
+-
-                     &intc_phandles[phandle_pos]);
+-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 -            create_fdt_socket_plic(s, memmap, socket, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 -        } else {
 -            create_fdt_socket_aplic(s, memmap, socket,
 -                msi_m_phandle, msi_s_phandle, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 +    /* KVM AIA only has one APLIC instance */
 +    if (virt_use_kvm_aia(s)) {
 +        create_fdt_socket_aplic(s, memmap, 0,
 +                                msi_m_phandle, msi_s_phandle, phandle,
 +                                &intc_phandles[0], xplic_phandles,
 +                                ms->smp.cpus);
 +    } else {
 +        phandle_pos = ms->smp.cpus;
 +        for (socket = (socket_count - 1); socket >= 0; socket--) {
 +            phandle_pos -= s->soc[socket].num_harts;
 +
 +            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +                create_fdt_socket_plic(s, memmap, socket, phandle,
 +                                       &intc_phandles[phandle_pos],
 +                                       xplic_phandles);
 +            } else {
 +                create_fdt_socket_aplic(s, memmap, socket,
 +                                        msi_m_phandle, msi_s_phandle, phandle,
 +                                        &intc_phandles[phandle_pos],
 +                                        xplic_phandles,
 +                                        s->soc[socket].num_harts);
 +            }
          }
      }
      g_free(intc_phandles);
 -    for (socket = 0; socket < socket_count; socket++) {
 -        if (socket == 0) {
 -            *irq_mmio_phandle = xplic_phandles[socket];
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 1) {
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 2) {
 -            *irq_pcie_phandle = xplic_phandles[socket];
 +    if (virt_use_kvm_aia(s)) {
 +        *irq_mmio_phandle = xplic_phandles[0];
 +        *irq_virtio_phandle = xplic_phandles[0];
 +        *irq_pcie_phandle = xplic_phandles[0];
 +    } else {
 +        for (socket = 0; socket < socket_count; socket++) {
 +            if (socket == 0) {
 +                *irq_mmio_phandle = xplic_phandles[socket];
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 1) {
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 2) {
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
          }
      }
 @@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-                                 hart_count, &error_abort);
+         }
-         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
+     }
--        if (!kvm_enabled()) {
++    if (virt_use_kvm_aia(s)) {
-+        if (tcg_enabled()) {
++        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
-             if (s->have_aclint) {
++                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
-                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
++                             memmap[VIRT_APLIC_S].base,
-                     /* Per-socket ACLINT MTIMER */
++                             memmap[VIRT_IMSIC_S].base,
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
++                             s->aia_guests);
      machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
  #endif
 -    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
 -                                   virt_set_aclint);
 -    object_class_property_set_description(oc, "aclint",
 -                                          "Set on/off to enable/disable "
 -                                          "emulating ACLINT devices");
 -
 +    if (tcg_enabled()) {
 +        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
 +                                       virt_set_aclint);
 +        object_class_property_set_description(oc, "aclint",
 +                                              "Set on/off to enable/disable "
 +                                              "emulating ACLINT devices");
 +    }
-     object_class_property_add_str(oc, "aia", virt_get_aia,
++
-                                   virt_set_aia);
+     if (riscv_is_32bit(&s->soc[0])) {
-     object_class_property_set_description(oc, "aia",
+ #if HOST_LONG_BITS == 64
          /* limit RAM size in a 32-bit system */
 --
-.40.1
+.41.0

-[PULL 34/54] hw/riscv: virt: Convert fdt_load_addr to uint64_t
+[PULL v2 34/45] hw/riscv: virt: Fix riscv,pmu DT node path
-From: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
+From: Conor Dooley <conor.dooley@microchip.com>
-fdt_load_addr was previously declared as uint32_t which doe not match
+On a dtb dumped from the virt machine, dt-validate complains:
-with the return type of riscv_compute_fdt_addr().
+soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
         from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
 That's pretty cryptic, but running the dtb back through dtc produces
 something a lot more reasonable:
 Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property
-This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
+Moving the riscv,pmu node out of the soc bus solves the problem.
 to match the riscv_compute_fdt_addr() return type.
-This fixes calculating the fdt address when DRAM is mapped to higher
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
--bit address.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
+Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
 [ Change by AF:
  - Cleanup commit title and message
 ]
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  hw/riscv/virt.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
-     target_ulong start_addr = memmap[VIRT_DRAM].base;
+     MachineState *ms = MACHINE(s);
-     target_ulong firmware_end_addr, kernel_start_addr;
+     RISCVCPU hart = s->soc[0].harts[0];
-     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
--    uint32_t fdt_load_addr;
+-    pmu_name = g_strdup_printf("/soc/pmu");
-+    uint64_t fdt_load_addr;
++    pmu_name = g_strdup_printf("/pmu");
-     uint64_t kernel_entry = 0;
+     qemu_fdt_add_subnode(ms->fdt, pmu_name);
-     BlockBackend *pflash_blk0;
+     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
+     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
 --
-.40.1
+.41.0

-[PULL 14/54] target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
+[PULL v2 35/45] target/riscv: Update CSR bits name for svadu extension
 From: Weiwei Li <liweiwei@iscas.ac.cn>
-Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
+The Svadu specification updated the name of the *envcfg bit from
-should also take MPRV into consideration. As pointer mask for instruction
+HADE to ADUE.
 is not supported currently, so we can directly update cur_pmbase/pmmask
 based on address related mode and xlen affected by MPRV now.
 Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
+Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c |  7 +++++--
+ target/riscv/cpu_bits.h   |  8 ++++----
- target/riscv/csr.c        | 27 ++++++++++++++++++++-------
+ target/riscv/cpu.c        |  4 ++--
-files changed, 25 insertions(+), 9 deletions(-)
+ target/riscv/cpu_helper.c |  6 +++---
  target/riscv/csr.c        | 12 ++++++------
 files changed, 15 insertions(+), 15 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define MENVCFG_CBIE                       (3UL << 4)
+ #define MENVCFG_CBCFE                      BIT(6)
+ #define MENVCFG_CBZE                       BIT(7)
+-#define MENVCFG_HADE                       (1ULL << 61)
++#define MENVCFG_ADUE                       (1ULL << 61)
+ #define MENVCFG_PBMTE                      (1ULL << 62)
+ #define MENVCFG_STCE                       (1ULL << 63)
+ /* For RV32 */
+-#define MENVCFGH_HADE                      BIT(29)
++#define MENVCFGH_ADUE                      BIT(29)
+ #define MENVCFGH_PBMTE                     BIT(30)
+ #define MENVCFGH_STCE                      BIT(31)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define HENVCFG_CBIE                       MENVCFG_CBIE
+ #define HENVCFG_CBCFE                      MENVCFG_CBCFE
+ #define HENVCFG_CBZE                       MENVCFG_CBZE
+-#define HENVCFG_HADE                       MENVCFG_HADE
++#define HENVCFG_ADUE                       MENVCFG_ADUE
+ #define HENVCFG_PBMTE                      MENVCFG_PBMTE
+ #define HENVCFG_STCE                       MENVCFG_STCE
+ /* For RV32 */
+-#define HENVCFGH_HADE                       MENVCFGH_HADE
++#define HENVCFGH_ADUE                       MENVCFGH_ADUE
+ #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
+ #define HENVCFGH_STCE                       MENVCFGH_STCE
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+     env->two_stage_lookup = false;
+     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
+-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
++                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
+     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
+-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
++                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
+     /* Initialized default priorities of local interrupts. */
+     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
- void riscv_cpu_update_mask(CPURISCVState *env)
+     }
- {
-     target_ulong mask = 0, base = 0;
+     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-+    RISCVMXL xl = env->xl;
+-    bool hade = env->menvcfg & MENVCFG_HADE;
-     /*
++    bool adue = env->menvcfg & MENVCFG_ADUE;
-      * TODO: Current RVJ spec does not specify
-      * how the extension interacts with XLEN.
+     if (first_stage && two_stage && env->virt_enabled) {
-      */
+         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
- #ifndef CONFIG_USER_ONLY
+-        hade = hade && (env->henvcfg & HENVCFG_HADE);
-+    int mode = cpu_address_mode(env);
++        adue = adue && (env->henvcfg & HENVCFG_ADUE);
-+    xl = cpu_get_xl(env, mode);
+     }
-     if (riscv_has_ext(env, RVJ)) {
--        switch (env->priv) {
+     int ptshift = (levels - 1) * ptidxbits;
-+        switch (mode) {
+@@ -XXX,XX +XXX,XX @@ restart:
-         case PRV_M:
-             if (env->mmte & M_PM_ENABLE) {
+     /* Page table updates need to be atomic with MTTCG enabled */
-                 mask = env->mpmmask;
+     if (updated_pte != pte && !is_debug) {
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_update_mask(CPURISCVState *env)
+-        if (!hade) {
 +        if (!adue) {
              return TRANSLATE_FAIL;
          }
-     }
  #endif
 -    if (env->xl == MXL_RV32) {
 +    if (xl == MXL_RV32) {
          env->cur_pmmask = mask & UINT32_MAX;
          env->cur_pmbase = base & UINT32_MAX;
      } else {
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
      if (riscv_cpu_mxl(env) == MXL_RV64) {
          mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                  (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                (cfg->ext_svadu ? MENVCFG_HADE : 0);
 +                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
      }
      env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
      const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
      uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                      (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
 +                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
      uint64_t valh = (uint64_t)val << 32;
      env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
       * henvcfg.stce is read_only 0 when menvcfg.stce = 0
       * henvcfg.hade is read_only 0 when menvcfg.hade = 0
       */
-     if (env->debugger) {
+-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
-         env->xl = cpu_recompute_xl(env);
++    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
--        riscv_cpu_update_mask(env);
+                            env->menvcfg);
      }
 +
 +    riscv_cpu_update_mask(env);
      return RISCV_EXCP_NONE;
  }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
      uint64_t mstatus;
      env->mpmmask = val;
 -    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
          env->cur_pmmask = val;
      }
-     env->mmte |= EXT_STATUS_DIRTY;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
-         return RISCV_EXCP_NONE;
+-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
 +        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
      }
-     env->spmmask = val;
--    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
-+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
-         env->cur_pmmask = val;
+         return ret;
 +        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 +            env->cur_pmmask &= UINT32_MAX;
 +        }
      }
-     env->mmte |= EXT_STATUS_DIRTY;
+-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
++    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-         return RISCV_EXCP_NONE;
+                             env->menvcfg)) >> 32;
-     }
+     return RISCV_EXCP_NONE;
-     env->upmmask = val;
+ }
--    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+                                      target_ulong val)
-         env->cur_pmmask = val;
+ {
-+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-+            env->cur_pmmask &= UINT32_MAX;
+-                                    HENVCFG_HADE);
-+        }
++                                    HENVCFG_ADUE);
-     }
+     uint64_t valh = (uint64_t)val << 32;
-     env->mmte |= EXT_STATUS_DIRTY;
+     RISCVException ret;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
      uint64_t mstatus;
      env->mpmbase = val;
 -    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
          env->cur_pmbase = val;
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->spmbase = val;
 -    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
          env->cur_pmbase = val;
 +        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 +            env->cur_pmbase &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->upmbase = val;
 -    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
          env->cur_pmbase = val;
 +        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 +            env->cur_pmbase &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
 --
-.40.1
+.41.0

-[PULL 37/54] target/riscv/cpu.c: restrict 'mvendorid' value
+[PULL v2 36/45] target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We're going to change the handling of mvendorid/marchid/mimpid by the
+In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
-KVM driver. Since these are always present in all CPUs let's put the
+longer to boot than the 'rv64' KVM CPU.
 same validation for everyone.
-It doesn't make sense to allow 'mvendorid' to be different than it
+The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
-is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
+when satp_mode.supported = 0, i.e. when cpu_init() does not set
-any 'mvendorid' they want.
+satp_mode_max_supported(). satp_mode_max_from_map(map) does:
-Change 'mvendorid' to be a class property created via
+- __builtin_clz(map)
 'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
 macro. This allow us to define a custom setter for it that will verify,
 for named CPUs, if mvendorid is different than it is already set by the
 CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
 set to an invalid value:
-$ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
+This means that, if satp_mode.supported = 0, satp_mode_supported_max
-qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
+wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
-    Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)
+set it to UINT_MAX (4294967295). After that, if the user didn't set a
 satp_mode, set_satp_mode_default_map(cpu) will make
+cfg.satp_mode.map = cfg.satp_mode.supported
+So satp_mode.map = 0. And then satp_mode_map_max will be set to
+satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
+guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
+here since both are UINT_MAX.
+And finally we have 2 loops:
+        for (int i = satp_mode_map_max - 1; i >= 0; --i) {
+Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
+extra delay when booting the 'host' CPU is coming from.
+Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
+in a different manner. We're doing the same here. If supported == 0,
+interpret as 'the CPU wants the OS to handle satp mode alone' and skip
+satp_mode_finalize().
+We'll also put a guard in satp_mode_max_from_map() to assert out if map
+is 0 since the function is not ready to deal with it.
+Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
+Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
 Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
+ target/riscv/cpu.c | 23 ++++++++++++++++++++---
-file changed, 37 insertions(+), 1 deletion(-)
+file changed, 20 insertions(+), 3 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
- static Property riscv_cpu_properties[] = {
-     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
+ uint8_t satp_mode_max_from_map(uint32_t map)
+ {
--    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
++    /*
-     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
++     * 'map = 0' will make us return (31 - 32), which C will
-     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
++     * happily overflow to UINT_MAX. There's no good result to
++     * return if 'map = 0' (e.g. returning 0 will be ambiguous
-@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
++     * with the result for 'map = 1').
- #endif /* !CONFIG_USER_ONLY */
++     *
- };
++     * Assert out if map = 0. Callers will have to deal with
++     * it outside of this function.
-+static bool riscv_cpu_is_dynamic(Object *cpu_obj)
++     */
-+{
++    g_assert(map > 0);
 +    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
 +}
 +
-+static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+     /* map here has at least one bit set, so no problem with clz */
-+                              void *opaque, Error **errp)
+     return 31 - __builtin_clz(map);
-+{
+ }
-+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-+    RISCVCPU *cpu = RISCV_CPU(obj);
+ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
-+    uint32_t prev_val = cpu->cfg.mvendorid;
+ {
-+    uint32_t value;
+     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
 -    uint8_t satp_mode_map_max;
 -    uint8_t satp_mode_supported_max =
 -                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 +    uint8_t satp_mode_map_max, satp_mode_supported_max;
 +
-+    if (!visit_type_uint32(v, name, &value, errp)) {
++    /* The CPU wants the OS to decide which satp mode to use */
 +    if (cpu->cfg.satp_mode.supported == 0) {
 +        return;
 +    }
 +
-+    if (!dynamic_cpu && prev_val != value) {
++    satp_mode_supported_max =
-+        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
++                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
-+                   object_get_typename(obj), prev_val);
-+        return;
+     if (cpu->cfg.satp_mode.map == 0) {
-+    }
+         if (cpu->cfg.satp_mode.init == 0) {
 +
 +    cpu->cfg.mvendorid = value;
 +}
 +
 +static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
 +                              void *opaque, Error **errp)
 +{
 +    bool value = RISCV_CPU(obj)->cfg.mvendorid;
 +
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
      cc->tcg_ops = &riscv_tcg_ops;
 +    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
 +                              cpu_set_mvendorid, NULL, NULL);
 +
      device_class_set_props(dc, riscv_cpu_properties);
  }
 --
-.40.1
+.41.0

-[PULL 50/54] target/riscv/cpu.c: create KVM mock properties
+[PULL v2 37/45] riscv: zicond: make non-experimental
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Vineet Gupta <vineetg@rivosinc.com>
-KVM-specific properties are being created inside target/riscv/kvm.c. But
+zicond is now codegen supported in both llvm and gcc.
 at this moment we're gathering all the remaining properties from TCG and
 adding them as is when running KVM. This creates a situation where
 non-KVM properties are setting flags to 'true' due to its default
 settings (e.g.  Zawrs). Users can also freely enable them via command
 line.
-This doesn't impact runtime per se because KVM doesn't care about these
+This change allows seamless enabling/testing of zicond in downstream
-flags, but code such as riscv_isa_string_ext() take those flags into
+projects. e.g. currently riscv-gnu-toolchain parses elf attributes
-account. The result is that, for a KVM guest, setting non-KVM properties
+to create a cmdline for qemu but fails short of enabling it because of
-will make them appear in the riscv,isa DT.
+the "x-" prefix.
-We want to keep the same API for both TCG and KVM and at the same time,
+Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
-when running KVM, forbid non-KVM extensions to be enabled internally. We
+Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
 accomplish both by changing riscv_cpu_add_user_properties() to add a
 mock boolean property for every non-KVM extension in
 riscv_cpu_extensions[]. Then, when running KVM, users are still free to
 set extensions at will, but we'll error out if a non-KVM extension is
 enabled. Setting such extension to 'false' will be ignored.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
+ target/riscv/cpu.c | 2 +-
-file changed, 36 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_END_OF_LIST(),
+     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
- };
+     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
+     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
-+
++    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
-+#ifndef CONFIG_USER_ONLY
-+static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+     /* Vendor-specific custom extensions */
-+                                    const char *name,
+     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
-+                                    void *opaque, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-+{
+     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
-+    const char *propname = opaque;
-+    bool value;
+     /* These are experimental so mark with 'x-' */
-+
+-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
-+    if (!visit_type_bool(v, name, &value, errp)) {
-+        return;
+     /* ePMP 0.9.3 */
-+    }
+     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
 +
 +    if (value) {
 +        error_setg(errp, "extension %s is not available with KVM",
 +                   propname);
 +    }
 +}
 +#endif
 +
  /*
   * Add CPU properties with user-facing flags.
   *
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
              if (object_property_find(obj, prop->name)) {
                  continue;
              }
 +
 +            /*
 +             * Set the default to disabled for every extension
 +             * unknown to KVM and error out if the user attempts
 +             * to enable any of them.
 +             *
 +             * We're giving a pass for non-bool properties since they're
 +             * not related to the availability of extensions and can be
 +             * safely ignored as is.
 +             */
 +            if (prop->info == &qdev_prop_bool) {
 +                object_property_add(obj, prop->name, "bool",
 +                                    NULL, cpu_set_cfg_unavailable,
 +                                    NULL, (void *)prop->name);
 +                continue;
 +            }
          }
  #endif
          qdev_property_add_static(dev, prop);
 --
-.40.1
+.41.0

-[PULL 36/54] hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
+[PULL v2 38/45] hw/riscv/virt.c: fix non-KVM --enable-debug build
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The absence of a satp mode in riscv_host_cpu_init() is causing the
+A build with --enable-debug and without KVM will fail as follows:
 following error:
-$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
-    -m 2G -smp 1  -nographic -snapshot \
+./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'
     -kernel ./guest_imgs/Image \
     -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
     -append "earlycon=sbi root=/dev/ram rw" \
     -cpu host
 **
 ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
 reached
 Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
 not be reached
 Aborted
-The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
+This happens because the code block with "if virt_use_kvm_aia(s)" isn't
-It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.
+being ignored by the debug build, resulting in an undefined reference to
 a KVM only function.
-For this KVM cpu we would need to inherit the satp supported modes
+Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
-from the RISC-V host. At this moment this is not possible because the
+make the compiler crop the kvm_riscv_aia_create() call entirely from a
-KVM driver does not support it. And even when it does we can't just let
+non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
-this broken for every other older kernel.
+virt_use_kvm_aia() won't fix the build because this function would need
 to be inlined multiple times to make the compiler zero out the entire
 block.
-Since mmu-type is not a required node, according to [1], skip the
+While we're at it, use kvm_enabled() in all instances where
-'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
+virt_use_kvm_aia() is checked to allow the compiler to elide these other
-logic when we can get satp information from KVM.
+kvm-only instances as well.
-[1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml
+Suggested-by: Richard Henderson <richard.henderson@linaro.org>
+Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 14 +++++++-------
+ hw/riscv/virt.c | 6 +++---
-file changed, 7 insertions(+), 7 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-             s->soc[socket].hartid_base + cpu);
+     }
-         qemu_fdt_add_subnode(ms->fdt, cpu_name);
+     /* KVM AIA only has one APLIC instance */
--        satp_mode_max = satp_mode_max_from_map(
+-    if (virt_use_kvm_aia(s)) {
--            s->soc[socket].harts[cpu].cfg.satp_mode.map);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
--        sv_name = g_strdup_printf("riscv,%s",
+         create_fdt_socket_aplic(s, memmap, 0,
--                                  satp_mode_str(satp_mode_max, is_32_bit));
+                                 msi_m_phandle, msi_s_phandle, phandle,
--        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+                                 &intc_phandles[0], xplic_phandles,
--        g_free(sv_name);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
--
-+        if (cpu_ptr->cfg.satp_mode.supported != 0) {
+     g_free(intc_phandles);
-+            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
-+            sv_name = g_strdup_printf("riscv,%s",
+-    if (virt_use_kvm_aia(s)) {
-+                                      satp_mode_str(satp_mode_max, is_32_bit));
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-+            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+         *irq_mmio_phandle = xplic_phandles[0];
-+            g_free(sv_name);
+         *irq_virtio_phandle = xplic_phandles[0];
-+        }
+         *irq_pcie_phandle = xplic_phandles[0];
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-         name = riscv_isa_string(cpu_ptr);
+         }
-         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);
+     }
 -    if (virt_use_kvm_aia(s)) {
 +    if (kvm_enabled() && virt_use_kvm_aia(s)) {
          kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                               VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                               memmap[VIRT_APLIC_S].base,
 --
-.40.1
+.41.0

-[PULL 45/54] target/riscv: add KVM specific MISA properties
+[PULL v2 39/45] hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Using all TCG user properties in KVM is tricky. First because KVM
+Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
-supports only a small subset of what TCG provides, so most of the
+environment with the following error:
 cpu->cfg flags do nothing for KVM.
-Second, and more important, we don't have a way of telling if any given
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
-value is an user input or not. For TCG this has a small impact since we
+./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
-just validating everything and error out if needed. But for KVM it would
+collect2: error: ld returned 1 exit status
 be good to know if a given value was set by the user or if it's a value
 already provided by KVM. Otherwise we don't know how to handle failed
 kvm_set_one_regs() when writing the configurations back.
-These characteristics make it overly complicated to use the same user
+This happens because the debug build will poke into the
-facing flags for both KVM and TCG. A simpler approach is to create KVM
+'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
-specific properties that have specialized logic, forking KVM and TCG use
+the KVM only function riscv_kvm_aplic_request().
 cases for those cases only. Fully separating KVM/TCG properties is
 unneeded at this point - in fact we want the user experience to be as
 equal as possible, regardless of the acceleration chosen.
-We'll start this fork with the MISA properties, adding the MISA bits
+There are multiple solutions to fix this. We'll go with the same
-that the KVM driver currently supports. A new KVMCPUConfig type is
+solution from the previous patch, i.e. add a kvm_enabled() conditional
-introduced. It'll hold general information about an extension. For MISA
+to filter out the block. But there's a catch: riscv_kvm_aplic_request()
-extensions we're going to use the newly created getters of
+is a local function that would end up being used if the compiler crops
-misa_ext_infos[] to populate their name and description. 'offset' holds
+the block, and this won't work. Quoting Richard Henderson's explanation
-the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
+in [1]:
 'misa_bit' because this same KVMCPUConfig struct will be used to
 multi-letter extensions later on.
-This new type also holds a 'user_set' flag. This flag will be set when
+"(...) the compiler won't eliminate entire unused functions with -O0"
 the user set an option that's different than what is already configured
 in the host, requiring KVM intervention to write the regs back during
 kvm_arch_init_vcpu(). Similar mechanics will be implemented for
 multi-letter extensions as well.
-There is no need to duplicate more code than necessary, so we're going
+We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
-to use the existing kvm_riscv_init_user_properties() to add the KVM
+declaration in kvm_riscv.h, where all other KVM specific public
-specific properties. Any code that is adding a TCG user prop is then
+functions are already declared. Other archs handles KVM specific code in
-changed slightly to verify first if there's a KVM prop with the same
+this manner and we expect to do the same from now on.
-name already added.
 [1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c |  5 +++
+ target/riscv/kvm_riscv.h | 1 +
- target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
+ hw/intc/riscv_aplic.c    | 8 ++------
-files changed, 83 insertions(+)
+ target/riscv/kvm.c       | 5 +++++
 files changed, 8 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/kvm_riscv.h
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/kvm_riscv.h
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-         misa_cfg->name = riscv_get_misa_ext_name(bit);
+                           uint64_t aia_irq_num, uint64_t aia_msi_num,
-         misa_cfg->description = riscv_get_misa_ext_description(bit);
+                           uint64_t aplic_base, uint64_t imsic_base,
+                           uint64_t guest_num);
-+        /* Check if KVM already created the property */
++void riscv_kvm_aplic_request(void *opaque, int irq, int level);
-+        if (object_property_find(cpu_obj, misa_cfg->name)) {
-+            continue;
+ #endif
-+        }
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
-+
+index XXXXXXX..XXXXXXX 100644
-         object_property_add(cpu_obj, misa_cfg->name, "bool",
+--- a/hw/intc/riscv_aplic.c
-                             cpu_get_misa_ext_cfg,
++++ b/hw/intc/riscv_aplic.c
-                             cpu_set_misa_ext_cfg,
+@@ -XXX,XX +XXX,XX @@
  #include "target/riscv/cpu.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 +#include "kvm_riscv.h"
  #include "migration/vmstate.h"
  #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
      return topi;
  }
 -static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 -{
 -    kvm_set_irq(kvm_state, irq, !!level);
 -}
 -
  static void riscv_aplic_request(void *opaque, int irq, int level)
  {
      bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        if (is_kvm_aia(aplic->msimode)) {
 +        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
              qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
          } else {
              qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
 @@ -XXX,XX +XXX,XX @@
- #include <linux/kvm.h>
+ #include "sysemu/runstate.h"
+ #include "hw/riscv/numa.h"
- #include "qemu/timer.h"
-+#include "qapi/error.h"
++void riscv_kvm_aplic_request(void *opaque, int irq, int level)
  #include "qemu/error-report.h"
  #include "qemu/main-loop.h"
 +#include "qapi/visitor.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
  #include "sysemu/kvm_int.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
          } \
      } while (0)
 +typedef struct KVMCPUConfig {
 +    const char *name;
 +    const char *description;
 +    target_ulong offset;
 +    int kvm_reg_id;
 +    bool user_set;
 +} KVMCPUConfig;
 +
 +#define KVM_MISA_CFG(_bit, _reg_id) \
 +    {.offset = _bit, .kvm_reg_id = _reg_id}
 +
 +/* KVM ISA extensions */
 +static KVMCPUConfig kvm_misa_ext_cfgs[] = {
 +    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
 +    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
 +    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
 +    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
 +    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
 +    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
 +    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
 +};
 +
 +static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
 +                                     const char *name,
 +                                     void *opaque, Error **errp)
 +{
-+    KVMCPUConfig *misa_ext_cfg = opaque;
++    kvm_set_irq(kvm_state, irq, !!level);
 +    target_ulong misa_bit = misa_ext_cfg->offset;
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    CPURISCVState *env = &cpu->env;
 +    bool value, host_bit;
 +
 +    if (!visit_type_bool(v, name, &value, errp)) {
 +        return;
 +    }
 +
 +    host_bit = env->misa_ext_mask & misa_bit;
 +
 +    if (value == host_bit) {
 +        return;
 +    }
 +
 +    if (!value) {
 +        misa_ext_cfg->user_set = true;
 +        return;
 +    }
 +
 +    /*
 +     * Forbid users to enable extensions that aren't
 +     * available in the hart.
 +     */
 +    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
 +               "enabled in the host", misa_ext_cfg->name);
 +}
 +
-+static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-+{
+                                  uint64_t idx)
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
 +        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
 +        int bit = misa_cfg->offset;
 +
 +        misa_cfg->name = riscv_get_misa_ext_name(bit);
 +        misa_cfg->description = riscv_get_misa_ext_description(bit);
 +
 +        object_property_add(cpu_obj, misa_cfg->name, "bool",
 +                            NULL,
 +                            kvm_cpu_set_misa_ext_cfg,
 +                            NULL, misa_cfg);
 +        object_property_set_description(cpu_obj, misa_cfg->name,
 +                                        misa_cfg->description);
 +    }
 +}
 +
  static int kvm_riscv_get_regs_core(CPUState *cs)
  {
-     int ret = 0;
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
-         return;
-     }
-+    kvm_riscv_add_cpu_user_properties(cpu_obj);
-     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
-     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 --
-.40.1
+.41.0

-[PULL 24/54] linux-user/riscv: Add syscall riscv_hwprobe
+[PULL v2 40/45] linux-user/riscv: Add new extensions to hwprobe
 From: Robbin Ehn <rehn@rivosinc.com>
-This patch adds the new syscall for the
+This patch adds the new extensions in
-"RISC-V Hardware Probing Interface"
+linux 6.5 to the hwprobe syscall.
 (https://docs.kernel.org/riscv/hwprobe.html).
-Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
+And fixes RVC check to OR with correct value.
 The previous variable contains 0 therefore it
 did work.
 Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
-Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
+Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- linux-user/riscv/syscall32_nr.h |   1 +
+ linux-user/syscall.c | 14 +++++++++++++-
- linux-user/riscv/syscall64_nr.h |   1 +
+file changed, 13 insertions(+), 1 deletion(-)
  linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
 files changed, 148 insertions(+)
-diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/riscv/syscall32_nr.h
-+++ b/linux-user/riscv/syscall32_nr.h
-@@ -XXX,XX +XXX,XX @@
- #define TARGET_NR_accept4 242
- #define TARGET_NR_arch_specific_syscall 244
- #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
-+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
- #define TARGET_NR_prlimit64 261
- #define TARGET_NR_fanotify_init 262
- #define TARGET_NR_fanotify_mark 263
-diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/riscv/syscall64_nr.h
-+++ b/linux-user/riscv/syscall64_nr.h
-@@ -XXX,XX +XXX,XX @@
- #define TARGET_NR_recvmmsg 243
- #define TARGET_NR_arch_specific_syscall 244
- #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
-+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
- #define TARGET_NR_wait4 260
- #define TARGET_NR_prlimit64 261
- #define TARGET_NR_fanotify_init 262
 diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/syscall.c
 +++ b/linux-user/syscall.c
 @@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
- }
+ #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
- #endif /* TARGET_NR_getdents64 */
+ #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+ #define     RISCV_HWPROBE_IMA_C        (1 << 1)
-+#if defined(TARGET_NR_riscv_hwprobe)
++#define     RISCV_HWPROBE_IMA_V        (1 << 2)
-+
++#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
-+#define RISCV_HWPROBE_KEY_MVENDORID     0
++#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
-+#define RISCV_HWPROBE_KEY_MARCHID       1
++#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
-+#define RISCV_HWPROBE_KEY_MIMPID        2
-+
+ #define RISCV_HWPROBE_KEY_CPUPERF_0     5
-+#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
+ #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
-+#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
-+
+                     riscv_has_ext(env, RVD) ?
-+#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
+                     RISCV_HWPROBE_IMA_FD : 0;
-+#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+             value |= riscv_has_ext(env, RVC) ?
-+#define     RISCV_HWPROBE_IMA_C        (1 << 1)
+-                     RISCV_HWPROBE_IMA_C : pair->value;
-+
++                     RISCV_HWPROBE_IMA_C : 0;
-+#define RISCV_HWPROBE_KEY_CPUPERF_0     5
++            value |= riscv_has_ext(env, RVV) ?
-+#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
++                     RISCV_HWPROBE_IMA_V : 0;
-+#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
++            value |= cfg->ext_zba ?
-+#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
++                     RISCV_HWPROBE_EXT_ZBA : 0;
-+#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
++            value |= cfg->ext_zbb ?
-+#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
++                     RISCV_HWPROBE_EXT_ZBB : 0;
-+#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
++            value |= cfg->ext_zbs ?
-+
++                     RISCV_HWPROBE_EXT_ZBS : 0;
-+struct riscv_hwprobe {
+             __put_user(value, &pair->value);
-+    abi_llong  key;
+             break;
-+    abi_ullong value;
+         case RISCV_HWPROBE_KEY_CPUPERF_0:
 +};
 +
 +static void risc_hwprobe_fill_pairs(CPURISCVState *env,
 +                                    struct riscv_hwprobe *pair,
 +                                    size_t pair_count)
 +{
 +    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
 +
 +    for (; pair_count > 0; pair_count--, pair++) {
 +        abi_llong key;
 +        abi_ullong value;
 +        __put_user(0, &pair->value);
 +        __get_user(key, &pair->key);
 +        switch (key) {
 +        case RISCV_HWPROBE_KEY_MVENDORID:
 +            __put_user(cfg->mvendorid, &pair->value);
 +            break;
 +        case RISCV_HWPROBE_KEY_MARCHID:
 +            __put_user(cfg->marchid, &pair->value);
 +            break;
 +        case RISCV_HWPROBE_KEY_MIMPID:
 +            __put_user(cfg->mimpid, &pair->value);
 +            break;
 +        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
 +            value = riscv_has_ext(env, RVI) &&
 +                    riscv_has_ext(env, RVM) &&
 +                    riscv_has_ext(env, RVA) ?
 +                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
 +            __put_user(value, &pair->value);
 +            break;
 +        case RISCV_HWPROBE_KEY_IMA_EXT_0:
 +            value = riscv_has_ext(env, RVF) &&
 +                    riscv_has_ext(env, RVD) ?
 +                    RISCV_HWPROBE_IMA_FD : 0;
 +            value |= riscv_has_ext(env, RVC) ?
 +                     RISCV_HWPROBE_IMA_C : pair->value;
 +            __put_user(value, &pair->value);
 +            break;
 +        case RISCV_HWPROBE_KEY_CPUPERF_0:
 +            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
 +            break;
 +        default:
 +            __put_user(-1, &pair->key);
 +            break;
 +        }
 +    }
 +}
 +
 +static int cpu_set_valid(abi_long arg3, abi_long arg4)
 +{
 +    int ret, i, tmp;
 +    size_t host_mask_size, target_mask_size;
 +    unsigned long *host_mask;
 +
 +    /*
 +     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
 +     * arg3 contains the cpu count.
 +     */
 +    tmp = (8 * sizeof(abi_ulong));
 +    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
 +    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
 +                     ~(sizeof(*host_mask) - 1);
 +
 +    host_mask = alloca(host_mask_size);
 +
 +    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
 +                                  arg4, target_mask_size);
 +    if (ret != 0) {
 +        return ret;
 +    }
 +
 +    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
 +        if (host_mask[i] != 0) {
 +            return 0;
 +        }
 +    }
 +    return -TARGET_EINVAL;
 +}
 +
 +static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
 +                                 abi_long arg2, abi_long arg3,
 +                                 abi_long arg4, abi_long arg5)
 +{
 +    int ret;
 +    struct riscv_hwprobe *host_pairs;
 +
 +    /* flags must be 0 */
 +    if (arg5 != 0) {
 +        return -TARGET_EINVAL;
 +    }
 +
 +    /* check cpu_set */
 +    if (arg3 != 0) {
 +        ret = cpu_set_valid(arg3, arg4);
 +        if (ret != 0) {
 +            return ret;
 +        }
 +    } else if (arg4 != 0) {
 +        return -TARGET_EINVAL;
 +    }
 +
 +    /* no pairs */
 +    if (arg2 == 0) {
 +        return 0;
 +    }
 +
 +    host_pairs = lock_user(VERIFY_WRITE, arg1,
 +                           sizeof(*host_pairs) * (size_t)arg2, 0);
 +    if (host_pairs == NULL) {
 +        return -TARGET_EFAULT;
 +    }
 +    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
 +    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
 +    return 0;
 +}
 +#endif /* TARGET_NR_riscv_hwprobe */
 +
  #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
  _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
  #endif
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
          return ret;
  #endif
 +#if defined(TARGET_NR_riscv_hwprobe)
 +    case TARGET_NR_riscv_hwprobe:
 +        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
 +#endif
 +
      default:
          qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
          return -TARGET_ENOSYS;
 --
-.40.1
+.41.0

-[PULL 08/54] disas/riscv: Add support for XThead* instructions
+[PULL v2 41/45] target/riscv: Use accelerated helper for AES64KS1I
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Ard Biesheuvel <ardb@kernel.org>
-Support for emulating XThead* instruction has been added recently.
+Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
-This patch adds support for these instructions to the RISC-V disassembler.
+implement the first half of the key schedule derivation. This does not
 actually involve shifting rows, so clone the same value into all four
 columns of the AES vector to counter that operation.
-Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Cc: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
-Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
+Cc: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230831154118.138727-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv-xthead.h   |  28 ++
+ target/riscv/crypto_helper.c | 17 +++++------------
- disas/riscv.h          |  12 +
+file changed, 5 insertions(+), 12 deletions(-)
  target/riscv/cpu_cfg.h |  11 +
  disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
  disas/riscv.c          |  69 ++++
  disas/meson.build      |   1 +
 files changed, 828 insertions(+)
  create mode 100644 disas/riscv-xthead.h
  create mode 100644 disas/riscv-xthead.c
-diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
+diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/disas/riscv-xthead.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU disassembler -- RISC-V specific header (xthead*).
 + *
 + * Copyright (c) 2023 VRULL GmbH
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#ifndef DISAS_RISCV_XTHEAD_H
 +#define DISAS_RISCV_XTHEAD_H
 +
 +#include "disas/riscv.h"
 +
 +extern const rv_opcode_data xthead_opcode_data[];
 +
 +void decode_xtheadba(rv_decode *, rv_isa);
 +void decode_xtheadbb(rv_decode *, rv_isa);
 +void decode_xtheadbs(rv_decode *, rv_isa);
 +void decode_xtheadcmo(rv_decode *, rv_isa);
 +void decode_xtheadcondmov(rv_decode *, rv_isa);
 +void decode_xtheadfmemidx(rv_decode *, rv_isa);
 +void decode_xtheadfmv(rv_decode *, rv_isa);
 +void decode_xtheadmac(rv_decode *, rv_isa);
 +void decode_xtheadmemidx(rv_decode *, rv_isa);
 +void decode_xtheadmempair(rv_decode *, rv_isa);
 +void decode_xtheadsync(rv_decode *, rv_isa);
 +
 +#endif /* DISAS_RISCV_XTHEAD_H */
 diff --git a/disas/riscv.h b/disas/riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
+--- a/target/riscv/crypto_helper.c
-+++ b/disas/riscv.h
++++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
-     rv_codec_zcmp_cm_pushpop,
-     rv_codec_zcmp_cm_mv,
+     uint8_t enc_rnum = rnum;
-     rv_codec_zcmt_jt,
+     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-+    rv_codec_r2_imm5,
+-    uint8_t rcon_ = 0;
-+    rv_codec_r2,
+-    target_ulong result;
-+    rv_codec_r2_imm6,
++    AESState t, rc = {};
-+    rv_codec_r_imm2,
-+    rv_codec_r2_immhl,
+     if (enc_rnum != 0xA) {
-+    rv_codec_r2_imm2_imm5,
+         temp = ror32(temp, 8); /* Rotate right by 8 */
- } rv_codec;
+-        rcon_ = round_consts[enc_rnum];
++        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
  /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint64_t  inst;
      const rv_opcode_data *opcode_data;
      int32_t   imm;
 +    int32_t   imm1;
      uint16_t  op;
      uint8_t   codec;
      uint8_t   rd;
@@ -XXX,XX +XXX,XX @@ enum {
  #define rv_fmt_push_rlist             "O\tx,-i"
  #define rv_fmt_pop_rlist              "O\tx,i"
  #define rv_fmt_zcmt_index             "O\ti"
 +#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
 +#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
 +#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
 +#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
 +#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
  #endif /* DISAS_RISCV_H */
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
          return cfg->ext_ ## ext ; \
      }
-+MATERIALISE_EXT_PREDICATE(xtheadba)
+-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-+MATERIALISE_EXT_PREDICATE(xtheadbb)
+-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-+MATERIALISE_EXT_PREDICATE(xtheadbs)
+-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-+MATERIALISE_EXT_PREDICATE(xtheadcmo)
+-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
-+MATERIALISE_EXT_PREDICATE(xtheadcondmov)
++    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
-+MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
++    aesenc_SB_SR_AK(&t, &t, &rc, false);
-+MATERIALISE_EXT_PREDICATE(xtheadfmv)
-+MATERIALISE_EXT_PREDICATE(xtheadmac)
+-    temp ^= rcon_;
-+MATERIALISE_EXT_PREDICATE(xtheadmemidx)
+-
-+MATERIALISE_EXT_PREDICATE(xtheadmempair)
+-    result = ((uint64_t)temp << 32) | temp;
-+MATERIALISE_EXT_PREDICATE(xtheadsync)
+-
- MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
+-    return result;
++    return t.d[0];
  #endif
 diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/disas/riscv-xthead.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU RISC-V Disassembler for xthead.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "disas/riscv.h"
 +#include "disas/riscv-xthead.h"
 +
 +typedef enum {
 +    /* 0 is reserved for rv_op_illegal. */
 +    /* XTheadBa */
 +    rv_op_th_addsl = 1,
 +    /* XTheadBb */
 +    rv_op_th_srri,
 +    rv_op_th_srriw,
 +    rv_op_th_ext,
 +    rv_op_th_extu,
 +    rv_op_th_ff0,
 +    rv_op_th_ff1,
 +    rv_op_th_rev,
 +    rv_op_th_revw,
 +    rv_op_th_tstnbz,
 +    /* XTheadBs */
 +    rv_op_th_tst,
 +    /* XTheadCmo */
 +    rv_op_th_dcache_call,
 +    rv_op_th_dcache_ciall,
 +    rv_op_th_dcache_iall,
 +    rv_op_th_dcache_cpa,
 +    rv_op_th_dcache_cipa,
 +    rv_op_th_dcache_ipa,
 +    rv_op_th_dcache_cva,
 +    rv_op_th_dcache_civa,
 +    rv_op_th_dcache_iva,
 +    rv_op_th_dcache_csw,
 +    rv_op_th_dcache_cisw,
 +    rv_op_th_dcache_isw,
 +    rv_op_th_dcache_cpal1,
 +    rv_op_th_dcache_cval1,
 +    rv_op_th_icache_iall,
 +    rv_op_th_icache_ialls,
 +    rv_op_th_icache_ipa,
 +    rv_op_th_icache_iva,
 +    rv_op_th_l2cache_call,
 +    rv_op_th_l2cache_ciall,
 +    rv_op_th_l2cache_iall,
 +    /* XTheadCondMov */
 +    rv_op_th_mveqz,
 +    rv_op_th_mvnez,
 +    /* XTheadFMemIdx */
 +    rv_op_th_flrd,
 +    rv_op_th_flrw,
 +    rv_op_th_flurd,
 +    rv_op_th_flurw,
 +    rv_op_th_fsrd,
 +    rv_op_th_fsrw,
 +    rv_op_th_fsurd,
 +    rv_op_th_fsurw,
 +    /* XTheadFmv */
 +    rv_op_th_fmv_hw_x,
 +    rv_op_th_fmv_x_hw,
 +    /* XTheadMac */
 +    rv_op_th_mula,
 +    rv_op_th_mulah,
 +    rv_op_th_mulaw,
 +    rv_op_th_muls,
 +    rv_op_th_mulsw,
 +    rv_op_th_mulsh,
 +    /* XTheadMemIdx */
 +    rv_op_th_lbia,
 +    rv_op_th_lbib,
 +    rv_op_th_lbuia,
 +    rv_op_th_lbuib,
 +    rv_op_th_lhia,
 +    rv_op_th_lhib,
 +    rv_op_th_lhuia,
 +    rv_op_th_lhuib,
 +    rv_op_th_lwia,
 +    rv_op_th_lwib,
 +    rv_op_th_lwuia,
 +    rv_op_th_lwuib,
 +    rv_op_th_ldia,
 +    rv_op_th_ldib,
 +    rv_op_th_sbia,
 +    rv_op_th_sbib,
 +    rv_op_th_shia,
 +    rv_op_th_shib,
 +    rv_op_th_swia,
 +    rv_op_th_swib,
 +    rv_op_th_sdia,
 +    rv_op_th_sdib,
 +    rv_op_th_lrb,
 +    rv_op_th_lrbu,
 +    rv_op_th_lrh,
 +    rv_op_th_lrhu,
 +    rv_op_th_lrw,
 +    rv_op_th_lrwu,
 +    rv_op_th_lrd,
 +    rv_op_th_srb,
 +    rv_op_th_srh,
 +    rv_op_th_srw,
 +    rv_op_th_srd,
 +    rv_op_th_lurb,
 +    rv_op_th_lurbu,
 +    rv_op_th_lurh,
 +    rv_op_th_lurhu,
 +    rv_op_th_lurw,
 +    rv_op_th_lurwu,
 +    rv_op_th_lurd,
 +    rv_op_th_surb,
 +    rv_op_th_surh,
 +    rv_op_th_surw,
 +    rv_op_th_surd,
 +    /* XTheadMemPair */
 +    rv_op_th_ldd,
 +    rv_op_th_lwd,
 +    rv_op_th_lwud,
 +    rv_op_th_sdd,
 +    rv_op_th_swd,
 +    /* XTheadSync */
 +    rv_op_th_sfence_vmas,
 +    rv_op_th_sync,
 +    rv_op_th_sync_i,
 +    rv_op_th_sync_is,
 +    rv_op_th_sync_s,
 +} rv_xthead_op;
 +
 +const rv_opcode_data xthead_opcode_data[] = {
 +    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
 +    /* XTheadBa */
 +    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    /* XTheadBb */
 +    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
 +    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
 +    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
 +    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
 +    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    /* XTheadBs */
 +    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
 +    /* XTheadCmo */
 +    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    /* XTheadCondMov */
 +    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    /* XTheadFMemIdx */
 +    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    /* XTheadFmv */
 +    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    /* XTheadMac */
 +    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    /* XTheadMemIdx */
 +    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
 +    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    /* XTheadMemPair */
 +    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    /* XTheadSync */
 +    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +};
 +
 +void decode_xtheadba(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0000000:
 +                case 0b0000001:
 +                case 0b0000010:
 +                case 0b0000011: op = rv_op_th_addsl; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadbb(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0001010: op = rv_op_th_srriw; break;
 +                case 0b1000000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_tstnbz;
 +                    }
 +                    break;
 +                case 0b1000001:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_rev;
 +                    }
 +                    break;
 +                case 0b1000010:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_ff0;
 +                    }
 +                    break;
 +                case 0b1000011:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_ff1;
 +                    }
 +                    break;
 +                case 0b1000100:
 +                case 0b1001000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_revw;
 +                    }
 +                    break;
 +                case 0b0000100:
 +                case 0b0000101: op = rv_op_th_srri; break;
 +                }
 +                break;
 +            case 2: op = rv_op_th_ext; break;
 +            case 3: op = rv_op_th_extu; break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadbs(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 26) & 0b111111) {
 +                case 0b100010: op = rv_op_th_tst; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 0:
 +                switch ((inst >> 20 & 0b111111111111)) {
 +                case 0b000000000001:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_dcache_call;
 +                    }
 +                    break;
 +                case 0b000000000011:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_dcache_ciall;
 +                    }
 +                    break;
 +                case 0b000000000010:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_dcache_iall;
 +                    }
 +                    break;
 +                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
 +                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
 +                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
 +                case 0b000000100101: op = rv_op_th_dcache_cva; break;
 +                case 0b000000100111: op = rv_op_th_dcache_civa; break;
 +                case 0b000000100110: op = rv_op_th_dcache_iva; break;
 +                case 0b000000100001: op = rv_op_th_dcache_csw; break;
 +                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
 +                case 0b000000100010: op = rv_op_th_dcache_isw; break;
 +                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
 +                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
 +                case 0b000000010000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_icache_iall;
 +                    }
 +                    break;
 +                case 0b000000010001:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_icache_ialls;
 +                    }
 +                    break;
 +                case 0b000000111000: op = rv_op_th_icache_ipa; break;
 +                case 0b000000110000: op = rv_op_th_icache_iva; break;
 +                case 0b000000010101:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_l2cache_call;
 +                    }
 +                    break;
 +                case 0b000000010111:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_l2cache_ciall;
 +                    }
 +                    break;
 +                case 0b000000010110:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_l2cache_iall;
 +                    }
 +                    break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0100000: op = rv_op_th_mveqz; break;
 +                case 0b0100001: op = rv_op_th_mvnez; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 6:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 8: op = rv_op_th_flrw; break;
 +                case 10: op = rv_op_th_flurw; break;
 +                case 12: op = rv_op_th_flrd; break;
 +                case 14: op = rv_op_th_flurd; break;
 +                }
 +                break;
 +            case 7:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 8: op = rv_op_th_fsrw; break;
 +                case 10: op = rv_op_th_fsurw; break;
 +                case 12: op = rv_op_th_fsrd; break;
 +                case 14: op = rv_op_th_fsurd; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b1010000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_fmv_hw_x;
 +                    }
 +                    break;
 +                case 0b1100000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_fmv_x_hw;
 +                    }
 +                    break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadmac(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0010000: op = rv_op_th_mula; break;
 +                case 0b0010001: op = rv_op_th_muls; break;
 +                case 0b0010010: op = rv_op_th_mulaw; break;
 +                case 0b0010011: op = rv_op_th_mulsw; break;
 +                case 0b0010100: op = rv_op_th_mulah; break;
 +                case 0b0010101: op = rv_op_th_mulsh; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 4:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 0: op = rv_op_th_lrb; break;
 +                case 1: op = rv_op_th_lbib; break;
 +                case 2: op = rv_op_th_lurb; break;
 +                case 3: op = rv_op_th_lbia; break;
 +                case 4: op = rv_op_th_lrh; break;
 +                case 5: op = rv_op_th_lhib; break;
 +                case 6: op = rv_op_th_lurh; break;
 +                case 7: op = rv_op_th_lhia; break;
 +                case 8: op = rv_op_th_lrw; break;
 +                case 9: op = rv_op_th_lwib; break;
 +                case 10: op = rv_op_th_lurw; break;
 +                case 11: op = rv_op_th_lwia; break;
 +                case 12: op = rv_op_th_lrd; break;
 +                case 13: op = rv_op_th_ldib; break;
 +                case 14: op = rv_op_th_lurd; break;
 +                case 15: op = rv_op_th_ldia; break;
 +                case 16: op = rv_op_th_lrbu; break;
 +                case 17: op = rv_op_th_lbuib; break;
 +                case 18: op = rv_op_th_lurbu; break;
 +                case 19: op = rv_op_th_lbuia; break;
 +                case 20: op = rv_op_th_lrhu; break;
 +                case 21: op = rv_op_th_lhuib; break;
 +                case 22: op = rv_op_th_lurhu; break;
 +                case 23: op = rv_op_th_lhuia; break;
 +                case 24: op = rv_op_th_lrwu; break;
 +                case 25: op = rv_op_th_lwuib; break;
 +                case 26: op = rv_op_th_lurwu; break;
 +                case 27: op = rv_op_th_lwuia; break;
 +                }
 +                break;
 +            case 5:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 0: op = rv_op_th_srb; break;
 +                case 1: op = rv_op_th_sbib; break;
 +                case 2: op = rv_op_th_surb; break;
 +                case 3: op = rv_op_th_sbia; break;
 +                case 4: op = rv_op_th_srh; break;
 +                case 5: op = rv_op_th_shib; break;
 +                case 6: op = rv_op_th_surh; break;
 +                case 7: op = rv_op_th_shia; break;
 +                case 8: op = rv_op_th_srw; break;
 +                case 9: op = rv_op_th_swib; break;
 +                case 10: op = rv_op_th_surw; break;
 +                case 11: op = rv_op_th_swia; break;
 +                case 12: op = rv_op_th_srd; break;
 +                case 13: op = rv_op_th_sdib; break;
 +                case 14: op = rv_op_th_surd; break;
 +                case 15: op = rv_op_th_sdia; break;
 +                }
 +                break;
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 4:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 28: op = rv_op_th_lwd; break;
 +                case 30: op = rv_op_th_lwud; break;
 +                case 31: op = rv_op_th_ldd; break;
 +                }
 +                break;
 +            case 5:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 28: op = rv_op_th_swd; break;
 +                case 31: op = rv_op_th_sdd; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadsync(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 0:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0000010: op = rv_op_th_sfence_vmas; break;
 +                case 0b0000000:
 +                    switch ((inst >> 20) & 0b11111) {
 +                    case 0b11000: op = rv_op_th_sync; break;
 +                    case 0b11010: op = rv_op_th_sync_i; break;
 +                    case 0b11011: op = rv_op_th_sync_is; break;
 +                    case 0b11001: op = rv_op_th_sync_s; break;
 +                    }
 +                    break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "qemu/bitops.h"
  #include "disas/dis-asm.h"
  #include "target/riscv/cpu_cfg.h"
  #include "disas/riscv.h"
  /* Vendor extensions */
 +#include "disas/riscv-xthead.h"
  #include "disas/riscv-xventana.h"
  typedef enum {
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
      return ((inst << 56) >> 60);
  }
-+static uint32_t operand_imm6(rv_inst inst)
+ target_ulong HELPER(aes64im)(target_ulong rs1)
 +{
 +    return (inst << 38) >> 60;
 +}
 +
 +static uint32_t operand_imm2(rv_inst inst)
 +{
 +    return (inst << 37) >> 62;
 +}
 +
 +static uint32_t operand_immh(rv_inst inst)
 +{
 +    return (inst << 32) >> 58;
 +}
 +
 +static uint32_t operand_imml(rv_inst inst)
 +{
 +    return (inst << 38) >> 58;
 +}
 +
  static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
  {
      int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
      case rv_codec_zcmt_jt:
          dec->imm = operand_tbl_index(inst);
          break;
 +    case rv_codec_r2_imm5:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = operand_rs2(inst);
 +        break;
 +    case rv_codec_r2:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        break;
 +    case rv_codec_r2_imm6:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = operand_imm6(inst);
 +        break;
 +    case rv_codec_r_imm2:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->rs2 = operand_rs2(inst);
 +        dec->imm = operand_imm2(inst);
 +        break;
 +    case rv_codec_r2_immhl:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = operand_immh(inst);
 +        dec->imm1 = operand_imml(inst);
 +        break;
 +    case rv_codec_r2_imm2_imm5:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = sextract32(operand_rs2(inst), 0, 5);
 +        dec->imm1 = operand_imm2(inst);
 +        break;
      };
  }
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
              snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
              append(buf, tmp, buflen);
              break;
 +        case 'j':
 +            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
 +            append(buf, tmp, buflen);
 +            break;
          case 'o':
              snprintf(tmp, sizeof(tmp), "%d", dec->imm);
              append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
          void (*decode_func)(rv_decode *, rv_isa);
      } decoders[] = {
          { always_true_p, rvi_opcode_data, decode_inst_opcode },
 +        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
 +        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
 +        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
 +        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
 +        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
 +        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
 +        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
 +        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
 +        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
 +        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
 +        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
          { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
      };
 diff --git a/disas/meson.build b/disas/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/meson.build
 +++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
  common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
  common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
      'riscv.c',
 +    'riscv-xthead.c',
      'riscv-xventana.c'
  ))
  common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
 --
-.40.1
+.41.0

-[PULL 44/54] target/riscv/cpu: add misa_ext_info_arr[]
+[PULL v2 42/45] target/riscv: Allocate itrigger timers only once
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-Next patch will add KVM specific user properties for both MISA and
+riscv_trigger_init() had been called on reset events that can happen
-multi-letter extensions. For MISA extensions we want to make use of what
+several times for a CPU and it allocated timers for itrigger. If old
-is already available in misa_ext_cfgs[] to avoid code repetition.
+timers were present, they were simply overwritten by the new timers,
 resulting in a memory leak.
-misa_ext_info_arr[] array will hold name and description for each MISA
+Divide riscv_trigger_init() into two functions, namely
-extension that misa_ext_cfgs[] is declaring. We'll then use this new
+riscv_trigger_realize() and riscv_trigger_reset() and call them in
-array in KVM code to avoid duplicating strings. Two getters were added
+appropriate timing. The timer allocation will happen only once for a
-to allow KVM to retrieve the 'name' and 'description' for each MISA
+CPU in riscv_trigger_realize().
 property.
-There's nothing holding us back from doing the same with multi-letter
+Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
-extensions. For now doing just with MISA extensions is enough.
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 It is worth documenting that even using the __bultin_ctz() directive to
 populate the misa_ext_info_arr[] we are forced to assign 'name' and
 'description' during runtime in riscv_cpu_add_misa_properties(). The
 reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
 throw errors like this if we fetch 'name' and 'description' from the
 array in the MISA_CFG() macro:
 ../target/riscv/cpu.c:1624:5: error: initializer element is not a
                               compile-time constant
     MISA_CFG(RVA, true),
     ^~~~~~~~~~~~~~~~~~~
 ../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
     {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
 gcc and others compilers/builders were fine with that change. We can't
 ignore failures in the Gitlab pipeline though, so code was changed to
 make every runner happy.
 As a side effect, misa_ext_cfg[] is no longer a 'const' array because
 it must be set during runtime.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
+Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |   7 ++-
+ target/riscv/debug.h |  3 ++-
- target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
+ target/riscv/cpu.c   |  8 +++++++-
-files changed, 88 insertions(+), 29 deletions(-)
+ target/riscv/debug.c | 15 ++++++++++++---
 files changed, 21 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/debug.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/debug.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
+ bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
- #define RV(x) ((target_ulong)1 << (x - 'A'))
+ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
--/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
+-void riscv_trigger_init(CPURISCVState *env);
-+/*
++void riscv_trigger_realize(CPURISCVState *env);
-+ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
++void riscv_trigger_reset_hold(CPURISCVState *env);
-+ * when adding new MISA bits here.
-+ */
+ bool riscv_itrigger_enabled(CPURISCVState *env);
- #define RVI RV('I')
+ void riscv_itrigger_update_priv(CPURISCVState *env);
  #define RVE RV('E') /* E and I are mutually exclusive */
  #define RVM RV('M')
@@ -XXX,XX +XXX,XX @@
  #define RVJ RV('J')
  #define RVG RV('G')
 +const char *riscv_get_misa_ext_name(uint32_t bit);
 +const char *riscv_get_misa_ext_description(uint32_t bit);
  /* Privileged specification version */
  enum {
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
-     visit_type_bool(v, name, &value, errp);
  #ifndef CONFIG_USER_ONLY
      if (cpu->cfg.debug) {
 -        riscv_trigger_init(env);
 +        riscv_trigger_reset_hold(env);
      }
      if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
      riscv_cpu_register_gdb_regs_for_features(cs);
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.debug) {
 +        riscv_trigger_realize(&cpu->env);
 +    }
 +#endif
 +
      qemu_init_vcpu(cs);
      cpu_reset(cs);
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
      return false;
  }
--static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+-void riscv_trigger_init(CPURISCVState *env)
--    {.name = "a", .description = "Atomic instructions",
++void riscv_trigger_realize(CPURISCVState *env)
--     .misa_bit = RVA, .enabled = true},
++{
--    {.name = "c", .description = "Compressed instructions",
++    int i;
 -     .misa_bit = RVC, .enabled = true},
 -    {.name = "d", .description = "Double-precision float point",
 -     .misa_bit = RVD, .enabled = true},
 -    {.name = "f", .description = "Single-precision float point",
 -     .misa_bit = RVF, .enabled = true},
 -    {.name = "i", .description = "Base integer instruction set",
 -     .misa_bit = RVI, .enabled = true},
 -    {.name = "e", .description = "Base integer instruction set (embedded)",
 -     .misa_bit = RVE, .enabled = false},
 -    {.name = "m", .description = "Integer multiplication and division",
 -     .misa_bit = RVM, .enabled = true},
 -    {.name = "s", .description = "Supervisor-level instructions",
 -     .misa_bit = RVS, .enabled = true},
 -    {.name = "u", .description = "User-level instructions",
 -     .misa_bit = RVU, .enabled = true},
 -    {.name = "h", .description = "Hypervisor",
 -     .misa_bit = RVH, .enabled = true},
 -    {.name = "x-j", .description = "Dynamic translated languages",
 -     .misa_bit = RVJ, .enabled = false},
 -    {.name = "v", .description = "Vector operations",
 -     .misa_bit = RVV, .enabled = false},
 -    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
 -     .misa_bit = RVG, .enabled = false},
 +typedef struct misa_ext_info {
 +    const char *name;
 +    const char *description;
 +} MISAExtInfo;
 +
-+#define MISA_INFO_IDX(_bit) \
++    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
-+    __builtin_ctz(_bit)
++        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+
++                                              riscv_itrigger_timer_cb, env);
-+#define MISA_EXT_INFO(_bit, _propname, _descr) \
++    }
 +    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
 +
 +static const MISAExtInfo misa_ext_info_arr[] = {
 +    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
 +    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
 +    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
 +    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
 +    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
 +    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
 +    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
 +    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
 +    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
 +    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
 +    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
 +    MISA_EXT_INFO(RVV, "v", "Vector operations"),
 +    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
 +};
 +
 +static int riscv_validate_misa_info_idx(uint32_t bit)
 +{
 +    int idx;
 +
 +    /*
 +     * Our lowest valid input (RVA) is 1 and
 +     * __builtin_ctz() is UB with zero.
 +     */
 +    g_assert(bit != 0);
 +    idx = MISA_INFO_IDX(bit);
 +
 +    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
 +    return idx;
 +}
 +
-+const char *riscv_get_misa_ext_name(uint32_t bit)
++void riscv_trigger_reset_hold(CPURISCVState *env)
-+{
+ {
-+    int idx = riscv_validate_misa_info_idx(bit);
+     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
 +    const char *val = misa_ext_info_arr[idx].name;
 +
 +    g_assert(val != NULL);
 +    return val;
 +}
 +
 +const char *riscv_get_misa_ext_description(uint32_t bit)
 +{
 +    int idx = riscv_validate_misa_info_idx(bit);
 +    const char *val = misa_ext_info_arr[idx].description;
 +
 +    g_assert(val != NULL);
 +    return val;
 +}
 +
 +#define MISA_CFG(_bit, _enabled) \
 +    {.misa_bit = _bit, .enabled = _enabled}
 +
 +static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
 +    MISA_CFG(RVA, true),
 +    MISA_CFG(RVC, true),
 +    MISA_CFG(RVD, true),
 +    MISA_CFG(RVF, true),
 +    MISA_CFG(RVI, true),
 +    MISA_CFG(RVE, false),
 +    MISA_CFG(RVM, true),
 +    MISA_CFG(RVS, true),
 +    MISA_CFG(RVU, true),
 +    MISA_CFG(RVH, true),
 +    MISA_CFG(RVJ, false),
 +    MISA_CFG(RVV, false),
 +    MISA_CFG(RVG, false),
  };
  static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
      int i;
+@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
-     for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
+         env->tdata3[i] = 0;
--        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+         env->cpu_breakpoint[i] = NULL;
-+        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+         env->cpu_watchpoint[i] = NULL;
-+        int bit = misa_cfg->misa_bit;
+-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+
+-                                              riscv_itrigger_timer_cb, env);
-+        misa_cfg->name = riscv_get_misa_ext_name(bit);
++        timer_del(env->itrigger_timer[i]);
-+        misa_cfg->description = riscv_get_misa_ext_description(bit);
+     }
+ }
          object_property_add(cpu_obj, misa_cfg->name, "bool",
                              cpu_get_misa_ext_cfg,
 --
-.40.1
+.41.0

-[PULL 20/54] target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
+[PULL v2 43/45] target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Leon Schuermann <leons@opentitan.org>
-We want to keep the ability to distinct between 32/64-bit host.
+When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
 configuration lock bits must not apply. While this behavior is
 implemented for the pmpcfgX CSRs, this bit is not respected for
 changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
 writes work even on locked regions when the global rule-lock bypass is
 enabled.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Leon Schuermann <leons@opentitan.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627143235.29947-2-philmd@linaro.org>
+Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- meson.build | 11 ++++-------
+ target/riscv/pmp.c | 4 ++++
-file changed, 4 insertions(+), 7 deletions(-)
+file changed, 4 insertions(+)
-diff --git a/meson.build b/meson.build
+diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/target/riscv/pmp.c
-+++ b/meson.build
++++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
+  */
- bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
+ static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
- supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
+ {
--supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
++    /* mseccfg.RLB is set */
-+supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
++    if (MSECCFG_RLB_ISSET(env)) {
-   'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
++        return 0;
++    }
- cpu = host_machine.cpu_family()
+     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
--# Unify riscv* to a single family.
+         return 1;
 -if cpu in ['riscv32', 'riscv64']
 -  cpu = 'riscv'
 -endif
 -
  target_dirs = config_host['TARGET_DIRS'].split()
  have_linux_user = false
  have_bsd_user = false
@@ -XXX,XX +XXX,XX @@ elif cpu == 'x86'
    host_arch = 'i386'
  elif cpu == 'mips64'
    host_arch = 'mips'
 +elif cpu in ['riscv32', 'riscv64']
 +  host_arch = 'riscv'
  else
    host_arch = cpu
  endif
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
    kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
  elif cpu in ['mips', 'mips64']
    kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
 -elif cpu in ['riscv']
 +elif cpu in ['riscv32', 'riscv64']
    kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
  else
    kvm_targets = []
 --
-.40.1
+.41.0

-[PULL 19/54] tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e
+[PULL v2 44/45] target/riscv: Align the AIA model to v1.0 ratified spec
 From: Tommy Wu <tommy.wu@sifive.com>
-Add some simple tests of the watchdog timer in the always-on domain device
+According to the new spec, when vsiselect has a reserved value, attempts
-of HiFive 1 rev b.
+from M-mode or HS-mode to access vsireg, or from VS-mode to access
 sireg, should preferably raise an illegal instruction exception.
 Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Acked-by: Thomas Huth <thuth@redhat.com>
+Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
+ target/riscv/csr.c | 7 +++++--
- tests/qtest/meson.build                  |   3 +
+file changed, 5 insertions(+), 2 deletions(-)
 files changed, 453 insertions(+)
  create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
-diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/sifive-e-aon-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for the watchdog timer of HiFive 1 rev b.
 + *
 + * Copyright (c) 2023 SiFive, Inc.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/timer.h"
 +#include "qemu/bitops.h"
 +#include "libqtest.h"
 +#include "hw/registerfields.h"
 +#include "hw/misc/sifive_e_aon.h"
 +
 +FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
 +FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
 +FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
 +FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
 +FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
 +FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
 +FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
 +FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
 +FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
 +FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
 +
 +#define WDOG_BASE (0x10000000)
 +#define WDOGCFG (0x0)
 +#define WDOGCOUNT (0x8)
 +#define WDOGS (0x10)
 +#define WDOGFEED (0x18)
 +#define WDOGKEY (0x1c)
 +#define WDOGCMP0 (0x20)
 +
 +#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
 +#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
 +#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
 +
 +static void test_init(QTestState *qts)
 +{
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
 +}
 +
 +static void test_wdogcount(void)
 +{
 +    uint64_t tmp;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
 +    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
 +    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
 +    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_wdogcfg(void)
 +{
 +    uint32_t tmp_cfg;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
 +    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
 +
 +    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
 +    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_wdogcmp0(void)
 +{
 +    uint32_t tmp;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
 +    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_wdogkey(void)
 +{
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_wdogfeed(void)
 +{
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_scaled_wdogs(void)
 +{
 +    uint32_t cfg;
 +    uint32_t fake_count = 0x12345678;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
 +    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
 +             (uint16_t)fake_count);
 +
 +    for (int i = 0; i < 16; i++) {
 +        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
 +        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
 +                 (uint16_t)(fake_count >>
 +                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
 +    }
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_watchdog(void)
 +{
 +    uint32_t cfg;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
 +
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
 +             SIFIVE_E_LFCLK_DEFAULT_FREQ);
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
 +             SIFIVE_E_LFCLK_DEFAULT_FREQ);
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_scaled_watchdog(void)
 +{
 +    uint32_t cfg;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
 +
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
 +             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
 +
 +    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_periodic_int(void)
 +{
 +    uint32_t cfg;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
 +
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
 +
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
 +    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_enable_disable(void)
 +{
 +    uint32_t cfg;
 +    QTestState *qts = qtest_init("-machine sifive_e");
 +
 +    test_init(qts);
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
 +
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
 +             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
 +    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
 +
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
 +             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
 +    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +
 +    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
 +
 +    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
 +             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
 +    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
 +
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
 +    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
 +    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
 +    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
 +    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
 +    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
 +    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
 +
 +    qtest_quit(qts);
 +}
 +
 +int main(int argc, char *argv[])
 +{
 +    g_test_init(&argc, &argv, NULL);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
 +                   test_wdogcount);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
 +                   test_wdogcfg);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
 +                   test_wdogcmp0);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
 +                   test_wdogkey);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
 +                   test_wdogfeed);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
 +                   test_scaled_wdogs);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
 +                   test_watchdog);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
 +                   test_scaled_watchdog);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
 +                   test_periodic_int);
 +    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
 +                   test_enable_disable);
 +    return g_test_run();
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/meson.build
+--- a/target/riscv/csr.c
-+++ b/tests/qtest/meson.build
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ qtests_s390x = \
+@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
-    'cpu-plug-test',
+ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
-    'migration-test']
+                      target_ulong new_val, target_ulong wr_mask)
+ {
-+qtests_riscv32 = \
+-    bool virt;
-+  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
++    bool virt, isel_reserved;
-+
+     uint8_t *iprio;
- qos_test_ss = ss.source_set()
+     int ret = -EINVAL;
- qos_test_ss.add(
+     target_ulong priv, isel, vgein;
-   'ac97-test.c',
+@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
      /* Decode register details from CSR number */
      virt = false;
 +    isel_reserved = false;
      switch (csrno) {
      case CSR_MIREG:
          iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                    riscv_cpu_mxl_bits(env)),
                                      val, new_val, wr_mask);
          }
 +    } else {
 +        isel_reserved = true;
      }
  done:
      if (ret) {
 -        return (env->virt_enabled && virt) ?
 +        return (env->virt_enabled && virt && !isel_reserved) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
      return RISCV_EXCP_NONE;
 --
-.40.1
+.41.0

-[PULL 10/54] target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
+[PULL v2 45/45] target/riscv: don't read CSR in riscv_csrrw_do64
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Nikita Shubin <n.shubin@yadro.com>
-MPV and GVA bits are added by hypervisor extension to mstatus
+As per ISA:
 and mstatush (if MXLEN=32).
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+shall not cause any of the side effects that might occur on a CSR read."
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
 riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.
 Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
+Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 10 ++++------
+ target/riscv/csr.c | 24 +++++++++++++++---------
-file changed, 4 insertions(+), 6 deletions(-)
+file changed, 15 insertions(+), 9 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                         target_ulong write_mask)
  {
      RISCVException ret;
 -    target_ulong old_value;
 +    target_ulong old_value = 0;
      /* execute combined read/write operation if it exists */
      if (csr_ops[csrno].op) {
          return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
      }
-     if (xl != MXL_RV32 || env->debugger) {
+-    /* if no accessor exists then return failure */
--        /*
+-    if (!csr_ops[csrno].read) {
--         * RV32: MPV and GVA are not in mstatus. The current plan is to
+-        return RISCV_EXCP_ILLEGAL_INST;
--         * add them to mstatush. For now, we just don't support it.
+-    }
--         */
+-    /* read old value */
--        mask |= MSTATUS_MPV | MSTATUS_GVA;
+-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-+        if (riscv_has_ext(env, RVH)) {
+-    if (ret != RISCV_EXCP_NONE) {
-+            mask |= MSTATUS_MPV | MSTATUS_GVA;
+-        return ret;
 +    /*
 +     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
 +     * and we can't throw side effects caused by CSR reads.
 +     */
 +    if (ret_value) {
 +        /* if no accessor exists then return failure */
 +        if (!csr_ops[csrno].read) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
-         if ((val & MSTATUS64_UXL) != 0) {
++        /* read old value */
-             mask |= MSTATUS64_UXL;
++        ret = csr_ops[csrno].read(env, csrno, &old_value);
-         }
++        if (ret != RISCV_EXCP_NONE) {
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
++            return ret;
-                                      target_ulong val)
++        }
- {
+     }
-     uint64_t valh = (uint64_t)val << 32;
--    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
+     /* write value if writable and write mask set, otherwise drop writes */
 +    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
      env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 --
-.40.1
+.41.0

-[PULL 15/54] roms/opensbi: Upgrade from v1.2 to v1.3
+Deleted patch
-From: Bin Meng <bmeng@tinylab.org>
-Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.
-The v1.3 release includes the following commits:
-fa81 treewide: Replace TRUE/FALSE with true/false
-6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
-f8 lib: utils/sys: Allow custom HTIF base address for RV32
-f14595a lib: sbi: Allow platform to influence cold boot HART selection
-ae0 platform: generic: Allow platform_override to select cold boot HART
-cb7e7c3 platform: generic: Allow platform_override to perform firmware init
-df8 generic/starfive: Add Starfive JH7110 platform implementation
-6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
-e397e3 docs: domain_support: Use capital letter for privilege modes
-e0ba09 include: sbi: Fine grain the permissions for M and SU modes
-aace1e1 lib: sbi: Use finer permission semantics for address validation
-dbdb3 lib: sbi: Add permissions for the firmware start till end
-ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
-f736c lib: sbi: Modify the boot time region flag prints
-e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
-e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
-a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
-d docs: Update domain's region permissions and requirements
-da5594b platform: generic: allwinner: Fix PLIC array bounds
-ce2a834 docs: generic.md: fix typo of andes-ae350
-ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
-b1818ee include: types: add always inline compiler attribute
-c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
-a platform: andes/ae350: Implement hart hotplug using HSM extension
-aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
-a990309 lib: utils: Fix reserved memory node for firmware memory
-fefa548 firmware: Split RO/RX and RW sections
-f40a99 firmware: Move dynsym and reladyn sections to RX section
-c10e3fe firmware: Add RW section offset in scratch
-b666760 lib: sbi: Print the RW section offset
-d lib: sbi: Add separate entries for firmware RX and RW regions
-dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
-bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
-c45992c platform: generic: allwinner: Advertise nonretentive suspend
-c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
-8050081 firmware: Not to clear all the MIP
-d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
-b lib: utils: Mark only the largest region as reserved in FDT
-b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
-f3de Makefile: Add missing .dep files for fw_*.elf.ld
-b34d8 include: Add support for byteorder/endianness conversion
-bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
-b224ddb include: types: Add typedefs for endianness
-aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
-e3bf1af include: Add defines for SBI debug console extension
-ee3a86 lib: sbi: Add sbi_nputs() function
-e0572f lib: sbi: Add sbi_ngets() function
-eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
-a41a38 lib: sbi: Implement SBI debug console extension
-c43903c lib: sbi: Add console_puts() callback in the console device
-ae lib: utils/serial: Implement console_puts() for semihosting
-c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
-c lib: utils/fdt: Fix fdt_pmu.c header dependency
-aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
-aaec platform: generic/andes: Fix ae350.c header dependency
-d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
-ee9 lib: utils: fdt_fixup: Fix compile error
-f2be40 docs: fix typo in fw.md
-ea806 lib: sbi_hart: Enable hcontext and scontext
-adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
-b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
-c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
-2491242 platform: generic: renesas: rzfive: Configure the PMA region
-b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
-a75f53 lib: sbi/sbi_domain: cosmetic style fixes
-bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
-b3776 docs: domain_support: Update the DT example
-d5a lib: sbi_hsm: Factor out invalid state detection
-f16a8 lib: sbi_hsm: Don't try to restore state on failed change
-c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
-b1ae6ef lib: sbi_hsm: Move misplaced comment
-fc lib: sbi_hsm: Remove unnecessary include
-a40306 lib: sbi_hsm: Export some functions
-a0 lib: sbi: Add system suspend skeleton
-c9917b6 lib: sbi: Add system_suspend_allowed domain property
-c964e2 lib: sbi: Implement system suspend
-dc docs: Correct opensbi-domain property name
-ccebf0 platform: generic: Add system suspend test
-be1b gpio/starfive: add gpio driver and support gpio reset
-b28afc make: Add a command line option for debugging OpenSBI
-e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
-ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
-f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
-fe8dc9 lib: sbi_pmu: add callback for counter width
-d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
-c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
-e4b4 lib: sbi_pmu: Rename fw_counter_value
-b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
-d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
-d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
-c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
-d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
-e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
-c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
-ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
-ab11d lib: sbi: Fix how to check whether the domain contains fw_region
-f64dfcd lib: sbi: Introduce sbi_entry_count() function
-b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
-e90259 lib: sbi_hart: clear mip csr during hart init
-ba2b2 include: Add defines for SBI CPPC extension
-caae8 lib: sbi: Implement SBI CPPC extension
-d0 lib: sbi: Print the CPPC device name
-edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
-ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
-f26 lib: utils: fdt_fixup: avoid buffer overrun
-fa925 lib: sbi: Optimize sbi_tlb
-dde46 lib: sbi: Optimize sbi_ipi
-ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
-bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
-eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
-f692289 firmware: Optimize loading relocation type
-e41dbb5 firmware: Change to use positive offset to access relocation entries
-bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
-e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
-f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
-7919530 lib: sbi: Add debug print when sbi_pmu_init fails
-e33530 lib: sbi: Remove unnecessary semicolon
-bc02de lib: sbi: Simplify sbi_ipi_process remove goto
-dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
-f58c140 lib: sbi: Introduce register_extensions extension callback
-e307ba7 lib: sbi: Narrow vendor extension range
-f0c3 lib: sbi: pmu: Remove unnecessary probe function
-b952d4 lib: sbi: Only register available extensions
-b5fc lib: sbi: Optimize probe of srst/susp
-c3e31cb lib: sbi: Remove 0/1 probe implementations
-f1722 lib: sbi: Document sbi_ecall_extension members
-d4c46e0 Makefile: Dereference symlinks on install
-b99a7f lib: sbi: Fix return of sbi_console_init
-d0be lib: utils: Improve fdt_serial_init
-a0bdd0 lib: utils: Improve fdt_ipi
-f226 lib: utils: Improve fdt_timer
-df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
-bdde2ec lib: sbi: Align system suspend errors with spec
-aad7a37 include: sbi_scratch: Add helper macros to access data type
-cf9a54 platform: Allow platforms to specify heap size
-d36a6 lib: sbi: Introduce simple heap allocator
-a04f70 lib: sbi: Print scratch size and usage at boot time
-bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
-ef4542d lib: sbi: Use heap for root domain creation
-daafe lib: sbi: Use scratch space to save per-HART domain pointer
-fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
-e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
-a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
-3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
-e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
-c1c972 lib: utils/fdt: Use heap in FDT domain parsing
-acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
-f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
-b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
-df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
-c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
-feec docs: Add OpenSBI logo and use it in the top-level README.md
-be2c README.md: Improve project copyright information
-b26 platform/lib: Set no-map attribute on all PMP regions
-d64942f firmware: Fix find hart index
-c957a lib: reset: Move fdt_reset_init into generic_early_init
-bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
-2552799 include: Bump-up version to 1.3
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
-Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
- .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
- roms/opensbi                                  |   2 +-
-files changed, 1 insertion(+), 1 deletion(-)
-diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
-diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
-diff --git a/roms/opensbi b/roms/opensbi
-index XXXXXXX..XXXXXXX 160000
---- a/roms/opensbi
-+++ b/roms/opensbi
-@@ -1 +1 @@
--Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
-+Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
---
-.40.1

-[PULL 16/54] tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing
+Deleted patch
-From: Bin Meng <bmeng@tinylab.org>
-The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
-Let's enable the 32-bit Spike OpenSBI boot testing.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
-Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- tests/avocado/riscv_opensbi.py | 2 --
-file changed, 2 deletions(-)
-diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/riscv_opensbi.py
-+++ b/tests/avocado/riscv_opensbi.py
-@@ -XXX,XX +XXX,XX @@
- # later.  See the COPYING file in the top-level directory.
- from avocado_qemu import QemuSystemTest
--from avocado import skip
- from avocado_qemu import wait_for_console_pattern
- class RiscvOpenSBI(QemuSystemTest):
-@@ -XXX,XX +XXX,XX @@ def boot_opensbi(self):
-         wait_for_console_pattern(self, 'Platform Name')
-         wait_for_console_pattern(self, 'Boot HART MEDELEG')
--    @skip("requires OpenSBI fix to work")
-     def test_riscv32_spike(self):
-         """
-         :avocado: tags=arch:riscv32
---
-.40.1

-[PULL 18/54] hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
+Deleted patch
-From: Tommy Wu <tommy.wu@sifive.com>
-Create the AON device when we realize the sifive_e machine.
-This patch only implemented the functionality of the watchdog timer,
-not all the functionality of the AON device.
-Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/riscv/sifive_e.h |  9 ++++++---
- hw/riscv/sifive_e.c         | 17 +++++++++++++++--
- hw/riscv/Kconfig            |  1 +
-files changed, 22 insertions(+), 5 deletions(-)
-diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_e.h
-+++ b/include/hw/riscv/sifive_e.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_cpu.h"
- #include "hw/gpio/sifive_gpio.h"
-+#include "hw/misc/sifive_e_aon.h"
- #include "hw/boards.h"
- #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
-@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
-     /*< public >*/
-     RISCVHartArrayState cpus;
-     DeviceState *plic;
-+    SiFiveEAONState aon;
-     SIFIVEGPIOState gpio;
-     MemoryRegion xip_mem;
-     MemoryRegion mask_rom;
-@@ -XXX,XX +XXX,XX @@ enum {
- };
- enum {
--    SIFIVE_E_UART0_IRQ  = 3,
--    SIFIVE_E_UART1_IRQ  = 4,
--    SIFIVE_E_GPIO0_IRQ0 = 8
-+    SIFIVE_E_AON_WDT_IRQ  = 1,
-+    SIFIVE_E_UART0_IRQ    = 3,
-+    SIFIVE_E_UART1_IRQ    = 4,
-+    SIFIVE_E_GPIO0_IRQ0   = 8
- };
- #define SIFIVE_E_PLIC_HART_CONFIG "M"
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/intc/riscv_aclint.h"
- #include "hw/intc/sifive_plic.h"
- #include "hw/misc/sifive_e_prci.h"
-+#include "hw/misc/sifive_e_aon.h"
- #include "chardev/char.h"
- #include "sysemu/sysemu.h"
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
-     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
-     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
-                             TYPE_SIFIVE_GPIO);
-+    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
-+                            TYPE_SIFIVE_E_AON);
- }
- static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
-         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
-         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
--    create_unimplemented_device("riscv.sifive.e.aon",
--        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
-     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
-+    /* AON */
-+
-+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
-+        return;
-+    }
-+
-+    /* Map AON registers */
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
-+
-     /* GPIO */
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-                            qdev_get_gpio_in(DEVICE(s->plic),
-                                             SIFIVE_E_GPIO0_IRQ0 + i));
-     }
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
-+                       qdev_get_gpio_in(DEVICE(s->plic),
-+                                        SIFIVE_E_AON_WDT_IRQ));
-     sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
-         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
-+++ b/hw/riscv/Kconfig
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
-     select SIFIVE_PLIC
-     select SIFIVE_UART
-     select SIFIVE_E_PRCI
-+    select SIFIVE_E_AON
-     select UNIMP
- config SIFIVE_U
---
-.40.1

The following changes since commit fcb237e64f9d026c03d635579c7b288d0008a6e5:

Merge tag 'pull-vfio-20230710' of https://github.com/legoater/qemu into staging (2023-07-10 09:17:06 +0100)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230710-1

for you to fetch changes up to a47842d16653b4f73b5d56ff0c252dd8a329481b:

riscv: Add support for the Zfa extension (2023-07-10 22:29:20 +1000)

----------------------------------------------------------------
Third RISC-V PR for 8.1

* Use xl instead of mxl for disassemble
* Factor out extension tests to cpu_cfg.h
* disas/riscv: Add vendor extension support
* disas/riscv: Add support for XVentanaCondOps
* disas/riscv: Add support for XThead* instructions
* Fix mstatus related problems
* Fix veyron-v1 CPU properties
* Fix the xlen for data address when MPRV=1
* opensbi: Upgrade from v1.2 to v1.3
* Enable 32-bit Spike OpenSBI boot testing
* Support the watchdog timer of HiFive 1 rev b
* Only build qemu-system-riscv$$ on rv$$ host
* Add RVV registers to log
* Restrict ACLINT to TCG
* Add syscall riscv_hwprobe
* Add support for BF16 extensions
* KVM_RISCV_SET_TIMER macro is not configured correctly
* Generate devicetree only after machine initialization is complete
* virt: Convert fdt_load_addr to uint64_t
* KVM: fixes and enhancements
* Add support for the Zfa extension

----------------------------------------------------------------
Bin Meng (2):
      roms/opensbi: Upgrade from v1.2 to v1.3
      tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing

Christoph Müllner (8):
      target/riscv: Factor out extension tests to cpu_cfg.h
      disas/riscv: Move types/constants to new header file
      disas/riscv: Make rv_op_illegal a shared enum value
      disas/riscv: Encapsulate opcode_data into decode
      disas/riscv: Provide infrastructure for vendor extensions
      disas/riscv: Add support for XVentanaCondOps
      disas/riscv: Add support for XThead* instructions
      riscv: Add support for the Zfa extension

Daniel Henrique Barboza (20):
      target/riscv/cpu.c: fix veyron-v1 CPU properties
      target/riscv: skip features setup for KVM CPUs
      hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
      target/riscv/cpu.c: restrict 'mvendorid' value
      target/riscv/cpu.c: restrict 'mimpid' value
      target/riscv/cpu.c: restrict 'marchid' value
      target/riscv: use KVM scratch CPUs to init KVM properties
      target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
      target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
      target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
      target/riscv/cpu: add misa_ext_info_arr[]
      target/riscv: add KVM specific MISA properties
      target/riscv/kvm.c: update KVM MISA bits
      target/riscv/kvm.c: add multi-letter extension KVM properties
      target/riscv/cpu.c: add satp_mode properties earlier
      target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
      target/riscv/cpu.c: create KVM mock properties
      target/riscv: update multi-letter extension KVM properties
      target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
      target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM

Guenter Roeck (1):
      riscv: Generate devicetree only after machine initialization is complete

Ivan Klokov (1):
      target/riscv: Add RVV registers to log

Jason Chien (1):
      target/riscv: Set the correct exception for implict G-stage translation fail

LIU Zhiwei (1):
      target/riscv: Use xl instead of mxl for disassemble

Lakshmi Bai Raja Subramanian (1):
      hw/riscv: virt: Convert fdt_load_addr to uint64_t

Philippe Mathieu-Daudé (3):
      target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
      target/riscv: Only build KVM guest with same wordsize as host
      hw/riscv/virt: Restrict ACLINT to TCG

Robbin Ehn (1):
      linux-user/riscv: Add syscall riscv_hwprobe

Tommy Wu (3):
      hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
      hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
      tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e

Weiwei Li (11):
      target/riscv: Make MPV only work when MPP != PRV_M
      target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
      target/riscv: Remove redundant assignment to SXL
      target/riscv: Add additional xlen for address when MPRV=1
      target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
      target/riscv: Add properties for BF16 extensions
      target/riscv: Add support for Zfbfmin extension
      target/riscv: Add support for Zvfbfmin extension
      target/riscv: Add support for Zvfbfwma extension
      target/riscv: Expose properties for BF16 extensions
      target/riscv: Add disas support for BF16 extensions

yang.zhang (1):
      target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly

docs/system/riscv/virt.rst                     |   1 +
 meson.build                                    |  15 +-
 disas/riscv-xthead.h                           |  28 +
 disas/riscv-xventana.h                         |  18 +
 disas/riscv.h                                  | 302 +++++++++++
 include/hw/misc/sifive_e_aon.h                 |  60 +++
 include/hw/riscv/sifive_e.h                    |   9 +-
 linux-user/riscv/syscall32_nr.h                |   1 +
 linux-user/riscv/syscall64_nr.h                |   1 +
 target/riscv/cpu.h                             |  56 +-
 target/riscv/cpu_cfg.h                         |  41 ++
 target/riscv/helper.h                          |  29 +
 target/riscv/kvm_riscv.h                       |   1 +
 target/riscv/insn32.decode                     |  38 ++
 disas/riscv-xthead.c                           | 707 +++++++++++++++++++++++++
 disas/riscv-xventana.c                         |  41 ++
 disas/riscv.c                                  | 559 +++++++++----------
 hw/misc/sifive_e_aon.c                         | 319 +++++++++++
 hw/riscv/sifive_e.c                            |  17 +-
 hw/riscv/virt.c                                |  56 +-
 linux-user/syscall.c                           | 146 +++++
 target/riscv/cpu.c                             | 439 +++++++++++++--
 target/riscv/cpu_helper.c                      |  12 +-
 target/riscv/csr.c                             |  41 +-
 target/riscv/fpu_helper.c                      | 166 ++++++
 target/riscv/kvm.c                             | 501 +++++++++++++++++-
 target/riscv/op_helper.c                       |   3 +-
 target/riscv/translate.c                       |  42 +-
 target/riscv/vector_helper.c                   |  17 +
 tests/qtest/sifive-e-aon-watchdog-test.c       | 450 ++++++++++++++++
 tests/tcg/riscv64/test-fcvtmod.c               | 345 ++++++++++++
 target/riscv/insn_trans/trans_rvbf16.c.inc     | 175 ++++++
 target/riscv/insn_trans/trans_rvzfa.c.inc      | 521 ++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc      |  12 +-
 disas/meson.build                              |   6 +-
 hw/misc/Kconfig                                |   3 +
 hw/misc/meson.build                            |   1 +
 hw/riscv/Kconfig                               |   1 +
 pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 123072 -> 135344 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 121800 -> 138304 bytes
 roms/opensbi                                   |   2 +-
 tests/avocado/riscv_opensbi.py                 |   2 -
 tests/qtest/meson.build                        |   3 +
 tests/tcg/riscv64/Makefile.target              |   6 +
 44 files changed, 4751 insertions(+), 442 deletions(-)
 create mode 100644 disas/riscv-xthead.h
 create mode 100644 disas/riscv-xventana.h
 create mode 100644 disas/riscv.h
 create mode 100644 include/hw/misc/sifive_e_aon.h
 create mode 100644 disas/riscv-xthead.c
 create mode 100644 disas/riscv-xventana.c
 create mode 100644 hw/misc/sifive_e_aon.c
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Disassemble function(plugin_disas, target_disas, monitor_disas) will
always call set_disas_info before disassembling instructions.

plugin_disas  and target_disas will always be called under a TB, which
has the same XLEN.

We can't ensure that monitor_disas will always be called under a TB,
but current XLEN will still be a better choice, thus we can ensure at
least the disassemble of the nearest one TB is right.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 {
     RISCVCPU *cpu = RISCV_CPU(s);
+    CPURISCVState *env = &cpu->env;
     info->target_info = &cpu->cfg;
 
-    switch (riscv_cpu_mxl(&cpu->env)) {
+    switch (env->xl) {
     case MXL_RV32:
         info->print_insn = print_insn_riscv32;
         break;
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch moves the extension test functions that are used
to gate vendor extension decoders, into cpu_cfg.h.
This allows to reuse them in the disassembler.

This patch does not introduce new functionality.
However, the patch includes a small change:
The parameter for the extension test functions has been changed
from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
the code in cpu_cfg.h self-contained.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
 target/riscv/translate.c | 27 ++-------------------------
 2 files changed, 28 insertions(+), 25 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
+
+/* Helper functions to test for extensions.  */
+
+static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
+{
+    return true;
+}
+
+static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
+{
+    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
+           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
+           cfg->ext_xtheadcondmov ||
+           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
+           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
+           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
+}
+
+#define MATERIALISE_EXT_PREDICATE(ext) \
+    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
+    { \
+        return cfg->ext_ ## ext ; \
+    }
+
+MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
+
 #endif
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
     return ctx->misa_ext & ext;
 }
 
-static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return true;
-}
-
-static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
-           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
-           ctx->cfg_ptr->ext_xtheadcondmov ||
-           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
-           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
-           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
-}
-
-#define MATERIALISE_EXT_PREDICATE(ext)  \
-    static bool has_ ## ext ## _p(DisasContext *ctx)    \
-    { \
-        return ctx->cfg_ptr->ext_ ## ext ; \
-    }
-
-MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
-
 #ifdef TARGET_RISCV32
 #define get_xl(ctx)    MXL_RV32
 #elif defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
      * that are tested in-order until a decoder matches onto the opcode.
      */
     static const struct {
-        bool (*guard_func)(DisasContext *);
+        bool (*guard_func)(const RISCVCPUConfig *);
         bool (*decode_func)(DisasContext *, uint32_t);
     } decoders[] = {
         { always_true_p,  decode_insn32 },
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         ctx->opcode = opcode32;
 
         for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx) &&
+            if (decoders[i].guard_func(ctx->cfg_ptr) &&
                 decoders[i].decode_func(ctx, opcode32)) {
                 return;
             }
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

In order to enable vendor disassembler support, we need to
move types and constants into a header file so that other
compilation units can use them as well.

This patch does not introduce any functional changes.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c | 270 +----------------------------------------------
 2 files changed, 283 insertions(+), 269 deletions(-)
 create mode 100644 disas/riscv.h

diff --git a/disas/riscv.h b/disas/riscv.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_H
+#define DISAS_RISCV_H
+
+#include "qemu/osdep.h"
+#include "target/riscv/cpu_cfg.h"
+
+/* types */
+
+typedef uint64_t rv_inst;
+typedef uint16_t rv_opcode;
+
+/* enums */
+
+typedef enum {
+    rv32,
+    rv64,
+    rv128
+} rv_isa;
+
+typedef enum {
+    rv_rm_rne = 0,
+    rv_rm_rtz = 1,
+    rv_rm_rdn = 2,
+    rv_rm_rup = 3,
+    rv_rm_rmm = 4,
+    rv_rm_dyn = 7,
+} rv_rm;
+
+typedef enum {
+    rv_fence_i = 8,
+    rv_fence_o = 4,
+    rv_fence_r = 2,
+    rv_fence_w = 1,
+} rv_fence;
+
+typedef enum {
+    rv_ireg_zero,
+    rv_ireg_ra,
+    rv_ireg_sp,
+    rv_ireg_gp,
+    rv_ireg_tp,
+    rv_ireg_t0,
+    rv_ireg_t1,
+    rv_ireg_t2,
+    rv_ireg_s0,
+    rv_ireg_s1,
+    rv_ireg_a0,
+    rv_ireg_a1,
+    rv_ireg_a2,
+    rv_ireg_a3,
+    rv_ireg_a4,
+    rv_ireg_a5,
+    rv_ireg_a6,
+    rv_ireg_a7,
+    rv_ireg_s2,
+    rv_ireg_s3,
+    rv_ireg_s4,
+    rv_ireg_s5,
+    rv_ireg_s6,
+    rv_ireg_s7,
+    rv_ireg_s8,
+    rv_ireg_s9,
+    rv_ireg_s10,
+    rv_ireg_s11,
+    rv_ireg_t3,
+    rv_ireg_t4,
+    rv_ireg_t5,
+    rv_ireg_t6,
+} rv_ireg;
+
+typedef enum {
+    rvc_end,
+    rvc_rd_eq_ra,
+    rvc_rd_eq_x0,
+    rvc_rs1_eq_x0,
+    rvc_rs2_eq_x0,
+    rvc_rs2_eq_rs1,
+    rvc_rs1_eq_ra,
+    rvc_imm_eq_zero,
+    rvc_imm_eq_n1,
+    rvc_imm_eq_p1,
+    rvc_csr_eq_0x001,
+    rvc_csr_eq_0x002,
+    rvc_csr_eq_0x003,
+    rvc_csr_eq_0xc00,
+    rvc_csr_eq_0xc01,
+    rvc_csr_eq_0xc02,
+    rvc_csr_eq_0xc80,
+    rvc_csr_eq_0xc81,
+    rvc_csr_eq_0xc82,
+} rvc_constraint;
+
+typedef enum {
+    rv_codec_illegal,
+    rv_codec_none,
+    rv_codec_u,
+    rv_codec_uj,
+    rv_codec_i,
+    rv_codec_i_sh5,
+    rv_codec_i_sh6,
+    rv_codec_i_sh7,
+    rv_codec_i_csr,
+    rv_codec_s,
+    rv_codec_sb,
+    rv_codec_r,
+    rv_codec_r_m,
+    rv_codec_r4_m,
+    rv_codec_r_a,
+    rv_codec_r_l,
+    rv_codec_r_f,
+    rv_codec_cb,
+    rv_codec_cb_imm,
+    rv_codec_cb_sh5,
+    rv_codec_cb_sh6,
+    rv_codec_ci,
+    rv_codec_ci_sh5,
+    rv_codec_ci_sh6,
+    rv_codec_ci_16sp,
+    rv_codec_ci_lwsp,
+    rv_codec_ci_ldsp,
+    rv_codec_ci_lqsp,
+    rv_codec_ci_li,
+    rv_codec_ci_lui,
+    rv_codec_ci_none,
+    rv_codec_ciw_4spn,
+    rv_codec_cj,
+    rv_codec_cj_jal,
+    rv_codec_cl_lw,
+    rv_codec_cl_ld,
+    rv_codec_cl_lq,
+    rv_codec_cr,
+    rv_codec_cr_mv,
+    rv_codec_cr_jalr,
+    rv_codec_cr_jr,
+    rv_codec_cs,
+    rv_codec_cs_sw,
+    rv_codec_cs_sd,
+    rv_codec_cs_sq,
+    rv_codec_css_swsp,
+    rv_codec_css_sdsp,
+    rv_codec_css_sqsp,
+    rv_codec_k_bs,
+    rv_codec_k_rnum,
+    rv_codec_v_r,
+    rv_codec_v_ldst,
+    rv_codec_v_i,
+    rv_codec_vsetvli,
+    rv_codec_vsetivli,
+    rv_codec_zcb_ext,
+    rv_codec_zcb_mul,
+    rv_codec_zcb_lb,
+    rv_codec_zcb_lh,
+    rv_codec_zcmp_cm_pushpop,
+    rv_codec_zcmp_cm_mv,
+    rv_codec_zcmt_jt,
+} rv_codec;
+
+/* structures */
+
+typedef struct {
+    RISCVCPUConfig *cfg;
+    uint64_t  pc;
+    uint64_t  inst;
+    int32_t   imm;
+    uint16_t  op;
+    uint8_t   codec;
+    uint8_t   rd;
+    uint8_t   rs1;
+    uint8_t   rs2;
+    uint8_t   rs3;
+    uint8_t   rm;
+    uint8_t   pred;
+    uint8_t   succ;
+    uint8_t   aq;
+    uint8_t   rl;
+    uint8_t   bs;
+    uint8_t   rnum;
+    uint8_t   vm;
+    uint32_t  vzimm;
+    uint8_t   rlist;
+} rv_decode;
+
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+enum {
+    rvcd_imm_nz = 0x1
+};
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
+/* instruction formats */
+
+#define rv_fmt_none                   "O\t"
+#define rv_fmt_rs1                    "O\t1"
+#define rv_fmt_offset                 "O\to"
+#define rv_fmt_pred_succ              "O\tp,s"
+#define rv_fmt_rs1_rs2                "O\t1,2"
+#define rv_fmt_rd_imm                 "O\t0,i"
+#define rv_fmt_rd_offset              "O\t0,o"
+#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
+#define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_frs1               "O\t3,4"
+#define rv_fmt_rd_frs1                "O\t0,4"
+#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
+#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
+#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
+#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
+#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
+#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
+#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
+#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
+#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
+#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
+#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
+#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
+#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
+#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
+#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
+#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
+#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
+#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
+#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
+#define rv_fmt_rd                     "O\t0"
+#define rv_fmt_rd_zimm                "O\t0,7"
+#define rv_fmt_rd_rs1                 "O\t0,1"
+#define rv_fmt_rd_rs2                 "O\t0,2"
+#define rv_fmt_rs1_offset             "O\t1,o"
+#define rv_fmt_rs2_offset             "O\t2,o"
+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
+#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
+#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
+#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
+#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
+#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
+#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
+#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
+#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
+#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
+#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
+#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
+#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
+#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
+#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
+#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
+#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
+#define rv_fmt_vd_vs1                 "O\tD,E"
+#define rv_fmt_vd_rs1                 "O\tD,1"
+#define rv_fmt_vd_fs1                 "O\tD,4"
+#define rv_fmt_vd_imm                 "O\tD,i"
+#define rv_fmt_vd_vs2                 "O\tD,F"
+#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
+#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
+#define rv_fmt_rd_vs2                 "O\t0,F"
+#define rv_fmt_fd_vs2                 "O\t3,F"
+#define rv_fmt_vd_vm                  "O\tDm"
+#define rv_fmt_vsetvli                "O\t0,1,v"
+#define rv_fmt_vsetivli               "O\t0,u,v"
+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
+#define rv_fmt_push_rlist             "O\tx,-i"
+#define rv_fmt_pop_rlist              "O\tx,i"
+#define rv_fmt_zcmt_index             "O\ti"
+
+#endif /* DISAS_RISCV_H */
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
-
-/* types */
-
-typedef uint64_t rv_inst;
-typedef uint16_t rv_opcode;
-
-/* enums */
-
-typedef enum {
-    rv32,
-    rv64,
-    rv128
-} rv_isa;
-
-typedef enum {
-    rv_rm_rne = 0,
-    rv_rm_rtz = 1,
-    rv_rm_rdn = 2,
-    rv_rm_rup = 3,
-    rv_rm_rmm = 4,
-    rv_rm_dyn = 7,
-} rv_rm;
-
-typedef enum {
-    rv_fence_i = 8,
-    rv_fence_o = 4,
-    rv_fence_r = 2,
-    rv_fence_w = 1,
-} rv_fence;
-
-typedef enum {
-    rv_ireg_zero,
-    rv_ireg_ra,
-    rv_ireg_sp,
-    rv_ireg_gp,
-    rv_ireg_tp,
-    rv_ireg_t0,
-    rv_ireg_t1,
-    rv_ireg_t2,
-    rv_ireg_s0,
-    rv_ireg_s1,
-    rv_ireg_a0,
-    rv_ireg_a1,
-    rv_ireg_a2,
-    rv_ireg_a3,
-    rv_ireg_a4,
-    rv_ireg_a5,
-    rv_ireg_a6,
-    rv_ireg_a7,
-    rv_ireg_s2,
-    rv_ireg_s3,
-    rv_ireg_s4,
-    rv_ireg_s5,
-    rv_ireg_s6,
-    rv_ireg_s7,
-    rv_ireg_s8,
-    rv_ireg_s9,
-    rv_ireg_s10,
-    rv_ireg_s11,
-    rv_ireg_t3,
-    rv_ireg_t4,
-    rv_ireg_t5,
-    rv_ireg_t6,
-} rv_ireg;
-
-typedef enum {
-    rvc_end,
-    rvc_rd_eq_ra,
-    rvc_rd_eq_x0,
-    rvc_rs1_eq_x0,
-    rvc_rs2_eq_x0,
-    rvc_rs2_eq_rs1,
-    rvc_rs1_eq_ra,
-    rvc_imm_eq_zero,
-    rvc_imm_eq_n1,
-    rvc_imm_eq_p1,
-    rvc_csr_eq_0x001,
-    rvc_csr_eq_0x002,
-    rvc_csr_eq_0x003,
-    rvc_csr_eq_0xc00,
-    rvc_csr_eq_0xc01,
-    rvc_csr_eq_0xc02,
-    rvc_csr_eq_0xc80,
-    rvc_csr_eq_0xc81,
-    rvc_csr_eq_0xc82,
-} rvc_constraint;
-
-typedef enum {
-    rv_codec_illegal,
-    rv_codec_none,
-    rv_codec_u,
-    rv_codec_uj,
-    rv_codec_i,
-    rv_codec_i_sh5,
-    rv_codec_i_sh6,
-    rv_codec_i_sh7,
-    rv_codec_i_csr,
-    rv_codec_s,
-    rv_codec_sb,
-    rv_codec_r,
-    rv_codec_r_m,
-    rv_codec_r4_m,
-    rv_codec_r_a,
-    rv_codec_r_l,
-    rv_codec_r_f,
-    rv_codec_cb,
-    rv_codec_cb_imm,
-    rv_codec_cb_sh5,
-    rv_codec_cb_sh6,
-    rv_codec_ci,
-    rv_codec_ci_sh5,
-    rv_codec_ci_sh6,
-    rv_codec_ci_16sp,
-    rv_codec_ci_lwsp,
-    rv_codec_ci_ldsp,
-    rv_codec_ci_lqsp,
-    rv_codec_ci_li,
-    rv_codec_ci_lui,
-    rv_codec_ci_none,
-    rv_codec_ciw_4spn,
-    rv_codec_cj,
-    rv_codec_cj_jal,
-    rv_codec_cl_lw,
-    rv_codec_cl_ld,
-    rv_codec_cl_lq,
-    rv_codec_cr,
-    rv_codec_cr_mv,
-    rv_codec_cr_jalr,
-    rv_codec_cr_jr,
-    rv_codec_cs,
-    rv_codec_cs_sw,
-    rv_codec_cs_sd,
-    rv_codec_cs_sq,
-    rv_codec_css_swsp,
-    rv_codec_css_sdsp,
-    rv_codec_css_sqsp,
-    rv_codec_k_bs,
-    rv_codec_k_rnum,
-    rv_codec_v_r,
-    rv_codec_v_ldst,
-    rv_codec_v_i,
-    rv_codec_vsetvli,
-    rv_codec_vsetivli,
-    rv_codec_zcb_ext,
-    rv_codec_zcb_mul,
-    rv_codec_zcb_lb,
-    rv_codec_zcb_lh,
-    rv_codec_zcmp_cm_pushpop,
-    rv_codec_zcmp_cm_mv,
-    rv_codec_zcmt_jt,
-} rv_codec;
+#include "disas/riscv.h"
 
 typedef enum {
     rv_op_illegal = 0,
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_czero_nez = 790,
 } rv_op;
 
-/* structures */
-
-typedef struct {
-    RISCVCPUConfig *cfg;
-    uint64_t  pc;
-    uint64_t  inst;
-    int32_t   imm;
-    uint16_t  op;
-    uint8_t   codec;
-    uint8_t   rd;
-    uint8_t   rs1;
-    uint8_t   rs2;
-    uint8_t   rs3;
-    uint8_t   rm;
-    uint8_t   pred;
-    uint8_t   succ;
-    uint8_t   aq;
-    uint8_t   rl;
-    uint8_t   bs;
-    uint8_t   rnum;
-    uint8_t   vm;
-    uint32_t  vzimm;
-    uint8_t   rlist;
-} rv_decode;
-
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
-enum {
-    rvcd_imm_nz = 0x1
-};
-
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* register names */
 
 static const char rv_ireg_name_sym[32][5] = {
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
-/* instruction formats */
-
-#define rv_fmt_none                   "O\t"
-#define rv_fmt_rs1                    "O\t1"
-#define rv_fmt_offset                 "O\to"
-#define rv_fmt_pred_succ              "O\tp,s"
-#define rv_fmt_rs1_rs2                "O\t1,2"
-#define rv_fmt_rd_imm                 "O\t0,i"
-#define rv_fmt_rd_offset              "O\t0,o"
-#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
-#define rv_fmt_frd_rs1                "O\t3,1"
-#define rv_fmt_frd_frs1               "O\t3,4"
-#define rv_fmt_rd_frs1                "O\t0,4"
-#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
-#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
-#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
-#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
-#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
-#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
-#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
-#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
-#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
-#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
-#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
-#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
-#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
-#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
-#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
-#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
-#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
-#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
-#define rv_fmt_rd                     "O\t0"
-#define rv_fmt_rd_zimm                "O\t0,7"
-#define rv_fmt_rd_rs1                 "O\t0,1"
-#define rv_fmt_rd_rs2                 "O\t0,2"
-#define rv_fmt_rs1_offset             "O\t1,o"
-#define rv_fmt_rs2_offset             "O\t2,o"
-#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
-#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
-#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
-#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
-#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
-#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
-#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
-#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
-#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
-#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
-#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
-#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
-#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
-#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
-#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
-#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
-#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
-#define rv_fmt_vd_vs1                 "O\tD,E"
-#define rv_fmt_vd_rs1                 "O\tD,1"
-#define rv_fmt_vd_fs1                 "O\tD,4"
-#define rv_fmt_vd_imm                 "O\tD,i"
-#define rv_fmt_vd_vs2                 "O\tD,F"
-#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
-#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
-#define rv_fmt_rd_vs2                 "O\t0,F"
-#define rv_fmt_fd_vs2                 "O\t3,F"
-#define rv_fmt_vd_vm                  "O\tDm"
-#define rv_fmt_vsetvli                "O\t0,1,v"
-#define rv_fmt_vsetivli               "O\t0,u,v"
-#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-#define rv_fmt_push_rlist             "O\tx,-i"
-#define rv_fmt_pop_rlist              "O\tx,i"
-#define rv_fmt_zcmt_index             "O\ti"
-
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

The enum value 'rv_op_illegal' does not represent an
instruction, but is a catch-all value in case we have
no match in the decoder. Let's make the value a shared
one, so that other compile units can reuse it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 4 ++++
 disas/riscv.c | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     const rvc_constraint *constraints;
 } rv_comp_data;
 
+enum {
+    rv_op_illegal = 0
+};
+
 enum {
     rvcd_imm_nz = 0x1
 };
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "disas/riscv.h"
 
 typedef enum {
-    rv_op_illegal = 0,
+    /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
     rv_op_auipc = 2,
     rv_op_jal = 3,
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch adds a reference to a struct rv_opcode_data object
into struct rv_decode. This further allows to remove all references
to the global variable opcode_data (which is renamed to rvi_opcode_data).

This patch does not introduce any functional change, but prepares
the code for more struct rv_opcode_data objects in the future.

This patch is based on previous work from Liu Zhiwei:
  https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 33 +++++++++++++++++----------------
 disas/riscv.c |  9 ++++++++-
 2 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 /* structures */
 
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
 typedef struct {
     RISCVCPUConfig *cfg;
     uint64_t  pc;
     uint64_t  inst;
+    const rv_opcode_data *opcode_data;
     int32_t   imm;
     uint16_t  op;
     uint8_t   codec;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint8_t   rlist;
 } rv_decode;
 
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
 enum {
     rv_op_illegal = 0
 };
@@ -XXX,XX +XXX,XX @@ enum {
     rvcd_imm_nz = 0x1
 };
 
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* instruction formats */
 
 #define rv_fmt_none                   "O\t"
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
 
 /* instruction metadata */
 
-const rv_opcode_data opcode_data[] = {
+const rv_opcode_data rvi_opcode_data[] = {
     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
     { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_tbl_index(rv_inst inst)
 
 static void decode_inst_operands(rv_decode *dec, rv_isa isa)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     rv_inst inst = dec->inst;
     dec->codec = opcode_data[dec->op].codec;
     switch (dec->codec) {
@@ -XXX,XX +XXX,XX @@ static void append(char *s1, const char *s2, size_t n)
 
 static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     char tmp[64];
     const char *fmt;
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 
 static void decode_inst_lift_pseudo(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
     if (!comp_data) {
         return;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_lift_pseudo(rv_decode *dec)
 
 static void decode_inst_decompress_rv32(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv32;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv32(rv_decode *dec)
 
 static void decode_inst_decompress_rv64(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv64;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv64(rv_decode *dec)
 
 static void decode_inst_decompress_rv128(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv128;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
+    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
     decode_inst_opcode(&dec, isa);
     decode_inst_operands(&dec, isa);
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

A previous patch provides a pointer to the RISCVCPUConfig data.
Let's use this to add the necessary code for vendor extensions.
This patch does not change the current behaviour, but clearly
defines how vendor extension support can be added to the disassembler.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
-    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
-    decode_inst_opcode(&dec, isa);
+
+    static const struct {
+        bool (*guard_func)(const RISCVCPUConfig *);
+        const rv_opcode_data *opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa);
+    } decoders[] = {
+        { always_true_p, rvi_opcode_data, decode_inst_opcode },
+    };
+
+    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
+        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
+        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
+
+        if (guard_func(cfg)) {
+            dec.opcode_data = opcode_data;
+            decode_func(&dec, isa);
+            if (dec.op != rv_op_illegal)
+                break;
+        }
+    }
+
+    if (dec.op == rv_op_illegal) {
+        dec.opcode_data = rvi_opcode_data;
+    }
+
     decode_inst_operands(&dec, isa);
     decode_inst_decompress(&dec, isa);
     decode_inst_lift_pseudo(&dec);
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch adds XVentanaCondOps support to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv-xventana.h | 18 ++++++++++++++++++
 disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c          |  4 ++++
 disas/meson.build      |  5 ++++-
 4 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 disas/riscv-xventana.h
 create mode 100644 disas/riscv-xventana.c

diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xventana.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xventana*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XVENTANA_H
+#define DISAS_RISCV_XVENTANA_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data ventana_opcode_data[];
+
+void decode_xventanacondops(rv_decode*, rv_isa);
+
+#endif /* DISAS_RISCV_XVENTANA_H */
diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xventana.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Disassembler for xventana.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xventana.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    ventana_op_vt_maskc = 1,
+    ventana_op_vt_maskcn = 2,
+} rv_ventana_op;
+
+const rv_opcode_data ventana_opcode_data[] = {
+    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+};
+
+void decode_xventanacondops(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 30:
+            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
+            case 6: op = ventana_op_vt_maskc; break;
+            case 7: op = ventana_op_vt_maskcn; break;
+            }
+            break;
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
+/* Vendor extensions */
+#include "disas/riscv-xventana.h"
+
 typedef enum {
     /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
diff --git a/disas/meson.build b/disas/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
 common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
 common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
-common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
+common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
+    'riscv.c',
+    'riscv-xventana.c'
+))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
 common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
 common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

Support for emulating XThead* instruction has been added recently.
This patch adds support for these instructions to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv-xthead.h   |  28 ++
 disas/riscv.h          |  12 +
 target/riscv/cpu_cfg.h |  11 +
 disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c          |  69 ++++
 disas/meson.build      |   1 +
 6 files changed, 828 insertions(+)
 create mode 100644 disas/riscv-xthead.h
 create mode 100644 disas/riscv-xthead.c

diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xthead.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xthead*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XTHEAD_H
+#define DISAS_RISCV_XTHEAD_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data xthead_opcode_data[];
+
+void decode_xtheadba(rv_decode *, rv_isa);
+void decode_xtheadbb(rv_decode *, rv_isa);
+void decode_xtheadbs(rv_decode *, rv_isa);
+void decode_xtheadcmo(rv_decode *, rv_isa);
+void decode_xtheadcondmov(rv_decode *, rv_isa);
+void decode_xtheadfmemidx(rv_decode *, rv_isa);
+void decode_xtheadfmv(rv_decode *, rv_isa);
+void decode_xtheadmac(rv_decode *, rv_isa);
+void decode_xtheadmemidx(rv_decode *, rv_isa);
+void decode_xtheadmempair(rv_decode *, rv_isa);
+void decode_xtheadsync(rv_decode *, rv_isa);
+
+#endif /* DISAS_RISCV_XTHEAD_H */
diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_zcmp_cm_pushpop,
     rv_codec_zcmp_cm_mv,
     rv_codec_zcmt_jt,
+    rv_codec_r2_imm5,
+    rv_codec_r2,
+    rv_codec_r2_imm6,
+    rv_codec_r_imm2,
+    rv_codec_r2_immhl,
+    rv_codec_r2_imm2_imm5,
 } rv_codec;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint64_t  inst;
     const rv_opcode_data *opcode_data;
     int32_t   imm;
+    int32_t   imm1;
     uint16_t  op;
     uint8_t   codec;
     uint8_t   rd;
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_push_rlist             "O\tx,-i"
 #define rv_fmt_pop_rlist              "O\tx,i"
 #define rv_fmt_zcmt_index             "O\ti"
+#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
+#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
+#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
+#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
+#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
         return cfg->ext_ ## ext ; \
     }
 
+MATERIALISE_EXT_PREDICATE(xtheadba)
+MATERIALISE_EXT_PREDICATE(xtheadbb)
+MATERIALISE_EXT_PREDICATE(xtheadbs)
+MATERIALISE_EXT_PREDICATE(xtheadcmo)
+MATERIALISE_EXT_PREDICATE(xtheadcondmov)
+MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadfmv)
+MATERIALISE_EXT_PREDICATE(xtheadmac)
+MATERIALISE_EXT_PREDICATE(xtheadmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadmempair)
+MATERIALISE_EXT_PREDICATE(xtheadsync)
 MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
 
 #endif
diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xthead.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Disassembler for xthead.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xthead.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    /* XTheadBa */
+    rv_op_th_addsl = 1,
+    /* XTheadBb */
+    rv_op_th_srri,
+    rv_op_th_srriw,
+    rv_op_th_ext,
+    rv_op_th_extu,
+    rv_op_th_ff0,
+    rv_op_th_ff1,
+    rv_op_th_rev,
+    rv_op_th_revw,
+    rv_op_th_tstnbz,
+    /* XTheadBs */
+    rv_op_th_tst,
+    /* XTheadCmo */
+    rv_op_th_dcache_call,
+    rv_op_th_dcache_ciall,
+    rv_op_th_dcache_iall,
+    rv_op_th_dcache_cpa,
+    rv_op_th_dcache_cipa,
+    rv_op_th_dcache_ipa,
+    rv_op_th_dcache_cva,
+    rv_op_th_dcache_civa,
+    rv_op_th_dcache_iva,
+    rv_op_th_dcache_csw,
+    rv_op_th_dcache_cisw,
+    rv_op_th_dcache_isw,
+    rv_op_th_dcache_cpal1,
+    rv_op_th_dcache_cval1,
+    rv_op_th_icache_iall,
+    rv_op_th_icache_ialls,
+    rv_op_th_icache_ipa,
+    rv_op_th_icache_iva,
+    rv_op_th_l2cache_call,
+    rv_op_th_l2cache_ciall,
+    rv_op_th_l2cache_iall,
+    /* XTheadCondMov */
+    rv_op_th_mveqz,
+    rv_op_th_mvnez,
+    /* XTheadFMemIdx */
+    rv_op_th_flrd,
+    rv_op_th_flrw,
+    rv_op_th_flurd,
+    rv_op_th_flurw,
+    rv_op_th_fsrd,
+    rv_op_th_fsrw,
+    rv_op_th_fsurd,
+    rv_op_th_fsurw,
+    /* XTheadFmv */
+    rv_op_th_fmv_hw_x,
+    rv_op_th_fmv_x_hw,
+    /* XTheadMac */
+    rv_op_th_mula,
+    rv_op_th_mulah,
+    rv_op_th_mulaw,
+    rv_op_th_muls,
+    rv_op_th_mulsw,
+    rv_op_th_mulsh,
+    /* XTheadMemIdx */
+    rv_op_th_lbia,
+    rv_op_th_lbib,
+    rv_op_th_lbuia,
+    rv_op_th_lbuib,
+    rv_op_th_lhia,
+    rv_op_th_lhib,
+    rv_op_th_lhuia,
+    rv_op_th_lhuib,
+    rv_op_th_lwia,
+    rv_op_th_lwib,
+    rv_op_th_lwuia,
+    rv_op_th_lwuib,
+    rv_op_th_ldia,
+    rv_op_th_ldib,
+    rv_op_th_sbia,
+    rv_op_th_sbib,
+    rv_op_th_shia,
+    rv_op_th_shib,
+    rv_op_th_swia,
+    rv_op_th_swib,
+    rv_op_th_sdia,
+    rv_op_th_sdib,
+    rv_op_th_lrb,
+    rv_op_th_lrbu,
+    rv_op_th_lrh,
+    rv_op_th_lrhu,
+    rv_op_th_lrw,
+    rv_op_th_lrwu,
+    rv_op_th_lrd,
+    rv_op_th_srb,
+    rv_op_th_srh,
+    rv_op_th_srw,
+    rv_op_th_srd,
+    rv_op_th_lurb,
+    rv_op_th_lurbu,
+    rv_op_th_lurh,
+    rv_op_th_lurhu,
+    rv_op_th_lurw,
+    rv_op_th_lurwu,
+    rv_op_th_lurd,
+    rv_op_th_surb,
+    rv_op_th_surh,
+    rv_op_th_surw,
+    rv_op_th_surd,
+    /* XTheadMemPair */
+    rv_op_th_ldd,
+    rv_op_th_lwd,
+    rv_op_th_lwud,
+    rv_op_th_sdd,
+    rv_op_th_swd,
+    /* XTheadSync */
+    rv_op_th_sfence_vmas,
+    rv_op_th_sync,
+    rv_op_th_sync_i,
+    rv_op_th_sync_is,
+    rv_op_th_sync_s,
+} rv_xthead_op;
+
+const rv_opcode_data xthead_opcode_data[] = {
+    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadBa */
+    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadBb */
+    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    /* XTheadBs */
+    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    /* XTheadCmo */
+    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadCondMov */
+    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadFMemIdx */
+    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadFmv */
+    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    /* XTheadMac */
+    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadMemIdx */
+    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadMemPair */
+    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    /* XTheadSync */
+    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+};
+
+void decode_xtheadba(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000000:
+                case 0b0000001:
+                case 0b0000010:
+                case 0b0000011: op = rv_op_th_addsl; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbb(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0001010: op = rv_op_th_srriw; break;
+                case 0b1000000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_tstnbz;
+                    }
+                    break;
+                case 0b1000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_rev;
+                    }
+                    break;
+                case 0b1000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff0;
+                    }
+                    break;
+                case 0b1000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff1;
+                    }
+                    break;
+                case 0b1000100:
+                case 0b1001000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_revw;
+                    }
+                    break;
+                case 0b0000100:
+                case 0b0000101: op = rv_op_th_srri; break;
+                }
+                break;
+            case 2: op = rv_op_th_ext; break;
+            case 3: op = rv_op_th_extu; break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbs(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 26) & 0b111111) {
+                case 0b100010: op = rv_op_th_tst; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 20 & 0b111111111111)) {
+                case 0b000000000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_call;
+                    }
+                    break;
+                case 0b000000000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_ciall;
+                    }
+                    break;
+                case 0b000000000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_iall;
+                    }
+                    break;
+                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
+                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
+                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
+                case 0b000000100101: op = rv_op_th_dcache_cva; break;
+                case 0b000000100111: op = rv_op_th_dcache_civa; break;
+                case 0b000000100110: op = rv_op_th_dcache_iva; break;
+                case 0b000000100001: op = rv_op_th_dcache_csw; break;
+                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
+                case 0b000000100010: op = rv_op_th_dcache_isw; break;
+                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
+                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
+                case 0b000000010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_iall;
+                    }
+                    break;
+                case 0b000000010001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_ialls;
+                    }
+                    break;
+                case 0b000000111000: op = rv_op_th_icache_ipa; break;
+                case 0b000000110000: op = rv_op_th_icache_iva; break;
+                case 0b000000010101:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_call;
+                    }
+                    break;
+                case 0b000000010111:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_ciall;
+                    }
+                    break;
+                case 0b000000010110:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_iall;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0100000: op = rv_op_th_mveqz; break;
+                case 0b0100001: op = rv_op_th_mvnez; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 6:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_flrw; break;
+                case 10: op = rv_op_th_flurw; break;
+                case 12: op = rv_op_th_flrd; break;
+                case 14: op = rv_op_th_flurd; break;
+                }
+                break;
+            case 7:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_fsrw; break;
+                case 10: op = rv_op_th_fsurw; break;
+                case 12: op = rv_op_th_fsrd; break;
+                case 14: op = rv_op_th_fsurd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b1010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_hw_x;
+                    }
+                    break;
+                case 0b1100000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_x_hw;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmac(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0010000: op = rv_op_th_mula; break;
+                case 0b0010001: op = rv_op_th_muls; break;
+                case 0b0010010: op = rv_op_th_mulaw; break;
+                case 0b0010011: op = rv_op_th_mulsw; break;
+                case 0b0010100: op = rv_op_th_mulah; break;
+                case 0b0010101: op = rv_op_th_mulsh; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_lrb; break;
+                case 1: op = rv_op_th_lbib; break;
+                case 2: op = rv_op_th_lurb; break;
+                case 3: op = rv_op_th_lbia; break;
+                case 4: op = rv_op_th_lrh; break;
+                case 5: op = rv_op_th_lhib; break;
+                case 6: op = rv_op_th_lurh; break;
+                case 7: op = rv_op_th_lhia; break;
+                case 8: op = rv_op_th_lrw; break;
+                case 9: op = rv_op_th_lwib; break;
+                case 10: op = rv_op_th_lurw; break;
+                case 11: op = rv_op_th_lwia; break;
+                case 12: op = rv_op_th_lrd; break;
+                case 13: op = rv_op_th_ldib; break;
+                case 14: op = rv_op_th_lurd; break;
+                case 15: op = rv_op_th_ldia; break;
+                case 16: op = rv_op_th_lrbu; break;
+                case 17: op = rv_op_th_lbuib; break;
+                case 18: op = rv_op_th_lurbu; break;
+                case 19: op = rv_op_th_lbuia; break;
+                case 20: op = rv_op_th_lrhu; break;
+                case 21: op = rv_op_th_lhuib; break;
+                case 22: op = rv_op_th_lurhu; break;
+                case 23: op = rv_op_th_lhuia; break;
+                case 24: op = rv_op_th_lrwu; break;
+                case 25: op = rv_op_th_lwuib; break;
+                case 26: op = rv_op_th_lurwu; break;
+                case 27: op = rv_op_th_lwuia; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_srb; break;
+                case 1: op = rv_op_th_sbib; break;
+                case 2: op = rv_op_th_surb; break;
+                case 3: op = rv_op_th_sbia; break;
+                case 4: op = rv_op_th_srh; break;
+                case 5: op = rv_op_th_shib; break;
+                case 6: op = rv_op_th_surh; break;
+                case 7: op = rv_op_th_shia; break;
+                case 8: op = rv_op_th_srw; break;
+                case 9: op = rv_op_th_swib; break;
+                case 10: op = rv_op_th_surw; break;
+                case 11: op = rv_op_th_swia; break;
+                case 12: op = rv_op_th_srd; break;
+                case 13: op = rv_op_th_sdib; break;
+                case 14: op = rv_op_th_surd; break;
+                case 15: op = rv_op_th_sdia; break;
+                }
+                break;
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_lwd; break;
+                case 30: op = rv_op_th_lwud; break;
+                case 31: op = rv_op_th_ldd; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_swd; break;
+                case 31: op = rv_op_th_sdd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadsync(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000010: op = rv_op_th_sfence_vmas; break;
+                case 0b0000000:
+                    switch ((inst >> 20) & 0b11111) {
+                    case 0b11000: op = rv_op_th_sync; break;
+                    case 0b11010: op = rv_op_th_sync_i; break;
+                    case 0b11011: op = rv_op_th_sync_is; break;
+                    case 0b11001: op = rv_op_th_sync_s; break;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
 /* Vendor extensions */
+#include "disas/riscv-xthead.h"
 #include "disas/riscv-xventana.h"
 
 typedef enum {
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
     return ((inst << 56) >> 60);
 }
 
+static uint32_t operand_imm6(rv_inst inst)
+{
+    return (inst << 38) >> 60;
+}
+
+static uint32_t operand_imm2(rv_inst inst)
+{
+    return (inst << 37) >> 62;
+}
+
+static uint32_t operand_immh(rv_inst inst)
+{
+    return (inst << 32) >> 58;
+}
+
+static uint32_t operand_imml(rv_inst inst)
+{
+    return (inst << 38) >> 58;
+}
+
 static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
 {
     int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
         break;
+    case rv_codec_r2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_rs2(inst);
+        break;
+    case rv_codec_r2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        break;
+    case rv_codec_r2_imm6:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_imm6(inst);
+        break;
+    case rv_codec_r_imm2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->rs2 = operand_rs2(inst);
+        dec->imm = operand_imm2(inst);
+        break;
+    case rv_codec_r2_immhl:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_immh(inst);
+        dec->imm1 = operand_imml(inst);
+        break;
+    case rv_codec_r2_imm2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = sextract32(operand_rs2(inst), 0, 5);
+        dec->imm1 = operand_imm2(inst);
+        break;
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
             append(buf, tmp, buflen);
             break;
+        case 'j':
+            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
+            append(buf, tmp, buflen);
+            break;
         case 'o':
             snprintf(tmp, sizeof(tmp), "%d", dec->imm);
             append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
+        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
+        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
+        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
+        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
+        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
+        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
+        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
+        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
+        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
+        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
         { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
diff --git a/disas/meson.build b/disas/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
 common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
     'riscv.c',
+    'riscv-xthead.c',
     'riscv-xventana.c'
 ))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
when MPP=PRV_M.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 3 ++-
 target/riscv/op_helper.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 
         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
-            virt = get_field(env->mstatus, MSTATUS_MPV);
+            virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                   (mode != PRV_M);
             if (virt) {
                 status = env->vsstatus;
             }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
 
-    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
+    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                             (prev_priv != PRV_M);
     mstatus = set_field(mstatus, MSTATUS_MIE,
                         get_field(mstatus, MSTATUS_MPIE));
     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

MPV and GVA bits are added by hypervisor extension to mstatus
and mstatush (if MXLEN=32).

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     }
 
     if (xl != MXL_RV32 || env->debugger) {
-        /*
-         * RV32: MPV and GVA are not in mstatus. The current plan is to
-         * add them to mstatush. For now, we just don't support it.
-         */
-        mask |= MSTATUS_MPV | MSTATUS_GVA;
+        if (riscv_has_ext(env, RVH)) {
+            mask |= MSTATUS_MPV | MSTATUS_GVA;
+        }
         if ((val & MSTATUS64_UXL) != 0) {
             mask |= MSTATUS64_UXL;
         }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t valh = (uint64_t)val << 32;
-    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
+    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
 
     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

SXL is initialized as env->misa_mxl which is also the mxl value.
So we can just remain it unchanged to keep it read-only.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 
     mstatus = (mstatus & ~mask) | (val & mask);
 
-    if (xl > MXL_RV32) {
-        /* SXL field is for now read only */
-        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
-    }
     env->mstatus = mstatus;
 
     /*
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
and ext_icsr from riscv_cpu_init(), the init() function of
TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
CPUs to explictly enable all extensions and features it requires,
without any 'magic values' that were inherited by the parent type.

This commit failed to make appropriate changes in the 'veyron-v1' CPU,
added earlier by commit e1d084a8524a. The result is that the veyron-v1
CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
case.

The reason why it took this long to notice (thanks LIU Zhiwei for
reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
absent in the 'riscv,isa' DT, implying that they're both present if the
'i' extension is enabled. OpenSBI also doesn't error out or warns about
the lack of 'pmp', it'll just not protect memory pages.

Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
7f0bdfb5bfc2 already did with other CPUs.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
 
     /* Enable ISA extensions */
     cpu->cfg.mmu = true;
+    cpu->cfg.ext_ifencei = true;
+    cpu->cfg.ext_icsr = true;
+    cpu->cfg.pmp = true;
     cpu->cfg.ext_icbom = true;
     cpu->cfg.cbom_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

As specified in privilege spec:"When MPRV=1, load and store memory
addresses are treated as though the current XLEN were set to MPP’s
XLEN". So the xlen for address may be different from current xlen.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
 target/riscv/cpu_helper.c |  1 +
 target/riscv/translate.c  | 13 ++++++++++-
 3 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 FIELD(TB_FLAGS, PRIV, 24, 2)
+FIELD(TB_FLAGS, AXL, 26, 2)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
@@ -XXX,XX +XXX,XX @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
     return &env_archcpu(env)->cfg;
 }
 
-#if defined(TARGET_RISCV32)
-#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
-#else
-static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+#if !defined(CONFIG_USER_ONLY)
+static inline int cpu_address_mode(CPURISCVState *env)
+{
+    int mode = env->priv;
+
+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+    }
+    return mode;
+}
+
+static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
 {
     RISCVMXL xl = env->misa_mxl;
-#if !defined(CONFIG_USER_ONLY)
     /*
      * When emulating a 32-bit-only cpu, use RV32.
      * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
      * back to RV64 for lower privs.
      */
     if (xl != MXL_RV32) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             break;
         case PRV_U:
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
             break;
         }
     }
-#endif
     return xl;
 }
 #endif
 
+#if defined(TARGET_RISCV32)
+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    return cpu_get_xl(env, env->priv);
+#else
+    return env->misa_mxl;
+#endif
+}
+#endif
+
+#if defined(TARGET_RISCV32)
+#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
+{
+#ifdef CONFIG_USER_ONLY
+    return env->xl;
+#else
+    int mode = cpu_address_mode(env);
+
+    return cpu_get_xl(env, mode);
+#endif
+}
+#endif
+
 static inline int riscv_cpu_xlen(CPURISCVState *env)
 {
     return 16 << env->xl;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
     if (env->cur_pmmask != 0) {
         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     target_ulong priv_ver;
     RISCVMXL misa_mxl_max;
     RISCVMXL xl;
+    RISCVMXL address_xl;
     uint32_t misa_ext;
     uint32_t opcode;
     RISCVExtStatus mstatus_fs;
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 #define get_xl(ctx)    ((ctx)->xl)
 #endif
 
+#ifdef TARGET_RISCV32
+#define get_address_xl(ctx)    MXL_RV32
+#elif defined(CONFIG_USER_ONLY)
+#define get_address_xl(ctx)    MXL_RV64
+#else
+#define get_address_xl(ctx)    ((ctx)->address_xl)
+#endif
+
 /* The word size for this machine mode. */
 static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
 {
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     tcg_gen_addi_tl(addr, src1, imm);
     if (ctx->pm_mask_enabled) {
         tcg_gen_andc_tl(addr, addr, pm_mask);
-    } else if (get_xl(ctx) == MXL_RV32) {
+    } else if (get_address_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
     if (ctx->pm_base_enabled) {
         tcg_gen_or_tl(addr, addr, pm_base);
     }
+
     return addr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
     ctx->misa_mxl_max = env->misa_mxl_max;
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
+    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
should also take MPRV into consideration. As pointer mask for instruction
is not supported currently, so we can directly update cur_pmbase/pmmask
based on address related mode and xlen affected by MPRV now.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  7 +++++--
 target/riscv/csr.c        | 27 ++++++++++++++++++++-------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env)
 {
     target_ulong mask = 0, base = 0;
+    RISCVMXL xl = env->xl;
     /*
      * TODO: Current RVJ spec does not specify
      * how the extension interacts with XLEN.
      */
 #ifndef CONFIG_USER_ONLY
+    int mode = cpu_address_mode(env);
+    xl = cpu_get_xl(env, mode);
     if (riscv_has_ext(env, RVJ)) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             if (env->mmte & M_PM_ENABLE) {
                 mask = env->mpmmask;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_update_mask(CPURISCVState *env)
         }
     }
 #endif
-    if (env->xl == MXL_RV32) {
+    if (xl == MXL_RV32) {
         env->cur_pmmask = mask & UINT32_MAX;
         env->cur_pmbase = base & UINT32_MAX;
     } else {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
      */
     if (env->debugger) {
         env->xl = cpu_recompute_xl(env);
-        riscv_cpu_update_mask(env);
     }
+
+    riscv_cpu_update_mask(env);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmmask = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmmask = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmmask = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmbase = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmbase = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmbase = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
-- 
2.40.1

From: Bin Meng <bmeng@tinylab.org>

Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.

The v1.3 release includes the following commits:

440fa81 treewide: Replace TRUE/FALSE with true/false
6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
65638f8 lib: utils/sys: Allow custom HTIF base address for RV32
f14595a lib: sbi: Allow platform to influence cold boot HART selection
6957ae0 platform: generic: Allow platform_override to select cold boot HART
cb7e7c3 platform: generic: Allow platform_override to perform firmware init
8020df8 generic/starfive: Add Starfive JH7110 platform implementation
6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
9e397e3 docs: domain_support: Use capital letter for privilege modes
9e0ba09 include: sbi: Fine grain the permissions for M and SU modes
aace1e1 lib: sbi: Use finer permission semantics for address validation
22dbdb3 lib: sbi: Add permissions for the firmware start till end
1ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
44f736c lib: sbi: Modify the boot time region flag prints
20646e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
3e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
59a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
001106d docs: Update domain's region permissions and requirements
da5594b platform: generic: allwinner: Fix PLIC array bounds
ce2a834 docs: generic.md: fix typo of andes-ae350
8ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
b1818ee include: types: add always inline compiler attribute
9c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
787296a platform: andes/ae350: Implement hart hotplug using HSM extension
7aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
a990309 lib: utils: Fix reserved memory node for firmware memory
fefa548 firmware: Split RO/RX and RW sections
2f40a99 firmware: Move dynsym and reladyn sections to RX section
c10e3fe firmware: Add RW section offset in scratch
b666760 lib: sbi: Print the RW section offset
230278d lib: sbi: Add separate entries for firmware RX and RW regions
dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
33bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
c45992c platform: generic: allwinner: Advertise nonretentive suspend
c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
8050081 firmware: Not to clear all the MIP
84d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
199189b lib: utils: Mark only the largest region as reserved in FDT
66b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
642f3de Makefile: Add missing .dep files for fw_*.elf.ld
09b34d8 include: Add support for byteorder/endianness conversion
680bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
b224ddb include: types: Add typedefs for endianness
aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
e3bf1af include: Add defines for SBI debug console extension
0ee3a86 lib: sbi: Add sbi_nputs() function
4e0572f lib: sbi: Add sbi_ngets() function
eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
5a41a38 lib: sbi: Implement SBI debug console extension
c43903c lib: sbi: Add console_puts() callback in the console device
29285ae lib: utils/serial: Implement console_puts() for semihosting
65c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
321293c lib: utils/fdt: Fix fdt_pmu.c header dependency
aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
745aaec platform: generic/andes: Fix ae350.c header dependency
99d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
6861ee9 lib: utils: fdt_fixup: Fix compile error
4f2be40 docs: fix typo in fw.md
30ea806 lib: sbi_hart: Enable hcontext and scontext
81adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
31b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
2491242 platform: generic: renesas: rzfive: Configure the PMA region
67b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
5a75f53 lib: sbi/sbi_domain: cosmetic style fixes
bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
17b3776 docs: domain_support: Update the DT example
1364d5a lib: sbi_hsm: Factor out invalid state detection
40f16a8 lib: sbi_hsm: Don't try to restore state on failed change
c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
b1ae6ef lib: sbi_hsm: Move misplaced comment
07673fc lib: sbi_hsm: Remove unnecessary include
8a40306 lib: sbi_hsm: Export some functions
73623a0 lib: sbi: Add system suspend skeleton
c9917b6 lib: sbi: Add system_suspend_allowed domain property
7c964e2 lib: sbi: Implement system suspend
37558dc docs: Correct opensbi-domain property name
5ccebf0 platform: generic: Add system suspend test
908be1b gpio/starfive: add gpio driver and support gpio reset
4b28afc make: Add a command line option for debugging OpenSBI
e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
568ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
506144f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
1fe8dc9 lib: sbi_pmu: add callback for counter width
51951d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
60c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
548e4b4 lib: sbi_pmu: Rename fw_counter_value
b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
641d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
57d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
73ab11d lib: sbi: Fix how to check whether the domain contains fw_region
f64dfcd lib: sbi: Introduce sbi_entry_count() function
30b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
8e90259 lib: sbi_hart: clear mip csr during hart init
45ba2b2 include: Add defines for SBI CPPC extension
33caae8 lib: sbi: Implement SBI CPPC extension
91767d0 lib: sbi: Print the CPPC device name
edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
2868f26 lib: utils: fdt_fixup: avoid buffer overrun
66fa925 lib: sbi: Optimize sbi_tlb
24dde46 lib: sbi: Optimize sbi_ipi
80078ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
f692289 firmware: Optimize loading relocation type
e41dbb5 firmware: Change to use positive offset to access relocation entries
bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
674e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
7919530 lib: sbi: Add debug print when sbi_pmu_init fails
4e33530 lib: sbi: Remove unnecessary semicolon
6bc02de lib: sbi: Simplify sbi_ipi_process remove goto
dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
f58c140 lib: sbi: Introduce register_extensions extension callback
e307ba7 lib: sbi: Narrow vendor extension range
042f0c3 lib: sbi: pmu: Remove unnecessary probe function
8b952d4 lib: sbi: Only register available extensions
767b5fc lib: sbi: Optimize probe of srst/susp
c3e31cb lib: sbi: Remove 0/1 probe implementations
33f1722 lib: sbi: Document sbi_ecall_extension members
d4c46e0 Makefile: Dereference symlinks on install
8b99a7f lib: sbi: Fix return of sbi_console_init
264d0be lib: utils: Improve fdt_serial_init
9a0bdd0 lib: utils: Improve fdt_ipi
122f226 lib: utils: Improve fdt_timer
df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
bdde2ec lib: sbi: Align system suspend errors with spec
aad7a37 include: sbi_scratch: Add helper macros to access data type
5cf9a54 platform: Allow platforms to specify heap size
40d36a6 lib: sbi: Introduce simple heap allocator
2a04f70 lib: sbi: Print scratch size and usage at boot time
bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
ef4542d lib: sbi: Use heap for root domain creation
66daafe lib: sbi: Use scratch space to save per-HART domain pointer
fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
903e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
5a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
7e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
3c1c972 lib: utils/fdt: Use heap in FDT domain parsing
acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
1df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
355796c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
524feec docs: Add OpenSBI logo and use it in the top-level README.md
932be2c README.md: Improve project copyright information
8153b26 platform/lib: Set no-map attribute on all PMP regions
d64942f firmware: Fix find hart index
27c957a lib: reset: Move fdt_reset_init into generic_early_init
8bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
2552799 include: Bump-up version to 1.3

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index XXXXXXX..XXXXXXX 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
+Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
-- 
2.40.1

From: Bin Meng <bmeng@tinylab.org>

The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
Let's enable the 32-bit Spike OpenSBI boot testing.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/avocado/riscv_opensbi.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/riscv_opensbi.py
+++ b/tests/avocado/riscv_opensbi.py
@@ -XXX,XX +XXX,XX @@
 # later.  See the COPYING file in the top-level directory.
 
 from avocado_qemu import QemuSystemTest
-from avocado import skip
 from avocado_qemu import wait_for_console_pattern
 
 class RiscvOpenSBI(QemuSystemTest):
@@ -XXX,XX +XXX,XX @@ def boot_opensbi(self):
         wait_for_console_pattern(self, 'Platform Name')
         wait_for_console_pattern(self, 'Boot HART MEDELEG')
 
-    @skip("requires OpenSBI fix to work")
     def test_riscv32_spike(self):
         """
         :avocado: tags=arch:riscv32
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

The watchdog timer is in the always-on domain device of HiFive 1 rev b,
so this patch added the AON device to the sifive_e machine. This patch
only implemented the functionality of the watchdog timer.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/misc/sifive_e_aon.h |  60 +++++++
 hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
 hw/misc/Kconfig                |   3 +
 hw/misc/meson.build            |   1 +
 4 files changed, 383 insertions(+)
 create mode 100644 include/hw/misc/sifive_e_aon.h
 create mode 100644 hw/misc/sifive_e_aon.c

diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/sifive_e_aon.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) interface.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_SIFIVE_AON_H
+#define HW_SIFIVE_AON_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
+OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+enum {
+    SIFIVE_E_AON_WDT    = 0x0,
+    SIFIVE_E_AON_RTC    = 0x40,
+    SIFIVE_E_AON_LFROSC = 0x70,
+    SIFIVE_E_AON_BACKUP = 0x80,
+    SIFIVE_E_AON_PMU    = 0x100,
+    SIFIVE_E_AON_MAX    = 0x150
+};
+
+struct SiFiveEAONState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion mmio;
+
+    /*< watchdog timer >*/
+    QEMUTimer *wdog_timer;
+    qemu_irq wdog_irq;
+    uint64_t wdog_restart_time;
+    uint64_t wdogclk_freq;
+
+    uint32_t wdogcfg;
+    uint16_t wdogcmp0;
+    uint32_t wdogcount;
+    uint8_t wdogunlock;
+};
+
+#endif
diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/sifive_e_aon.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) for QEMU.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "sysemu/watchdog.h"
+#include "hw/qdev-properties.h"
+
+REG32(AON_WDT_WDOGCFG, 0x0)
+    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+REG32(AON_WDT_WDOGCOUNT, 0x8)
+    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
+REG32(AON_WDT_WDOGS, 0x10)
+REG32(AON_WDT_WDOGFEED, 0x18)
+REG32(AON_WDT_WDOGKEY, 0x1c)
+REG32(AON_WDT_WDOGCMP0, 0x20)
+
+static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
+{
+    int64_t now;
+    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
+        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
+        return;
+    }
+
+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    r->wdogcount += muldiv64(now - r->wdog_restart_time,
+                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
+
+    /* Clean the most significant bit. */
+    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+    r->wdog_restart_time = now;
+}
+
+static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
+{
+    uint16_t wdogs;
+    bool cmp_signal = false;
+    sifive_e_aon_wdt_update_wdogcount(r);
+    wdogs = (uint16_t)(r->wdogcount >>
+                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
+
+    if (wdogs >= r->wdogcmp0) {
+        cmp_signal = true;
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
+            r->wdogcount = 0;
+            wdogs = 0;
+        }
+    }
+
+    if (cmp_signal) {
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
+            watchdog_perform_action();
+        }
+        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
+    }
+
+    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
+
+    if (wdogs < r->wdogcmp0 &&
+        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
+         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
+        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        next += muldiv64((r->wdogcmp0 - wdogs) <<
+                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
+                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
+        timer_mod(r->wdog_timer, next);
+    } else {
+        timer_mod(r->wdog_timer, INT64_MAX);
+    }
+}
+
+/*
+ * Callback used when the timer set using timer_mod expires.
+ */
+static void sifive_e_aon_wdt_expired_cb(void *opaque)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG:
+        return r->wdogcfg;
+    case A_AON_WDT_WDOGCOUNT:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount;
+    case A_AON_WDT_WDOGS:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount >>
+               FIELD_EX32(r->wdogcfg,
+                          AON_WDT_WDOGCFG,
+                          SCALE);
+    case A_AON_WDT_WDOGFEED:
+        return 0;
+    case A_AON_WDT_WDOGKEY:
+        return r->wdogunlock;
+    case A_AON_WDT_WDOGCMP0:
+        return r->wdogcmp0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+
+    return 0;
+}
+
+static void
+sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    uint32_t value = val64;
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG: {
+        uint8_t new_en_always;
+        uint8_t new_en_core_awake;
+        uint8_t old_en_always;
+        uint8_t old_en_core_awake;
+        if (r->wdogunlock == 0) {
+            return;
+        }
+
+        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
+        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
+        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
+        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
+                                       EN_CORE_AWAKE);
+
+        if ((old_en_always ||
+             old_en_core_awake) == 1 &&
+            (new_en_always ||
+             new_en_core_awake) == 0) {
+            sifive_e_aon_wdt_update_wdogcount(r);
+        } else if ((old_en_always ||
+                    old_en_core_awake) == 0 &&
+                   (new_en_always ||
+                    new_en_core_awake) == 1) {
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogcfg = value;
+        r->wdogunlock = 0;
+        break;
+    }
+    case A_AON_WDT_WDOGCOUNT:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGS:
+        return;
+    case A_AON_WDT_WDOGFEED:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        if (value == SIFIVE_E_AON_WDOGFEED) {
+            r->wdogcount = 0;
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGKEY:
+        if (value == SIFIVE_E_AON_WDOGKEY) {
+            r->wdogunlock = 1;
+        }
+        break;
+    case A_AON_WDT_WDOGCMP0:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcmp0 = (uint16_t) value;
+        r->wdogunlock = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
+                      __func__, (int)addr, (int)value);
+    }
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        return sifive_e_aon_wdt_read(opaque, addr, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+    return 0;
+}
+
+static void
+sifive_e_aon_write(void *opaque, hwaddr addr,
+                   uint64_t val64, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        sifive_e_aon_wdt_write(opaque, addr, val64, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+}
+
+static const MemoryRegionOps sifive_e_aon_ops = {
+    .read = sifive_e_aon_read,
+    .write = sifive_e_aon_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static void sifive_e_aon_reset(DeviceState *dev)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(dev);
+
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
+    r->wdogcmp0 = 0xbeef;
+
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static void sifive_e_aon_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    SiFiveEAONState *r = SIFIVE_E_AON(obj);
+
+    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
+                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
+    sysbus_init_mmio(sbd, &r->mmio);
+
+    /* watchdog timer */
+    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                 sifive_e_aon_wdt_expired_cb, r);
+    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
+    sysbus_init_irq(sbd, &r->wdog_irq);
+}
+
+static Property sifive_e_aon_properties[] = {
+    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
+                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->reset = sifive_e_aon_reset;
+    device_class_set_props(dc, sifive_e_aon_properties);
+}
+
+static const TypeInfo sifive_e_aon_info = {
+    .name          = TYPE_SIFIVE_E_AON,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SiFiveEAONState),
+    .instance_init = sifive_e_aon_init,
+    .class_init    = sifive_e_aon_class_init,
+};
+
+static void sifive_e_aon_register_types(void)
+{
+    type_register_static(&sifive_e_aon_info);
+}
+
+type_init(sifive_e_aon_register_types)
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_TEST
 config SIFIVE_E_PRCI
     bool
 
+config SIFIVE_E_AON
+    bool
+
 config SIFIVE_U_OTP
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
 system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

Create the AON device when we realize the sifive_e machine.
This patch only implemented the functionality of the watchdog timer,
not all the functionality of the AON device.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_e.h |  9 ++++++---
 hw/riscv/sifive_e.c         | 17 +++++++++++++++--
 hw/riscv/Kconfig            |  1 +
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/gpio/sifive_gpio.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "hw/boards.h"
 
 #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
     /*< public >*/
     RISCVHartArrayState cpus;
     DeviceState *plic;
+    SiFiveEAONState aon;
     SIFIVEGPIOState gpio;
     MemoryRegion xip_mem;
     MemoryRegion mask_rom;
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 enum {
-    SIFIVE_E_UART0_IRQ  = 3,
-    SIFIVE_E_UART1_IRQ  = 4,
-    SIFIVE_E_GPIO0_IRQ0 = 8
+    SIFIVE_E_AON_WDT_IRQ  = 1,
+    SIFIVE_E_UART0_IRQ    = 3,
+    SIFIVE_E_UART1_IRQ    = 4,
+    SIFIVE_E_GPIO0_IRQ0   = 8
 };
 
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "chardev/char.h"
 #include "sysemu/sysemu.h"
 
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
                             TYPE_SIFIVE_GPIO);
+    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
+                            TYPE_SIFIVE_E_AON);
 }
 
 static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
-    create_unimplemented_device("riscv.sifive.e.aon",
-        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
 
+    /* AON */
+
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
+        return;
+    }
+
+    /* Map AON registers */
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
+
     /* GPIO */
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
                            qdev_get_gpio_in(DEVICE(s->plic),
                                             SIFIVE_E_GPIO0_IRQ0 + i));
     }
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
+                       qdev_get_gpio_in(DEVICE(s->plic),
+                                        SIFIVE_E_AON_WDT_IRQ));
 
     sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     select SIFIVE_PLIC
     select SIFIVE_UART
     select SIFIVE_E_PRCI
+    select SIFIVE_E_AON
     select UNIMP
 
 config SIFIVE_U
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

Add some simple tests of the watchdog timer in the always-on domain device
of HiFive 1 rev b.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
 tests/qtest/meson.build                  |   3 +
 2 files changed, 453 insertions(+)
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c

diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/sifive-e-aon-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the watchdog timer of HiFive 1 rev b.
+ *
+ * Copyright (c) 2023 SiFive, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/bitops.h"
+#include "libqtest.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+
+FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+
+#define WDOG_BASE (0x10000000)
+#define WDOGCFG (0x0)
+#define WDOGCOUNT (0x8)
+#define WDOGS (0x10)
+#define WDOGFEED (0x18)
+#define WDOGKEY (0x1c)
+#define WDOGCMP0 (0x20)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+static void test_init(QTestState *qts)
+{
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+}
+
+static void test_wdogcount(void)
+{
+    uint64_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcfg(void)
+{
+    uint32_t tmp_cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcmp0(void)
+{
+    uint32_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogkey(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogfeed(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_wdogs(void)
+{
+    uint32_t cfg;
+    uint32_t fake_count = 0x12345678;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
+    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             (uint16_t)fake_count);
+
+    for (int i = 0; i < 16; i++) {
+        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
+        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+                 (uint16_t)(fake_count >>
+                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
+    }
+
+    qtest_quit(qts);
+}
+
+static void test_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_periodic_int(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_enable_disable(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char *argv[])
+{
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
+                   test_wdogcount);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
+                   test_wdogcfg);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
+                   test_wdogcmp0);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
+                   test_wdogkey);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
+                   test_wdogfeed);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
+                   test_scaled_wdogs);
+    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
+                   test_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
+                   test_scaled_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
+                   test_periodic_int);
+    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
+                   test_enable_disable);
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_s390x = \
    'cpu-plug-test',
    'migration-test']
 
+qtests_riscv32 = \
+  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
+
 qos_test_ss = ss.source_set()
 qos_test_ss.add(
   'ac97-test.c',
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

We want to keep the ability to distinct between 32/64-bit host.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-2-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
 
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
 supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
-supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
+supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
   'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
 
 cpu = host_machine.cpu_family()
 
-# Unify riscv* to a single family.
-if cpu in ['riscv32', 'riscv64']
-  cpu = 'riscv'
-endif
-
 target_dirs = config_host['TARGET_DIRS'].split()
 have_linux_user = false
 have_bsd_user = false
@@ -XXX,XX +XXX,XX @@ elif cpu == 'x86'
   host_arch = 'i386'
 elif cpu == 'mips64'
   host_arch = 'mips'
+elif cpu in ['riscv32', 'riscv64']
+  host_arch = 'riscv'
 else
   host_arch = cpu
 endif
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv']
+elif cpu in ['riscv32', 'riscv64']
   kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
 else
   kvm_targets = []
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Per Anup Patel in [*]:

> Currently, we only support running rv64 guest on rv64 host
 > and rv32 guest on rv32 host.
 >
 > In the future, we might support running rv32 guest on rv64
 > host but as of now we don't see a strong push for it.

Therefore, when only using the KVM accelerator it is pointless
to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
on a rv32 host). Restrict meson to only build the correct binary,
avoiding to waste ressources building unusable code.

[*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv32', 'riscv64']
-  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
+elif cpu in ['riscv32']
+  kvm_targets = ['riscv32-softmmu']
+elif cpu in ['riscv64']
+  kvm_targets = ['riscv64-softmmu']
 else
   kvm_targets = []
 endif
-- 
2.40.1

From: Ivan Klokov <ivan.klokov@syntacore.com>

Print RvV extension register to log if VPU option is enabled.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
+/*
+ * From vector_helper.c
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing bytes needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define BYTE(x)   ((x) ^ 7)
+#else
+#define BYTE(x)   (x)
+#endif
+
 /*
  * Here are the ordering rules of extension naming defined by RISC-V
  * specification :
@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
     "f30/ft10", "f31/ft11"
 };
 
+const char * const riscv_rvv_regnames[] = {
+  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
+  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
+  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
+  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
+  "v28", "v29", "v30", "v31"
+};
+
 static const char * const riscv_excp_names[] = {
     "misaligned_fetch",
     "fault_fetch",
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    int i;
+    int i, j;
+    uint8_t *p;
 
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVH)) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             }
         }
     }
+    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
+        static const int dump_rvv_csrs[] = {
+                    CSR_VSTART,
+                    CSR_VXSAT,
+                    CSR_VXRM,
+                    CSR_VCSR,
+                    CSR_VL,
+                    CSR_VTYPE,
+                    CSR_VLENB,
+                };
+        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
+            int csrno = dump_rvv_csrs[i];
+            target_ulong val = 0;
+            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
+
+            /*
+             * Rely on the smode, hmode, etc, predicates within csr.c
+             * to do the filtering of the registers that are present.
+             */
+            if (res == RISCV_EXCP_NONE) {
+                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
+                             csr_ops[csrno].name, val);
+            }
+        }
+        uint16_t vlenb = cpu->cfg.vlen >> 3;
+
+        for (i = 0; i < 32; i++) {
+            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
+            p = (uint8_t *)env->vreg;
+            for (j = vlenb - 1 ; j >= 0; j--) {
+                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
+            }
+            qemu_fprintf(f, "\n");
+        }
+    }
 }
 
 static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The Advanced Core Local Interruptor (ACLINT) device can
only be used with TCG. Check for TCG enabled instead of
KVM being not. Only add the property when TCG is used.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629121103.87733-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst |  1 +
 hw/riscv/virt.c            | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
 
   When this option is "on", ACLINT devices will be emulated instead of
   SiFive CLINT. When not specified, this option is assumed to be "off".
+  This option is restricted to the TCG accelerator.
 
 - aia=[none|aplic|aplic-imsic]
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/tcg.h"
 #include "sysemu/kvm.h"
 #include "sysemu/tpm.h"
 #include "hw/pci/pci.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         g_free(clust_name);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 create_fdt_socket_aclint(s, memmap, socket,
                     &intc_phandles[phandle_pos]);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                 hart_count, &error_abort);
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
                     /* Per-socket ACLINT MTIMER */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
 
-    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
-                                   virt_set_aclint);
-    object_class_property_set_description(oc, "aclint",
-                                          "Set on/off to enable/disable "
-                                          "emulating ACLINT devices");
-
+    if (tcg_enabled()) {
+        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
+                                       virt_set_aclint);
+        object_class_property_set_description(oc, "aclint",
+                                              "Set on/off to enable/disable "
+                                              "emulating ACLINT devices");
+    }
     object_class_property_add_str(oc, "aia", virt_get_aia,
                                   virt_set_aia);
     object_class_property_set_description(oc, "aia",
-- 
2.40.1

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new syscall for the
"RISC-V Hardware Probing Interface"
(https://docs.kernel.org/riscv/hwprobe.html).

Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/syscall32_nr.h |   1 +
 linux-user/riscv/syscall64_nr.h |   1 +
 linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
 3 files changed, 148 insertions(+)

diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/syscall32_nr.h
+++ b/linux-user/riscv/syscall32_nr.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_NR_accept4 242
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
 #define TARGET_NR_fanotify_mark 263
diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/syscall64_nr.h
+++ b/linux-user/riscv/syscall64_nr.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_NR_recvmmsg 243
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_wait4 260
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 }
 #endif /* TARGET_NR_getdents64 */
 
+#if defined(TARGET_NR_riscv_hwprobe)
+
+#define RISCV_HWPROBE_KEY_MVENDORID     0
+#define RISCV_HWPROBE_KEY_MARCHID       1
+#define RISCV_HWPROBE_KEY_MIMPID        2
+
+#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
+#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+
+#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
+#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+#define     RISCV_HWPROBE_IMA_C        (1 << 1)
+
+#define RISCV_HWPROBE_KEY_CPUPERF_0     5
+#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
+
+struct riscv_hwprobe {
+    abi_llong  key;
+    abi_ullong value;
+};
+
+static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+                                    struct riscv_hwprobe *pair,
+                                    size_t pair_count)
+{
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
+
+    for (; pair_count > 0; pair_count--, pair++) {
+        abi_llong key;
+        abi_ullong value;
+        __put_user(0, &pair->value);
+        __get_user(key, &pair->key);
+        switch (key) {
+        case RISCV_HWPROBE_KEY_MVENDORID:
+            __put_user(cfg->mvendorid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MARCHID:
+            __put_user(cfg->marchid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MIMPID:
+            __put_user(cfg->mimpid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
+            value = riscv_has_ext(env, RVI) &&
+                    riscv_has_ext(env, RVM) &&
+                    riscv_has_ext(env, RVA) ?
+                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_IMA_EXT_0:
+            value = riscv_has_ext(env, RVF) &&
+                    riscv_has_ext(env, RVD) ?
+                    RISCV_HWPROBE_IMA_FD : 0;
+            value |= riscv_has_ext(env, RVC) ?
+                     RISCV_HWPROBE_IMA_C : pair->value;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_CPUPERF_0:
+            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
+            break;
+        default:
+            __put_user(-1, &pair->key);
+            break;
+        }
+    }
+}
+
+static int cpu_set_valid(abi_long arg3, abi_long arg4)
+{
+    int ret, i, tmp;
+    size_t host_mask_size, target_mask_size;
+    unsigned long *host_mask;
+
+    /*
+     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
+     * arg3 contains the cpu count.
+     */
+    tmp = (8 * sizeof(abi_ulong));
+    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
+    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
+                     ~(sizeof(*host_mask) - 1);
+
+    host_mask = alloca(host_mask_size);
+
+    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
+                                  arg4, target_mask_size);
+    if (ret != 0) {
+        return ret;
+    }
+
+    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
+        if (host_mask[i] != 0) {
+            return 0;
+        }
+    }
+    return -TARGET_EINVAL;
+}
+
+static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
+                                 abi_long arg2, abi_long arg3,
+                                 abi_long arg4, abi_long arg5)
+{
+    int ret;
+    struct riscv_hwprobe *host_pairs;
+
+    /* flags must be 0 */
+    if (arg5 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* check cpu_set */
+    if (arg3 != 0) {
+        ret = cpu_set_valid(arg3, arg4);
+        if (ret != 0) {
+            return ret;
+        }
+    } else if (arg4 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* no pairs */
+    if (arg2 == 0) {
+        return 0;
+    }
+
+    host_pairs = lock_user(VERIFY_WRITE, arg1,
+                           sizeof(*host_pairs) * (size_t)arg2, 0);
+    if (host_pairs == NULL) {
+        return -TARGET_EFAULT;
+    }
+    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
+    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
+    return 0;
+}
+#endif /* TARGET_NR_riscv_hwprobe */
+
 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
 #endif
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return ret;
 #endif
 
+#if defined(TARGET_NR_riscv_hwprobe)
+    case TARGET_NR_riscv_hwprobe:
+        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
+#endif
+
     default:
         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
         return -TARGET_ENOSYS;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
Add require check for BF16 extensions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h |  3 +++
 target/riscv/cpu.c     | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  4 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/fpu_helper.c                  | 12 +++++
 target/riscv/translate.c                   |  1 +
 target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
 6 files changed, 80 insertions(+), 6 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 
 /* Zce helper */
 DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+
+/* BF16 functions */
+DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
 # *** RV32 Zicond Standard Extension ***
 czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
 czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+
+# *** Zfbfmin Standard Extension ***
+fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
+fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
     float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_float64(frs1, true, &env->fp_status);
 }
+
+uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
+}
+
+uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
 #include "insn_trans/trans_svinval.c.inc"
+#include "insn_trans/trans_rvbf16.c.inc"
 #include "decode-xthead.c.inc"
 #include "insn_trans/trans_xthead.c.inc"
 #include "insn_trans/trans_xventanacondops.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the BF16 Standard Extensions.
+ *
+ * Copyright (c) 2020-2023 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
+static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -XXX,XX +XXX,XX @@
     }                                  \
 } while (0)
 
-#define REQUIRE_ZFHMIN(ctx) do {              \
-    if (!ctx->cfg_ptr->ext_zfhmin) {          \
+#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
         return false;                         \
     }                                         \
 } while (0)
@@ -XXX,XX +XXX,XX @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
 static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
 
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zvfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 +
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/vector_helper.c               |  6 ++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
 4 files changed, 77 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
 /* BF16 functions */
 DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+
+DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
 # *** Zfbfmin Standard Extension ***
 fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
 fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+
+# *** Zvfbfmin Standard Extension ***
+vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
 
+RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
+GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
+
 /* Narrowing Floating-Point/Integer Type-Convert Instructions */
 /* (TD, T2, TX2) */
 #define NOP_UU_B uint8_t,  uint16_t, uint32_t
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
 
+RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
+GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
+
 /*
  * Vector Reduction Operations
  */
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
     mark_fs_dirty(ctx);
     return true;
 }
+
+static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfncvtbf16_f_f_w);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwcvtbf16_f_f_v);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zvfbfwma instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/vector_helper.c               | 11 ++++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
 4 files changed, 76 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
 
 DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
 DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
 # *** Zvfbfmin Standard Extension ***
 vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
 vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
+
+# *** Zvfbfwma Standard Extension ***
+vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
+vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
 GEN_VEXT_VF(vfwmacc_vf_h, 4)
 GEN_VEXT_VF(vfwmacc_vf_w, 8)
 
+static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
+{
+    return float32_muladd(bfloat16_to_float32(a, s),
+                          bfloat16_to_float32(b, s), d, 0, s);
+}
+
+RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
+GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
+RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
+GEN_VEXT_VF(vfwmaccbf16_vf, 4)
+
 static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFWMA(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
     }
     return false;
 }
+
+static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
+        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs1),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwmaccbf16_vv);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
+        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
+        uint32_t data = 0;
+
+        gen_set_rm(ctx, RISCV_FRM_DYN);
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
+                           gen_helper_vfwmaccbf16_vf, ctx);
+    }
+
+    return false;
+}
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
+    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
+    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
     DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
 
+    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
+
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.40.1

From: Jason Chien <jason.chien@sifive.com>

The privileged spec states:
For a memory access made to support VS-stage address translation (such as
to read/write a VS-level page table), permissions are checked as though
for a load or store, not for the original access type. However, any
exception is always reported for the original access type (instruction,
load, or store/AMO).

The current implementation converts the access type to LOAD if implicit
G-stage translation fails which results in only reporting "Load guest-page
fault". This commit removes the convertion of access type, so the reported
exception conforms to the spec.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_G_STAGE_FAIL) {
             first_stage_error = false;
             two_stage_indirect_error = true;
-            access_type = MMU_DATA_LOAD;
         }
 
         qemu_log_mask(CPU_LOG_MMU,
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_cm_jalt = 788,
     rv_op_czero_eqz = 789,
     rv_op_czero_nez = 790,
+    rv_op_fcvt_bf16_s = 791,
+    rv_op_fcvt_s_bf16 = 792,
+    rv_op_vfncvtbf16_f_f_w = 793,
+    rv_op_vfwcvtbf16_f_f_v = 794,
+    rv_op_vfwmaccbf16_vv = 795,
+    rv_op_vfwmaccbf16_vf = 796,
+    rv_op_flh = 797,
+    rv_op_fsh = 798,
+    rv_op_fmv_h_x = 799,
+    rv_op_fmv_x_h = 800,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
     { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
+    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
+    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
+    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
+    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vloxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_flh; break;
             case 2: op = rv_op_flw; break;
             case 3: op = rv_op_fld; break;
             case 4: op = rv_op_flq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vsoxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_fsh; break;
             case 2: op = rv_op_fsw; break;
             case 3: op = rv_op_fsd; break;
             case 4: op = rv_op_fsq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
             case 33:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_fcvt_d_q; break;
                 }
                 break;
+            case 34:
+                switch (((inst >> 20) & 0b11111)) {
+                case 8: op = rv_op_fcvt_bf16_s; break;
+                }
+                break;
             case 35:
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fclass_d; break;
                 }
                 break;
+            case 114:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_x_h; break;
+                }
+                break;
             case 115:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fmv_d_x; break;
                 }
                 break;
+            case 122:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_h_x; break;
+                }
+                break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 10: op = rv_op_vfwcvt_f_xu_v; break;
                     case 11: op = rv_op_vfwcvt_f_x_v; break;
                     case 12: op = rv_op_vfwcvt_f_f_v; break;
+                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
                     case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
                     case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
                     case 16: op = rv_op_vfncvt_xu_f_w; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 21: op = rv_op_vfncvt_rod_f_f_w; break;
                     case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
                     case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
+                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
                     }
                     break;
                 case 19:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wv; break;
                 case 54: op = rv_op_vfwsub_wv; break;
                 case 56: op = rv_op_vfwmul_vv; break;
+                case 59: op = rv_op_vfwmaccbf16_vv; break;
                 case 60: op = rv_op_vfwmacc_vv; break;
                 case 61: op = rv_op_vfwnmacc_vv; break;
                 case 62: op = rv_op_vfwmsac_vv; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wf; break;
                 case 54: op = rv_op_vfwsub_wf; break;
                 case 56: op = rv_op_vfwmul_vf; break;
+                case 59: op = rv_op_vfwmaccbf16_vf; break;
                 case 60: op = rv_op_vfwmacc_vf; break;
                 case 61: op = rv_op_vfwnmacc_vf; break;
                 case 62: op = rv_op_vfwmsac_vf; break;
-- 
2.40.1

From: "yang.zhang" <yang.zhang@hexintek.com>

Should set/get riscv all reg timer,i.e, time/compare/frequency/state.

Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 
 #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
     do { \
-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
         if (ret) { \
             abort(); \
         } \
-- 
2.40.1

From: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>

fdt_load_addr was previously declared as uint32_t which doe not match
with the return type of riscv_compute_fdt_addr().

This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
to match the riscv_compute_fdt_addr() return type.

This fixes calculating the fdt address when DRAM is mapped to higher
64-bit address.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
[ Change by AF:
 - Cleanup commit title and message
]
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
     target_ulong start_addr = memmap[VIRT_DRAM].base;
     target_ulong firmware_end_addr, kernel_start_addr;
     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     uint64_t kernel_entry = 0;
     BlockBackend *pflash_blk0;
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

As it is today it's not possible to use '-cpu host' if the RISC-V host
has RVH enabled. This is the resulting error:

$ ./qemu/build/qemu-system-riscv64 \
    -machine virt,accel=kvm -m 2G -smp 1 \
    -nographic -snapshot -kernel ./guest_imgs/Image  \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
qemu-system-riscv64: H extension requires priv spec 1.12.0

This happens because we're checking for priv spec for all CPUs, and
since we're not setting  env->priv_ver for the 'host' CPU, it's being
default to zero (i.e. PRIV_SPEC_1_10_0).

In reality env->priv_ver does not make sense when running with the KVM
'host' CPU. It's used to gate certain CSRs/extensions during translation
to make them unavailable if the hart declares an older spec version. It
doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
are available [1].

'priv_ver' is just one example. We're doing a lot of feature validation
and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
Validating the feature set for those CPUs is a KVM problem that should
be handled in KVM specific code.

The new riscv_cpu_realize_tcg() helper contains all validation logic that
are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
running TCG and, if it's the case, proceed with the usual TCG realize()
logic.

[1] lib/sbi/sbi_hart.c, hart_detect_features()

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "fpu/softfloat-helpers.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "kvm_riscv.h"
 #include "tcg/tcg.h"
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
     }
 }
 
-static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
 {
-    CPUState *cs = CPU(dev);
     RISCVCPU *cpu = RISCV_CPU(dev);
     CPURISCVState *env = &cpu->env;
-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
     Error *local_err = NULL;
 
-    cpu_exec_realizefn(cs, &local_err);
-    if (local_err != NULL) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     }
 
 #ifndef CONFIG_USER_ONLY
-    cs->tcg_cflags |= CF_PCREL;
+    CPU(dev)->tcg_cflags |= CF_PCREL;
 
     if (cpu->cfg.ext_sstc) {
         riscv_timer_init(cpu);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         }
      }
 #endif
+}
+
+static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+{
+    CPUState *cs = CPU(dev);
+    RISCVCPU *cpu = RISCV_CPU(dev);
+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+    Error *local_err = NULL;
+
+    cpu_exec_realizefn(cs, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (tcg_enabled()) {
+        riscv_cpu_realize_tcg(dev, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
 
     riscv_cpu_finalize_features(cpu, &local_err);
     if (local_err != NULL) {
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The absence of a satp mode in riscv_host_cpu_init() is causing the
following error:

$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
    -m 2G -smp 1  -nographic -snapshot \
    -kernel ./guest_imgs/Image \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
**
ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
reached
Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
not be reached
Aborted

The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.

For this KVM cpu we would need to inherit the satp supported modes
from the RISC-V host. At this moment this is not possible because the
KVM driver does not support it. And even when it does we can't just let
this broken for every other older kernel.

Since mmu-type is not a required node, according to [1], skip the
'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
logic when we can get satp information from KVM.

[1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
             s->soc[socket].hartid_base + cpu);
         qemu_fdt_add_subnode(ms->fdt, cpu_name);
 
-        satp_mode_max = satp_mode_max_from_map(
-            s->soc[socket].harts[cpu].cfg.satp_mode.map);
-        sv_name = g_strdup_printf("riscv,%s",
-                                  satp_mode_str(satp_mode_max, is_32_bit));
-        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
-        g_free(sv_name);
-
+        if (cpu_ptr->cfg.satp_mode.supported != 0) {
+            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
+            sv_name = g_strdup_printf("riscv,%s",
+                                      satp_mode_str(satp_mode_max, is_32_bit));
+            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+            g_free(sv_name);
+        }
 
         name = riscv_isa_string(cpu_ptr);
         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're going to change the handling of mvendorid/marchid/mimpid by the
KVM driver. Since these are always present in all CPUs let's put the
same validation for everyone.

It doesn't make sense to allow 'mvendorid' to be different than it
is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
any 'mvendorid' they want.

Change 'mvendorid' to be a class property created via
'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
macro. This allow us to define a custom setter for it that will verify,
for named CPUs, if mvendorid is different than it is already set by the
CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
set to an invalid value:

$ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
    Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
+static bool riscv_cpu_is_dynamic(Object *cpu_obj)
+{
+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
+}
+
+static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint32_t prev_val = cpu->cfg.mvendorid;
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mvendorid = value;
+}
+
+static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mvendorid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops = &riscv_tcg_ops;
 
+    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
+                              cpu_set_mvendorid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Following the same logic used with 'mvendorid' let's also restrict
'mimpid' for named CPUs. Generic CPUs keep setting the value freely.

Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
reason is that this is not a good default since it's dynamic, changing
with with every QEMU version, regardless of whether the actual
implementation of the CPU changed from one QEMU version to the other.
Named CPU should set it to a meaningful value instead and generic CPUs
can set whatever they want.

This is the error thrown for an invalid 'mimpid' value for the veyron-v1
CPU:

$ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
    Unable to change veyron-v1-riscv-cpu mimpid (0x111)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
                              (QEMU_VERSION_MINOR << 8)  | \
                              (QEMU_VERSION_MICRO))
-#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
 
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.mimpid;
+    uint64_t value;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mimpid = value;
+}
+
+static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mimpid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
                               cpu_set_mvendorid, NULL, NULL);
 
+    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
+                              cpu_set_mimpid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'marchid' shouldn't be set to a different value as previously set for
named CPUs.

For all other CPUs it shouldn't be freely set either - the spec requires
that 'marchid' can't have the MSB (most significant bit) set and every
other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
32 bit CPUs.

As with 'mimpid', setting a default value based on the current QEMU
version is not a good idea because it implies that the CPU
implementation changes from one QEMU version to the other. Named CPUs
should set 'marchid' to a meaningful value instead, and generic CPUs can
set to any valid value.

For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
a different val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
    Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)

And, for generics CPUs, this is the error when trying to set to an
invalid val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
    Unable to set marchid with MSB (64) bit set and the remaining bits zero

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 
 /* RISC-V CPU definitions */
-
-#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
-                             (QEMU_VERSION_MINOR << 8)  | \
-                             (QEMU_VERSION_MICRO))
-
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
 #endif
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.marchid;
+    uint64_t value, invalid_val;
+    uint32_t mxlen = 0;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    switch (riscv_cpu_mxl(&cpu->env)) {
+    case MXL_RV32:
+        mxlen = 32;
+        break;
+    case MXL_RV64:
+    case MXL_RV128:
+        mxlen = 64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    invalid_val = 1LL << (mxlen - 1);
+
+    if (value == invalid_val) {
+        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
+                         "and the remaining bits zero", mxlen);
+        return;
+    }
+
+    cpu->cfg.marchid = value;
+}
+
+static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.marchid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
                               cpu_set_mimpid, NULL, NULL);
 
+    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
+                              cpu_set_marchid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Certain validations, such as the validations done for the machine IDs
(mvendorid/marchid/mimpid), are done before starting the CPU.
Non-dynamic (named) CPUs tries to match user input with a preset
default. As it is today we can't prefetch a KVM default for these cases
because we're only able to read/write KVM regs after the vcpu is
spinning.

Our target/arm friends use a concept called "scratch CPU", which
consists of creating a vcpu for doing queries and validations and so on,
which is discarded shortly after use [1]. This is a suitable solution
for what we need so let's implement it in target/riscv as well.

kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
a KVM scratch CPU, fetch KVM regs that work as default values for user
properties, and then discard the scratch CPU afterwards.

We're starting by initializing 'mvendorid'. This concept will be used to
init other KVM specific properties in the next patches as well.

[1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |  1 +
 target/riscv/cpu.c       |  6 +++
 target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 92 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_KVM_RISCV_H
 #define QEMU_KVM_RISCV_H
 
+void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     Property *prop;
     DeviceState *dev = DEVICE(obj);
 
+#ifndef CONFIG_USER_ONLY
+    if (kvm_enabled()) {
+        kvm_riscv_init_user_properties(obj);
+    }
+#endif
+
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
+typedef struct KVMScratchCPU {
+    int kvmfd;
+    int vmfd;
+    int cpufd;
+} KVMScratchCPU;
+
+/*
+ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
+ * from target/arm/kvm.c.
+ */
+static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    int kvmfd = -1, vmfd = -1, cpufd = -1;
+
+    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+    if (kvmfd < 0) {
+        goto err;
+    }
+    do {
+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
+    } while (vmfd == -1 && errno == EINTR);
+    if (vmfd < 0) {
+        goto err;
+    }
+    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
+    if (cpufd < 0) {
+        goto err;
+    }
+
+    scratch->kvmfd =  kvmfd;
+    scratch->vmfd = vmfd;
+    scratch->cpufd = cpufd;
+
+    return true;
+
+ err:
+    if (cpufd >= 0) {
+        close(cpufd);
+    }
+    if (vmfd >= 0) {
+        close(vmfd);
+    }
+    if (kvmfd >= 0) {
+        close(kvmfd);
+    }
+
+    return false;
+}
+
+static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    close(scratch->cpufd);
+    close(scratch->vmfd);
+    close(scratch->kvmfd);
+}
+
+static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mvendorid from host, error %d", ret);
+    }
+}
+
+void kvm_riscv_init_user_properties(Object *cpu_obj)
+{
+    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+    KVMScratchCPU kvmcpu;
+
+    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
+        return;
+    }
+
+    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+
+    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+}
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Allow 'marchid' and 'mimpid' to also be initialized in
kvm_riscv_init_machine_ids().

After this change, the handling of mvendorid/marchid/mimpid for the
'host' CPU type will be equal to what we already have for TCG named
CPUs, i.e. the user is not able to set these values to a different val
than the one that is already preset.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(marchid));
+    reg.addr = (uint64_t)&cpu->cfg.marchid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve marchid from host, error %d", ret);
+    }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mimpid));
+    reg.addr = (uint64_t)&cpu->cfg.mimpid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mimpid from host, error %d", ret);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

After changing user validation for mvendorid/marchid/mimpid to guarantee
that the value is validated on user input time, coupled with the work in
fetching KVM default values for them by using a scratch CPU, we're
certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
already good to be written back to KVM.

There's no need to write the values back for 'host' type CPUs since the
values can't be changed, so let's do that just for generic CPUs.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
 
+static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id;
+    int ret;
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(marchid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mimpid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
+
+    return ret;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
     env->misa_ext = isa;
 
+    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+        ret = kvm_vcpu_set_machine_ids(cpu, cs);
+    }
+
     return ret;
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

At this moment we're retrieving env->misa_ext during
kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.

We want to set env->misa_ext_mask, and we want to set it as early as
possible. The reason is that we're going to use it in the validation
process of the KVM MISA properties we're going to add next. Setting it
during arch_init_cpu() is too late for user validation.

Move the code to a new helper that is going to be called during init()
time, via kvm_riscv_init_user_properties(), like we're already doing for
the machine ID properties. Set both misa_ext and misa_ext_mask to the
same value retrieved by the 'isa' config reg.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     }
 }
 
+static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
+                                         KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(isa));
+    reg.addr = (uint64_t)&env->misa_ext_mask;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+
+    if (ret) {
+        error_report("Unable to fetch ISA register from KVM, "
+                     "error %d", ret);
+        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+        exit(EXIT_FAILURE);
+    }
+
+    env->misa_ext = env->misa_ext_mask;
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     }
 
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
-    target_ulong isa;
     RISCVCPU *cpu = RISCV_CPU(cs);
-    CPURISCVState *env = &cpu->env;
-    uint64_t id;
 
     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(isa));
-    ret = kvm_get_one_reg(cs, id, &isa);
-    if (ret) {
-        return ret;
-    }
-    env->misa_ext = isa;
-
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
     }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Next patch will add KVM specific user properties for both MISA and
multi-letter extensions. For MISA extensions we want to make use of what
is already available in misa_ext_cfgs[] to avoid code repetition.

misa_ext_info_arr[] array will hold name and description for each MISA
extension that misa_ext_cfgs[] is declaring. We'll then use this new
array in KVM code to avoid duplicating strings. Two getters were added
to allow KVM to retrieve the 'name' and 'description' for each MISA
property.

There's nothing holding us back from doing the same with multi-letter
extensions. For now doing just with MISA extensions is enough.

It is worth documenting that even using the __bultin_ctz() directive to
populate the misa_ext_info_arr[] we are forced to assign 'name' and
'description' during runtime in riscv_cpu_add_misa_properties(). The
reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
throw errors like this if we fetch 'name' and 'description' from the
array in the MISA_CFG() macro:

../target/riscv/cpu.c:1624:5: error: initializer element is not a
                              compile-time constant
    MISA_CFG(RVA, true),
    ^~~~~~~~~~~~~~~~~~~
../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
    {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~

gcc and others compilers/builders were fine with that change. We can't
ignore failures in the Gitlab pipeline though, so code was changed to
make every runner happy.

As a side effect, misa_ext_cfg[] is no longer a 'const' array because
it must be set during runtime.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |   7 ++-
 target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
 2 files changed, 88 insertions(+), 29 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
-/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
+/*
+ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
+ * when adding new MISA bits here.
+ */
 #define RVI RV('I')
 #define RVE RV('E') /* E and I are mutually exclusive */
 #define RVM RV('M')
@@ -XXX,XX +XXX,XX @@
 #define RVJ RV('J')
 #define RVG RV('G')
 
+const char *riscv_get_misa_ext_name(uint32_t bit);
+const char *riscv_get_misa_ext_description(uint32_t bit);
 
 /* Privileged specification version */
 enum {
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
-static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-    {.name = "a", .description = "Atomic instructions",
-     .misa_bit = RVA, .enabled = true},
-    {.name = "c", .description = "Compressed instructions",
-     .misa_bit = RVC, .enabled = true},
-    {.name = "d", .description = "Double-precision float point",
-     .misa_bit = RVD, .enabled = true},
-    {.name = "f", .description = "Single-precision float point",
-     .misa_bit = RVF, .enabled = true},
-    {.name = "i", .description = "Base integer instruction set",
-     .misa_bit = RVI, .enabled = true},
-    {.name = "e", .description = "Base integer instruction set (embedded)",
-     .misa_bit = RVE, .enabled = false},
-    {.name = "m", .description = "Integer multiplication and division",
-     .misa_bit = RVM, .enabled = true},
-    {.name = "s", .description = "Supervisor-level instructions",
-     .misa_bit = RVS, .enabled = true},
-    {.name = "u", .description = "User-level instructions",
-     .misa_bit = RVU, .enabled = true},
-    {.name = "h", .description = "Hypervisor",
-     .misa_bit = RVH, .enabled = true},
-    {.name = "x-j", .description = "Dynamic translated languages",
-     .misa_bit = RVJ, .enabled = false},
-    {.name = "v", .description = "Vector operations",
-     .misa_bit = RVV, .enabled = false},
-    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
-     .misa_bit = RVG, .enabled = false},
+typedef struct misa_ext_info {
+    const char *name;
+    const char *description;
+} MISAExtInfo;
+
+#define MISA_INFO_IDX(_bit) \
+    __builtin_ctz(_bit)
+
+#define MISA_EXT_INFO(_bit, _propname, _descr) \
+    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
+
+static const MISAExtInfo misa_ext_info_arr[] = {
+    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
+    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
+    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
+    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
+    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
+    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
+    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
+    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
+    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
+    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
+    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
+    MISA_EXT_INFO(RVV, "v", "Vector operations"),
+    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
+};
+
+static int riscv_validate_misa_info_idx(uint32_t bit)
+{
+    int idx;
+
+    /*
+     * Our lowest valid input (RVA) is 1 and
+     * __builtin_ctz() is UB with zero.
+     */
+    g_assert(bit != 0);
+    idx = MISA_INFO_IDX(bit);
+
+    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
+    return idx;
+}
+
+const char *riscv_get_misa_ext_name(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].name;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+const char *riscv_get_misa_ext_description(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].description;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+#define MISA_CFG(_bit, _enabled) \
+    {.misa_bit = _bit, .enabled = _enabled}
+
+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+    MISA_CFG(RVA, true),
+    MISA_CFG(RVC, true),
+    MISA_CFG(RVD, true),
+    MISA_CFG(RVF, true),
+    MISA_CFG(RVI, true),
+    MISA_CFG(RVE, false),
+    MISA_CFG(RVM, true),
+    MISA_CFG(RVS, true),
+    MISA_CFG(RVU, true),
+    MISA_CFG(RVH, true),
+    MISA_CFG(RVJ, false),
+    MISA_CFG(RVV, false),
+    MISA_CFG(RVG, false),
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
     int i;
 
     for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
-        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        int bit = misa_cfg->misa_bit;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
 
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Using all TCG user properties in KVM is tricky. First because KVM
supports only a small subset of what TCG provides, so most of the
cpu->cfg flags do nothing for KVM.

Second, and more important, we don't have a way of telling if any given
value is an user input or not. For TCG this has a small impact since we
just validating everything and error out if needed. But for KVM it would
be good to know if a given value was set by the user or if it's a value
already provided by KVM. Otherwise we don't know how to handle failed
kvm_set_one_regs() when writing the configurations back.

These characteristics make it overly complicated to use the same user
facing flags for both KVM and TCG. A simpler approach is to create KVM
specific properties that have specialized logic, forking KVM and TCG use
cases for those cases only. Fully separating KVM/TCG properties is
unneeded at this point - in fact we want the user experience to be as
equal as possible, regardless of the acceleration chosen.

We'll start this fork with the MISA properties, adding the MISA bits
that the KVM driver currently supports. A new KVMCPUConfig type is
introduced. It'll hold general information about an extension. For MISA
extensions we're going to use the newly created getters of
misa_ext_infos[] to populate their name and description. 'offset' holds
the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
'misa_bit' because this same KVMCPUConfig struct will be used to
multi-letter extensions later on.

This new type also holds a 'user_set' flag. This flag will be set when
the user set an option that's different than what is already configured
in the host, requiring KVM intervention to write the regs back during
kvm_arch_init_vcpu(). Similar mechanics will be implemented for
multi-letter extensions as well.

There is no need to duplicate more code than necessary, so we're going
to use the existing kvm_riscv_init_user_properties() to add the KVM
specific properties. Any code that is adding a TCG user prop is then
changed slightly to verify first if there's a KVM prop with the same
name already added.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |  5 +++
 target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
         misa_cfg->name = riscv_get_misa_ext_name(bit);
         misa_cfg->description = riscv_get_misa_ext_description(bit);
 
+        /* Check if KVM already created the property */
+        if (object_property_find(cpu_obj, misa_cfg->name)) {
+            continue;
+        }
+
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
                             cpu_set_misa_ext_cfg,
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include <linux/kvm.h>
 
 #include "qemu/timer.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "qapi/visitor.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sysemu/kvm_int.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
         } \
     } while (0)
 
+typedef struct KVMCPUConfig {
+    const char *name;
+    const char *description;
+    target_ulong offset;
+    int kvm_reg_id;
+    bool user_set;
+} KVMCPUConfig;
+
+#define KVM_MISA_CFG(_bit, _reg_id) \
+    {.offset = _bit, .kvm_reg_id = _reg_id}
+
+/* KVM ISA extensions */
+static KVMCPUConfig kvm_misa_ext_cfgs[] = {
+    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
+    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
+    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
+    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
+    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
+    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
+    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
+};
+
+static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
+                                     const char *name,
+                                     void *opaque, Error **errp)
+{
+    KVMCPUConfig *misa_ext_cfg = opaque;
+    target_ulong misa_bit = misa_ext_cfg->offset;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    CPURISCVState *env = &cpu->env;
+    bool value, host_bit;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_bit = env->misa_ext_mask & misa_bit;
+
+    if (value == host_bit) {
+        return;
+    }
+
+    if (!value) {
+        misa_ext_cfg->user_set = true;
+        return;
+    }
+
+    /*
+     * Forbid users to enable extensions that aren't
+     * available in the hart.
+     */
+    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
+               "enabled in the host", misa_ext_cfg->name);
+}
+
+static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        int bit = misa_cfg->offset;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
+
+        object_property_add(cpu_obj, misa_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_misa_ext_cfg,
+                            NULL, misa_cfg);
+        object_property_set_description(cpu_obj, misa_cfg->name,
+                                        misa_cfg->description);
+    }
+}
+
 static int kvm_riscv_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
         return;
     }
 
+    kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Our design philosophy with KVM properties can be resumed in two main
decisions based on KVM interface availability and what the user wants to
do:

- if the user disables an extension that the host KVM module doesn't
know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
keep booting the CPU. This will avoid users having to deal with issues
with older KVM versions while disabling features they don't care;

- for any other case we're going to error out immediately. If the user
wants to enable a feature that KVM doesn't know about this a problem that
is worth aborting - the user must know that the feature wasn't enabled
in the hart. Likewise, if KVM knows about the extension, the user wants
to enable/disable it, and we fail to do it so, that's also a problem we
can't shrug it off.

In the case of MISA bits we won't even try enabling bits that aren't
already available in the host. The ioctl() is so likely to fail that
it's not worth trying. This check is already done in the previous patch,
in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.

In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
option and do as follows:

- if the user didn't set the property or set to the same value of the
host, do nothing;

- Disable the given extension in KVM. Error out if anything goes wrong.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
                "enabled in the host", misa_ext_cfg->name);
 }
 
+static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id, reg;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        target_ulong misa_bit = misa_cfg->offset;
+
+        if (!misa_cfg->user_set) {
+            continue;
+        }
+
+        /* If we're here we're going to disable the MISA bit */
+        reg = 0;
+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                              misa_cfg->kvm_reg_id);
+        ret = kvm_set_one_reg(cs, id, &reg);
+        if (ret != 0) {
+            /*
+             * We're not checking for -EINVAL because if the bit is about
+             * to be disabled, it means that it was already enabled by
+             * KVM. We determined that by fetching the 'isa' register
+             * during init() time. Any error at this point is worth
+             * aborting.
+             */
+            error_report("Unable to set KVM reg %s, error %d",
+                         misa_cfg->name, ret);
+            exit(EXIT_FAILURE);
+        }
+        env->misa_ext &= ~misa_bit;
+    }
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
+        if (ret != 0) {
+            return ret;
+        }
     }
 
+    kvm_riscv_update_cpu_misa_ext(cpu, cs);
+
     return ret;
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Let's add KVM user properties for the multi-letter extensions that KVM
currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
svinval and svpbmt.

As with MISA extensions, we're using the KVMCPUConfig type to hold
information about the state of each extension. However, multi-letter
extensions have more cases to cover than MISA extensions, so we're
adding an extra 'supported' flag as well. This flag will reflect if a
given extension is supported by KVM, i.e. KVM knows how to handle it.
This is determined during KVM extension discovery in
kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
other error will cause an abort.

The use of the 'user_set' is similar to what we already do with MISA
extensions: the flag set only if the user is changing the extension
state.

The 'supported' flag will be used later on to make an exception for
users that are disabling multi-letter extensions that are unknown to
KVM.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |   8 +++
 target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 127 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+#ifndef CONFIG_USER_ONLY
+        if (kvm_enabled()) {
+            /* Check if KVM created the property already */
+            if (object_property_find(obj, prop->name)) {
+                continue;
+            }
+        }
+#endif
         qdev_property_add_static(dev, prop);
     }
 
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ typedef struct KVMCPUConfig {
     target_ulong offset;
     int kvm_reg_id;
     bool user_set;
+    bool supported;
 } KVMCPUConfig;
 
 #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
     }
 }
 
+#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
+
+#define KVM_EXT_CFG(_name, _prop, _reg_id) \
+    {.name = _name, .offset = CPUCFG(_prop), \
+     .kvm_reg_id = _reg_id}
+
+static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
+    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
+    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
+    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
+    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
+    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
+    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
+    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+};
+
+static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
+                            uint32_t val)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    *ext_enabled = val;
+}
+
+static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
+                                KVMCPUConfig *multi_ext)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    return *ext_enabled;
+}
+
+static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *multi_ext_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    bool value, host_val;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
+
+    /*
+     * Ignore if the user is setting the same value
+     * as the host.
+     */
+    if (value == host_val) {
+        return;
+    }
+
+    if (!multi_ext_cfg->supported) {
+        /*
+         * Error out if the user is trying to enable an
+         * extension that KVM doesn't support. Ignore
+         * option otherwise.
+         */
+        if (value) {
+            error_setg(errp, "KVM does not support disabling extension %s",
+                       multi_ext_cfg->name);
+        }
+
+        return;
+    }
+
+    multi_ext_cfg->user_set = true;
+    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
         object_property_set_description(cpu_obj, misa_cfg->name,
                                         misa_cfg->description);
     }
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
+
+        object_property_add(cpu_obj, multi_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_multi_ext_cfg,
+                            NULL, multi_cfg);
+    }
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t val;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
+        struct kvm_one_reg reg;
+
+        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                                  multi_ext_cfg->kvm_reg_id);
+        reg.addr = (uint64_t)&val;
+        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+        if (ret != 0) {
+            if (errno == EINVAL) {
+                /* Silently default to 'false' if KVM does not support it. */
+                multi_ext_cfg->supported = false;
+                val = false;
+            } else {
+                error_report("Unable to read ISA_EXT KVM register %s, "
+                             "error %d", multi_ext_cfg->name, ret);
+                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+                exit(EXIT_FAILURE);
+            }
+        } else {
+            multi_ext_cfg->supported = true;
+        }
+
+        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
+    }
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
CONFIG_USER_ONLY" blocks after changes that added KVM properties
handling.

KVM specific properties are required to be created earlier than their
TCG counterparts, but the remaining props can be created at any order.
Move riscv_add_satp_mode_properties() to the start of the function,
inside the !CONFIG_USER_ONLY block already present there, to remove the
last ifndef block.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     DeviceState *dev = DEVICE(obj);
 
 #ifndef CONFIG_USER_ONLY
+    riscv_add_satp_mode_properties(obj);
+
     if (kvm_enabled()) {
         kvm_riscv_init_user_properties(obj);
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 #endif
         qdev_property_add_static(dev, prop);
     }
-
-#ifndef CONFIG_USER_ONLY
-    riscv_add_satp_mode_properties(obj);
-#endif
 }
 
 static Property riscv_cpu_properties[] = {
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

riscv_isa_string_ext() is being used by riscv_isa_string(), which is
then used by boards to retrieve the 'riscv,isa' string to be written in
the FDT. All this happens after riscv_cpu_realize(), meaning that we're
already past riscv_cpu_validate_set_extensions() and, more important,
riscv_cpu_disable_priv_spec_isa_exts().

This means that all extensions that needed to be disabled due to
priv_spec mismatch are already disabled. Checking this again during
riscv_isa_string_ext() is unneeded. Remove it.

As a bonus, riscv_isa_string_ext() can now be used with the 'host'
KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
would fail this check for no good reason.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
     int i;
 
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
-            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
             g_free(old);
             old = new;
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM-specific properties are being created inside target/riscv/kvm.c. But
at this moment we're gathering all the remaining properties from TCG and
adding them as is when running KVM. This creates a situation where
non-KVM properties are setting flags to 'true' due to its default
settings (e.g.  Zawrs). Users can also freely enable them via command
line.

This doesn't impact runtime per se because KVM doesn't care about these
flags, but code such as riscv_isa_string_ext() take those flags into
account. The result is that, for a KVM guest, setting non-KVM properties
will make them appear in the riscv,isa DT.

We want to keep the same API for both TCG and KVM and at the same time,
when running KVM, forbid non-KVM extensions to be enabled internally. We
accomplish both by changing riscv_cpu_add_user_properties() to add a
mock boolean property for every non-KVM extension in
riscv_cpu_extensions[]. Then, when running KVM, users are still free to
set extensions at will, but we'll error out if a non-KVM extension is
enabled. Setting such extension to 'false' will be ignored.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+
+#ifndef CONFIG_USER_ONLY
+static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+                                    const char *name,
+                                    void *opaque, Error **errp)
+{
+    const char *propname = opaque;
+    bool value;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    if (value) {
+        error_setg(errp, "extension %s is not available with KVM",
+                   propname);
+    }
+}
+#endif
+
 /*
  * Add CPU properties with user-facing flags.
  *
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
             if (object_property_find(obj, prop->name)) {
                 continue;
             }
+
+            /*
+             * Set the default to disabled for every extension
+             * unknown to KVM and error out if the user attempts
+             * to enable any of them.
+             *
+             * We're giving a pass for non-bool properties since they're
+             * not related to the availability of extensions and can be
+             * safely ignored as is.
+             */
+            if (prop->info == &qdev_prop_bool) {
+                object_property_add(obj, prop->name, "bool",
+                                    NULL, cpu_set_cfg_unavailable,
+                                    NULL, (void *)prop->name);
+                continue;
+            }
         }
 #endif
         qdev_property_add_static(dev, prop);
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're now ready to update the multi-letter extensions status for KVM.

kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
time to verify which user options changes host defaults (via the 'user_set'
flag) and tries to write them back to KVM.

Failure to commit a change to KVM is only ignored in case KVM doesn't
know about the extension (-EINVAL error code) and the user wanted to
disable the given extension. Otherwise we're going to abort the boot
process.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

There are 2 places in which we need to get a pointer to a certain
property of the cpu->cfg struct based on property offset. Next patch
will add a couple more.

Create a helper to avoid repeating this code over and over.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 };
 
+static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
+{
+    return (void *)&cpu->cfg + kvmcfg->offset;
+}
+
 static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
                             uint32_t val)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     *ext_enabled = val;
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
                                 KVMCPUConfig *multi_ext)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     return *ext_enabled;
 }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
Linux Kernel will fail to detect the availability of the CBOM/CBOZ
extensions, regardless of the contents of the 'riscv,isa' DT prop.

The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
so let's expose them as user properties like it is already done with
TCG.

This will also require us to determine proper blocksize values during
init() time since the FDT is already created during realize(). We'll
take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
don't need to fetch both cbom and cboz blocksizes every time: check for
their parent extensions (icbom and icboz) and only read the blocksizes
if needed.

In contrast with cbom|z_blocksize properties from TCG, the user is not
able to set any value that is different from the 'host' value when
running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
can be thrown for the mere attempt of executing kvm_set_one_reg() for
these 2 regs.

Hopefully we don't need to call kvm_set_one_reg() for these regs.
We'll check if the user input matches the host value in
kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
properties. We'll fail fast since it's already known to not be
supported.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 }
 
+static KVMCPUConfig kvm_cbom_blocksize = {
+    .name = "cbom_blocksize",
+    .offset = CPUCFG(cbom_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
+};
+
+static KVMCPUConfig kvm_cboz_blocksize = {
+    .name = "cboz_blocksize",
+    .offset = CPUCFG(cboz_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
+};
+
+static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *cbomz_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint16_t value, *host_val;
+
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+
+    if (value != *host_val) {
+        error_report("Unable to set %s to a different value than "
+                     "the host (%u)",
+                     cbomz_cfg->name, *host_val);
+        exit(EXIT_FAILURE);
+    }
+
+    cbomz_cfg->user_set = true;
+}
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
                             kvm_cpu_set_multi_ext_cfg,
                             NULL, multi_cfg);
     }
+
+    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cbom_blocksize);
+
+    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cboz_blocksize);
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
+                                         KVMCPUConfig *cbomz_cfg)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              cbomz_cfg->kvm_reg_id);
+    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to read KVM reg %s, error %d",
+                     cbomz_cfg->name, ret);
+        exit(EXIT_FAILURE);
+    }
+}
+
 static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
         kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
     }
+
+    if (cpu->cfg.ext_icbom) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
+    }
+
+    if (cpu->cfg.ext_icboz) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch introduces the RISC-V Zfa extension, which introduces
additional floating-point instructions:
* fli (load-immediate) with pre-defined immediates
* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
* fround/froundmx (round to integer)
* fcvtmod.w.d (Modular Convert-to-Integer)
* fmv* to access high bits of float register bigger than XLEN
* Quiet comparison instructions (fleq/fltq)

Zfa defines its instructions in combination with the following extensions:
* single-precision floating-point (F)
* double-precision floating-point (D)
* quad-precision floating-point (Q)
* half-precision floating-point (Zfh)

Since QEMU does not support the RISC-V quad-precision floating-point
ISA extension (Q), this patch does not include the instructions that
depend on this extension. All other instructions are included in this
patch.

The Zfa specification can be found here:
  https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
The Zfa specifciation is frozen and is in public review since May 3, 2023:
  https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg

The patch also includes a TCG test for the fcvtmod.w.d instruction.
The test cases test for correct results and flag behaviour.
Note, that the Zfa specification requires fcvtmod's flag behaviour
to be identical to a fcvt with the same operands (which is also
tested).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h                             |   3 +
 target/riscv/cpu_cfg.h                    |   1 +
 target/riscv/helper.h                     |  19 +
 target/riscv/insn32.decode                |  26 ++
 disas/riscv.c                             | 139 ++++++
 target/riscv/cpu.c                        |   8 +
 target/riscv/fpu_helper.c                 | 154 +++++++
 target/riscv/translate.c                  |   1 +
 tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
 target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target         |   6 +
 11 files changed, 1223 insertions(+)
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_r_imm2,
     rv_codec_r2_immhl,
     rv_codec_r2_imm2_imm5,
+    rv_codec_fli,
 } rv_codec;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_rd_offset              "O\t0,o"
 #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 #define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
 #define rv_fmt_frd_frs1               "O\t3,4"
 #define rv_fmt_rd_frs1                "O\t0,4"
 #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
 #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
 #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
+#define rv_fmt_fli                    "O\t3,h"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svpbmt;
     bool ext_zdinx;
     bool ext_zawrs;
+    bool ext_zfa;
     bool ext_zfbfmin;
     bool ext_zfh;
     bool ext_zfhmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Floating Point - Double Precision */
 DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
+DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
+DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Bitmanip */
 DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Cache-block operations */
 DEF_HELPER_2(cbo_clean_flush, void, env, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
 bset       0010100 .......... 001 ..... 0110011 @r
 bseti      00101. ........... 001 ..... 0010011 @sh
 
+# *** Zfa Standard Extension ***
+fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
+fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
+fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
+fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
+fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
+fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
+fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
+fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
+fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
+fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
+fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
+fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
+fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
+fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
+fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
+fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
+fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
+fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
+fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
+fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
+fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
+
 # *** RV32 Zfh Extension ***
 flh        ............   ..... 001 ..... 0000111 @i
 fsh        .......  ..... ..... 001 ..... 0100111 @s
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_fsh = 798,
     rv_op_fmv_h_x = 799,
     rv_op_fmv_x_h = 800,
+    rv_op_fli_s = 801,
+    rv_op_fli_d = 802,
+    rv_op_fli_q = 803,
+    rv_op_fli_h = 804,
+    rv_op_fminm_s = 805,
+    rv_op_fmaxm_s = 806,
+    rv_op_fminm_d = 807,
+    rv_op_fmaxm_d = 808,
+    rv_op_fminm_q = 809,
+    rv_op_fmaxm_q = 810,
+    rv_op_fminm_h = 811,
+    rv_op_fmaxm_h = 812,
+    rv_op_fround_s = 813,
+    rv_op_froundnx_s = 814,
+    rv_op_fround_d = 815,
+    rv_op_froundnx_d = 816,
+    rv_op_fround_q = 817,
+    rv_op_froundnx_q = 818,
+    rv_op_fround_h = 819,
+    rv_op_froundnx_h = 820,
+    rv_op_fcvtmod_w_d = 821,
+    rv_op_fmvh_x_d = 822,
+    rv_op_fmvp_d_x = 823,
+    rv_op_fmvh_x_q = 824,
+    rv_op_fmvp_q_x = 825,
+    rv_op_fleq_s = 826,
+    rv_op_fltq_s = 827,
+    rv_op_fleq_d = 828,
+    rv_op_fltq_d = 829,
+    rv_op_fleq_q = 830,
+    rv_op_fltq_q = 831,
+    rv_op_fleq_h = 832,
+    rv_op_fltq_h = 833,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
+/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
+ * The constants use the hex floating-point literal representation
+ * that is printed when using the printf %a format specifier,
+ * which matches the output that is generated by the disassembler.
+ */
+static const char rv_fli_name_const[32][9] =
+{
+    "0x1p+0", "min", "0x1p-16", "0x1p-15",
+    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
+    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
+    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
+    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
+    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
+    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
+    "0x1p+15", "0x1p+16", "inf", "nan"
+};
+
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
     { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
     { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_s; break;
                 case 1: op = rv_op_fmax_s; break;
+                case 2: op = rv_op_fminm_s; break;
+                case 3: op = rv_op_fmaxm_s; break;
                 }
                 break;
             case 21:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_d; break;
                 case 1: op = rv_op_fmax_d; break;
+                case 2: op = rv_op_fminm_d; break;
+                case 3: op = rv_op_fmaxm_d; break;
+                }
+                break;
+            case 22:
+                switch (((inst >> 12) & 0b111)) {
+                case 2: op = rv_op_fminm_h; break;
+                case 3: op = rv_op_fmaxm_h; break;
                 }
                 break;
             case 23:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_q; break;
                 case 1: op = rv_op_fmax_q; break;
+                case 2: op = rv_op_fminm_q; break;
+                case 3: op = rv_op_fmaxm_q; break;
                 }
                 break;
             case 32:
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 4: op = rv_op_fround_s; break;
+                case 5: op = rv_op_froundnx_s; break;
                 case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_d_s; break;
                 case 3: op = rv_op_fcvt_d_q; break;
+                case 4: op = rv_op_fround_d; break;
+                case 5: op = rv_op_froundnx_d; break;
                 }
                 break;
             case 34:
                 switch (((inst >> 20) & 0b11111)) {
+                case 4: op = rv_op_fround_h; break;
+                case 5: op = rv_op_froundnx_h; break;
                 case 8: op = rv_op_fcvt_bf16_s; break;
                 }
                 break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
                 case 1: op = rv_op_fcvt_q_d; break;
+                case 4: op = rv_op_fround_q; break;
+                case 5: op = rv_op_froundnx_q; break;
                 }
                 break;
             case 44:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_s; break;
                 case 1: op = rv_op_flt_s; break;
                 case 2: op = rv_op_feq_s; break;
+                case 4: op = rv_op_fleq_s; break;
+                case 5: op = rv_op_fltq_s; break;
                 }
                 break;
             case 81:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_d; break;
                 case 1: op = rv_op_flt_d; break;
                 case 2: op = rv_op_feq_d; break;
+                case 4: op = rv_op_fleq_d; break;
+                case 5: op = rv_op_fltq_d; break;
+                }
+                break;
+            case 82:
+                switch (((inst >> 12) & 0b111)) {
+                case 4: op = rv_op_fleq_h; break;
+                case 5: op = rv_op_fltq_h; break;
                 }
                 break;
             case 83:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_q; break;
                 case 1: op = rv_op_flt_q; break;
                 case 2: op = rv_op_feq_q; break;
+                case 4: op = rv_op_fleq_q; break;
+                case 5: op = rv_op_fltq_q; break;
+                }
+                break;
+            case 89:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_d_x; break;
+                }
+                break;
+            case 91:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_q_x; break;
                 }
                 break;
             case 96:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fcvt_wu_d; break;
                 case 2: op = rv_op_fcvt_l_d; break;
                 case 3: op = rv_op_fcvt_lu_d; break;
+                case 8: op = rv_op_fcvtmod_w_d; break;
                 }
                 break;
             case 99:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_d; break;
                 case 1: op = rv_op_fclass_d; break;
+                case 8: op = rv_op_fmvh_x_d; break;
                 }
                 break;
             case 114:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_q; break;
                 case 1: op = rv_op_fclass_q; break;
+                case 8: op = rv_op_fmvh_x_q; break;
                 }
                 break;
             case 120:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_s_x; break;
+                case 8: op = rv_op_fli_s; break;
                 }
                 break;
             case 121:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_d_x; break;
+                case 8: op = rv_op_fli_d; break;
                 }
                 break;
             case 122:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_h_x; break;
+                case 8: op = rv_op_fli_h; break;
                 }
                 break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_q_x; break;
+                case 8: op = rv_op_fli_q; break;
                 }
                 break;
             }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
         break;
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
+	break;
+    case rv_codec_fli:
+        dec->rd = operand_rd(inst);
+        dec->imm = operand_rs1(inst);
         break;
     case rv_codec_r2_imm5:
         dec->rd = operand_rd(inst);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             append(buf, tmp, buflen);
             break;
         }
+        case 'h':
+            append(buf, rv_fli_name_const[dec->imm], buflen);
+            break;
         default:
             break;
         }
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
     env->priv_ver = PRIV_VERSION_1_11_0;
 
+    cpu->cfg.ext_zfa = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
     cpu->cfg.ext_xtheadba = true;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
+        error_setg(errp, "Zfa extension requires F extension");
+        return;
+    }
+
     if (cpu->cfg.ext_zfh) {
         cpu->cfg.ext_zfhmin = true;
     }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_min(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_max(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
     return fclass_s(frs1);
 }
 
+uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float32 frs1 = check_nanbox_s(env, rs1);
+
+    frs1 = float32_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_s(env, frs1);
+}
+
+uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float32_round_to_int(frs1, &env->fp_status);
+    return nanbox_s(env, frs1);
+}
+
 uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_add(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_minimum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_min(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_maximum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_max(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
 {
     return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
     return float64_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
     return float64_to_int32(frs1, &env->fp_status);
 }
 
+uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
+{
+    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
+}
+
 target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
 {
     return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
     return fclass_d(frs1);
 }
 
+uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+
+    frs1 = float64_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return frs1;
+}
+
+uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
+{
+    return float64_round_to_int(frs1, &env->fp_status);
+}
+
 uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_min(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_max(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
     return fclass_h(frs1);
 }
 
+uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float16 frs1 = check_nanbox_h(env, rs1);
+
+    frs1 = float16_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_h(env, frs1);
+}
+
+uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float16_round_to_int(frs1, &env->fp_status);
+    return nanbox_h(env, frs1);
+}
+
 target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvzicond.c.inc"
 #include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzicbo.c.inc"
+#include "insn_trans/trans_rvzfa.c.inc"
 #include "insn_trans/trans_rvzfh.c.inc"
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/test-fcvtmod.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define FFLAG_NX_SHIFT 0 /* inexact */
+#define FFLAG_UF_SHIFT 1 /* underflow */
+#define FFLAG_OF_SHIFT 2 /* overflow */
+#define FFLAG_DZ_SHIFT 3 /* divide by zero */
+#define FFLAG_NV_SHIFT 4 /* invalid operation */
+
+#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
+#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
+#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
+#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
+#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
+
+typedef struct fp64_fcvt_fcvtmod_testcase {
+    const char* name;
+    union {
+        uint64_t inp_lu;
+        double inp_lf;
+    };
+    uint64_t exp_fcvt;
+    uint8_t exp_fcvt_fflags;
+    uint64_t exp_fcvtmod;
+    uint8_t exp_fcvtmod_fflags;
+} fp64_fcvt_fcvtmod_testcase_t;
+
+void print_fflags(uint8_t fflags)
+{
+    int set = 0;
+
+    if (fflags == 0) {
+        printf("-");
+        return;
+    }
+
+    if (fflags & FFLAG_NV) {
+        printf("%sFFLAG_NV", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_DZ) {
+        printf("%sFFLAG_DZ", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_OF) {
+        printf("%sFFLAG_OF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_UF) {
+        printf("%sFFLAG_UF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_NX) {
+        printf("%sFFLAG_NX", set ? " | " : "");
+        set = 1;
+    }
+}
+
+/* Clear all FP flags. */
+static inline void clear_fflags()
+{
+    __asm__ __volatile__("fsflags zero");
+}
+
+/* Read all FP flags. */
+static inline uint8_t get_fflags()
+{
+    uint64_t v;
+    __asm__ __volatile__("frflags %0" : "=r"(v));
+    return (uint8_t)v;
+}
+
+/* Move input value (without conversations) into an FP register. */
+static inline double do_fmv_d_x(uint64_t inp)
+{
+    double fpr;
+    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
+    return fpr;
+}
+
+static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
+    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
+    /* Zero (exp=0, frac=0) */
+    { .name = "+0.0",
+      .inp_lf = 0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-0.0",
+      .inp_lf = -0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+
+    /* Subnormal: exp=0 frac!=0 */
+    { .name = "Subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Subnormal frac=0xf..f",
+      .inp_lu = 0x0000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=0xf..f",
+      .inp_lu = 0x8000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    /* Infinity: exp=0x7ff, frac=0 */
+    { .name = "+INF",
+      .inp_lu = 0x7ff0000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-INF",
+      .inp_lu = 0xfff0000000000000,
+      .exp_fcvt = 0xffffffff80000000, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* NaN: exp=7ff, frac!=0 */
+    { .name = "canonical NaN",
+      .inp_lu = 0x7ff8000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "non-canonical NaN",
+      .inp_lu = 0x7ff8000000100000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* Normal numbers: exp!=0, exp!=7ff */
+    { .name = "+smallest normal value",
+      .inp_lu = 0x0010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-smallest normal value",
+      .inp_lu = 0x8010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+0.5",
+      .inp_lf = 0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-0.5",
+      .inp_lf = -0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+value just below 1.0",
+      .inp_lu = 0x3fefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-value just above -1.0",
+      .inp_lu = 0xbfefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+1.0",
+      .inp_lf = 0x1p0,
+      .exp_fcvt = 0x0000000000000001,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000001,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-1.0",
+      .inp_lf = -0x1p0,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = 0 },
+
+    { .name = "+1.5",
+      .inp_lu = 0x3ff8000000000000,
+      .exp_fcvt = 1,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 1,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-1.5",
+      .inp_lu = 0xbff8000000000000,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+max int32 (2147483647)",
+      .inp_lu = 0x41dfffffffc00000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x000000007fffffff,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "+max int32 +1 (2147483648)",
+      .inp_lf = 0x1p31,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "+max int32 +2 (2147483649)",
+      .inp_lu = 0x41e0000000200000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    { .name = "-max int32 (-2147483648)",
+      .inp_lf = -0x1p31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffff80000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-max int32 -1 (-2147483649)",
+      .inp_lf = -0x1.00000002p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483647, /* int32 max */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-max int32 -2 (-2147483650)",
+      .inp_lf = -0x1.00000004p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483646, /* int32 max -1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+};
+
+int run_fcvtmod_tests()
+{
+    uint64_t act_fcvt;
+    uint8_t act_fcvt_fflags;
+    uint64_t act_fcvtmod;
+    uint8_t act_fcvtmod_fflags;
+
+    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
+        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
+
+        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
+        int fcvt_correct = act_fcvt == t->exp_fcvt &&
+                    act_fcvt_fflags == t->exp_fcvt_fflags;
+        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
+        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
+                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
+
+        if (fcvt_correct && fcvtmod_correct) {
+            continue;
+        }
+
+        printf("Test %zu (%s) failed!\n", i, t->name);
+
+        double fpr = do_fmv_d_x(t->inp_lu);
+        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
+        printf("inp_lf: %lf\n", t->inp_lf);
+
+        uint32_t sign = (t->inp_lu >> 63);
+        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
+        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
+        int true_exp = exp - 1023;
+        int shift = true_exp - 52;
+        uint64_t true_frac = frac | 1ull << 52;
+
+        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
+        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
+
+        if (!fcvt_correct) {
+            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
+            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
+            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
+            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
+        }
+
+        if (!fcvtmod_correct) {
+            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
+            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
+            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
+            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
+        }
+
+        return 1;
+    }
+
+    return 0;
+}
+
+int main()
+{
+    return run_fcvtmod_tests();
+}
diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the Zfa Standard Extension.
+ *
+ * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFA(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfa) { \
+        return false;             \
+    }                             \
+} while (0)
+
+#define REQUIRE_ZFH(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfh) { \
+        return false;             \
+    }                             \
+} while (0)
+
+static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
+    static const uint64_t fli_s_table[] = {
+        0xffffffffbf800000,  /* -1.0 */
+        0xffffffff00800000,  /* minimum positive normal */
+        0xffffffff37800000,  /* 1.0 * 2^-16 */
+        0xffffffff38000000,  /* 1.0 * 2^-15 */
+        0xffffffff3b800000,  /* 1.0 * 2^-8  */
+        0xffffffff3c000000,  /* 1.0 * 2^-7  */
+        0xffffffff3d800000,  /* 1.0 * 2^-4  */
+        0xffffffff3e000000,  /* 1.0 * 2^-3  */
+        0xffffffff3e800000,  /* 0.25 */
+        0xffffffff3ea00000,  /* 0.3125 */
+        0xffffffff3ec00000,  /* 0.375 */
+        0xffffffff3ee00000,  /* 0.4375 */
+        0xffffffff3f000000,  /* 0.5 */
+        0xffffffff3f200000,  /* 0.625 */
+        0xffffffff3f400000,  /* 0.75 */
+        0xffffffff3f600000,  /* 0.875 */
+        0xffffffff3f800000,  /* 1.0 */
+        0xffffffff3fa00000,  /* 1.25 */
+        0xffffffff3fc00000,  /* 1.5 */
+        0xffffffff3fe00000,  /* 1.75 */
+        0xffffffff40000000,  /* 2.0 */
+        0xffffffff40200000,  /* 2.5 */
+        0xffffffff40400000,  /* 3 */
+        0xffffffff40800000,  /* 4 */
+        0xffffffff41000000,  /* 8 */
+        0xffffffff41800000,  /* 16 */
+        0xffffffff43000000,  /* 2^7 */
+        0xffffffff43800000,  /* 2^8 */
+        0xffffffff47000000,  /* 2^15 */
+        0xffffffff47800000,  /* 2^16 */
+        0xffffffff7f800000,  /* +inf */
+        0xffffffff7fc00000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    static const uint64_t fli_d_table[] = {
+        0xbff0000000000000,  /* -1.0 */
+        0x0010000000000000,  /* minimum positive normal */
+        0x3ef0000000000000,  /* 1.0 * 2^-16 */
+        0x3f00000000000000,  /* 1.0 * 2^-15 */
+        0x3f70000000000000,  /* 1.0 * 2^-8  */
+        0x3f80000000000000,  /* 1.0 * 2^-7  */
+        0x3fb0000000000000,  /* 1.0 * 2^-4  */
+        0x3fc0000000000000,  /* 1.0 * 2^-3  */
+        0x3fd0000000000000,  /* 0.25 */
+        0x3fd4000000000000,  /* 0.3125 */
+        0x3fd8000000000000,  /* 0.375 */
+        0x3fdc000000000000,  /* 0.4375 */
+        0x3fe0000000000000,  /* 0.5 */
+        0x3fe4000000000000,  /* 0.625 */
+        0x3fe8000000000000,  /* 0.75 */
+        0x3fec000000000000,  /* 0.875 */
+        0x3ff0000000000000,  /* 1.0 */
+        0x3ff4000000000000,  /* 1.25 */
+        0x3ff8000000000000,  /* 1.5 */
+        0x3ffc000000000000,  /* 1.75 */
+        0x4000000000000000,  /* 2.0 */
+        0x4004000000000000,  /* 2.5 */
+        0x4008000000000000,  /* 3 */
+        0x4010000000000000,  /* 4 */
+        0x4020000000000000,  /* 8 */
+        0x4030000000000000,  /* 16 */
+        0x4060000000000000,  /* 2^7 */
+        0x4070000000000000,  /* 2^8 */
+        0x40e0000000000000,  /* 2^15 */
+        0x40f0000000000000,  /* 2^16 */
+        0x7ff0000000000000,  /* +inf */
+        0x7ff8000000000000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
+    static const uint64_t fli_h_table[] = {
+        0xffffffffffffbc00,  /* -1.0 */
+        0xffffffffffff0400,  /* minimum positive normal */
+        0xffffffffffff0100,  /* 1.0 * 2^-16 */
+        0xffffffffffff0200,  /* 1.0 * 2^-15 */
+        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
+        0xffffffffffff2000,  /* 1.0 * 2^-7  */
+        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
+        0xffffffffffff3000,  /* 1.0 * 2^-3  */
+        0xffffffffffff3400,  /* 0.25 */
+        0xffffffffffff3500,  /* 0.3125 */
+        0xffffffffffff3600,  /* 0.375 */
+        0xffffffffffff3700,  /* 0.4375 */
+        0xffffffffffff3800,  /* 0.5 */
+        0xffffffffffff3900,  /* 0.625 */
+        0xffffffffffff3a00,  /* 0.75 */
+        0xffffffffffff3b00,  /* 0.875 */
+        0xffffffffffff3c00,  /* 1.0 */
+        0xffffffffffff3d00,  /* 1.25 */
+        0xffffffffffff3e00,  /* 1.5 */
+        0xffffffffffff3f00,  /* 1.75 */
+        0xffffffffffff4000,  /* 2.0 */
+        0xffffffffffff4100,  /* 2.5 */
+        0xffffffffffff4200,  /* 3 */
+        0xffffffffffff4400,  /* 4 */
+        0xffffffffffff4800,  /* 8 */
+        0xffffffffffff4c00,  /* 16 */
+        0xffffffffffff5800,  /* 2^7 */
+        0xffffffffffff5c00,  /* 2^8 */
+        0xffffffffffff7800,  /* 2^15 */
+        0xffffffffffff7c00,  /* 2^16 */
+        0xffffffffffff7c00,  /* +inf */
+        0xffffffffffff7e00,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fminm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+
+    /* Rounding mode is RTZ. */
+    gen_set_rm(ctx, RISCV_FRM_RTZ);
+    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+
+    return true;
+}
+
+bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+    return true;
+}
+
+bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
 
 TESTS += test-aes
 run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
+
+# Test for fcvtmod
+TESTS += test-fcvtmod
+test-fcvtmod: CFLAGS += -march=rv64imafdc
+test-fcvtmod: LDFLAGS += -static
+run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
-- 
2.40.1

The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911

for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:

target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)

----------------------------------------------------------------
First RISC-V PR for 8.2

* Remove 'host' CPU from TCG
 * riscv_htif Fixup printing on big endian hosts
 * Add zmmul isa string
 * Add smepmp isa string
 * Fix page_check_range use in fault-only-first
 * Use existing lookup tables for MixColumns
 * Add RISC-V vector cryptographic instruction set support
 * Implement WARL behaviour for mcountinhibit/mcounteren
 * Add Zihintntl extension ISA string to DTS
 * Fix zfa fleq.d and fltq.d
 * Fix upper/lower mtime write calculation
 * Make rtc variable names consistent
 * Use abi type for linux-user target_ucontext
 * Add RISC-V KVM AIA Support
 * Fix riscv,pmu DT node path in the virt machine
 * Update CSR bits name for svadu extension
 * Mark zicond non-experimental
 * Fix satp_mode_finalize() when satp_mode.supported = 0
 * Fix non-KVM --enable-debug build
 * Add new extensions to hwprobe
 * Use accelerated helper for AES64KS1I
 * Allocate itrigger timers only once
 * Respect mseccfg.RLB for pmpaddrX changes
 * Align the AIA model to v1.0 ratified spec
 * Don't read the CSR in riscv_csrrw_do64

----------------------------------------------------------------
Akihiko Odaki (1):
      target/riscv: Allocate itrigger timers only once

Ard Biesheuvel (2):
      target/riscv: Use existing lookup tables for MixColumns
      target/riscv: Use accelerated helper for AES64KS1I

Conor Dooley (1):
      hw/riscv: virt: Fix riscv,pmu DT node path

Daniel Henrique Barboza (6):
      target/riscv/cpu.c: do not run 'host' CPU with TCG
      target/riscv/cpu.c: add zmmul isa string
      target/riscv/cpu.c: add smepmp isa string
      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
      hw/riscv/virt.c: fix non-KVM --enable-debug build
      hw/intc/riscv_aplic.c fix non-KVM --enable-debug build

Dickon Hood (2):
      target/riscv: Refactor translation of vector-widening instruction
      target/riscv: Add Zvbb ISA extension support

Jason Chien (3):
      target/riscv: Add Zihintntl extension ISA string to DTS
      hw/intc: Fix upper/lower mtime write calculation
      hw/intc: Make rtc variable names consistent

Kiran Ostrolenk (4):
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Refactor vector-vector translation macro
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Add Zvknh ISA extension support

LIU Zhiwei (3):
      target/riscv: Fix page_check_range use in fault-only-first
      target/riscv: Fix zfa fleq.d and fltq.d
      linux-user/riscv: Use abi type for target_ucontext

Lawrence Hunter (2):
      target/riscv: Add Zvbc ISA extension support
      target/riscv: Add Zvksh ISA extension support

Leon Schuermann (1):
      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes

Max Chou (3):
      crypto: Create sm4_subword
      crypto: Add SM4 constant parameter CK
      target/riscv: Add Zvksed ISA extension support

Nazar Kazakov (4):
      target/riscv: Remove redundant "cpu_vl == 0" checks
      target/riscv: Move vector translation checks
      target/riscv: Add Zvkned ISA extension support
      target/riscv: Add Zvkg ISA extension support

Nikita Shubin (1):
      target/riscv: don't read CSR in riscv_csrrw_do64

Rob Bradford (1):
      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren

Robbin Ehn (1):
      linux-user/riscv: Add new extensions to hwprobe

Thomas Huth (2):
      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
      hw/char/riscv_htif: Fix the console syscall on big endian hosts

Tommy Wu (1):
      target/riscv: Align the AIA model to v1.0 ratified spec

Vineet Gupta (1):
      riscv: zicond: make non-experimental

Weiwei Li (1):
      target/riscv: Update CSR bits name for svadu extension

Yong-Xuan Wang (5):
      target/riscv: support the AIA device emulation with KVM enabled
      target/riscv: check the in-kernel irqchip support
      target/riscv: Create an KVM AIA irqchip
      target/riscv: update APLIC and IMSIC to support KVM AIA
      target/riscv: select KVM AIA in riscv virt machine

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The 'host' CPU is available in a CONFIG_KVM build and it's currently
available for all accels, but is a KVM only CPU. This means that in a
RISC-V KVM capable host we can do things like this:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: H extension requires priv spec 1.12.0

This CPU does not have a priv spec because we don't filter its extensions
via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
with the 'host' CPU.

We don't have a way to filter the 'host' CPU out of the available CPU
options (-cpu help) if the build includes both KVM and TCG. What we can
do is to error out during riscv_cpu_realize_tcg() if the user chooses
the 'host' CPU with accel=tcg:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
+    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
+        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
+        return;
+    }
+
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

The character that should be printed is stored in the 64 bit "payload"
variable. The code currently tries to print it by taking the address
of the variable and passing this pointer to qemu_chr_fe_write(). However,
this only works on little endian hosts where the least significant bits
are stored on the lowest address. To do this in a portable way, we have
to store the value in an uint8_t variable instead.

Fixes: 5033606780 ("RISC-V HTIF Console")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721094720.902454-2-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             s->tohost = 0; /* clear to indicate we read */
             return;
         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
+            uint8_t ch = (uint8_t)payload;
+            qemu_chr_fe_write(&s->chr, &ch, 1);
             resp = 0x100 | (uint8_t)payload;
         } else {
             qemu_log("HTIF device %d: unknown command\n", device);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

Values that have been read via cpu_physical_memory_read() from the
guest's memory have to be swapped in case the host endianess differs
from the guest.

Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230721094720.902454-3-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
+#include "exec/tswap.h"
 #include "sysemu/dma.h"
 
 #define RISCV_DEBUG_HTIF 0
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             } else {
                 uint64_t syscall[8];
                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-                if (syscall[0] == PK_SYS_WRITE &&
-                    syscall[1] == HTIF_DEV_CONSOLE &&
-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
+                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
+                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
+                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                     uint8_t ch;
-                    cpu_physical_memory_read(syscall[2], &ch, 1);
+                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                     qemu_chr_fe_write(&s->chr, &ch, 1);
                     resp = 0x100 | (uint8_t)payload;
                 } else {
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
Add a riscv,isa string for it.

Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The cpu->cfg.epmp extension is still experimental, but it already has a
'smepmp' riscv,isa string. Add it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
integer return value to bool type. However, it wrongly converted the use
of the API in riscv fault-only-first, where page_check_range < = 0, should
be converted to !page_check_range.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, offset, PAGE_READ)) {
+                    if (!page_check_range(addr, offset, PAGE_READ)) {
                         vl = i;
                         goto ProbeSuccess;
                     }
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

The AES MixColumns and InvMixColumns operations are relatively
expensive 4x4 matrix multiplications in GF(2^8), which is why C
implementations usually rely on precomputed lookup tables rather than
performing the calculations on demand.

Given that we already carry those tables in QEMU, we can just grab the
right value in the implementation of the RISC-V AES32 instructions. Note
that the tables in question are permuted according to the respective
Sbox, so we can omit the Sbox lookup as well in this case.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Zewen Ye <lustrew@foxmail.com>
Cc: Weiwei Li <liweiwei@iscas.ac.cn>
Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/aes.h         |  7 +++++++
 crypto/aes.c                 |  4 ++--
 target/riscv/crypto_helper.c | 34 ++++------------------------------
 3 files changed, 13 insertions(+), 32 deletions(-)

diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
+/*
+AES_Te0[x] = S [x].[02, 01, 01, 03];
+AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
+*/
+
+extern const uint32_t AES_Te0[256], AES_Td0[256];
+
 #endif
diff --git a/crypto/aes.c b/crypto/aes.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
 AES_Td4[x] = Si[x].[01, 01, 01, 01];
 */
 
-static const uint32_t AES_Te0[256] = {
+const uint32_t AES_Te0[256] = {
     0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
     0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
     0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
     0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
 
-static const uint32_t AES_Td0[256] = {
+const uint32_t AES_Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
     0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 
-#define AES_XTIME(a) \
-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
-
-#define AES_GFMUL(a, b) (( \
-    (((b) & 0x1) ? (a) : 0) ^ \
-    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
-    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-
-static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
-{
-    uint32_t u;
-
-    if (fwd) {
-        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
-            (AES_GFMUL(x, 2) << 0);
-    } else {
-        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-    }
-    return u;
-}
-
 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
 
 static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                            bool enc, bool mix)
 {
     uint8_t si = rs2 >> shamt;
-    uint8_t so;
     uint32_t mixed;
     target_ulong res;
 
     if (enc) {
-        so = AES_sbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, true);
+            mixed = be32_to_cpu(AES_Te0[si]);
         } else {
-            mixed = so;
+            mixed = AES_sbox[si];
         }
     } else {
-        so = AES_isbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, false);
+            mixed = be32_to_cpu(AES_Td0[si]);
         } else {
-            mixed = so;
+            mixed = AES_isbox[si];
         }
     }
     mixed = rol32(mixed, shamt);
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Take some functions/macros out of `vector_helper` and put them in a new
module called `vector_internals`. This ensures they can be used by both
vector and vector-crypto helpers (latter implemented in proceeding
commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 201 +-------------------------------
 target/riscv/vector_internals.c |  81 +++++++++++++
 target/riscv/meson.build        |   1 +
 4 files changed, 265 insertions(+), 200 deletions(-)
 create mode 100644 target/riscv/vector_internals.h
 create mode 100644 target/riscv/vector_internals.c

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
+#define TARGET_RISCV_VECTOR_INTERNALS_H
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "cpu.h"
+#include "tcg/tcg-gvec-desc.h"
+#include "internals.h"
+
+static inline uint32_t vext_nf(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, NF);
+}
+
+/*
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing units smaller than that needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define H1(x)   ((x) ^ 7)
+#define H1_2(x) ((x) ^ 6)
+#define H1_4(x) ((x) ^ 4)
+#define H2(x)   ((x) ^ 3)
+#define H4(x)   ((x) ^ 1)
+#define H8(x)   ((x))
+#else
+#define H1(x)   (x)
+#define H1_2(x) (x)
+#define H1_4(x) (x)
+#define H2(x)   (x)
+#define H4(x)   (x)
+#define H8(x)   (x)
+#endif
+
+/*
+ * Encode LMUL to lmul as following:
+ *     LMUL    vlmul    lmul
+ *      1       000       0
+ *      2       001       1
+ *      4       010       2
+ *      8       011       3
+ *      -       100       -
+ *     1/8      101      -3
+ *     1/4      110      -2
+ *     1/2      111      -1
+ */
+static inline int32_t vext_lmul(uint32_t desc)
+{
+    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+}
+
+static inline uint32_t vext_vm(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VM);
+}
+
+static inline uint32_t vext_vma(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+}
+
+static inline uint32_t vext_vta(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+}
+
+static inline uint32_t vext_vta_all_1s(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+}
+
+/*
+ * Earlier designs (pre-0.9) had a varying number of bits
+ * per mask value (MLEN). In the 0.9 design, MLEN=1.
+ * (Section 4.5)
+ */
+static inline int vext_elem_mask(void *v0, int index)
+{
+    int idx = index / 64;
+    int pos = index  % 64;
+    return (((uint64_t *)v0)[idx] >> pos) & 1;
+}
+
+/*
+ * Get number of total elements, including prestart, body and tail elements.
+ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+ * are held in the same vector register.
+ */
+static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+                                            uint32_t esz)
+{
+    uint32_t vlenb = simd_maxsz(desc);
+    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+    return (vlenb << emul) / esz;
+}
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot);
+
+/* expand macro args before macro */
+#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+
+/* (TD, T1, T2, TX1, TX2) */
+#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+
+/* operation of two vector elements */
+typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+
+#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+{                                                               \
+    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz);
+
+/* generate the helpers for OPIVV */
+#define GEN_VEXT_VV(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+               do_##NAME, ESZ);                           \
+}
+
+typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+
+/*
+ * (T1)s1 gives the real operator type.
+ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+ */
+#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+{                                                                   \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz);
+
+/* generate the helpers for OPIVX */
+#define GEN_VEXT_VX(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+               do_##NAME, ESZ);                           \
+}
+
+#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
+#include "vector_internals.h"
 #include <math.h>
 
 target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     return vl;
 }
 
-/*
- * Note that vector data is stored in host-endian 64-bit chunks,
- * so addressing units smaller than that needs a host-endian fixup.
- */
-#if HOST_BIG_ENDIAN
-#define H1(x)   ((x) ^ 7)
-#define H1_2(x) ((x) ^ 6)
-#define H1_4(x) ((x) ^ 4)
-#define H2(x)   ((x) ^ 3)
-#define H4(x)   ((x) ^ 1)
-#define H8(x)   ((x))
-#else
-#define H1(x)   (x)
-#define H1_2(x) (x)
-#define H1_4(x) (x)
-#define H2(x)   (x)
-#define H4(x)   (x)
-#define H8(x)   (x)
-#endif
-
-static inline uint32_t vext_nf(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, NF);
-}
-
-static inline uint32_t vext_vm(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VM);
-}
-
-/*
- * Encode LMUL to lmul as following:
- *     LMUL    vlmul    lmul
- *      1       000       0
- *      2       001       1
- *      4       010       2
- *      8       011       3
- *      -       100       -
- *     1/8      101      -3
- *     1/4      110      -2
- *     1/2      111      -1
- */
-static inline int32_t vext_lmul(uint32_t desc)
-{
-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
-}
-
-static inline uint32_t vext_vta(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
-}
-
-static inline uint32_t vext_vma(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
-}
-
-static inline uint32_t vext_vta_all_1s(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
-}
-
 /*
  * Get the maximum number of elements can be operated.
  *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
-/*
- * Get number of total elements, including prestart, body and tail elements.
- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
- * are held in the same vector register.
- */
-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
-                                            uint32_t esz)
-{
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
-    return (vlenb << emul) / esz;
-}
-
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
     }
 }
 
-/* set agnostic elements to 1s */
-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-                              uint32_t tot)
-{
-    if (is_agnostic == 0) {
-        /* policy undisturbed */
-        return;
-    }
-    if (tot - cnt == 0) {
-        return;
-    }
-    memset(base + cnt, -1, tot - cnt);
-}
-
 static inline void vext_set_elem_mask(void *v0, int index,
                                       uint8_t value)
 {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
 }
 
-/*
- * Earlier designs (pre-0.9) had a varying number of bits
- * per mask value (MLEN). In the 0.9 design, MLEN=1.
- * (Section 4.5)
- */
-static inline int vext_elem_mask(void *v0, int index)
-{
-    int idx = index / 64;
-    int pos = index  % 64;
-    return (((uint64_t *)v0)[idx] >> pos) & 1;
-}
-
 /* elements operations for load and store */
 typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  * Vector Integer Arithmetic Instructions
  */
 
-/* expand macro args before macro */
-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
 #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
 #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
 #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
 #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 
-/* operation of two vector elements */
-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
-
-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
-{                                                               \
-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
-}
 #define DO_SUB(N, M) (N - M)
 #define DO_RSUB(N, M) (M - N)
 
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 
-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivv2_fn *fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, vs1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVV */
-#define GEN_VEXT_VV(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VV(vadd_vv_b, 1)
 GEN_VEXT_VV(vadd_vv_h, 2)
 GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
 GEN_VEXT_VV(vsub_vv_w, 4)
 GEN_VEXT_VV(vsub_vv_d, 8)
 
-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
-
-/*
- * (T1)s1 gives the real operator type.
- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
- */
-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
-{                                                                   \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
-}
 
 RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
 RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 
-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivx2_fn fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, s1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVX */
-#define GEN_VEXT_VX(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VX(vadd_vx_b, 1)
 GEN_VEXT_VX(vadd_vx_h, 2)
 GEN_VEXT_VX(vadd_vx_w, 4)
diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vector_internals.h"
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot)
+{
+    if (is_agnostic == 0) {
+        /* policy undisturbed */
+        return;
+    }
+    if (tot - cnt == 0) {
+        return ;
+    }
+    memset(base + cnt, -1, tot - cnt);
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, vs1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, s1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'gdbstub.c',
   'op_helper.c',
   'vector_helper.c',
+  'vector_internals.c',
   'bitmanip_helper.c',
   'translate.c',
   'm128_helper.c',
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
used in proceeding vector-crypto commits.

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
 1 file changed, 32 insertions(+), 30 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
 1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         return false;
     }
 
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
     if (checkfn(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
     if (opiwv_widen_check(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
 {
     uint32_t data = 0;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     data = FIELD_DP32(data, VDATA, VM, vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
             gen_helper_##NAME##_w,                                 \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
         vext_check_ss(s, a->rd, 0, 1)) {
         TCGv s1;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i64 t1;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         };                                                       \
         TCGLabel *over = gen_new_label();                        \
         gen_set_rm(s, RISCV_FRM_DYN);                            \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                  \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
         gen_set_rm_chkfrm(s, rm);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                 gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
         uint32_t data = 0;                                         \
         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
         require_vm(a->vm, a->rd)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
         TCGv s1;
         TCGLabel *over = gen_new_label();
 
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
         TCGv_i64 t1;
         TCGLabel *over = gen_new_label();
 
-        /* if vl == 0 or vstart >= vl, skip vector register write back */
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        /* if vstart >= vl, skip vector register write back */
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
     uint32_t data = 0;
     gen_helper_gvec_3_ptr *fn;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     static gen_helper_gvec_3_ptr * const fns[6][4] = {
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvbc vector-crypto extension, which
consists of the following instructions:

* vclmulh.[vx,vv]
* vclmul.[vx,vv]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
[max.chou@sifive.com: Exposed x-zvbc property]
Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  6 +++
 target/riscv/insn32.decode               |  6 +++
 target/riscv/cpu.c                       |  9 ++++
 target/riscv/translate.c                 |  1 +
 target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
 target/riscv/meson.build                 |  3 +-
 8 files changed, 146 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/vcrypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
and into the corresponding macros. This enables the functions to be
reused in proceeding commits without check duplication.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
 1 file changed, 12 insertions(+), 16 deletions(-)

From: Dickon Hood <dickon.hood@codethink.co.uk>

Zvbb (implemented in later commit) has a widening instruction, which
requires an extra check on the enabled extensions.  Refactor
GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
it.

Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
 1 file changed, 23 insertions(+), 29 deletions(-)

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Move some macros out of `vector_helper` and into `vector_internals`.
This ensures they can be used by both vector and vector-crypto helpers
(latter implemented in proceeding commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 42 ------------------------------
 2 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 /* expand macro args before macro */
 #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 
+/* (TD, T2, TX2) */
+#define OP_UU_B uint8_t, uint8_t, uint8_t
+#define OP_UU_H uint16_t, uint16_t, uint16_t
+#define OP_UU_W uint32_t, uint32_t, uint32_t
+#define OP_UU_D uint64_t, uint64_t, uint64_t
+
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 
+#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+static void do_##NAME(void *vd, void *vs2, int i)      \
+{                                                      \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+    *((TD *)vd + HD(i)) = OP(s2);                      \
+}
+
+#define GEN_VEXT_V(NAME, ESZ)                          \
+void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+                  CPURISCVState *env, uint32_t desc)   \
+{                                                      \
+    uint32_t vm = vext_vm(desc);                       \
+    uint32_t vl = env->vl;                             \
+    uint32_t total_elems =                             \
+        vext_get_total_elems(env, desc, ESZ);          \
+    uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
+    uint32_t i;                                        \
+                                                       \
+    for (i = env->vstart; i < vl; i++) {               \
+        if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
+            continue;                                  \
+        }                                              \
+        do_##NAME(vd, vs2, i);                         \
+    }                                                  \
+    env->vstart = 0;                                   \
+    /* set tail elements to 1s */                      \
+    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+                      total_elems * ESZ);              \
+}
+
 /* operation of two vector elements */
 typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                do_##NAME, ESZ);                           \
 }
 
+/* Three of the widening shortening macros: */
+/* (TD, T1, T2, TX1, TX2) */
+#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+
 #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
 #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
 #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
 #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
 GEN_VEXT_VF(vfwnmsac_vf_w, 8)
 
 /* Vector Floating-Point Square-Root Instruction */
-/* (TD, T2, TX2) */
-#define OP_UU_H uint16_t, uint16_t, uint16_t
-#define OP_UU_W uint32_t, uint32_t, uint32_t
-#define OP_UU_D uint64_t, uint64_t, uint64_t
-
 #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 static void do_##NAME(void *vd, void *vs2, int i,      \
                       CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
-static void do_##NAME(void *vd, void *vs2, int i)      \
-{                                                      \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
-    *((TD *)vd + HD(i)) = OP(s2);                      \
-}
-
-#define GEN_VEXT_V(NAME, ESZ)                          \
-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-                  CPURISCVState *env, uint32_t desc)   \
-{                                                      \
-    uint32_t vm = vext_vm(desc);                       \
-    uint32_t vl = env->vl;                             \
-    uint32_t total_elems =                             \
-        vext_get_total_elems(env, desc, ESZ);          \
-    uint32_t vta = vext_vta(desc);                     \
-    uint32_t vma = vext_vma(desc);                     \
-    uint32_t i;                                        \
-                                                       \
-    for (i = env->vstart; i < vl; i++) {               \
-        if (!vm && !vext_elem_mask(v0, i)) {           \
-            /* set masked-off elements to 1s */        \
-            vext_set_elems_1s(vd, vma, i * ESZ,        \
-                              (i + 1) * ESZ);          \
-            continue;                                  \
-        }                                              \
-        do_##NAME(vd, vs2, i);                         \
-    }                                                  \
-    env->vstart = 0;                                   \
-    /* set tail elements to 1s */                      \
-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
-                      total_elems * ESZ);              \
-}
-
 target_ulong fclass_h(uint64_t frs1)
 {
     float16 f = frs1;
-- 
2.41.0

From: Dickon Hood <dickon.hood@codethink.co.uk>

This commit adds support for the Zvbb vector-crypto extension, which
consists of the following instructions:

* vrol.[vv,vx]
* vror.[vv,vx,vi]
* vbrev8.v
* vrev8.v
* vandn.[vv,vx]
* vbrev.v
* vclz.v
* vctz.v
* vcpop.v
* vwsll.[vv,vx,vi]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Fix imm mode of vror.vi]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvbb property]
Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  62 +++++++++
 target/riscv/insn32.decode               |  20 +++
 target/riscv/cpu.c                       |  12 ++
 target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 6 files changed, 397 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
     bool ext_zve64d;
+    bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zmmul;
     bool ext_zvfbfmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_u    12:s20                 !function=ex_shift_12
 %imm_bs   30:2                   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_z6   26:1 15:5
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
 @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
 @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
+@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
 @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
 @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
 @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
+
+# *** Zvbb vector crypto extension ***
+vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
+vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
+vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
+vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
+vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
+vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
+vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
+vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
+vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
+vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
+vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    /*
+     * In principle Zve*x would also suffice here, were they supported
+     * in qemu
+     */
+    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+        error_setg(errp,
+                   "Vector crypto extensions require V or Zve* extensions");
+        return;
+    }
+
     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 
     /* Vector cryptography extensions */
+    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
+#include "qemu/bswap.h"
 #include "cpu.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 GEN_VEXT_VV(vclmulh_vv, 8)
 RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 GEN_VEXT_VX(vclmulh_vx, 8)
+
+RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
+RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
+RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
+RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
+GEN_VEXT_VV(vror_vv_b, 1)
+GEN_VEXT_VV(vror_vv_h, 2)
+GEN_VEXT_VV(vror_vv_w, 4)
+GEN_VEXT_VV(vror_vv_d, 8)
+
+RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
+RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
+RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
+RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
+GEN_VEXT_VX(vror_vx_b, 1)
+GEN_VEXT_VX(vror_vx_h, 2)
+GEN_VEXT_VX(vror_vx_w, 4)
+GEN_VEXT_VX(vror_vx_d, 8)
+
+RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
+RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
+RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
+RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
+GEN_VEXT_VV(vrol_vv_b, 1)
+GEN_VEXT_VV(vrol_vv_h, 2)
+GEN_VEXT_VV(vrol_vv_w, 4)
+GEN_VEXT_VV(vrol_vv_d, 8)
+
+RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
+RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
+RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
+RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
+GEN_VEXT_VX(vrol_vx_b, 1)
+GEN_VEXT_VX(vrol_vx_h, 2)
+GEN_VEXT_VX(vrol_vx_w, 4)
+GEN_VEXT_VX(vrol_vx_d, 8)
+
+static uint64_t brev8(uint64_t val)
+{
+    val = ((val & 0x5555555555555555ull) << 1) |
+          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
+    val = ((val & 0x3333333333333333ull) << 2) |
+          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
+    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
+          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
+
+    return val;
+}
+
+RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
+RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
+RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
+RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
+GEN_VEXT_V(vbrev8_v_b, 1)
+GEN_VEXT_V(vbrev8_v_h, 2)
+GEN_VEXT_V(vbrev8_v_w, 4)
+GEN_VEXT_V(vbrev8_v_d, 8)
+
+#define DO_IDENTITY(a) (a)
+RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
+RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
+RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
+RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
+GEN_VEXT_V(vrev8_v_b, 1)
+GEN_VEXT_V(vrev8_v_h, 2)
+GEN_VEXT_V(vrev8_v_w, 4)
+GEN_VEXT_V(vrev8_v_d, 8)
+
+#define DO_ANDN(a, b) ((a) & ~(b))
+RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
+GEN_VEXT_VV(vandn_vv_b, 1)
+GEN_VEXT_VV(vandn_vv_h, 2)
+GEN_VEXT_VV(vandn_vv_w, 4)
+GEN_VEXT_VV(vandn_vv_d, 8)
+
+RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
+GEN_VEXT_VX(vandn_vx_b, 1)
+GEN_VEXT_VX(vandn_vx_h, 2)
+GEN_VEXT_VX(vandn_vx_w, 4)
+GEN_VEXT_VX(vandn_vx_d, 8)
+
+RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
+RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
+RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
+RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
+GEN_VEXT_V(vbrev_v_b, 1)
+GEN_VEXT_V(vbrev_v_h, 2)
+GEN_VEXT_V(vbrev_v_w, 4)
+GEN_VEXT_V(vbrev_v_d, 8)
+
+RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
+RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
+RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
+RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
+GEN_VEXT_V(vclz_v_b, 1)
+GEN_VEXT_V(vclz_v_h, 2)
+GEN_VEXT_V(vclz_v_w, 4)
+GEN_VEXT_V(vclz_v_d, 8)
+
+RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
+RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
+RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
+RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
+GEN_VEXT_V(vctz_v_b, 1)
+GEN_VEXT_V(vctz_v_h, 2)
+GEN_VEXT_V(vctz_v_w, 4)
+GEN_VEXT_V(vctz_v_d, 8)
+
+RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
+RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
+RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
+RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
+GEN_VEXT_V(vcpop_v_b, 1)
+GEN_VEXT_V(vcpop_v_h, 2)
+GEN_VEXT_V(vcpop_v_w, 4)
+GEN_VEXT_V(vcpop_v_d, 8)
+
+#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
+RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
+GEN_VEXT_VV(vwsll_vv_b, 2)
+GEN_VEXT_VV(vwsll_vv_h, 4)
+GEN_VEXT_VV(vwsll_vv_w, 8)
+
+RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+GEN_VEXT_VX(vwsll_vx_b, 2)
+GEN_VEXT_VX(vwsll_vx_h, 4)
+GEN_VEXT_VX(vwsll_vx_w, 8)
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 
 GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
+
+/*
+ * Zvbb
+ */
+
+#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
+    {                                                                   \
+        if (CHECK(s, a)) {                                              \
+            static gen_helper_opivx *const fns[4] = {                   \
+                gen_helper_##OPIVX##_b,                                 \
+                gen_helper_##OPIVX##_h,                                 \
+                gen_helper_##OPIVX##_w,                                 \
+                gen_helper_##OPIVX##_d,                                 \
+            };                                                          \
+            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
+                                 IMM_MODE);                             \
+        }                                                               \
+        return false;                                                   \
+    }
+
+#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_gvec_4_ptr *const fns[4] = {               \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
+    {                                                            \
+        if (CHECK(s, a)) {                                       \
+            static gen_helper_opivx *const fns[4] = {            \
+                gen_helper_##NAME##_b,                           \
+                gen_helper_##NAME##_h,                           \
+                gen_helper_##NAME##_w,                           \
+                gen_helper_##NAME##_d,                           \
+            };                                                   \
+            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
+                                       fns[s->sew]);             \
+        }                                                        \
+        return false;                                            \
+    }
+
+static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+/* vrol.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
+
+/* vror.v[vxi] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
+GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
+
+#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_opivx *const fns[4] = {                    \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+/* vandn.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
+GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
+
+#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
+    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
+    {                                                                      \
+        if (CHECK(s, a)) {                                                 \
+            uint32_t data = 0;                                             \
+            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
+                gen_helper_##NAME##_b,                                     \
+                gen_helper_##NAME##_h,                                     \
+                gen_helper_##NAME##_w,                                     \
+                gen_helper_##NAME##_d,                                     \
+            };                                                             \
+            TCGLabel *over = gen_new_label();                              \
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
+                                                                           \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
+                               vreg_ofs(s, a->rs2), cpu_env,               \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
+                               data, fns[s->sew]);                         \
+            mark_vs_dirty(s);                                              \
+            gen_set_label(over);                                           \
+            return true;                                                   \
+        }                                                                  \
+        return false;                                                      \
+    }
+
+static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
+{
+    return s->cfg_ptr->ext_zvbb == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ss(s, a->rd, a->rs2, a->vm);
+}
+
+GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
+
+static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
+}
+
+static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
+}
+
+/* OPIVI without GVEC IR */
+#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
+    {                                                                        \
+        if (CHECK(s, a)) {                                                   \
+            static gen_helper_opivx *const fns[3] = {                        \
+                gen_helper_##OPIVX##_b,                                      \
+                gen_helper_##OPIVX##_h,                                      \
+                gen_helper_##OPIVX##_w,                                      \
+            };                                                               \
+            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
+                               IMM_MODE);                                    \
+        }                                                                    \
+        return false;                                                        \
+    }
+
+GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
-- 
2.41.0

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkned vector-crypto extension, which
consists of the following instructions:

* vaesef.[vv,vs]
* vaesdf.[vv,vs]
* vaesdm.[vv,vs]
* vaesz.vs
* vaesem.[vv,vs]
* vaeskf1.vi
* vaeskf2.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
property]
[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
egs checking by helper function]
[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  14 ++
 target/riscv/insn32.decode               |  14 ++
 target/riscv/cpu.c                       |   4 +-
 target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 6 files changed, 381 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64d;
     bool ext_zvbb;
     bool ext_zvbc;
+    bool ext_zvkned;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_2(egs_check, void, i32, env)
+
+DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
+DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
 @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
 @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
+@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
 @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
 @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
 @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
+
+# *** Zvkned vector crypto extension ***
+vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
+vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/bswap.h"
 #include "cpu.h"
+#include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 GEN_VEXT_VX(vwsll_vx_b, 2)
 GEN_VEXT_VX(vwsll_vx_h, 4)
 GEN_VEXT_VX(vwsll_vx_w, 8)
+
+void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
+{
+    uint32_t vl = env->vl;
+    uint32_t vstart = env->vstart;
+
+    if (vl % egs != 0 || vstart % egs != 0) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
+static inline void xor_round_key(AESState *round_state, AESState *round_key)
+{
+    round_state->v = round_state->v ^ round_key->v;
+}
+
+#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
+
+void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 10 || uimm == 0) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[8], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vs2[i * 4 + H4(0)];
+        rk[1] = vs2[i * 4 + H4(1)];
+        rk[2] = vs2[i * 4 + H4(2)];
+        rk[3] = vs2[i * 4 + H4(3)];
+        tmp = ror32(rk[3], 8);
+
+        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                      ^ rcon[uimm - 1];
+        rk[5] = rk[1] ^ rk[4];
+        rk[6] = rk[2] ^ rk[5];
+        rk[7] = rk[3] ^ rk[6];
+
+        vd[i * 4 + H4(0)] = rk[4];
+        vd[i * 4 + H4(1)] = rk[5];
+        vd[i * 4 + H4(2)] = rk[6];
+        vd[i * 4 + H4(3)] = rk[7];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
+
+void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 14 || uimm < 2) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[12], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vd[i * 4 + H4(0)];
+        rk[1] = vd[i * 4 + H4(1)];
+        rk[2] = vd[i * 4 + H4(2)];
+        rk[3] = vd[i * 4 + H4(3)];
+        rk[4] = vs2[i * 4 + H4(0)];
+        rk[5] = vs2[i * 4 + H4(1)];
+        rk[6] = vs2[i * 4 + H4(2)];
+        rk[7] = vs2[i * 4 + H4(3)];
+
+        if (uimm % 2 == 0) {
+            tmp = ror32(rk[7], 8);
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                          ^ rcon[(uimm - 1) / 2];
+        } else {
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
+        }
+        rk[9] = rk[1] ^ rk[8];
+        rk[10] = rk[2] ^ rk[9];
+        rk[11] = rk[3] ^ rk[10];
+
+        vd[i * 4 + H4(0)] = rk[8];
+        vd[i * 4 + H4(1)] = rk[9];
+        vd[i * 4 + H4(2)] = rk[10];
+        vd[i * 4 + H4(3)] = rk[11];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
+
+/*
+ * Zvkned
+ */
+
+#define ZVKNED_EGS 4
+
+#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 desc, egs;                                               \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul) &&
+           s->sew == MO_32;
+}
+
+static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
+{
+    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
+    return !is_overlapped(vd, op_size, vs2, 1);
+}
+
+static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return vaes_check_overlap(s, a->rd, a->rs2) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           require_align(a->rd, s->lmul) &&
+           s->sew == MO_32;
+}
+
+GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
+
+#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 uimm_v, desc, egs;                                       \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            uimm_v = tcg_constant_i32(a->rs1);                                \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
+GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

This commit adds support for the Zvknh vector-crypto extension, which
consists of the following instructions:

* vsha2ms.vv
* vsha2c[hl].vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
[max.chou@sifive.com: Replaced SEW selection to happened during
translation]
Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   2 +
 target/riscv/helper.h                    |   6 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |  13 +-
 target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 6 files changed, 390 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zvkned;
+    bool ext_zvknha;
+    bool ext_zvknhb;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+
+DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+
+# *** Zvknh vector crypto extension ***
+vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
+        !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
     }
 
-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
+    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
+        error_setg(
+            errp,
+            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
+    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     /* set tail elements to 1s */
     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 }
+
+static inline uint32_t sig0_sha256(uint32_t x)
+{
+    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
+}
+
+static inline uint32_t sig1_sha256(uint32_t x)
+{
+    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
+}
+
+static inline uint64_t sig0_sha512(uint64_t x)
+{
+    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
+}
+
+static inline uint64_t sig1_sha512(uint64_t x)
+{
+    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
+}
+
+static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
+{
+    uint32_t res[4];
+    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
+             vd[H4(0)];
+    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
+             vd[H4(1)];
+    res[2] =
+        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
+    res[3] =
+        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
+    vd[H4(3)] = res[3];
+    vd[H4(2)] = res[2];
+    vd[H4(1)] = res[1];
+    vd[H4(0)] = res[0];
+}
+
+static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
+{
+    uint64_t res[4];
+    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
+    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
+    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
+    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
+    vd[3] = res[3];
+    vd[2] = res[2];
+    vd[1] = res[1];
+    vd[0] = res[0];
+}
+
+void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                        uint32_t desc)
+{
+    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
+    uint32_t esz = sew == MO_32 ? 4 : 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        if (sew == MO_32) {
+            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
+                        ((uint32_t *)vs2) + i * 4);
+        } else {
+            /* If not 32 then SEW should be 64 */
+            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
+                        ((uint64_t *)vs2) + i * 4);
+        }
+    }
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+static inline uint64_t sum0_64(uint64_t x)
+{
+    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
+}
+
+static inline uint32_t sum0_32(uint32_t x)
+{
+    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
+}
+
+static inline uint64_t sum1_64(uint64_t x)
+{
+    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
+}
+
+static inline uint32_t sum1_32(uint32_t x)
+{
+    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
+}
+
+#define ch(x, y, z) ((x & y) ^ ((~x) & z))
+
+#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
+
+static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
+{
+    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
+    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
+    uint64_t W0 = vs1[0], W1 = vs1[1];
+    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
+    uint64_t T2 = sum0_64(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
+    T2 = sum0_64(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[0] = f;
+    vd[1] = e;
+    vd[2] = b;
+    vd[3] = a;
+}
+
+static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
+{
+    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
+    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
+    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
+    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
+    uint32_t T2 = sum0_32(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
+    T2 = sum0_32(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[H4(0)] = f;
+    vd[H4(1)] = e;
+    vd[H4(2)] = b;
+    vd[H4(3)] = a;
+}
+
+void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  ((uint32_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  ((uint64_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  (((uint32_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  (((uint64_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 
 GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+
+/*
+ * Zvknh
+ */
+
+#define ZVKNH_EGS 4
+
+#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+            TCGv_i32 egs;                                                     \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
+                               vreg_ofs(s, a->rs2), cpu_env,                  \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
+                               data, gen_helper_##NAME);                      \
+                                                                              \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vsha_check_sew(DisasContext *s)
+{
+    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
+           (s->cfg_ptr->ext_zvknhb == true &&
+            (s->sew == MO_32 || s->sew == MO_64));
+}
+
+static bool vsha_check(DisasContext *s, arg_rmrr *a)
+{
+    int egw_bytes = ZVKNH_EGS << s->sew;
+    int mult = 1 << MAX(s->lmul, 0);
+    return opivv_check(s, a) &&
+           vsha_check_sew(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           !is_overlapped(a->rd, mult, a->rs1, mult) &&
+           !is_overlapped(a->rd, mult, a->rs2, mult) &&
+           s->lmul >= 0;
+}
+
+GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
+
+static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvksh vector-crypto extension, which
consists of the following instructions:

* vsm3me.vv
* vsm3c.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvksh property]
Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   3 +
 target/riscv/insn32.decode               |   4 +
 target/riscv/cpu.c                       |   6 +-
 target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 6 files changed, 177 insertions(+), 2 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkg vector-crypto extension, which
consists of the following instructions:

* vgmul.vv
* vghsh.vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvkg property]
[max.chou@sifive.com: Replaced uint by int for cross win32 build]
Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  3 +
 target/riscv/insn32.decode               |  4 ++
 target/riscv/cpu.c                       |  6 +-
 target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 6 files changed, 114 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

Allows sharing of sm4_subword between different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h           |  8 ++++++++
 target/arm/tcg/crypto_helper.c | 10 ++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 
 extern const uint8_t sm4_sbox[256];
 
+static inline uint32_t sm4_subword(uint32_t word)
+{
+    return sm4_sbox[word & 0xff] |
+           sm4_sbox[(word >> 8) & 0xff] << 8 |
+           sm4_sbox[(word >> 16) & 0xff] << 16 |
+           sm4_sbox[(word >> 24) & 0xff] << 24;
+}
+
 #endif
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(n, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
                             rol32(t, 24);
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(m, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
     }
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

Adds sm4_ck constant for use in sm4 cryptography across different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h |  1 +
 crypto/sm4.c         | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_SM4_H
 
 extern const uint8_t sm4_sbox[256];
+extern const uint32_t sm4_ck[32];
 
 static inline uint32_t sm4_subword(uint32_t word)
 {
diff --git a/crypto/sm4.c b/crypto/sm4.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/sm4.c
+++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
     0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
 };
 
+uint32_t const sm4_ck[] = {
+    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
+    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
+    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
+    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
+    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
+    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
+    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
+    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
+};
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

This commit adds support for the Zvksed vector-crypto extension, which
consists of the following instructions:

* vsm4k.vi
* vsm4r.[vv,vs]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
[lawrence.hunter@codethink.co.uk: Moved SM4 functions from
crypto_helper.c to vcrypto_helper.c]
[nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
use macros, and minor style changes]
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   4 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |   5 +-
 target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 6 files changed, 184 insertions(+), 1 deletion(-)

From: Rob Bradford <rbradford@rivosinc.com>

These are WARL fields - zero out the bits for unavailable counters and
special case the TM bit in mcountinhibit which is hardwired to zero.
This patch achieves this by modifying the value written so that any use
of the field will see the correctly masked bits.

Tested by modifying OpenSBI to write max value to these CSRs and upon
subsequent read the appropriate number of bits for number of PMUs is
enabled and the TM bit is zero in mcountinhibit.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 {
     int cidx;
     PMUCTRState *counter;
+    RISCVCPU *cpu = env_archcpu(env);
 
-    env->mcountinhibit = val;
+    /* WARL register - disable unavailable counters; TM bit is always 0 */
+    env->mcountinhibit =
+        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
 
     /* Check if any other counter is also monitoring cycles/instructions */
     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    env->mcounteren = val;
+    RISCVCPU *cpu = env_archcpu(env);
+
+    /* WARL register - disable unavailable counters */
+    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
+                             COUNTEREN_IR);
     return RISCV_EXCP_NONE;
 }
 
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

RVA23 Profiles states:
The RVA23 profiles are intended to be used for 64-bit application
processors that will run rich OS stacks from standard binary OS
distributions and with a substantial number of third-party binary user
applications that will be supported over a considerable length of time
in the field.

The chapter 4 of the unprivileged spec introduces the Zihintntl extension
and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
purpose is to enable application and operating system portability across
different implementations. Thus the DTS should contain the Zihintntl ISA
string in order to pass to software.

The unprivileged spec states:
Like any HINTs, these instructions may be freely ignored. Hence, although
they are described in terms of cache-based memory hierarchies, they do not
mandate the provision of caches.

These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
which QEMU already supports, and QEMU does not emulate cache. Therefore
these instructions can be considered as a no-op, and we only need to add
a new property for the Zihintntl extension.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 1 +
 target/riscv/cpu.c     | 2 ++
 2 files changed, 3 insertions(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
helper function.

Fixes: a47842d ("riscv: Add support for the Zfa extension")
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fleq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fltq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

When writing the upper mtime, we should keep the original lower mtime
whose value is given by cpu_riscv_read_rtc() instead of
cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         return;
     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
+        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
         if (addr == mtimer->time_base) {
             if (size == 4) {
                 /* time_lo for RV32/RV64 */
-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
+                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
             } else {
                 /* time for RV64 */
                 mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else {
             if (size == 4) {
                 /* time_hi for RV32/RV64 */
-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
+                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
             } else {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "aclint-mtimer: invalid time_hi write: %08x",
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

The variables whose values are given by cpu_riscv_read_rtc() should be named
"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
should be named "rtc_r".

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
     uint64_t next;
     uint64_t diff;
 
-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
+    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
     /* Compute the relative hartid w.r.t the socket */
     hartid = hartid - mtimer->hartid_base;
 
     mtimer->timecmp[hartid] = value;
-    if (mtimer->timecmp[hartid] <= rtc_r) {
+    if (mtimer->timecmp[hartid] <= rtc) {
         /*
          * If we're setting an MTIMECMP value in the "past",
          * immediately raise the timer interrupt
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
 
     /* otherwise, set up the future timer interrupt */
     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-    diff = mtimer->timecmp[hartid] - rtc_r;
+    diff = mtimer->timecmp[hartid] - rtc;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

We should not use types dependend on host arch for target_ucontext.
This bug is found when run rv32 applications.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
 }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
 
 struct target_ucontext {
-    unsigned long uc_flags;
-    struct target_ucontext *uc_link;
+    abi_ulong uc_flags;
+    abi_ptr uc_link;
     target_stack_t uc_stack;
     target_sigset_t uc_sigmask;
     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In this patch, we create the APLIC and IMSIC FDT helper functions and
remove M mode AIA devices when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
 1 file changed, 137 insertions(+), 153 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
     return ret;
 }
 
-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-                             uint32_t *phandle, uint32_t *intc_phandles,
-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
+                                 uint32_t *intc_phandles, uint32_t msi_phandle,
+                                 bool m_mode, uint32_t imsic_guest_bits)
 {
     int cpu, socket;
     char *imsic_name;
     MachineState *ms = MACHINE(s);
     int socket_count = riscv_socket_count(ms);
-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
+    uint32_t imsic_max_hart_per_socket;
     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 
-    *msi_m_phandle = (*phandle)++;
-    *msi_s_phandle = (*phandle)++;
     imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
     imsic_regs = g_new0(uint32_t, socket_count * 4);
 
-    /* M-level IMSIC node */
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    imsic_max_hart_per_socket = 0;
-    for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_M].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
-        imsic_regs[socket * 4 + 0] = 0;
-        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
-        imsic_regs[socket * 4 + 2] = 0;
-        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
-        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
-            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-        }
-    }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_M].base);
-    qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
-    if (socket_count > 1) {
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
-    }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
-
-    g_free(imsic_name);
 
-    /* S-level IMSIC node */
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-    }
-    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
     imsic_max_hart_per_socket = 0;
     for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_S].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
         imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                      s->soc[socket].num_harts;
         imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
             imsic_max_hart_per_socket = s->soc[socket].num_harts;
         }
     }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_S].base);
+
+    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
     qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
+    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
+                          FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
     qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
+                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
     qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
+                     socket_count * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
+                     VIRT_IRQCHIP_NUM_MSIS);
+
     if (imsic_guest_bits) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
-            imsic_guest_bits);
+                              imsic_guest_bits);
     }
+
     if (socket_count > 1) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
+                              imsic_num_bits(imsic_max_hart_per_socket));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
+                              imsic_num_bits(socket_count));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
+                              IMSIC_MMIO_GROUP_MIN_SHIFT);
     }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
-    g_free(imsic_name);
+    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 
+    g_free(imsic_name);
     g_free(imsic_regs);
     g_free(imsic_cells);
 }
 
-static void create_fdt_socket_aplic(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
-                                    uint32_t msi_m_phandle,
-                                    uint32_t msi_s_phandle,
-                                    uint32_t *phandle,
-                                    uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle, uint32_t *intc_phandles,
+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+{
+    *msi_m_phandle = (*phandle)++;
+    *msi_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level IMSIC node */
+        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
+                             *msi_m_phandle, true, 0);
+    }
+
+    /* S-level IMSIC node */
+    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
+                         *msi_s_phandle, false,
+                         imsic_num_bits(s->aia_guests + 1));
+
+}
+
+static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+                                 unsigned long aplic_addr, uint32_t aplic_size,
+                                 uint32_t msi_phandle,
+                                 uint32_t *intc_phandles,
+                                 uint32_t aplic_phandle,
+                                 uint32_t aplic_child_phandle,
+                                 bool m_mode)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
-    unsigned long aplic_addr;
     MachineState *ms = MACHINE(s);
-    uint32_t aplic_m_phandle, aplic_s_phandle;
 
-    aplic_m_phandle = (*phandle)++;
-    aplic_s_phandle = (*phandle)++;
     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 
-    /* M-level APLIC node */
     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    aplic_addr = memmap[VIRT_APLIC_M].base +
-                 (memmap[VIRT_APLIC_M].size * socket);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
     qemu_fdt_add_subnode(ms->fdt, aplic_name);
     qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
     qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
     } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_m_phandle);
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
+
     qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
+                           0x0, aplic_addr, 0x0, aplic_size);
     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
-        aplic_s_phandle);
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
-        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
+                          VIRT_IRQCHIP_NUM_SOURCES);
+
+    if (aplic_child_phandle) {
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
+                              aplic_child_phandle);
+        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
+                               aplic_child_phandle, 0x1,
+                               VIRT_IRQCHIP_NUM_SOURCES);
+    }
+
     riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
+
     g_free(aplic_name);
+    g_free(aplic_cells);
+}
 
-    /* S-level APLIC node */
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t msi_m_phandle,
+                                    uint32_t msi_s_phandle,
+                                    uint32_t *phandle,
+                                    uint32_t *intc_phandles,
+                                    uint32_t *aplic_phandles)
+{
+    char *aplic_name;
+    unsigned long aplic_addr;
+    MachineState *ms = MACHINE(s);
+    uint32_t aplic_m_phandle, aplic_s_phandle;
+
+    aplic_m_phandle = (*phandle)++;
+    aplic_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level APLIC node */
+        aplic_addr = memmap[VIRT_APLIC_M].base +
+                     (memmap[VIRT_APLIC_M].size * socket);
+        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+                             msi_m_phandle, intc_phandles,
+                             aplic_m_phandle, aplic_s_phandle,
+                             true);
     }
+
+    /* S-level APLIC node */
     aplic_addr = memmap[VIRT_APLIC_S].base +
                  (memmap[VIRT_APLIC_S].size * socket);
+    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+                         msi_s_phandle, intc_phandles,
+                         aplic_s_phandle, 0,
+                         false);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-    } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_s_phandle);
-    }
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
 
     if (!socket) {
         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 
     g_free(aplic_name);
 
-    g_free(aplic_cells);
     aplic_phandles[socket] = aplic_s_phandle;
 }
 
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
     int i;
     hwaddr addr;
     uint32_t guest_bits;
-    DeviceState *aplic_m;
-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
+    DeviceState *aplic_s = NULL;
+    DeviceState *aplic_m = NULL;
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 
     if (msimode) {
-        /* Per-socket M-level IMSICs */
-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        for (i = 0; i < hart_count; i++) {
-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-                               base_hartid + i, true, 1,
-                               VIRT_IRQCHIP_NUM_MSIS);
+        if (!kvm_enabled()) {
+            /* Per-socket M-level IMSICs */
+            addr = memmap[VIRT_IMSIC_M].base +
+                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+            for (i = 0; i < hart_count; i++) {
+                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+                                   base_hartid + i, true, 1,
+                                   VIRT_IRQCHIP_NUM_MSIS);
+            }
         }
 
         /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
         }
     }
 
-    /* Per-socket M-level APLIC */
-    aplic_m = riscv_aplic_create(
-        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
-        memmap[VIRT_APLIC_M].size,
-        (msimode) ? 0 : base_hartid,
-        (msimode) ? 0 : hart_count,
-        VIRT_IRQCHIP_NUM_SOURCES,
-        VIRT_IRQCHIP_NUM_PRIO_BITS,
-        msimode, true, NULL);
-
-    if (aplic_m) {
-        /* Per-socket S-level APLIC */
-        riscv_aplic_create(
-            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
-            memmap[VIRT_APLIC_S].size,
-            (msimode) ? 0 : base_hartid,
-            (msimode) ? 0 : hart_count,
-            VIRT_IRQCHIP_NUM_SOURCES,
-            VIRT_IRQCHIP_NUM_PRIO_BITS,
-            msimode, false, aplic_m);
+    if (!kvm_enabled()) {
+        /* Per-socket M-level APLIC */
+        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
+                                     socket * memmap[VIRT_APLIC_M].size,
+                                     memmap[VIRT_APLIC_M].size,
+                                     (msimode) ? 0 : base_hartid,
+                                     (msimode) ? 0 : hart_count,
+                                     VIRT_IRQCHIP_NUM_SOURCES,
+                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                     msimode, true, NULL);
     }
 
-    return aplic_m;
+    /* Per-socket S-level APLIC */
+    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
+                                 socket * memmap[VIRT_APLIC_S].size,
+                                 memmap[VIRT_APLIC_S].size,
+                                 (msimode) ? 0 : base_hartid,
+                                 (msimode) ? 0 : hart_count,
+                                 VIRT_IRQCHIP_NUM_SOURCES,
+                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                 msimode, false, aplic_m);
+
+    return kvm_enabled() ? aplic_s : aplic_m;
 }
 
 static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We check the in-kernel irqchip support when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    return 0;
+    if (kvm_kernel_irqchip_split()) {
+        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
+        exit(1);
+    }
+
+    /*
+     * We can create the VAIA using the newer device control API.
+     */
+    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 }
 
 int kvm_arch_process_async_events(CPUState *cs)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
parameter is passed along with --accel in QEMU command-line.
1) "riscv-aia=emul": IMSIC is emulated by hypervisor
2) "riscv-aia=hwaccel": use hardware guest IMSIC
3) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                     otherwise we fallback to software emulation.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |   4 +
 target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num);
 
 #endif
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
+#include "hw/intc/riscv_imsic.h"
 #include "qemu/log.h"
 #include "hw/loader.h"
 #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "migration/migration.h"
 #include "sysemu/runstate.h"
+#include "hw/riscv/numa.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
     return true;
 }
 
+static int aia_mode;
+
+static const char *kvm_aia_mode_str(uint64_t mode)
+{
+    switch (mode) {
+    case KVM_DEV_RISCV_AIA_MODE_EMUL:
+        return "emul";
+    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
+        return "hwaccel";
+    case KVM_DEV_RISCV_AIA_MODE_AUTO:
+    default:
+        return "auto";
+    };
+}
+
+static char *riscv_get_kvm_aia(Object *obj, Error **errp)
+{
+    return g_strdup(kvm_aia_mode_str(aia_mode));
+}
+
+static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
+{
+    if (!strcmp(val, "emul")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
+    } else if (!strcmp(val, "hwaccel")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
+    } else if (!strcmp(val, "auto")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
+    } else {
+        error_setg(errp, "Invalid KVM AIA mode");
+        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
+    }
+}
+
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
+    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
+                                  riscv_set_kvm_aia);
+    object_class_property_set_description(oc, "riscv-aia",
+                                          "Set KVM AIA mode. Valid values are "
+                                          "emul, hwaccel, and auto. Default "
+                                          "is auto.");
+    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
+                                    "auto");
+}
+
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num)
+{
+    int ret, i;
+    int aia_fd = -1;
+    uint64_t default_aia_mode;
+    uint64_t socket_count = riscv_socket_count(machine);
+    uint64_t max_hart_per_socket = 0;
+    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
+    uint64_t socket_bits, hart_bits, guest_bits;
+
+    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
+
+    if (aia_fd < 0) {
+        error_report("Unable to create in-kernel irqchip");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                            &default_aia_mode, false, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to get current KVM AIA mode");
+        exit(1);
+    }
+    qemu_log("KVM AIA: default mode is %s\n",
+             kvm_aia_mode_str(default_aia_mode));
+
+    if (default_aia_mode != aia_mode) {
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                                &aia_mode, true, NULL);
+        if (ret < 0)
+            warn_report("KVM AIA: failed to set KVM AIA mode");
+        else
+            qemu_log("KVM AIA: set current mode to %s\n",
+                     kvm_aia_mode_str(aia_mode));
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
+                            &aia_irq_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of input irq lines");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
+                            &aia_msi_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of msi");
+        exit(1);
+    }
+
+    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                            &socket_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                            &group_shift, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_shift");
+        exit(1);
+    }
+
+    guest_bits = guest_num == 0 ? 0 :
+                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
+                            &guest_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set guest_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
+                            &aplic_base, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set the base address of APLIC");
+        exit(1);
+    }
+
+    for (socket = 0; socket < socket_count; socket++) {
+        socket_imsic_base = imsic_base + socket * (1U << group_shift);
+        hart_count = riscv_socket_hart_count(machine, socket);
+        base_hart = riscv_socket_first_hartid(machine, socket);
+
+        if (max_hart_per_socket < hart_count) {
+            max_hart_per_socket = hart_count;
+        }
+
+        for (i = 0; i < hart_count; i++) {
+            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
+            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
+                                    &imsic_addr, true, NULL);
+            if (ret < 0) {
+                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
+                exit(1);
+            }
+        }
+    }
+
+    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
+                            &hart_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set hart_bits");
+        exit(1);
+    }
+
+    if (kvm_has_gsi_routing()) {
+        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
+            /* KVM AIA only has one APLIC instance */
+            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
+        }
+        kvm_gsi_routing_allowed = true;
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
+                            KVM_DEV_RISCV_AIA_CTRL_INIT,
+                            NULL, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: initialized fail");
+        exit(1);
+    }
+
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 }
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
mmio operations of APLIC when using KVM AIA and send wired interrupt
signal via KVM_IRQ_LINE API.
After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
when the IMSICs receive mmio write requests.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
 hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 2 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
 
 #define APLIC_IDC_CLAIMI               0x1c
 
+/*
+ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
+ * APLIC Wired.
+ */
+static bool is_kvm_aia(bool msimode)
+{
+    return kvm_irqchip_in_kernel() && msimode;
+}
+
 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                             uint32_t word)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
+static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-    aplic->state = g_new0(uint32_t, aplic->num_irqs);
-    aplic->target = g_new0(uint32_t, aplic->num_irqs);
-    if (!aplic->msimode) {
-        for (i = 0; i < aplic->num_irqs; i++) {
-            aplic->target[i] = 1;
+    if (!is_kvm_aia(aplic->msimode)) {
+        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
+        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
+        aplic->state = g_new0(uint32_t, aplic->num_irqs);
+        aplic->target = g_new0(uint32_t, aplic->num_irqs);
+        if (!aplic->msimode) {
+            for (i = 0; i < aplic->num_irqs; i++) {
+                aplic->target[i] = 1;
+            }
         }
-    }
-    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
-    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
-    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
+        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
+        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
+        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 
-    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
-                          TYPE_RISCV_APLIC, aplic->aperture_size);
-    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
+                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+    }
 
     /*
      * Only root APLICs have hardware IRQ lines. All non-root APLICs
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        if (is_kvm_aia(aplic->msimode)) {
+            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+        } else {
+            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        }
     }
 
     /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "mmode", mmode);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    if (!is_kvm_aia(msimode)) {
+        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+    }
 
     if (parent) {
         riscv_aplic_add_child(parent, dev);
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "target/riscv/cpu_bits.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
         goto err;
     }
 
+#if defined(CONFIG_KVM)
+    if (kvm_irqchip_in_kernel()) {
+        struct kvm_msi msi;
+
+        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
+        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
+        msi.data = le32_to_cpu(value);
+
+        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
+
+        return;
+    }
+#endif
+
     /* Writes only supported for MSI little-endian registers */
     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 
-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    if (!kvm_irqchip_in_kernel()) {
+        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    }
 
     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                           imsic, TYPE_RISCV_IMSIC,
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

Select KVM AIA when the host kernel has in-kernel AIA chip support.
Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
devices to KVM APLIC.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 63 insertions(+), 31 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
 #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
 #error "Can't accommodate all IMSIC groups in address space"
 #endif
 
+/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
+static bool virt_use_kvm_aia(RISCVVirtState *s)
+{
+    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+}
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =        {        0x0,         0x100 },
     [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                  uint32_t *intc_phandles,
                                  uint32_t aplic_phandle,
                                  uint32_t aplic_child_phandle,
-                                 bool m_mode)
+                                 bool m_mode, int num_harts)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
     MachineState *ms = MACHINE(s);
 
-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aplic_cells = g_new0(uint32_t, num_harts * 2);
 
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+    for (cpu = 0; cpu < num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-                         aplic_cells,
-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
     } else {
         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                     uint32_t msi_s_phandle,
                                     uint32_t *phandle,
                                     uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+                                    uint32_t *aplic_phandles,
+                                    int num_harts)
 {
     char *aplic_name;
     unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                              msi_m_phandle, intc_phandles,
                              aplic_m_phandle, aplic_s_phandle,
-                             true);
+                             true, num_harts);
     }
 
     /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                          msi_s_phandle, intc_phandles,
                          aplic_s_phandle, 0,
-                         false);
+                         false, num_harts);
 
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    phandle_pos = ms->smp.cpus;
-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-        phandle_pos -= s->soc[socket].num_harts;
-
-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-            create_fdt_socket_plic(s, memmap, socket, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
-        } else {
-            create_fdt_socket_aplic(s, memmap, socket,
-                msi_m_phandle, msi_s_phandle, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
+    /* KVM AIA only has one APLIC instance */
+    if (virt_use_kvm_aia(s)) {
+        create_fdt_socket_aplic(s, memmap, 0,
+                                msi_m_phandle, msi_s_phandle, phandle,
+                                &intc_phandles[0], xplic_phandles,
+                                ms->smp.cpus);
+    } else {
+        phandle_pos = ms->smp.cpus;
+        for (socket = (socket_count - 1); socket >= 0; socket--) {
+            phandle_pos -= s->soc[socket].num_harts;
+
+            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+                create_fdt_socket_plic(s, memmap, socket, phandle,
+                                       &intc_phandles[phandle_pos],
+                                       xplic_phandles);
+            } else {
+                create_fdt_socket_aplic(s, memmap, socket,
+                                        msi_m_phandle, msi_s_phandle, phandle,
+                                        &intc_phandles[phandle_pos],
+                                        xplic_phandles,
+                                        s->soc[socket].num_harts);
+            }
         }
     }
 
     g_free(intc_phandles);
 
-    for (socket = 0; socket < socket_count; socket++) {
-        if (socket == 0) {
-            *irq_mmio_phandle = xplic_phandles[socket];
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 1) {
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 2) {
-            *irq_pcie_phandle = xplic_phandles[socket];
+    if (virt_use_kvm_aia(s)) {
+        *irq_mmio_phandle = xplic_phandles[0];
+        *irq_virtio_phandle = xplic_phandles[0];
+        *irq_pcie_phandle = xplic_phandles[0];
+    } else {
+        for (socket = 0; socket < socket_count; socket++) {
+            if (socket == 0) {
+                *irq_mmio_phandle = xplic_phandles[socket];
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 1) {
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 2) {
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
+    if (virt_use_kvm_aia(s)) {
+        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
+                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
+                             memmap[VIRT_APLIC_S].base,
+                             memmap[VIRT_IMSIC_S].base,
+                             s->aia_guests);
+    }
+
     if (riscv_is_32bit(&s->soc[0])) {
 #if HOST_LONG_BITS == 64
         /* limit RAM size in a 32-bit system */
-- 
2.41.0

From: Conor Dooley <conor.dooley@microchip.com>

On a dtb dumped from the virt machine, dt-validate complains:
soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
That's pretty cryptic, but running the dtb back through dtc produces
something a lot more reasonable:
Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property

Moving the riscv,pmu node out of the soc bus solves the problem.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
     MachineState *ms = MACHINE(s);
     RISCVCPU hart = s->soc[0].harts[0];
 
-    pmu_name = g_strdup_printf("/soc/pmu");
+    pmu_name = g_strdup_printf("/pmu");
     qemu_fdt_add_subnode(ms->fdt, pmu_name);
     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
-- 
2.41.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The Svadu specification updated the name of the *envcfg bit from
HADE to ADUE.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  8 ++++----
 target/riscv/cpu.c        |  4 ++--
 target/riscv/cpu_helper.c |  6 +++---
 target/riscv/csr.c        | 12 ++++++------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBIE                       (3UL << 4)
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
-#define MENVCFG_HADE                       (1ULL << 61)
+#define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
 
 /* For RV32 */
-#define MENVCFGH_HADE                      BIT(29)
+#define MENVCFGH_ADUE                      BIT(29)
 #define MENVCFGH_PBMTE                     BIT(30)
 #define MENVCFGH_STCE                      BIT(31)
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBIE                       MENVCFG_CBIE
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
-#define HENVCFG_HADE                       MENVCFG_HADE
+#define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
 
 /* For RV32 */
-#define HENVCFGH_HADE                       MENVCFGH_HADE
+#define HENVCFGH_ADUE                       MENVCFGH_ADUE
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     env->two_stage_lookup = false;
 
     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
 
     /* Initialized default priorities of local interrupts. */
     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-    bool hade = env->menvcfg & MENVCFG_HADE;
+    bool adue = env->menvcfg & MENVCFG_ADUE;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-        hade = hade && (env->henvcfg & HENVCFG_HADE);
+        adue = adue && (env->henvcfg & HENVCFG_ADUE);
     }
 
     int ptshift = (levels - 1) * ptidxbits;
@@ -XXX,XX +XXX,XX @@ restart:
 
     /* Page table updates need to be atomic with MTTCG enabled */
     if (updated_pte != pte && !is_debug) {
-        if (!hade) {
+        if (!adue) {
             return TRANSLATE_FAIL;
         }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
      */
-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                            env->menvcfg);
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
+        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
     }
 
     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg)) >> 32;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-                                    HENVCFG_HADE);
+                                    HENVCFG_ADUE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
 
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
longer to boot than the 'rv64' KVM CPU.

The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
when satp_mode.supported = 0, i.e. when cpu_init() does not set
satp_mode_max_supported(). satp_mode_max_from_map(map) does:

31 - __builtin_clz(map)

This means that, if satp_mode.supported = 0, satp_mode_supported_max
wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
set it to UINT_MAX (4294967295). After that, if the user didn't set a
satp_mode, set_satp_mode_default_map(cpu) will make

cfg.satp_mode.map = cfg.satp_mode.supported

So satp_mode.map = 0. And then satp_mode_map_max will be set to
satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
here since both are UINT_MAX.

And finally we have 2 loops:

for (int i = satp_mode_map_max - 1; i >= 0; --i) {

Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
extra delay when booting the 'host' CPU is coming from.

Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
in a different manner. We're doing the same here. If supported == 0,
interpret as 'the CPU wants the OS to handle satp mode alone' and skip
satp_mode_finalize().

We'll also put a guard in satp_mode_max_from_map() to assert out if map
is 0 since the function is not ready to deal with it.

Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
 
 uint8_t satp_mode_max_from_map(uint32_t map)
 {
+    /*
+     * 'map = 0' will make us return (31 - 32), which C will
+     * happily overflow to UINT_MAX. There's no good result to
+     * return if 'map = 0' (e.g. returning 0 will be ambiguous
+     * with the result for 'map = 1').
+     *
+     * Assert out if map = 0. Callers will have to deal with
+     * it outside of this function.
+     */
+    g_assert(map > 0);
+
     /* map here has at least one bit set, so no problem with clz */
     return 31 - __builtin_clz(map);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-    uint8_t satp_mode_map_max;
-    uint8_t satp_mode_supported_max =
-                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+    uint8_t satp_mode_map_max, satp_mode_supported_max;
+
+    /* The CPU wants the OS to decide which satp mode to use */
+    if (cpu->cfg.satp_mode.supported == 0) {
+        return;
+    }
+
+    satp_mode_supported_max =
+                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 
     if (cpu->cfg.satp_mode.map == 0) {
         if (cpu->cfg.satp_mode.init == 0) {
-- 
2.41.0

From: Vineet Gupta <vineetg@rivosinc.com>

zicond is now codegen supported in both llvm and gcc.

This change allows seamless enabling/testing of zicond in downstream
projects. e.g. currently riscv-gnu-toolchain parses elf attributes
to create a cmdline for qemu but fails short of enabling it because of
the "x-" prefix.

Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
+    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
     /* These are experimental so mark with 'x-' */
-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

A build with --enable-debug and without KVM will fail as follows:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'

This happens because the code block with "if virt_use_kvm_aia(s)" isn't
being ignored by the debug build, resulting in an undefined reference to
a KVM only function.

Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
make the compiler crop the kvm_riscv_aia_create() call entirely from a
non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
virt_use_kvm_aia() won't fix the build because this function would need
to be inlined multiple times to make the compiler zero out the entire
block.

While we're at it, use kvm_enabled() in all instances where
virt_use_kvm_aia() is checked to allow the compiler to elide these other
kvm-only instances as well.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 
     /* KVM AIA only has one APLIC instance */
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
     g_free(intc_phandles);
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         *irq_mmio_phandle = xplic_phandles[0];
         *irq_virtio_phandle = xplic_phandles[0];
         *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                              memmap[VIRT_APLIC_S].base,
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
environment with the following error:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
collect2: error: ld returned 1 exit status

This happens because the debug build will poke into the
'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
the KVM only function riscv_kvm_aplic_request().

There are multiple solutions to fix this. We'll go with the same
solution from the previous patch, i.e. add a kvm_enabled() conditional
to filter out the block. But there's a catch: riscv_kvm_aplic_request()
is a local function that would end up being used if the compiler crops
the block, and this won't work. Quoting Richard Henderson's explanation
in [1]:

"(...) the compiler won't eliminate entire unused functions with -O0"

We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
declaration in kvm_riscv.h, where all other KVM specific public
functions are already declared. Other archs handles KVM specific code in
this manner and we expect to do the same from now on.

[1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h | 1 +
 hw/intc/riscv_aplic.c    | 8 ++------
 target/riscv/kvm.c       | 5 +++++
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
                           uint64_t aia_irq_num, uint64_t aia_msi_num,
                           uint64_t aplic_base, uint64_t imsic_base,
                           uint64_t guest_num);
+void riscv_kvm_aplic_request(void *opaque, int irq, int level);
 
 #endif
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "kvm_riscv.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-{
-    kvm_set_irq(kvm_state, irq, !!level);
-}
-
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (is_kvm_aia(aplic->msimode)) {
+        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
-- 
2.41.0

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new extensions in
linux 6.5 to the hwprobe syscall.

And fixes RVC check to OR with correct value.
The previous variable contains 0 therefore it
did work.

Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
 #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
 #define     RISCV_HWPROBE_IMA_C        (1 << 1)
+#define     RISCV_HWPROBE_IMA_V        (1 << 2)
+#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
+#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
+#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
 
 #define RISCV_HWPROBE_KEY_CPUPERF_0     5
 #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                     riscv_has_ext(env, RVD) ?
                     RISCV_HWPROBE_IMA_FD : 0;
             value |= riscv_has_ext(env, RVC) ?
-                     RISCV_HWPROBE_IMA_C : pair->value;
+                     RISCV_HWPROBE_IMA_C : 0;
+            value |= riscv_has_ext(env, RVV) ?
+                     RISCV_HWPROBE_IMA_V : 0;
+            value |= cfg->ext_zba ?
+                     RISCV_HWPROBE_EXT_ZBA : 0;
+            value |= cfg->ext_zbb ?
+                     RISCV_HWPROBE_EXT_ZBB : 0;
+            value |= cfg->ext_zbs ?
+                     RISCV_HWPROBE_EXT_ZBS : 0;
             __put_user(value, &pair->value);
             break;
         case RISCV_HWPROBE_KEY_CPUPERF_0:
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
implement the first half of the key schedule derivation. This does not
actually involve shifting rows, so clone the same value into all four
columns of the AES vector to counter that operation.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230831154118.138727-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/crypto_helper.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 
     uint8_t enc_rnum = rnum;
     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-    uint8_t rcon_ = 0;
-    target_ulong result;
+    AESState t, rc = {};
 
     if (enc_rnum != 0xA) {
         temp = ror32(temp, 8); /* Rotate right by 8 */
-        rcon_ = round_consts[enc_rnum];
+        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
     }
 
-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
+    aesenc_SB_SR_AK(&t, &t, &rc, false);
 
-    temp ^= rcon_;
-
-    result = ((uint64_t)temp << 32) | temp;
-
-    return result;
+    return t.d[0];
 }
 
 target_ulong HELPER(aes64im)(target_ulong rs1)
-- 
2.41.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

riscv_trigger_init() had been called on reset events that can happen
several times for a CPU and it allocated timers for itrigger. If old
timers were present, they were simply overwritten by the new timers,
resulting in a memory leak.

Divide riscv_trigger_init() into two functions, namely
riscv_trigger_realize() and riscv_trigger_reset() and call them in
appropriate timing. The timer allocation will happen only once for a
CPU in riscv_trigger_realize().

Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  3 ++-
 target/riscv/cpu.c   |  8 +++++++-
 target/riscv/debug.c | 15 ++++++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
-void riscv_trigger_init(CPURISCVState *env);
+void riscv_trigger_realize(CPURISCVState *env);
+void riscv_trigger_reset_hold(CPURISCVState *env);
 
 bool riscv_itrigger_enabled(CPURISCVState *env);
 void riscv_itrigger_update_priv(CPURISCVState *env);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->cfg.debug) {
-        riscv_trigger_init(env);
+        riscv_trigger_reset_hold(env);
     }
 
     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 
     riscv_cpu_register_gdb_regs_for_features(cs);
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.debug) {
+        riscv_trigger_realize(&cpu->env);
+    }
+#endif
+
     qemu_init_vcpu(cs);
     cpu_reset(cs);
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return false;
 }
 
-void riscv_trigger_init(CPURISCVState *env)
+void riscv_trigger_realize(CPURISCVState *env)
+{
+    int i;
+
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                              riscv_itrigger_timer_cb, env);
+    }
+}
+
+void riscv_trigger_reset_hold(CPURISCVState *env)
 {
     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
         env->tdata3[i] = 0;
         env->cpu_breakpoint[i] = NULL;
         env->cpu_watchpoint[i] = NULL;
-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                              riscv_itrigger_timer_cb, env);
+        timer_del(env->itrigger_timer[i]);
     }
 }
-- 
2.41.0

From: Leon Schuermann <leons@opentitan.org>

When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
configuration lock bits must not apply. While this behavior is
implemented for the pmpcfgX CSRs, this bit is not respected for
changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
writes work even on locked regions when the global rule-lock bypass is
enabled.

Signed-off-by: Leon Schuermann <leons@opentitan.org>
Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
  */
 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 {
+    /* mseccfg.RLB is set */
+    if (MSECCFG_RLB_ISSET(env)) {
+        return 0;
+    }
 
     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
         return 1;
-- 
2.41.0

From: Tommy Wu <tommy.wu@sifive.com>

According to the new spec, when vsiselect has a reserved value, attempts
from M-mode or HS-mode to access vsireg, or from VS-mode to access
sireg, should preferably raise an illegal instruction exception.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                      target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt;
+    bool virt, isel_reserved;
     uint8_t *iprio;
     int ret = -EINVAL;
     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
 
     /* Decode register details from CSR number */
     virt = false;
+    isel_reserved = false;
     switch (csrno) {
     case CSR_MIREG:
         iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                   riscv_cpu_mxl_bits(env)),
                                     val, new_val, wr_mask);
         }
+    } else {
+        isel_reserved = true;
     }
 
 done:
     if (ret) {
-        return (env->virt_enabled && virt) ?
+        return (env->virt_enabled && virt && !isel_reserved) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
-- 
2.41.0

From: Nikita Shubin <n.shubin@yadro.com>

As per ISA:

"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
shall not cause any of the side effects that might occur on a CSR read."

trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.

Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                        target_ulong write_mask)
 {
     RISCVException ret;
-    target_ulong old_value;
+    target_ulong old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
     }
 
-    /* if no accessor exists then return failure */
-    if (!csr_ops[csrno].read) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-    /* read old value */
-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-    if (ret != RISCV_EXCP_NONE) {
-        return ret;
+    /*
+     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
+     * and we can't throw side effects caused by CSR reads.
+     */
+    if (ret_value) {
+        /* if no accessor exists then return failure */
+        if (!csr_ops[csrno].read) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+        /* read old value */
+        ret = csr_ops[csrno].read(env, csrno, &old_value);
+        if (ret != RISCV_EXCP_NONE) {
+            return ret;
+        }
     }
 
     /* write value if writable and write mask set, otherwise drop writes */
-- 
2.41.0