Series comparison

-[PULL 00/54] riscv-to-apply queue
+[PULL 00/28] riscv-to-apply queue
-The following changes since commit fcb237e64f9d026c03d635579c7b288d0008a6e5:
+The following changes since commit ad10b4badc1dd5b28305f9b9f1168cf0aa3ae946:
-  Merge tag 'pull-vfio-20230710' of https://github.com/legoater/qemu into staging (2023-07-10 09:17:06 +0100)
+  Merge tag 'pull-error-2024-05-27' of https://repo.or.cz/qemu/armbru into staging (2024-05-27 06:40:42 -0700)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230710-1
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240528
-for you to fetch changes up to a47842d16653b4f73b5d56ff0c252dd8a329481b:
+for you to fetch changes up to 1806da76cb81088ea026ca3441551782b850e393:
-  riscv: Add support for the Zfa extension (2023-07-10 22:29:20 +1000)
+  target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR (2024-05-28 12:20:27 +1000)
 ----------------------------------------------------------------
-Third RISC-V PR for 8.1
+RISC-V PR for 9.1
-* Use xl instead of mxl for disassemble
+* APLICs add child earlier than realize
-* Factor out extension tests to cpu_cfg.h
+* Fix exposure of Zkr
-* disas/riscv: Add vendor extension support
+* Raise exceptions on wrs.nto
-* disas/riscv: Add support for XVentanaCondOps
+* Implement SBI debug console (DBCN) calls for KVM
-* disas/riscv: Add support for XThead* instructions
+* Support 64-bit addresses for initrd
-* Fix mstatus related problems
+* Change RISCV_EXCP_SEMIHOST exception number to 63
-* Fix veyron-v1 CPU properties
+* Tolerate KVM disable ext errors
-* Fix the xlen for data address when MPRV=1
+* Set tval in breakpoints
-* opensbi: Upgrade from v1.2 to v1.3
+* Add support for Zve32x extension
-* Enable 32-bit Spike OpenSBI boot testing
+* Add support for Zve64x extension
-* Support the watchdog timer of HiFive 1 rev b
+* Relax vector register check in RISCV gdbstub
-* Only build qemu-system-riscv$$ on rv$$ host
+* Fix the element agnostic Vector function problem
-* Add RVV registers to log
+* Fix Zvkb extension config
-* Restrict ACLINT to TCG
+* Implement dynamic establishment of custom decoder
-* Add syscall riscv_hwprobe
+* Add th.sxstatus CSR emulation
-* Add support for BF16 extensions
+* Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
-* KVM_RISCV_SET_TIMER macro is not configured correctly
+* Check single width operator for vector fp widen instructions
-* Generate devicetree only after machine initialization is complete
+* Check single width operator for vfncvt.rod.f.f.w
-* virt: Convert fdt_load_addr to uint64_t
+* Remove redudant SEW checking for vector fp narrow/widen instructions
-* KVM: fixes and enhancements
+* Prioritize pmp errors in raise_mmu_exception()
-* Add support for the Zfa extension
+* Do not set mtval2 for non guest-page faults
 * Remove experimental prefix from "B" extension
 * Fixup CBO extension register calculation
 * Fix the hart bit setting of AIA
 * Fix reg_width in ricsv_gen_dynamic_vector_feature()
 * Decode all of the pmpcfg and pmpaddr CSRs
 * Raise an exception when CSRRS/CSRRC writes a read-only CSR
 ----------------------------------------------------------------
-Bin Meng (2):
+Alexei Filippov (1):
-      roms/opensbi: Upgrade from v1.2 to v1.3
+      target/riscv: do not set mtval2 for non guest-page faults
       tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing
-Christoph Müllner (8):
+Alistair Francis (2):
-      target/riscv: Factor out extension tests to cpu_cfg.h
+      target/riscv: rvzicbo: Fixup CBO extension register calculation
-      disas/riscv: Move types/constants to new header file
+      disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
       disas/riscv: Make rv_op_illegal a shared enum value
       disas/riscv: Encapsulate opcode_data into decode
       disas/riscv: Provide infrastructure for vendor extensions
       disas/riscv: Add support for XVentanaCondOps
       disas/riscv: Add support for XThead* instructions
       riscv: Add support for the Zfa extension
-Daniel Henrique Barboza (20):
+Andrew Jones (2):
-      target/riscv/cpu.c: fix veyron-v1 CPU properties
+      target/riscv/kvm: Fix exposure of Zkr
-      target/riscv: skip features setup for KVM CPUs
+      target/riscv: Raise exceptions on wrs.nto
       hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
       target/riscv/cpu.c: restrict 'mvendorid' value
       target/riscv/cpu.c: restrict 'mimpid' value
       target/riscv/cpu.c: restrict 'marchid' value
       target/riscv: use KVM scratch CPUs to init KVM properties
       target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
       target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
       target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
       target/riscv/cpu: add misa_ext_info_arr[]
       target/riscv: add KVM specific MISA properties
       target/riscv/kvm.c: update KVM MISA bits
       target/riscv/kvm.c: add multi-letter extension KVM properties
       target/riscv/cpu.c: add satp_mode properties earlier
       target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
       target/riscv/cpu.c: create KVM mock properties
       target/riscv: update multi-letter extension KVM properties
       target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
       target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM
-Guenter Roeck (1):
+Cheng Yang (1):
-      riscv: Generate devicetree only after machine initialization is complete
+      hw/riscv/boot.c: Support 64-bit address for initrd
-Ivan Klokov (1):
+Christoph Müllner (1):
-      target/riscv: Add RVV registers to log
+      riscv: thead: Add th.sxstatus CSR emulation
-Jason Chien (1):
+Clément Léger (1):
-      target/riscv: Set the correct exception for implict G-stage translation fail
+      target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63
-LIU Zhiwei (1):
+Daniel Henrique Barboza (6):
-      target/riscv: Use xl instead of mxl for disassemble
+      target/riscv/kvm: implement SBI debug console (DBCN) calls
       target/riscv/kvm: tolerate KVM disable ext errors
       target/riscv/debug: set tval=pc in breakpoint exceptions
       trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
       target/riscv: prioritize pmp errors in raise_mmu_exception()
       riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()
-Lakshmi Bai Raja Subramanian (1):
+Huang Tao (2):
-      hw/riscv: virt: Convert fdt_load_addr to uint64_t
+      target/riscv: Fix the element agnostic function problem
       target/riscv: Implement dynamic establishment of custom decoder
-Philippe Mathieu-Daudé (3):
+Jason Chien (3):
-      target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
+      target/riscv: Add support for Zve32x extension
-      target/riscv: Only build KVM guest with same wordsize as host
+      target/riscv: Add support for Zve64x extension
-      hw/riscv/virt: Restrict ACLINT to TCG
+      target/riscv: Relax vector register check in RISCV gdbstub
-Robbin Ehn (1):
+Max Chou (4):
-      linux-user/riscv: Add syscall riscv_hwprobe
+      target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
       target/riscv: rvv: Check single width operator for vector fp widen instructions
       target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
       target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
-Tommy Wu (3):
+Rob Bradford (1):
-      hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
+      target/riscv: Remove experimental prefix from "B" extension
       hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
       tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e
-Weiwei Li (11):
+Yangyu Chen (1):
-      target/riscv: Make MPV only work when MPP != PRV_M
+      target/riscv/cpu.c: fix Zvkb extension config
-      target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
-      target/riscv: Remove redundant assignment to SXL
+Yong-Xuan Wang (1):
-      target/riscv: Add additional xlen for address when MPRV=1
+      target/riscv/kvm.c: Fix the hart bit setting of AIA
-      target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
-      target/riscv: Add properties for BF16 extensions
+Yu-Ming Chang (1):
-      target/riscv: Add support for Zfbfmin extension
+      target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR
       target/riscv: Add support for Zvfbfmin extension
       target/riscv: Add support for Zvfbfwma extension
       target/riscv: Expose properties for BF16 extensions
       target/riscv: Add disas support for BF16 extensions
 yang.zhang (1):
-      target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly
+      hw/intc/riscv_aplic: APLICs should add child earlier than realize
- docs/system/riscv/virt.rst                     |   1 +
+ MAINTAINERS                                    |   1 +
- meson.build                                    |  15 +-
+ target/riscv/cpu.h                             |  11 ++
- disas/riscv-xthead.h                           |  28 +
+ target/riscv/cpu_bits.h                        |   2 +-
- disas/riscv-xventana.h                         |  18 +
+ target/riscv/cpu_cfg.h                         |   2 +
- disas/riscv.h                                  | 302 +++++++++++
+ target/riscv/helper.h                          |   1 +
- include/hw/misc/sifive_e_aon.h                 |  60 +++
+ target/riscv/sbi_ecall_interface.h             |  17 +++
- include/hw/riscv/sifive_e.h                    |   9 +-
+ target/riscv/tcg/tcg-cpu.h                     |  15 +++
- linux-user/riscv/syscall32_nr.h                |   1 +
+ disas/riscv.c                                  |  65 +++++++++-
- linux-user/riscv/syscall64_nr.h                |   1 +
+ hw/intc/riscv_aplic.c                          |   8 +-
- target/riscv/cpu.h                             |  56 +-
+ hw/riscv/boot.c                                |   4 +-
- target/riscv/cpu_cfg.h                         |  41 ++
+ target/riscv/cpu.c                             |  10 +-
- target/riscv/helper.h                          |  29 +
+ target/riscv/cpu_helper.c                      |  37 +++---
- target/riscv/kvm_riscv.h                       |   1 +
+ target/riscv/csr.c                             |  71 +++++++++--
- target/riscv/insn32.decode                     |  38 ++
+ target/riscv/debug.c                           |   3 +
- disas/riscv-xthead.c                           | 707 +++++++++++++++++++++++++
+ target/riscv/gdbstub.c                         |   8 +-
- disas/riscv-xventana.c                         |  41 ++
+ target/riscv/kvm/kvm-cpu.c                     | 157 ++++++++++++++++++++++++-
- disas/riscv.c                                  | 559 +++++++++----------
+ target/riscv/op_helper.c                       |  17 ++-
- hw/misc/sifive_e_aon.c                         | 319 +++++++++++
+ target/riscv/tcg/tcg-cpu.c                     |  50 +++++---
- hw/riscv/sifive_e.c                            |  17 +-
+ target/riscv/th_csr.c                          |  79 +++++++++++++
- hw/riscv/virt.c                                |  56 +-
+ target/riscv/translate.c                       |  31 +++--
- linux-user/syscall.c                           | 146 +++++
+ target/riscv/vector_internals.c                |  22 ++++
- target/riscv/cpu.c                             | 439 +++++++++++++--
+ target/riscv/insn_trans/trans_privileged.c.inc |   2 +
- target/riscv/cpu_helper.c                      |  12 +-
+ target/riscv/insn_trans/trans_rvv.c.inc        |  46 +++++---
- target/riscv/csr.c                             |  41 +-
+ target/riscv/insn_trans/trans_rvzawrs.c.inc    |  29 +++--
- target/riscv/fpu_helper.c                      | 166 ++++++
+ target/riscv/insn_trans/trans_rvzicbo.c.inc    |  16 ++-
- target/riscv/kvm.c                             | 501 +++++++++++++++++-
+ target/riscv/meson.build                       |   1 +
- target/riscv/op_helper.c                       |   3 +-
+files changed, 596 insertions(+), 109 deletions(-)
- target/riscv/translate.c                       |  42 +-
+ create mode 100644 target/riscv/th_csr.c
  target/riscv/vector_helper.c                   |  17 +
  tests/qtest/sifive-e-aon-watchdog-test.c       | 450 ++++++++++++++++
  tests/tcg/riscv64/test-fcvtmod.c               | 345 ++++++++++++
  target/riscv/insn_trans/trans_rvbf16.c.inc     | 175 ++++++
  target/riscv/insn_trans/trans_rvzfa.c.inc      | 521 ++++++++++++++++++
  target/riscv/insn_trans/trans_rvzfh.c.inc      |  12 +-
  disas/meson.build                              |   6 +-
  hw/misc/Kconfig                                |   3 +
  hw/misc/meson.build                            |   1 +
  hw/riscv/Kconfig                               |   1 +
  pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 123072 -> 135344 bytes
  pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 121800 -> 138304 bytes
  roms/opensbi                                   |   2 +-
  tests/avocado/riscv_opensbi.py                 |   2 -
  tests/qtest/meson.build                        |   3 +
  tests/tcg/riscv64/Makefile.target              |   6 +
 files changed, 4751 insertions(+), 442 deletions(-)
  create mode 100644 disas/riscv-xthead.h
  create mode 100644 disas/riscv-xventana.h
  create mode 100644 disas/riscv.h
  create mode 100644 include/hw/misc/sifive_e_aon.h
  create mode 100644 disas/riscv-xthead.c
  create mode 100644 disas/riscv-xventana.c
  create mode 100644 hw/misc/sifive_e_aon.c
  create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
  create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
  create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
  create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

-[PULL 45/54] target/riscv: add KVM specific MISA properties
+[PULL 01/28] hw/intc/riscv_aplic: APLICs should add child earlier than realize
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: "yang.zhang" <yang.zhang@hexintek.com>
-Using all TCG user properties in KVM is tricky. First because KVM
+Since only root APLICs can have hw IRQ lines, aplic->parent should
-supports only a small subset of what TCG provides, so most of the
+be initialized first.
 cpu->cfg flags do nothing for KVM.
-Second, and more important, we don't have a way of telling if any given
+Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation")
-value is an user input or not. For TCG this has a small impact since we
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-just validating everything and error out if needed. But for KVM it would
+Signed-off-by: yang.zhang <yang.zhang@hexintek.com>
-be good to know if a given value was set by the user or if it's a value
+Cc: qemu-stable <qemu-stable@nongnu.org>
-already provided by KVM. Otherwise we don't know how to handle failed
+Message-ID: <20240409014445.278-1-gaoshanliukou@163.com>
 kvm_set_one_regs() when writing the configurations back.
 These characteristics make it overly complicated to use the same user
 facing flags for both KVM and TCG. A simpler approach is to create KVM
 specific properties that have specialized logic, forking KVM and TCG use
 cases for those cases only. Fully separating KVM/TCG properties is
 unneeded at this point - in fact we want the user experience to be as
 equal as possible, regardless of the acceleration chosen.
 We'll start this fork with the MISA properties, adding the MISA bits
 that the KVM driver currently supports. A new KVMCPUConfig type is
 introduced. It'll hold general information about an extension. For MISA
 extensions we're going to use the newly created getters of
 misa_ext_infos[] to populate their name and description. 'offset' holds
 the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
 'misa_bit' because this same KVMCPUConfig struct will be used to
 multi-letter extensions later on.
 This new type also holds a 'user_set' flag. This flag will be set when
 the user set an option that's different than what is already configured
 in the host, requiring KVM intervention to write the regs back during
 kvm_arch_init_vcpu(). Similar mechanics will be implemented for
 multi-letter extensions as well.
 There is no need to duplicate more code than necessary, so we're going
 to use the existing kvm_riscv_init_user_properties() to add the KVM
 specific properties. Any code that is adding a TCG user prop is then
 changed slightly to verify first if there's a KVM prop with the same
 name already added.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c |  5 +++
+ hw/intc/riscv_aplic.c | 8 ++++----
- target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 4 insertions(+), 4 deletions(-)
 files changed, 83 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/target/riscv/cpu.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
-         misa_cfg->name = riscv_get_misa_ext_name(bit);
+     qdev_prop_set_bit(dev, "msimode", msimode);
-         misa_cfg->description = riscv_get_misa_ext_description(bit);
+     qdev_prop_set_bit(dev, "mmode", mmode);
-+        /* Check if KVM already created the property */
++    if (parent) {
-+        if (object_property_find(cpu_obj, misa_cfg->name)) {
++        riscv_aplic_add_child(parent, dev);
 +            continue;
 +        }
 +
          object_property_add(cpu_obj, misa_cfg->name, "bool",
                              cpu_get_misa_ext_cfg,
                              cpu_set_misa_ext_cfg,
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
  #include <linux/kvm.h>
  #include "qemu/timer.h"
 +#include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "qemu/main-loop.h"
 +#include "qapi/visitor.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
  #include "sysemu/kvm_int.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
          } \
      } while (0)
 +typedef struct KVMCPUConfig {
 +    const char *name;
 +    const char *description;
 +    target_ulong offset;
 +    int kvm_reg_id;
 +    bool user_set;
 +} KVMCPUConfig;
 +
 +#define KVM_MISA_CFG(_bit, _reg_id) \
 +    {.offset = _bit, .kvm_reg_id = _reg_id}
 +
 +/* KVM ISA extensions */
 +static KVMCPUConfig kvm_misa_ext_cfgs[] = {
 +    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
 +    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
 +    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
 +    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
 +    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
 +    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
 +    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
 +};
 +
 +static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
 +                                     const char *name,
 +                                     void *opaque, Error **errp)
 +{
 +    KVMCPUConfig *misa_ext_cfg = opaque;
 +    target_ulong misa_bit = misa_ext_cfg->offset;
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    CPURISCVState *env = &cpu->env;
 +    bool value, host_bit;
 +
 +    if (!visit_type_bool(v, name, &value, errp)) {
 +        return;
 +    }
 +
-+    host_bit = env->misa_ext_mask & misa_bit;
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+
-+    if (value == host_bit) {
+     if (!is_kvm_aia(msimode)) {
-+        return;
+         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +    }
 +
 +    if (!value) {
 +        misa_ext_cfg->user_set = true;
 +        return;
 +    }
 +
 +    /*
 +     * Forbid users to enable extensions that aren't
 +     * available in the hart.
 +     */
 +    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
 +               "enabled in the host", misa_ext_cfg->name);
 +}
 +
 +static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
 +        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
 +        int bit = misa_cfg->offset;
 +
 +        misa_cfg->name = riscv_get_misa_ext_name(bit);
 +        misa_cfg->description = riscv_get_misa_ext_description(bit);
 +
 +        object_property_add(cpu_obj, misa_cfg->name, "bool",
 +                            NULL,
 +                            kvm_cpu_set_misa_ext_cfg,
 +                            NULL, misa_cfg);
 +        object_property_set_description(cpu_obj, misa_cfg->name,
 +                                        misa_cfg->description);
 +    }
 +}
 +
  static int kvm_riscv_get_regs_core(CPUState *cs)
  {
      int ret = 0;
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
          return;
      }
-+    kvm_riscv_add_cpu_user_properties(cpu_obj);
+-    if (parent) {
-     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+-        riscv_aplic_add_child(parent, dev);
-     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+-    }
+-
      if (!msimode) {
          for (i = 0; i < num_harts; i++) {
              CPUState *cpu = cpu_by_arch_id(hartid_base + i);
 --
-.40.1
+.45.1

-[PULL 44/54] target/riscv/cpu: add misa_ext_info_arr[]
+[PULL 02/28] target/riscv/kvm: Fix exposure of Zkr
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Andrew Jones <ajones@ventanamicro.com>
-Next patch will add KVM specific user properties for both MISA and
+The Zkr extension may only be exposed to KVM guests if the VMM
-multi-letter extensions. For MISA extensions we want to make use of what
+implements the SEED CSR. Use the same implementation as TCG.
 is already available in misa_ext_cfgs[] to avoid code repetition.
-misa_ext_info_arr[] array will hold name and description for each MISA
+Without this patch, running with a KVM which does not forward the
-extension that misa_ext_cfgs[] is declaring. We'll then use this new
+SEED CSR access to QEMU will result in an ILL exception being
-array in KVM code to avoid duplicating strings. Two getters were added
+injected into the guest (this results in Linux guests crashing on
-to allow KVM to retrieve the 'name' and 'description' for each MISA
+boot). And, when running with a KVM which does forward the access,
-property.
+QEMU will crash, since QEMU doesn't know what to do with the exit.
-There's nothing holding us back from doing the same with multi-letter
+Fixes: 3108e2f1c69d ("target/riscv/kvm: update KVM exts to Linux 6.8")
-extensions. For now doing just with MISA extensions is enough.
+Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-It is worth documenting that even using the __bultin_ctz() directive to
+Cc: qemu-stable <qemu-stable@nongnu.org>
-populate the misa_ext_info_arr[] we are forced to assign 'name' and
+Message-ID: <20240422134605.534207-2-ajones@ventanamicro.com>
 'description' during runtime in riscv_cpu_add_misa_properties(). The
 reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
 throw errors like this if we fetch 'name' and 'description' from the
 array in the MISA_CFG() macro:
 ../target/riscv/cpu.c:1624:5: error: initializer element is not a
                               compile-time constant
     MISA_CFG(RVA, true),
     ^~~~~~~~~~~~~~~~~~~
 ../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
     {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
 gcc and others compilers/builders were fine with that change. We can't
 ignore failures in the Gitlab pipeline though, so code was changed to
 make every runner happy.
 As a side effect, misa_ext_cfg[] is no longer a 'const' array because
 it must be set during runtime.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |   7 ++-
+ target/riscv/cpu.h         |  3 +++
- target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
+ target/riscv/csr.c         | 18 ++++++++++++++----
-files changed, 88 insertions(+), 29 deletions(-)
+ target/riscv/kvm/kvm-cpu.c | 25 +++++++++++++++++++++++++
 files changed, 42 insertions(+), 4 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
- #define RV(x) ((target_ulong)1 << (x - 'A'))
+ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
--/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
++target_ulong riscv_new_csr_seed(target_ulong new_value,
-+/*
++                                target_ulong write_mask);
-+ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
++
-+ * when adding new MISA bits here.
+ uint8_t satp_mode_max_from_map(uint32_t map);
-+ */
+ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
- #define RVI RV('I')
- #define RVE RV('E') /* E and I are mutually exclusive */
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
  #define RVM RV('M')
@@ -XXX,XX +XXX,XX @@
  #define RVJ RV('J')
  #define RVG RV('G')
 +const char *riscv_get_misa_ext_name(uint32_t bit);
 +const char *riscv_get_misa_ext_description(uint32_t bit);
  /* Privileged specification version */
  enum {
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/csr.c
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
-     visit_type_bool(v, name, &value, errp);
+ #endif
- }
+ /* Crypto Extension */
--static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+-static RISCVException rmw_seed(CPURISCVState *env, int csrno,
--    {.name = "a", .description = "Atomic instructions",
+-                               target_ulong *ret_value,
--     .misa_bit = RVA, .enabled = true},
+-                               target_ulong new_value,
--    {.name = "c", .description = "Compressed instructions",
+-                               target_ulong write_mask)
--     .misa_bit = RVC, .enabled = true},
++target_ulong riscv_new_csr_seed(target_ulong new_value,
--    {.name = "d", .description = "Double-precision float point",
++                                target_ulong write_mask)
--     .misa_bit = RVD, .enabled = true},
+ {
--    {.name = "f", .description = "Single-precision float point",
+     uint16_t random_v;
--     .misa_bit = RVF, .enabled = true},
+     Error *random_e = NULL;
--    {.name = "i", .description = "Base integer instruction set",
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
--     .misa_bit = RVI, .enabled = true},
+         rval = random_v | SEED_OPST_ES16;
--    {.name = "e", .description = "Base integer instruction set (embedded)",
+     }
--     .misa_bit = RVE, .enabled = false},
--    {.name = "m", .description = "Integer multiplication and division",
++    return rval;
 -     .misa_bit = RVM, .enabled = true},
 -    {.name = "s", .description = "Supervisor-level instructions",
 -     .misa_bit = RVS, .enabled = true},
 -    {.name = "u", .description = "User-level instructions",
 -     .misa_bit = RVU, .enabled = true},
 -    {.name = "h", .description = "Hypervisor",
 -     .misa_bit = RVH, .enabled = true},
 -    {.name = "x-j", .description = "Dynamic translated languages",
 -     .misa_bit = RVJ, .enabled = false},
 -    {.name = "v", .description = "Vector operations",
 -     .misa_bit = RVV, .enabled = false},
 -    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
 -     .misa_bit = RVG, .enabled = false},
 +typedef struct misa_ext_info {
 +    const char *name;
 +    const char *description;
 +} MISAExtInfo;
 +
 +#define MISA_INFO_IDX(_bit) \
 +    __builtin_ctz(_bit)
 +
 +#define MISA_EXT_INFO(_bit, _propname, _descr) \
 +    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
 +
 +static const MISAExtInfo misa_ext_info_arr[] = {
 +    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
 +    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
 +    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
 +    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
 +    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
 +    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
 +    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
 +    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
 +    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
 +    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
 +    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
 +    MISA_EXT_INFO(RVV, "v", "Vector operations"),
 +    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
 +};
 +
 +static int riscv_validate_misa_info_idx(uint32_t bit)
 +{
 +    int idx;
 +
 +    /*
 +     * Our lowest valid input (RVA) is 1 and
 +     * __builtin_ctz() is UB with zero.
 +     */
 +    g_assert(bit != 0);
 +    idx = MISA_INFO_IDX(bit);
 +
 +    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
 +    return idx;
 +}
 +
-+const char *riscv_get_misa_ext_name(uint32_t bit)
++static RISCVException rmw_seed(CPURISCVState *env, int csrno,
 +                               target_ulong *ret_value,
 +                               target_ulong new_value,
 +                               target_ulong write_mask)
 +{
-+    int idx = riscv_validate_misa_info_idx(bit);
++    target_ulong rval;
 +    const char *val = misa_ext_info_arr[idx].name;
 +
-+    g_assert(val != NULL);
++    rval = riscv_new_csr_seed(new_value, write_mask);
-+    return val;
++
      if (ret_value) {
          *ret_value = rval;
      }
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
      return ret;
  }
 +static int kvm_riscv_handle_csr(CPUState *cs, struct kvm_run *run)
 +{
 +    target_ulong csr_num = run->riscv_csr.csr_num;
 +    target_ulong new_value = run->riscv_csr.new_value;
 +    target_ulong write_mask = run->riscv_csr.write_mask;
 +    int ret = 0;
 +
 +    switch (csr_num) {
 +    case CSR_SEED:
 +        run->riscv_csr.ret_value = riscv_new_csr_seed(new_value, write_mask);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: un-handled CSR EXIT for CSR %lx\n",
 +                      __func__, csr_num);
 +        ret = -1;
 +        break;
 +    }
 +
 +    return ret;
 +}
 +
-+const char *riscv_get_misa_ext_description(uint32_t bit)
+ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-+{
+ {
-+    int idx = riscv_validate_misa_info_idx(bit);
+     int ret = 0;
-+    const char *val = misa_ext_info_arr[idx].description;
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-+
+     case KVM_EXIT_RISCV_SBI:
-+    g_assert(val != NULL);
+         ret = kvm_riscv_handle_sbi(cs, run);
-+    return val;
+         break;
-+}
++    case KVM_EXIT_RISCV_CSR:
-+
++        ret = kvm_riscv_handle_csr(cs, run);
-+#define MISA_CFG(_bit, _enabled) \
++        break;
-+    {.misa_bit = _bit, .enabled = _enabled}
+     default:
-+
+         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
-+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+                       __func__, run->exit_reason);
 +    MISA_CFG(RVA, true),
 +    MISA_CFG(RVC, true),
 +    MISA_CFG(RVD, true),
 +    MISA_CFG(RVF, true),
 +    MISA_CFG(RVI, true),
 +    MISA_CFG(RVE, false),
 +    MISA_CFG(RVM, true),
 +    MISA_CFG(RVS, true),
 +    MISA_CFG(RVU, true),
 +    MISA_CFG(RVH, true),
 +    MISA_CFG(RVJ, false),
 +    MISA_CFG(RVV, false),
 +    MISA_CFG(RVG, false),
  };
  static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
      int i;
      for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
 -        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
 +        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
 +        int bit = misa_cfg->misa_bit;
 +
 +        misa_cfg->name = riscv_get_misa_ext_name(bit);
 +        misa_cfg->description = riscv_get_misa_ext_description(bit);
          object_property_add(cpu_obj, misa_cfg->name, "bool",
                              cpu_get_misa_ext_cfg,
 --
-.40.1
+.45.1

-[PULL 28/54] target/riscv: Add support for Zvfbfwma extension
+[PULL 03/28] target/riscv: Raise exceptions on wrs.nto
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Andrew Jones <ajones@ventanamicro.com>
-Add trans_* and helper function for Zvfbfwma instructions.
+Implementing wrs.nto to always just return is consistent with the
 specification, as the instruction is permitted to terminate the
 stall for any reason, but it's not useful for virtualization, where
 we'd like the guest to trap to the hypervisor in order to allow
 scheduling of the lock holding VCPU. Change to always immediately
 raise exceptions when the appropriate conditions are present,
 otherwise continue to just return. Note, immediately raising
 exceptions is also consistent with the specification since the
 time limit that should expire prior to the exception is
 implementation-specific.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240424142808.62936-2-ajones@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                      |  3 ++
+ target/riscv/helper.h                       |  1 +
- target/riscv/insn32.decode                 |  4 ++
+ target/riscv/op_helper.c                    | 11 ++++++++
- target/riscv/vector_helper.c               | 11 ++++
+ target/riscv/insn_trans/trans_rvzawrs.c.inc | 29 ++++++++++++++-------
- target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
+files changed, 32 insertions(+), 9 deletions(-)
 files changed, 76 insertions(+)
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
+ DEF_HELPER_1(sret, tl, env)
- DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_1(mret, tl, env)
- DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_1(wfi, void, env)
-+
++DEF_HELPER_1(wrs_nto, void, env)
-+DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_1(tlb_flush, void, env)
-+DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
+ DEF_HELPER_1(tlb_flush_all, void, env)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+ /* Native Debug */
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
+--- a/target/riscv/op_helper.c
-+++ b/target/riscv/insn32.decode
++++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
- # *** Zvfbfmin Standard Extension ***
+     }
- vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+ }
- vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
-+
++void helper_wrs_nto(CPURISCVState *env)
 +# *** Zvfbfwma Standard Extension ***
 +vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
 +vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
  GEN_VEXT_VF(vfwmacc_vf_h, 4)
  GEN_VEXT_VF(vfwmacc_vf_w, 8)
 +static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 +{
-+    return float32_muladd(bfloat16_to_float32(a, s),
++    if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) &&
-+                          bfloat16_to_float32(b, s), d, 0, s);
++        get_field(env->hstatus, HSTATUS_VTW) &&
 +        !get_field(env->mstatus, MSTATUS_TW)) {
 +        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
 +    } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) {
 +        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 +    }
 +}
 +
-+RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
+ void helper_tlb_flush(CPURISCVState *env)
-+GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
+ {
-+RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
+     CPUState *cs = env_cpu(env);
-+GEN_VEXT_VF(vfwmaccbf16_vf, 4)
+diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvzawrs.c.inc
 +++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
@@ -XXX,XX +XXX,XX @@
   * this program.  If not, see <http://www.gnu.org/licenses/>.
   */
 -static bool trans_wrs(DisasContext *ctx)
 +static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
  {
      if (!ctx->cfg_ptr->ext_zawrs) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_wrs(DisasContext *ctx)
      return true;
  }
 -#define GEN_TRANS_WRS(insn)                                     \
 -static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
 -{                                                               \
 -    (void)a;                                                    \
 -    return trans_wrs(ctx);                                      \
 -}
 +static bool trans_wrs_nto(DisasContext *ctx, arg_wrs_nto *a)
 +{
 +    if (!ctx->cfg_ptr->ext_zawrs) {
 +        return false;
 +    }
 -GEN_TRANS_WRS(wrs_nto)
 -GEN_TRANS_WRS(wrs_sto)
 +    /*
 +     * Depending on the mode of execution, mstatus.TW and hstatus.VTW, wrs.nto
 +     * should raise an exception when the implementation-specific bounded time
 +     * limit has expired. Our time limit is zero, so we either return
 +     * immediately, as does our implementation of wrs.sto, or raise an
 +     * exception, as handled by the wrs.nto helper.
 +     */
 +#ifndef CONFIG_USER_ONLY
 +    gen_helper_wrs_nto(tcg_env);
 +#endif
 +
- static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
++    /* We only get here when helper_wrs_nto() doesn't raise an exception. */
- {
++    return trans_wrs_sto(ctx, NULL);
      return float32_muladd(float16_to_float32(a, true, s),
 diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvbf16.c.inc
 +++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
      } \
  } while (0)
 +#define REQUIRE_ZVFBFWMA(ctx) do { \
 +    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
 +        return false; \
 +    } \
 +} while (0)
 +
  static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
  {
      REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
      }
      return false;
  }
 +
 +static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZVFBFWMA(ctx);
 +
 +    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
 +        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
 +
 +        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
 +        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
 +        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
 +        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
 +                           vreg_ofs(ctx, a->rs1),
 +                           vreg_ofs(ctx, a->rs2), cpu_env,
 +                           ctx->cfg_ptr->vlen / 8,
 +                           ctx->cfg_ptr->vlen / 8, data,
 +                           gen_helper_vfwmaccbf16_vv);
 +        mark_vs_dirty(ctx);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 +
 +static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZVFBFWMA(ctx);
 +
 +    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
 +        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
 +        uint32_t data = 0;
 +
 +        gen_set_rm(ctx, RISCV_FRM_DYN);
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
 +        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
 +                           gen_helper_vfwmaccbf16_vf, ctx);
 +    }
 +
 +    return false;
 +}
 --
-.40.1
+.45.1

-[PULL 46/54] target/riscv/kvm.c: update KVM MISA bits
+[PULL 04/28] target/riscv/kvm: implement SBI debug console (DBCN) calls
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Our design philosophy with KVM properties can be resumed in two main
+SBI defines a Debug Console extension "DBCN" that will, in time, replace
-decisions based on KVM interface availability and what the user wants to
+the legacy console putchar and getchar SBI extensions.
-do:
+The appeal of the DBCN extension is that it allows multiple bytes to be
-- if the user disables an extension that the host KVM module doesn't
+read/written in the SBI console in a single SBI call.
-know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
-keep booting the CPU. This will avoid users having to deal with issues
+As far as KVM goes, the DBCN calls are forwarded by an in-kernel KVM
-with older KVM versions while disabling features they don't care;
+module to userspace. But this will only happens if the KVM module
+actually supports this SBI extension and we activate it.
-- for any other case we're going to error out immediately. If the user
-wants to enable a feature that KVM doesn't know about this a problem that
+We'll check for DBCN support during init time, checking if get-reg-list
-is worth aborting - the user must know that the feature wasn't enabled
+is advertising KVM_RISCV_SBI_EXT_DBCN. In that case, we'll enable it via
-in the hart. Likewise, if KVM knows about the extension, the user wants
+kvm_set_one_reg() during kvm_arch_init_vcpu().
-to enable/disable it, and we fail to do it so, that's also a problem we
-can't shrug it off.
+Finally, change kvm_riscv_handle_sbi() to handle the incoming calls for
+SBI_EXT_DBCN, reading and writing as required.
-In the case of MISA bits we won't even try enabling bits that aren't
-already available in the host. The ioctl() is so likely to fail that
+A simple KVM guest with 'earlycon=sbi', running in an emulated RISC-V
-it's not worth trying. This check is already done in the previous patch,
+host, takes around 20 seconds to boot without using DBCN. With this
-in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.
+patch we're taking around 14 seconds to boot due to the speed-up in the
+terminal output.  There's no change in boot time if the guest isn't
-In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
+using earlycon.
 option and do as follows:
 - if the user didn't set the property or set to the same value of the
 host, do nothing;
 - Disable the given extension in KVM. Error out if anything goes wrong.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20240425155012.581366-1-dbarboza@ventanamicro.com>
 Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ target/riscv/sbi_ecall_interface.h |  17 +++++
-file changed, 40 insertions(+)
+ target/riscv/kvm/kvm-cpu.c         | 111 +++++++++++++++++++++++++++++
+files changed, 128 insertions(+)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/sbi_ecall_interface.h
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/sbi_ecall_interface.h
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@
-                "enabled in the host", misa_ext_cfg->name);
- }
+ /* clang-format off */
-+static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
++#define SBI_SUCCESS                      0
 +#define SBI_ERR_FAILED                  -1
 +#define SBI_ERR_NOT_SUPPORTED           -2
 +#define SBI_ERR_INVALID_PARAM           -3
 +#define SBI_ERR_DENIED                  -4
 +#define SBI_ERR_INVALID_ADDRESS         -5
 +#define SBI_ERR_ALREADY_AVAILABLE       -6
 +#define SBI_ERR_ALREADY_STARTED         -7
 +#define SBI_ERR_ALREADY_STOPPED         -8
 +#define SBI_ERR_NO_SHMEM                -9
 +
  /* SBI Extension IDs */
  #define SBI_EXT_0_1_SET_TIMER           0x0
  #define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_IPI                     0x735049
  #define SBI_EXT_RFENCE                  0x52464E43
  #define SBI_EXT_HSM                     0x48534D
 +#define SBI_EXT_DBCN                    0x4442434E
  /* SBI function IDs for BASE extension */
  #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_HSM_HART_STOP           0x1
  #define SBI_EXT_HSM_HART_GET_STATUS     0x2
 +/* SBI function IDs for DBCN extension */
 +#define SBI_EXT_DBCN_CONSOLE_WRITE      0x0
 +#define SBI_EXT_DBCN_CONSOLE_READ       0x1
 +#define SBI_EXT_DBCN_CONSOLE_WRITE_BYTE 0x2
 +
  #define SBI_HSM_HART_STATUS_STARTED     0x0
  #define SBI_HSM_HART_STATUS_STOPPED     0x1
  #define SBI_HSM_HART_STATUS_START_PENDING   0x2
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_v_vlenb = {
                     KVM_REG_RISCV_VECTOR_CSR_REG(vlenb)
  };
 +static KVMCPUConfig kvm_sbi_dbcn = {
 +    .name = "sbi_dbcn",
 +    .kvm_reg_id = KVM_REG_RISCV | KVM_REG_SIZE_U64 |
 +                  KVM_REG_RISCV_SBI_EXT | KVM_RISCV_SBI_EXT_DBCN
 +};
 +
  static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
  {
      CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int uint64_cmp(const void *a, const void *b)
      return 0;
  }
 +static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
 +                                             KVMScratchCPU *kvmcpu,
 +                                             struct kvm_reg_list *reglist)
 +{
-+    CPURISCVState *env = &cpu->env;
++    struct kvm_reg_list *reg_search;
-+    uint64_t id, reg;
++
-+    int i, ret;
++    reg_search = bsearch(&kvm_sbi_dbcn.kvm_reg_id, reglist->reg, reglist->n,
-+
++                         sizeof(uint64_t), uint64_cmp);
-+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
++
-+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
++    if (reg_search) {
-+        target_ulong misa_bit = misa_cfg->offset;
++        kvm_sbi_dbcn.supported = true;
 +
 +        if (!misa_cfg->user_set) {
 +            continue;
 +        }
 +
 +        /* If we're here we're going to disable the MISA bit */
 +        reg = 0;
 +        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
 +                              misa_cfg->kvm_reg_id);
 +        ret = kvm_set_one_reg(cs, id, &reg);
 +        if (ret != 0) {
 +            /*
 +             * We're not checking for -EINVAL because if the bit is about
 +             * to be disabled, it means that it was already enabled by
 +             * KVM. We determined that by fetching the 'isa' register
 +             * during init() time. Any error at this point is worth
 +             * aborting.
 +             */
 +            error_report("Unable to set KVM reg %s, error %d",
 +                         misa_cfg->name, ret);
 +            exit(EXIT_FAILURE);
 +        }
 +        env->misa_ext &= ~misa_bit;
 +    }
 +}
 +
- static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+ static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
- {
+                                  struct kvm_reg_list *reglist)
-     int i;
+ {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
      if (riscv_has_ext(&cpu->env, RVV)) {
          kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
      }
 +
 +    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
  }
  static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
      return ret;
  }
 +static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
 +{
 +    target_ulong reg = 1;
 +
 +    if (!kvm_sbi_dbcn.supported) {
 +        return 0;
 +    }
 +
 +    return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
 +}
 +
  int kvm_arch_init_vcpu(CPUState *cs)
  {
      int ret = 0;
 @@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
+     kvm_riscv_update_cpu_misa_ext(cpu, cs);
-     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+     kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
-         ret = kvm_vcpu_set_machine_ids(cpu, cs);
-+        if (ret != 0) {
++    ret = kvm_vcpu_enable_sbi_dbcn(cpu, cs);
 +            return ret;
 +        }
      }
 +    kvm_riscv_update_cpu_misa_ext(cpu, cs);
 +
      return ret;
  }
+@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
+     return true;
+ }
++static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
++{
++    g_autofree uint8_t *buf = NULL;
++    RISCVCPU *cpu = RISCV_CPU(cs);
++    target_ulong num_bytes;
++    uint64_t addr;
++    unsigned char ch;
++    int ret;
++
++    switch (run->riscv_sbi.function_id) {
++    case SBI_EXT_DBCN_CONSOLE_READ:
++    case SBI_EXT_DBCN_CONSOLE_WRITE:
++        num_bytes = run->riscv_sbi.args[0];
++
++        if (num_bytes == 0) {
++            run->riscv_sbi.ret[0] = SBI_SUCCESS;
++            run->riscv_sbi.ret[1] = 0;
++            break;
++        }
++
++        addr = run->riscv_sbi.args[1];
++
++        /*
++         * Handle the case where a 32 bit CPU is running in a
++         * 64 bit addressing env.
++         */
++        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
++            addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
++        }
++
++        buf = g_malloc0(num_bytes);
++
++        if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
++            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
++            if (ret < 0) {
++                error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
++                             "reading chardev");
++                exit(1);
++            }
++
++            cpu_physical_memory_write(addr, buf, ret);
++        } else {
++            cpu_physical_memory_read(addr, buf, num_bytes);
++
++            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
++            if (ret < 0) {
++                error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
++                             "writing chardev");
++                exit(1);
++            }
++        }
++
++        run->riscv_sbi.ret[0] = SBI_SUCCESS;
++        run->riscv_sbi.ret[1] = ret;
++        break;
++    case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
++        ch = run->riscv_sbi.args[0];
++        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
++
++        if (ret < 0) {
++            error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
++                         "writing chardev");
++            exit(1);
++        }
++
++        run->riscv_sbi.ret[0] = SBI_SUCCESS;
++        run->riscv_sbi.ret[1] = 0;
++        break;
++    default:
++        run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
++    }
++}
++
+ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
+ {
+     int ret = 0;
+@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
+         }
+         ret = 0;
+         break;
++    case SBI_EXT_DBCN:
++        kvm_riscv_handle_sbi_dbcn(cs, run);
++        break;
+     default:
+         qemu_log_mask(LOG_UNIMP,
+                       "%s: un-handled SBI EXIT, specific reasons is %lu\n",
 --
-.40.1
+.45.1

-[PULL 43/54] target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
+[PULL 05/28] hw/riscv/boot.c: Support 64-bit address for initrd
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Cheng Yang <yangcheng.work@foxmail.com>
-At this moment we're retrieving env->misa_ext during
+Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell()
-kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.
+to set the address of initrd in FDT to support 64-bit address.
-We want to set env->misa_ext_mask, and we want to set it as early as
+Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com>
-possible. The reason is that we're going to use it in the validation
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-process of the KVM MISA properties we're going to add next. Setting it
+Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com>
 during arch_init_cpu() is too late for user validation.
 Move the code to a new helper that is going to be called during init()
 time, via kvm_riscv_init_user_properties(), like we're already doing for
 the machine ID properties. Set both misa_ext and misa_ext_mask to the
 same value retrieved by the 'isa' config reg.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
+ hw/riscv/boot.c | 4 ++--
-file changed, 23 insertions(+), 11 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/hw/riscv/boot.c
-+++ b/target/riscv/kvm.c
++++ b/hw/riscv/boot.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
      /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
      if (fdt) {
          end = start + size;
 -        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", start);
 -        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", end);
 +        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-start", start);
 +        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-end", end);
      }
  }
-+static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
-+                                         KVMScratchCPU *kvmcpu)
-+{
-+    CPURISCVState *env = &cpu->env;
-+    struct kvm_one_reg reg;
-+    int ret;
-+
-+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-+                              KVM_REG_RISCV_CONFIG_REG(isa));
-+    reg.addr = (uint64_t)&env->misa_ext_mask;
-+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-+
-+    if (ret) {
-+        error_report("Unable to fetch ISA register from KVM, "
-+                     "error %d", ret);
-+        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
-+        exit(EXIT_FAILURE);
-+    }
-+
-+    env->misa_ext = env->misa_ext_mask;
-+}
-+
- void kvm_riscv_init_user_properties(Object *cpu_obj)
- {
-     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
-     }
-     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
-+    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
-     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
- }
-@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     int ret = 0;
--    target_ulong isa;
-     RISCVCPU *cpu = RISCV_CPU(cs);
--    CPURISCVState *env = &cpu->env;
--    uint64_t id;
-     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
--    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                          KVM_REG_RISCV_CONFIG_REG(isa));
--    ret = kvm_get_one_reg(cs, id, &isa);
--    if (ret) {
--        return ret;
--    }
--    env->misa_ext = isa;
--
-     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
-         ret = kvm_vcpu_set_machine_ids(cpu, cs);
-     }
 --
-.40.1
+.45.1

-[PULL 04/54] disas/riscv: Make rv_op_illegal a shared enum value
+[PULL 06/28] target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Clément Léger <cleger@rivosinc.com>
-The enum value 'rv_op_illegal' does not represent an
+The current semihost exception number (16) is a reserved number (range
-instruction, but is a catch-all value in case we have
+[16-17]). The upcoming double trap specification uses that number for
-no match in the decoder. Let's make the value a shared
+the double trap exception. Since the privileged spec (Table 22) defines
-one, so that other compile units can reuse it.
+ranges for custom uses change the semihosting exception number to 63
 which belongs to the range [48-63] in order to avoid any future
 collisions with reserved exception.
 Signed-off-by: Clément Léger <cleger@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20240422135840.1959967-1-cleger@rivosinc.com>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.h | 4 ++++
+ target/riscv/cpu_bits.h | 2 +-
- disas/riscv.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 5 insertions(+), 1 deletion(-)
-diff --git a/disas/riscv.h b/disas/riscv.h
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
+--- a/target/riscv/cpu_bits.h
-+++ b/disas/riscv.h
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
-     const rvc_constraint *constraints;
+     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
- } rv_comp_data;
+     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
+     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
-+enum {
+-    RISCV_EXCP_SEMIHOST = 0x10,
-+    rv_op_illegal = 0
+     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
-+};
+     RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
-+
+     RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
- enum {
+     RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
-     rvcd_imm_nz = 0x1
++    RISCV_EXCP_SEMIHOST = 0x3f,
- };
+ } RISCVException;
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
+ #define RISCV_EXCP_INT_FLAG                0x80000000
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
  #include "disas/riscv.h"
  typedef enum {
 -    rv_op_illegal = 0,
 +    /* 0 is reserved for rv_op_illegal. */
      rv_op_lui = 1,
      rv_op_auipc = 2,
      rv_op_jal = 3,
 --
-.40.1
+.45.1

-[PULL 40/54] target/riscv: use KVM scratch CPUs to init KVM properties
+[PULL 07/28] target/riscv/kvm: tolerate KVM disable ext errors
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Certain validations, such as the validations done for the machine IDs
+Running a KVM guest using a 6.9-rc3 kernel, in a 6.8 host that has zkr
-(mvendorid/marchid/mimpid), are done before starting the CPU.
+enabled, will fail with a kernel oops SIGILL right at the start. The
-Non-dynamic (named) CPUs tries to match user input with a preset
+reason is that we can't expose zkr without implementing the SEED CSR.
-default. As it is today we can't prefetch a KVM default for these cases
+Disabling zkr in the guest would be a workaround, but if the KVM doesn't
-because we're only able to read/write KVM regs after the vcpu is
+allow it we'll error out and never boot.
 spinning.
-Our target/arm friends use a concept called "scratch CPU", which
+In hindsight this is too strict. If we keep proceeding, despite not
-consists of creating a vcpu for doing queries and validations and so on,
+disabling the extension in the KVM vcpu, we'll not add the extension in
-which is discarded shortly after use [1]. This is a suitable solution
+the riscv,isa. The guest kernel will be unaware of the extension, i.e.
-for what we need so let's implement it in target/riscv as well.
+it doesn't matter if the KVM vcpu has it enabled underneath or not. So
 it's ok to keep booting in this case.
-kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
+Change our current logic to not error out if we fail to disable an
-KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
+extension in kvm_set_one_reg(), but show a warning and keep booting. It
-a KVM scratch CPU, fetch KVM regs that work as default values for user
+is important to throw a warning because we must make the user aware that
-properties, and then discard the scratch CPU afterwards.
+the extension is still available in the vcpu, meaning that an
 ill-behaved guest can ignore the riscv,isa settings and  use the
 extension.
-We're starting by initializing 'mvendorid'. This concept will be used to
+The case we're handling happens with an EINVAL error code. If we fail to
-init other KVM specific properties in the next patches as well.
+disable the extension in KVM for any other reason, error out.
-[1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()
+We'll also keep erroring out when we fail to enable an extension in KVM,
 since adding the extension in riscv,isa at this point will cause a guest
 malfunction because the extension isn't enabled in the vcpu.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
+Message-ID: <20240422171425.333037-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm_riscv.h |  1 +
+ target/riscv/kvm/kvm-cpu.c | 12 ++++++++----
- target/riscv/cpu.c       |  6 +++
+file changed, 8 insertions(+), 4 deletions(-)
  target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
 files changed, 92 insertions(+)
-diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm_riscv.h
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm_riscv.h
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
- #ifndef QEMU_KVM_RISCV_H
+         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
- #define QEMU_KVM_RISCV_H
+         ret = kvm_set_one_reg(cs, id, &reg);
+         if (ret != 0) {
-+void kvm_riscv_init_user_properties(Object *cpu_obj);
+-            error_report("Unable to %s extension %s in KVM, error %d",
- void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
+-                         reg ? "enable" : "disable",
- void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+-                         multi_ext_cfg->name, ret);
+-            exit(EXIT_FAILURE);
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
++            if (!reg && ret == -EINVAL) {
-index XXXXXXX..XXXXXXX 100644
++                warn_report("KVM cannot disable extension %s",
---- a/target/riscv/cpu.c
++                            multi_ext_cfg->name);
-+++ b/target/riscv/cpu.c
++            } else {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
++                error_report("Unable to enable extension %s in KVM, error %d",
-     Property *prop;
++                             multi_ext_cfg->name, ret);
-     DeviceState *dev = DEVICE(obj);
++                exit(EXIT_FAILURE);
++            }
-+#ifndef CONFIG_USER_ONLY
+         }
-+    if (kvm_enabled()) {
+     }
 +        kvm_riscv_init_user_properties(obj);
 +    }
 +#endif
 +
      riscv_cpu_add_misa_properties(obj);
      for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
      env->kvm_timer_dirty = false;
  }
-+typedef struct KVMScratchCPU {
-+    int kvmfd;
-+    int vmfd;
-+    int cpufd;
-+} KVMScratchCPU;
-+
-+/*
-+ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
-+ * from target/arm/kvm.c.
-+ */
-+static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
-+{
-+    int kvmfd = -1, vmfd = -1, cpufd = -1;
-+
-+    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
-+    if (kvmfd < 0) {
-+        goto err;
-+    }
-+    do {
-+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
-+    } while (vmfd == -1 && errno == EINTR);
-+    if (vmfd < 0) {
-+        goto err;
-+    }
-+    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
-+    if (cpufd < 0) {
-+        goto err;
-+    }
-+
-+    scratch->kvmfd =  kvmfd;
-+    scratch->vmfd = vmfd;
-+    scratch->cpufd = cpufd;
-+
-+    return true;
-+
-+ err:
-+    if (cpufd >= 0) {
-+        close(cpufd);
-+    }
-+    if (vmfd >= 0) {
-+        close(vmfd);
-+    }
-+    if (kvmfd >= 0) {
-+        close(kvmfd);
-+    }
-+
-+    return false;
-+}
-+
-+static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
-+{
-+    close(scratch->cpufd);
-+    close(scratch->vmfd);
-+    close(scratch->kvmfd);
-+}
-+
-+static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
-+{
-+    CPURISCVState *env = &cpu->env;
-+    struct kvm_one_reg reg;
-+    int ret;
-+
-+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-+                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
-+    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
-+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-+    if (ret != 0) {
-+        error_report("Unable to retrieve mvendorid from host, error %d", ret);
-+    }
-+}
-+
-+void kvm_riscv_init_user_properties(Object *cpu_obj)
-+{
-+    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
-+    KVMScratchCPU kvmcpu;
-+
-+    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
-+        return;
-+    }
-+
-+    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
-+
-+    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
-+}
-+
- const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
-     KVM_CAP_LAST_INFO
- };
 --
-.40.1
+.45.1

-[PULL 50/54] target/riscv/cpu.c: create KVM mock properties
+[PULL 08/28] target/riscv/debug: set tval=pc in breakpoint exceptions
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM-specific properties are being created inside target/riscv/kvm.c. But
+We're not setting (s/m)tval when triggering breakpoints of type 2
-at this moment we're gathering all the remaining properties from TCG and
+(mcontrol) and 6 (mcontrol6). According to the debug spec section
-adding them as is when running KVM. This creates a situation where
+.7.12, "Match Control Type 6":
 non-KVM properties are setting flags to 'true' due to its default
 settings (e.g.  Zawrs). Users can also freely enable them via command
 line.
-This doesn't impact runtime per se because KVM doesn't care about these
+"The Privileged Spec says that breakpoint exceptions that occur on
-flags, but code such as riscv_isa_string_ext() take those flags into
+instruction fetches, loads, or stores update the tval CSR with either
-account. The result is that, for a KVM guest, setting non-KVM properties
+zero or the faulting virtual address. The faulting virtual address for
-will make them appear in the riscv,isa DT.
+an mcontrol6 trigger with action = 0 is the address being accessed and
 which caused that trigger to fire."
-We want to keep the same API for both TCG and KVM and at the same time,
+A similar text is also found in the Debug spec section 5.7.11 w.r.t.
-when running KVM, forbid non-KVM extensions to be enabled internally. We
+mcontrol.
-accomplish both by changing riscv_cpu_add_user_properties() to add a
-mock boolean property for every non-KVM extension in
+Note that what we're doing ATM is not violating the spec, but it's
-riscv_cpu_extensions[]. Then, when running KVM, users are still free to
+simple enough to set mtval/stval and it makes life easier for any
-set extensions at will, but we'll error out if a non-KVM extension is
+software that relies on this info.
-enabled. Setting such extension to 'false' will be ignored.
 Given that we always use action = 0, save the faulting address for the
 mcontrol and mcontrol6 trigger breakpoints into env->badaddr, which is
 used as as scratch area for traps with address information. 'tval' is
 then set during riscv_cpu_do_interrupt().
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-ID: <20240416230437.1869024-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
+ target/riscv/cpu_helper.c | 1 +
-file changed, 36 insertions(+)
+ target/riscv/debug.c      | 3 +++
 files changed, 4 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-     DEFINE_PROP_END_OF_LIST(),
+             tval = env->bins;
- };
+             break;
+         case RISCV_EXCP_BREAKPOINT:
-+
++            tval = env->badaddr;
-+#ifndef CONFIG_USER_ONLY
+             if (cs->watchpoint_hit) {
-+static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+                 tval = cs->watchpoint_hit->hitaddr;
-+                                    const char *name,
+                 cs->watchpoint_hit = NULL;
-+                                    void *opaque, Error **errp)
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
-+{
+index XXXXXXX..XXXXXXX 100644
-+    const char *propname = opaque;
+--- a/target/riscv/debug.c
-+    bool value;
++++ b/target/riscv/debug.c
-+
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
-+    if (!visit_type_bool(v, name, &value, errp)) {
+                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
-+        return;
+                     /* check U/S/M bit against current privilege level */
-+    }
+                     if ((ctrl >> 3) & BIT(env->priv)) {
-+
++                        env->badaddr = pc;
-+    if (value) {
+                         return true;
-+        error_setg(errp, "extension %s is not available with KVM",
+                     }
-+                   propname);
+                 }
-+    }
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
-+}
+                     if (env->virt_enabled) {
-+#endif
+                         /* check VU/VS bit against current privilege level */
-+
+                         if ((ctrl >> 23) & BIT(env->priv)) {
- /*
++                            env->badaddr = pc;
-  * Add CPU properties with user-facing flags.
+                             return true;
-  *
+                         }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+                     } else {
-             if (object_property_find(obj, prop->name)) {
+                         /* check U/S/M bit against current privilege level */
-                 continue;
+                         if ((ctrl >> 3) & BIT(env->priv)) {
-             }
++                            env->badaddr = pc;
-+
+                             return true;
-+            /*
+                         }
-+             * Set the default to disabled for every extension
+                     }
 +             * unknown to KVM and error out if the user attempts
 +             * to enable any of them.
 +             *
 +             * We're giving a pass for non-bool properties since they're
 +             * not related to the availability of extensions and can be
 +             * safely ignored as is.
 +             */
 +            if (prop->info == &qdev_prop_bool) {
 +                object_property_add(obj, prop->name, "bool",
 +                                    NULL, cpu_set_cfg_unavailable,
 +                                    NULL, (void *)prop->name);
 +                continue;
 +            }
          }
  #endif
          qdev_property_add_static(dev, prop);
 --
-.40.1
+.45.1

-[PULL 12/54] target/riscv/cpu.c: fix veyron-v1 CPU properties
+[PULL 09/28] trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
+Privileged spec section 4.1.9 mentions:
 riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
 and ext_icsr from riscv_cpu_init(), the init() function of
 TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
 CPUs to explictly enable all extensions and features it requires,
 without any 'magic values' that were inherited by the parent type.
-This commit failed to make appropriate changes in the 'veyron-v1' CPU,
+"When a trap is taken into S-mode, stval is written with
-added earlier by commit e1d084a8524a. The result is that the veyron-v1
+exception-specific information to assist software in handling the trap.
-CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
+(...)
 case.
-The reason why it took this long to notice (thanks LIU Zhiwei for
+If stval is written with a nonzero value when a breakpoint,
-reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
+address-misaligned, access-fault, or page-fault exception occurs on an
-absent in the 'riscv,isa' DT, implying that they're both present if the
+instruction fetch, load, or store, then stval will contain the faulting
-'i' extension is enabled. OpenSBI also doesn't error out or warns about
+virtual address."
 the lack of 'pmp', it'll just not protect memory pages.
-Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
+A similar text is found for mtval in section 3.1.16.
 f0bdfb5bfc2 already did with other CPUs.
-Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Setting mtval/stval in this scenario is optional, but some softwares read
-Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
+these regs when handling ebreaks.
 Write 'badaddr' in all ebreak breakpoints to write the appropriate
 'tval' during riscv_do_cpu_interrrupt().
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20240416230437.1869024-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 3 +++
+ target/riscv/insn_trans/trans_privileged.c.inc | 2 ++
-file changed, 3 insertions(+)
+file changed, 2 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
+     if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
-     /* Enable ISA extensions */
+         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
-     cpu->cfg.mmu = true;
+     } else {
-+    cpu->cfg.ext_ifencei = true;
++        tcg_gen_st_tl(tcg_constant_tl(ebreak_addr), tcg_env,
-+    cpu->cfg.ext_icsr = true;
++                      offsetof(CPURISCVState, badaddr));
-+    cpu->cfg.pmp = true;
+         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
-     cpu->cfg.ext_icbom = true;
+     }
-     cpu->cfg.cbom_blocksize = 64;
+     return true;
      cpu->cfg.cboz_blocksize = 64;
 --
-.40.1
+.45.1

-[PULL 54/54] riscv: Add support for the Zfa extension
+[PULL 10/28] target/riscv: Add support for Zve32x extension
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Jason Chien <jason.chien@sifive.com>
-This patch introduces the RISC-V Zfa extension, which introduces
+Add support for Zve32x extension and replace some checks for Zve32f with
-additional floating-point instructions:
+Zve32x, since Zve32f depends on Zve32x.
 * fli (load-immediate) with pre-defined immediates
 * fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
 * fround/froundmx (round to integer)
 * fcvtmod.w.d (Modular Convert-to-Integer)
 * fmv* to access high bits of float register bigger than XLEN
 * Quiet comparison instructions (fleq/fltq)
-Zfa defines its instructions in combination with the following extensions:
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-* single-precision floating-point (F)
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-* double-precision floating-point (D)
+Reviewed-by: Max Chou <max.chou@sifive.com>
-* quad-precision floating-point (Q)
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-* half-precision floating-point (Zfh)
+Message-ID: <20240328022343.6871-2-jason.chien@sifive.com>
 Since QEMU does not support the RISC-V quad-precision floating-point
 ISA extension (Q), this patch does not include the instructions that
 depend on this extension. All other instructions are included in this
 patch.
 The Zfa specification can be found here:
   https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
 The Zfa specifciation is frozen and is in public review since May 3, 2023:
   https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg
 The patch also includes a TCG test for the fcvtmod.w.d instruction.
 The test cases test for correct results and flag behaviour.
 Note, that the Zfa specification requires fcvtmod's flag behaviour
 to be identical to a fcvt with the same operands (which is also
 tested).
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.h                             |   3 +
+ target/riscv/cpu_cfg.h                  |  1 +
- target/riscv/cpu_cfg.h                    |   1 +
+ target/riscv/cpu.c                      |  2 ++
- target/riscv/helper.h                     |  19 +
+ target/riscv/cpu_helper.c               |  2 +-
- target/riscv/insn32.decode                |  26 ++
+ target/riscv/csr.c                      |  2 +-
- disas/riscv.c                             | 139 ++++++
+ target/riscv/tcg/tcg-cpu.c              | 16 ++++++++--------
- target/riscv/cpu.c                        |   8 +
+ target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
- target/riscv/fpu_helper.c                 | 154 +++++++
+files changed, 15 insertions(+), 12 deletions(-)
  target/riscv/translate.c                  |   1 +
  tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
  target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
  tests/tcg/riscv64/Makefile.target         |   6 +
 files changed, 1223 insertions(+)
  create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
  create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc
-diff --git a/disas/riscv.h b/disas/riscv.h
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_codec_r_imm2,
-     rv_codec_r2_immhl,
-     rv_codec_r2_imm2_imm5,
-+    rv_codec_fli,
- } rv_codec;
- /* structures */
-@@ -XXX,XX +XXX,XX @@ enum {
- #define rv_fmt_rd_offset              "O\t0,o"
- #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
- #define rv_fmt_frd_rs1                "O\t3,1"
-+#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
- #define rv_fmt_frd_frs1               "O\t3,4"
- #define rv_fmt_rd_frs1                "O\t0,4"
- #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-@@ -XXX,XX +XXX,XX @@ enum {
- #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
- #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
- #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
-+#define rv_fmt_fli                    "O\t3,h"
- #endif /* DISAS_RISCV_H */
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svpbmt;
+     bool ext_zhinx;
-     bool ext_zdinx;
+     bool ext_zhinxmin;
-     bool ext_zawrs;
+     bool ext_zve32f;
-+    bool ext_zfa;
++    bool ext_zve32x;
-     bool ext_zfbfmin;
+     bool ext_zve64f;
-     bool ext_zfh;
+     bool ext_zve64d;
-     bool ext_zfhmin;
+     bool ext_zvbb;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Floating Point - Double Precision */
  DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 +DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Bitmanip */
  DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Cache-block operations */
  DEF_HELPER_2(cbo_clean_flush, void, env, tl)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
  bset       0010100 .......... 001 ..... 0110011 @r
  bseti      00101. ........... 001 ..... 0010011 @sh
 +# *** Zfa Standard Extension ***
 +fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
 +fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
 +fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
 +fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
 +fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
 +fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
 +fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
 +fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
 +fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
 +fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
 +fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
 +fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
 +fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
 +fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
 +fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
 +fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
 +fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
 +fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
 +fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
 +fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
 +fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
 +
  # *** RV32 Zfh Extension ***
  flh        ............   ..... 001 ..... 0000111 @i
  fsh        .......  ..... ..... 001 ..... 0100111 @s
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
      rv_op_fsh = 798,
      rv_op_fmv_h_x = 799,
      rv_op_fmv_x_h = 800,
 +    rv_op_fli_s = 801,
 +    rv_op_fli_d = 802,
 +    rv_op_fli_q = 803,
 +    rv_op_fli_h = 804,
 +    rv_op_fminm_s = 805,
 +    rv_op_fmaxm_s = 806,
 +    rv_op_fminm_d = 807,
 +    rv_op_fmaxm_d = 808,
 +    rv_op_fminm_q = 809,
 +    rv_op_fmaxm_q = 810,
 +    rv_op_fminm_h = 811,
 +    rv_op_fmaxm_h = 812,
 +    rv_op_fround_s = 813,
 +    rv_op_froundnx_s = 814,
 +    rv_op_fround_d = 815,
 +    rv_op_froundnx_d = 816,
 +    rv_op_fround_q = 817,
 +    rv_op_froundnx_q = 818,
 +    rv_op_fround_h = 819,
 +    rv_op_froundnx_h = 820,
 +    rv_op_fcvtmod_w_d = 821,
 +    rv_op_fmvh_x_d = 822,
 +    rv_op_fmvp_d_x = 823,
 +    rv_op_fmvh_x_q = 824,
 +    rv_op_fmvp_q_x = 825,
 +    rv_op_fleq_s = 826,
 +    rv_op_fltq_s = 827,
 +    rv_op_fleq_d = 828,
 +    rv_op_fltq_d = 829,
 +    rv_op_fleq_q = 830,
 +    rv_op_fltq_q = 831,
 +    rv_op_fleq_h = 832,
 +    rv_op_fltq_h = 833,
  } rv_op;
  /* register names */
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
      "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
  };
 +/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
 + * The constants use the hex floating-point literal representation
 + * that is printed when using the printf %a format specifier,
 + * which matches the output that is generated by the disassembler.
 + */
 +static const char rv_fli_name_const[32][9] =
 +{
 +    "0x1p+0", "min", "0x1p-16", "0x1p-15",
 +    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
 +    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
 +    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
 +    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
 +    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
 +    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
 +    "0x1p+15", "0x1p+16", "inf", "nan"
 +};
 +
  /* pseudo-instruction constraints */
  static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
      { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
      { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
      { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
  };
  /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_s; break;
                  case 1: op = rv_op_fmax_s; break;
 +                case 2: op = rv_op_fminm_s; break;
 +                case 3: op = rv_op_fmaxm_s; break;
                  }
                  break;
              case 21:
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_d; break;
                  case 1: op = rv_op_fmax_d; break;
 +                case 2: op = rv_op_fminm_d; break;
 +                case 3: op = rv_op_fmaxm_d; break;
 +                }
 +                break;
 +            case 22:
 +                switch (((inst >> 12) & 0b111)) {
 +                case 2: op = rv_op_fminm_h; break;
 +                case 3: op = rv_op_fmaxm_h; break;
                  }
                  break;
              case 23:
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_q; break;
                  case 1: op = rv_op_fmax_q; break;
 +                case 2: op = rv_op_fminm_q; break;
 +                case 3: op = rv_op_fmaxm_q; break;
                  }
                  break;
              case 32:
                  switch ((inst >> 20) & 0b11111) {
                  case 1: op = rv_op_fcvt_s_d; break;
                  case 3: op = rv_op_fcvt_s_q; break;
 +                case 4: op = rv_op_fround_s; break;
 +                case 5: op = rv_op_froundnx_s; break;
                  case 6: op = rv_op_fcvt_s_bf16; break;
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_d_s; break;
                  case 3: op = rv_op_fcvt_d_q; break;
 +                case 4: op = rv_op_fround_d; break;
 +                case 5: op = rv_op_froundnx_d; break;
                  }
                  break;
              case 34:
                  switch (((inst >> 20) & 0b11111)) {
 +                case 4: op = rv_op_fround_h; break;
 +                case 5: op = rv_op_froundnx_h; break;
                  case 8: op = rv_op_fcvt_bf16_s; break;
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_q_s; break;
                  case 1: op = rv_op_fcvt_q_d; break;
 +                case 4: op = rv_op_fround_q; break;
 +                case 5: op = rv_op_froundnx_q; break;
                  }
                  break;
              case 44:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_s; break;
                  case 1: op = rv_op_flt_s; break;
                  case 2: op = rv_op_feq_s; break;
 +                case 4: op = rv_op_fleq_s; break;
 +                case 5: op = rv_op_fltq_s; break;
                  }
                  break;
              case 81:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_d; break;
                  case 1: op = rv_op_flt_d; break;
                  case 2: op = rv_op_feq_d; break;
 +                case 4: op = rv_op_fleq_d; break;
 +                case 5: op = rv_op_fltq_d; break;
 +                }
 +                break;
 +            case 82:
 +                switch (((inst >> 12) & 0b111)) {
 +                case 4: op = rv_op_fleq_h; break;
 +                case 5: op = rv_op_fltq_h; break;
                  }
                  break;
              case 83:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_q; break;
                  case 1: op = rv_op_flt_q; break;
                  case 2: op = rv_op_feq_q; break;
 +                case 4: op = rv_op_fleq_q; break;
 +                case 5: op = rv_op_fltq_q; break;
 +                }
 +                break;
 +            case 89:
 +        switch (((inst >> 12) & 0b111)) {
 +                case 0: op = rv_op_fmvp_d_x; break;
 +                }
 +                break;
 +            case 91:
 +        switch (((inst >> 12) & 0b111)) {
 +                case 0: op = rv_op_fmvp_q_x; break;
                  }
                  break;
              case 96:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 1: op = rv_op_fcvt_wu_d; break;
                  case 2: op = rv_op_fcvt_l_d; break;
                  case 3: op = rv_op_fcvt_lu_d; break;
 +                case 8: op = rv_op_fcvtmod_w_d; break;
                  }
                  break;
              case 99:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_x_d; break;
                  case 1: op = rv_op_fclass_d; break;
 +                case 8: op = rv_op_fmvh_x_d; break;
                  }
                  break;
              case 114:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_x_q; break;
                  case 1: op = rv_op_fclass_q; break;
 +                case 8: op = rv_op_fmvh_x_q; break;
                  }
                  break;
              case 120:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_s_x; break;
 +                case 8: op = rv_op_fli_s; break;
                  }
                  break;
              case 121:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_d_x; break;
 +                case 8: op = rv_op_fli_d; break;
                  }
                  break;
              case 122:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_h_x; break;
 +                case 8: op = rv_op_fli_h; break;
                  }
                  break;
              case 123:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_q_x; break;
 +                case 8: op = rv_op_fli_q; break;
                  }
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
          break;
      case rv_codec_zcmt_jt:
          dec->imm = operand_tbl_index(inst);
 +    break;
 +    case rv_codec_fli:
 +        dec->rd = operand_rd(inst);
 +        dec->imm = operand_rs1(inst);
          break;
      case rv_codec_r2_imm5:
          dec->rd = operand_rd(inst);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
              append(buf, tmp, buflen);
              break;
          }
 +        case 'h':
 +            append(buf, rv_fli_name_const[dec->imm], buflen);
 +            break;
          default:
              break;
          }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
+     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
-     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
-     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-+    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
++    ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
-     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
+     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
-@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-     set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
+     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
-     env->priv_ver = PRIV_VERSION_1_11_0;
+     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
+     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
-+    cpu->cfg.ext_zfa = true;
++    MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
-     cpu->cfg.ext_zfh = true;
+     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
-     cpu->cfg.mmu = true;
+     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
-     cpu->cfg.ext_xtheadba = true;
+     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
      *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
      *cs_base = 0;
 -    if (cpu->cfg.ext_zve32f) {
 +    if (cpu->cfg.ext_zve32x) {
          /*
           * If env->vl equals to VLMAX, we can use generic vector operation
           * expanders (GVEC) to accerlate the vector operations.
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
  static RISCVException vs(CPURISCVState *env, int csrno)
  {
 -    if (riscv_cpu_cfg(env)->ext_zve32f) {
 +    if (riscv_cpu_cfg(env)->ext_zve32x) {
  #if !defined(CONFIG_USER_ONLY)
          if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
              return RISCV_EXCP_ILLEGAL_INST;
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
 @@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-+    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
+-    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
-+        error_setg(errp, "Zfa extension requires F extension");
+-        error_setg(errp, "Zve32f/Zve64f extensions require F extension");
-+        return;
+-        return;
-+    }
++    /* The Zve32f extension depends on the Zve32x extension */
-+
++    if (cpu->cfg.ext_zve32f) {
-     if (cpu->cfg.ext_zfh) {
++        if (!riscv_has_ext(env, RVF)) {
-         cpu->cfg.ext_zfhmin = true;
++            error_setg(errp, "Zve32f/Zve64f extensions require F extension");
 +            return;
 +        }
 +        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
      }
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+     if (cpu->cfg.ext_zvfh) {
-     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zvbc), true);
-+    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
+     }
-     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
-     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
+-    /*
-     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
+-     * In principle Zve*x would also suffice here, were they supported
-diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
+-     * in qemu
 -     */
      if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkb || cpu->cfg.ext_zvkg ||
           cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32x) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/fpu_helper.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/fpu_helper.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
                           float32_minimum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    float32 ret = float32_min(frs1, frs2, &env->fp_status);
 +    return nanbox_s(env, ret);
 +}
 +
  uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
-     float32 frs1 = check_nanbox_s(env, rs1);
+     TCGv s1, dst;
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-                          float32_maximum_number(frs1, frs2, &env->fp_status));
+-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
- }
++    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
+         return false;
-+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+     }
-+{
-+    float32 frs1 = check_nanbox_s(env, rs1);
+@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    float32 ret = float32_max(frs1, frs2, &env->fp_status);
 +    return nanbox_s(env, ret);
 +}
 +
  uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
  {
-     float32 frs1 = check_nanbox_s(env, rs1);
+     TCGv dst;
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-     return float32_le(frs1, frs2, &env->fp_status);
+-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
- }
++    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
+         return false;
-+target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+     }
-+{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return float32_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float32_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return float32_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
      return fclass_s(frs1);
  }
 +uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +
 +    frs1 = float32_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return nanbox_s(env, frs1);
 +}
 +
 +uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    frs1 = float32_round_to_int(frs1, &env->fp_status);
 +    return nanbox_s(env, frs1);
 +}
 +
  uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_add(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
             float64_minimum_number(frs1, frs2, &env->fp_status);
  }
 +uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_min(frs1, frs2, &env->fp_status);
 +}
 +
  uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
             float64_maximum_number(frs1, frs2, &env->fp_status);
  }
 +uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_max(frs1, frs2, &env->fp_status);
 +}
 +
  uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
  {
      return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
      return float64_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
      return float64_to_int32(frs1, &env->fp_status);
  }
 +uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
 +{
 +    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
 +}
 +
  target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
  {
      return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
      return fclass_d(frs1);
  }
 +uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +
 +    frs1 = float64_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return frs1;
 +}
 +
 +uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
 +{
 +    return float64_round_to_int(frs1, &env->fp_status);
 +}
 +
  uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float16_minimum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 ret = float16_min(frs1, frs2, &env->fp_status);
 +    return nanbox_h(env, ret);
 +}
 +
  uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float16_maximum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 ret = float16_max(frs1, frs2, &env->fp_status);
 +    return nanbox_h(env, ret);
 +}
 +
  uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float16_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return float16_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float16_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return float16_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
      return fclass_h(frs1);
  }
 +uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +
 +    frs1 = float16_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return nanbox_h(env, frs1);
 +}
 +
 +uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
 +{
 +    float16 frs1 = check_nanbox_s(env, rs1);
 +    frs1 = float16_round_to_int(frs1, &env->fp_status);
 +    return nanbox_h(env, frs1);
 +}
 +
  target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
  #include "insn_trans/trans_rvzicond.c.inc"
  #include "insn_trans/trans_rvzawrs.c.inc"
  #include "insn_trans/trans_rvzicbo.c.inc"
 +#include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvzfh.c.inc"
  #include "insn_trans/trans_rvk.c.inc"
  #include "insn_trans/trans_privileged.c.inc"
 diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/riscv64/test-fcvtmod.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <stddef.h>
 +#include <stdint.h>
 +
 +#define FFLAG_NX_SHIFT 0 /* inexact */
 +#define FFLAG_UF_SHIFT 1 /* underflow */
 +#define FFLAG_OF_SHIFT 2 /* overflow */
 +#define FFLAG_DZ_SHIFT 3 /* divide by zero */
 +#define FFLAG_NV_SHIFT 4 /* invalid operation */
 +
 +#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
 +#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
 +#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
 +#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
 +#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
 +
 +typedef struct fp64_fcvt_fcvtmod_testcase {
 +    const char* name;
 +    union {
 +        uint64_t inp_lu;
 +        double inp_lf;
 +    };
 +    uint64_t exp_fcvt;
 +    uint8_t exp_fcvt_fflags;
 +    uint64_t exp_fcvtmod;
 +    uint8_t exp_fcvtmod_fflags;
 +} fp64_fcvt_fcvtmod_testcase_t;
 +
 +void print_fflags(uint8_t fflags)
 +{
 +    int set = 0;
 +
 +    if (fflags == 0) {
 +        printf("-");
 +        return;
 +    }
 +
 +    if (fflags & FFLAG_NV) {
 +        printf("%sFFLAG_NV", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_DZ) {
 +        printf("%sFFLAG_DZ", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_OF) {
 +        printf("%sFFLAG_OF", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_UF) {
 +        printf("%sFFLAG_UF", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_NX) {
 +        printf("%sFFLAG_NX", set ? " | " : "");
 +        set = 1;
 +    }
 +}
 +
 +/* Clear all FP flags. */
 +static inline void clear_fflags()
 +{
 +    __asm__ __volatile__("fsflags zero");
 +}
 +
 +/* Read all FP flags. */
 +static inline uint8_t get_fflags()
 +{
 +    uint64_t v;
 +    __asm__ __volatile__("frflags %0" : "=r"(v));
 +    return (uint8_t)v;
 +}
 +
 +/* Move input value (without conversations) into an FP register. */
 +static inline double do_fmv_d_x(uint64_t inp)
 +{
 +    double fpr;
 +    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
 +    return fpr;
 +}
 +
 +static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
 +{
 +    uint64_t ret;
 +    double fpr = do_fmv_d_x(inp);
 +
 +    clear_fflags();
 +
 +    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
 +
 +    *fflags = get_fflags();
 +
 +    return ret;
 +}
 +
 +static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
 +{
 +    uint64_t ret;
 +    double fpr = do_fmv_d_x(inp);
 +
 +    clear_fflags();
 +
 +    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
 +    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
 +
 +    *fflags = get_fflags();
 +
 +    return ret;
 +}
 +
 +static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
 +    /* Zero (exp=0, frac=0) */
 +    { .name = "+0.0",
 +      .inp_lf = 0x0p0,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000000,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-0.0",
 +      .inp_lf = -0x0p0,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000000,
 +      .exp_fcvtmod_fflags = 0 },
 +
 +    /* Subnormal: exp=0 frac!=0 */
 +    { .name = "Subnormal frac=1",
 +      .inp_lu = 0x0000000000000001,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Subnormal frac=0xf..f",
 +      .inp_lu = 0x0000ffffffffffff,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Neg subnormal frac=1",
 +      .inp_lu = 0x0000000000000001,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Neg subnormal frac=0xf..f",
 +      .inp_lu = 0x8000ffffffffffff,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    /* Infinity: exp=0x7ff, frac=0 */
 +    { .name = "+INF",
 +      .inp_lu = 0x7ff0000000000000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 max */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "-INF",
 +      .inp_lu = 0xfff0000000000000,
 +      .exp_fcvt = 0xffffffff80000000, /* int32 min */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    /* NaN: exp=7ff, frac!=0 */
 +    { .name = "canonical NaN",
 +      .inp_lu = 0x7ff8000000000000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 max */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "non-canonical NaN",
 +      .inp_lu = 0x7ff8000000100000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 min */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    /* Normal numbers: exp!=0, exp!=7ff */
 +    { .name = "+smallest normal value",
 +      .inp_lu = 0x0010000000000000,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-smallest normal value",
 +      .inp_lu = 0x8010000000000000,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+0.5",
 +      .inp_lf = 0x1p-1,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-0.5",
 +      .inp_lf = -0x1p-1,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+value just below 1.0",
 +      .inp_lu = 0x3fefffffffffffff,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-value just above -1.0",
 +      .inp_lu = 0xbfefffffffffffff,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+1.0",
 +      .inp_lf = 0x1p0,
 +      .exp_fcvt = 0x0000000000000001,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000001,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-1.0",
 +      .inp_lf = -0x1p0,
 +      .exp_fcvt = 0xffffffffffffffff,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0xffffffffffffffff,
 +      .exp_fcvtmod_fflags = 0 },
 +
 +    { .name = "+1.5",
 +      .inp_lu = 0x3ff8000000000000,
 +      .exp_fcvt = 1,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 1,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-1.5",
 +      .inp_lu = 0xbff8000000000000,
 +      .exp_fcvt = 0xffffffffffffffff,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0xffffffffffffffff,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+max int32 (2147483647)",
 +      .inp_lu = 0x41dfffffffc00000,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x000000007fffffff,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "+max int32 +1 (2147483648)",
 +      .inp_lf = 0x1p31,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "+max int32 +2 (2147483649)",
 +      .inp_lu = 0x41e0000000200000,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    { .name = "-max int32 (-2147483648)",
 +      .inp_lf = -0x1p31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0xffffffff80000000,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-max int32 -1 (-2147483649)",
 +      .inp_lf = -0x1.00000002p+31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 2147483647, /* int32 max */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "-max int32 -2 (-2147483650)",
 +      .inp_lf = -0x1.00000004p+31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 2147483646, /* int32 max -1 */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +};
 +
 +int run_fcvtmod_tests()
 +{
 +    uint64_t act_fcvt;
 +    uint8_t act_fcvt_fflags;
 +    uint64_t act_fcvtmod;
 +    uint8_t act_fcvtmod_fflags;
 +
 +    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
 +        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
 +
 +        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
 +        int fcvt_correct = act_fcvt == t->exp_fcvt &&
 +                    act_fcvt_fflags == t->exp_fcvt_fflags;
 +        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
 +        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
 +                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
 +
 +        if (fcvt_correct && fcvtmod_correct) {
 +            continue;
 +        }
 +
 +        printf("Test %zu (%s) failed!\n", i, t->name);
 +
 +        double fpr = do_fmv_d_x(t->inp_lu);
 +        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
 +        printf("inp_lf: %lf\n", t->inp_lf);
 +
 +        uint32_t sign = (t->inp_lu >> 63);
 +        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
 +        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
 +        int true_exp = exp - 1023;
 +        int shift = true_exp - 52;
 +        uint64_t true_frac = frac | 1ull << 52;
 +
 +        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
 +        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
 +
 +        if (!fcvt_correct) {
 +            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
 +            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
 +            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
 +            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
 +        }
 +
 +        if (!fcvtmod_correct) {
 +            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
 +            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
 +            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
 +            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
 +        }
 +
 +        return 1;
 +    }
 +
 +    return 0;
 +}
 +
 +int main()
 +{
 +    return run_fcvtmod_tests();
 +}
 diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V translation routines for the Zfa Standard Extension.
 + *
 + * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#define REQUIRE_ZFA(ctx) do {     \
 +    if (!ctx->cfg_ptr->ext_zfa) { \
 +        return false;             \
 +    }                             \
 +} while (0)
 +
 +#define REQUIRE_ZFH(ctx) do {     \
 +    if (!ctx->cfg_ptr->ext_zfh) { \
 +        return false;             \
 +    }                             \
 +} while (0)
 +
 +static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
 +    static const uint64_t fli_s_table[] = {
 +        0xffffffffbf800000,  /* -1.0 */
 +        0xffffffff00800000,  /* minimum positive normal */
 +        0xffffffff37800000,  /* 1.0 * 2^-16 */
 +        0xffffffff38000000,  /* 1.0 * 2^-15 */
 +        0xffffffff3b800000,  /* 1.0 * 2^-8  */
 +        0xffffffff3c000000,  /* 1.0 * 2^-7  */
 +        0xffffffff3d800000,  /* 1.0 * 2^-4  */
 +        0xffffffff3e000000,  /* 1.0 * 2^-3  */
 +        0xffffffff3e800000,  /* 0.25 */
 +        0xffffffff3ea00000,  /* 0.3125 */
 +        0xffffffff3ec00000,  /* 0.375 */
 +        0xffffffff3ee00000,  /* 0.4375 */
 +        0xffffffff3f000000,  /* 0.5 */
 +        0xffffffff3f200000,  /* 0.625 */
 +        0xffffffff3f400000,  /* 0.75 */
 +        0xffffffff3f600000,  /* 0.875 */
 +        0xffffffff3f800000,  /* 1.0 */
 +        0xffffffff3fa00000,  /* 1.25 */
 +        0xffffffff3fc00000,  /* 1.5 */
 +        0xffffffff3fe00000,  /* 1.75 */
 +        0xffffffff40000000,  /* 2.0 */
 +        0xffffffff40200000,  /* 2.5 */
 +        0xffffffff40400000,  /* 3 */
 +        0xffffffff40800000,  /* 4 */
 +        0xffffffff41000000,  /* 8 */
 +        0xffffffff41800000,  /* 16 */
 +        0xffffffff43000000,  /* 2^7 */
 +        0xffffffff43800000,  /* 2^8 */
 +        0xffffffff47000000,  /* 2^15 */
 +        0xffffffff47800000,  /* 2^16 */
 +        0xffffffff7f800000,  /* +inf */
 +        0xffffffff7fc00000,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    static const uint64_t fli_d_table[] = {
 +        0xbff0000000000000,  /* -1.0 */
 +        0x0010000000000000,  /* minimum positive normal */
 +        0x3ef0000000000000,  /* 1.0 * 2^-16 */
 +        0x3f00000000000000,  /* 1.0 * 2^-15 */
 +        0x3f70000000000000,  /* 1.0 * 2^-8  */
 +        0x3f80000000000000,  /* 1.0 * 2^-7  */
 +        0x3fb0000000000000,  /* 1.0 * 2^-4  */
 +        0x3fc0000000000000,  /* 1.0 * 2^-3  */
 +        0x3fd0000000000000,  /* 0.25 */
 +        0x3fd4000000000000,  /* 0.3125 */
 +        0x3fd8000000000000,  /* 0.375 */
 +        0x3fdc000000000000,  /* 0.4375 */
 +        0x3fe0000000000000,  /* 0.5 */
 +        0x3fe4000000000000,  /* 0.625 */
 +        0x3fe8000000000000,  /* 0.75 */
 +        0x3fec000000000000,  /* 0.875 */
 +        0x3ff0000000000000,  /* 1.0 */
 +        0x3ff4000000000000,  /* 1.25 */
 +        0x3ff8000000000000,  /* 1.5 */
 +        0x3ffc000000000000,  /* 1.75 */
 +        0x4000000000000000,  /* 2.0 */
 +        0x4004000000000000,  /* 2.5 */
 +        0x4008000000000000,  /* 3 */
 +        0x4010000000000000,  /* 4 */
 +        0x4020000000000000,  /* 8 */
 +        0x4030000000000000,  /* 16 */
 +        0x4060000000000000,  /* 2^7 */
 +        0x4070000000000000,  /* 2^8 */
 +        0x40e0000000000000,  /* 2^15 */
 +        0x40f0000000000000,  /* 2^16 */
 +        0x7ff0000000000000,  /* +inf */
 +        0x7ff8000000000000,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
 +    static const uint64_t fli_h_table[] = {
 +        0xffffffffffffbc00,  /* -1.0 */
 +        0xffffffffffff0400,  /* minimum positive normal */
 +        0xffffffffffff0100,  /* 1.0 * 2^-16 */
 +        0xffffffffffff0200,  /* 1.0 * 2^-15 */
 +        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
 +        0xffffffffffff2000,  /* 1.0 * 2^-7  */
 +        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
 +        0xffffffffffff3000,  /* 1.0 * 2^-3  */
 +        0xffffffffffff3400,  /* 0.25 */
 +        0xffffffffffff3500,  /* 0.3125 */
 +        0xffffffffffff3600,  /* 0.375 */
 +        0xffffffffffff3700,  /* 0.4375 */
 +        0xffffffffffff3800,  /* 0.5 */
 +        0xffffffffffff3900,  /* 0.625 */
 +        0xffffffffffff3a00,  /* 0.75 */
 +        0xffffffffffff3b00,  /* 0.875 */
 +        0xffffffffffff3c00,  /* 1.0 */
 +        0xffffffffffff3d00,  /* 1.25 */
 +        0xffffffffffff3e00,  /* 1.5 */
 +        0xffffffffffff3f00,  /* 1.75 */
 +        0xffffffffffff4000,  /* 2.0 */
 +        0xffffffffffff4100,  /* 2.5 */
 +        0xffffffffffff4200,  /* 3 */
 +        0xffffffffffff4400,  /* 4 */
 +        0xffffffffffff4800,  /* 8 */
 +        0xffffffffffff4c00,  /* 16 */
 +        0xffffffffffff5800,  /* 2^7 */
 +        0xffffffffffff5c00,  /* 2^8 */
 +        0xffffffffffff7800,  /* 2^15 */
 +        0xffffffffffff7c00,  /* 2^16 */
 +        0xffffffffffff7c00,  /* +inf */
 +        0xffffffffffff7e00,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fminm_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +
 +    gen_helper_fminm_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fminm_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dst = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 t1 = tcg_temp_new_i64();
 +
 +    /* Rounding mode is RTZ. */
 +    gen_set_rm(ctx, RISCV_FRM_RTZ);
 +    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
 +    tcg_gen_trunc_i64_tl(dst, t1);
 +    gen_set_gpr(ctx, a->rd, dst);
 +
 +    return true;
 +}
 +
 +bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_32BIT(ctx);
 +
 +    TCGv dst = dest_gpr(ctx, a->rd);
 +    TCGv_i64 t1 = tcg_temp_new_i64();
 +    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
 +    tcg_gen_trunc_i64_tl(dst, t1);
 +    gen_set_gpr(ctx, a->rd, dst);
 +    return true;
 +}
 +
 +bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_32BIT(ctx);
 +
 +    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
 +    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 +    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fleq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fleq_h(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_h(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/riscv64/Makefile.target
 +++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
  TESTS += test-aes
  run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
 +
 +# Test for fcvtmod
 +TESTS += test-fcvtmod
 +test-fcvtmod: CFLAGS += -march=rv64imafdc
 +test-fcvtmod: LDFLAGS += -static
 +run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
 --
-.40.1
+.45.1

-[PULL 25/54] target/riscv: Add properties for BF16 extensions
+[PULL 11/28] target/riscv: Add support for Zve64x extension
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Jason Chien <jason.chien@sifive.com>
-Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
+Add support for Zve64x extension. Enabling Zve64f enables Zve64x and
-Add require check for BF16 extensions.
+enabling Zve64x enables Zve32x according to their dependency.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2107
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
+Message-ID: <20240328022343.6871-3-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h |  3 +++
+ target/riscv/cpu_cfg.h     |  1 +
- target/riscv/cpu.c     | 20 ++++++++++++++++++++
+ target/riscv/cpu.c         |  2 ++
-files changed, 23 insertions(+)
+ target/riscv/tcg/tcg-cpu.c | 17 +++++++++++------
 files changed, 14 insertions(+), 6 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svpbmt;
+     bool ext_zve32x;
      bool ext_zdinx;
      bool ext_zawrs;
 +    bool ext_zfbfmin;
      bool ext_zfh;
      bool ext_zfhmin;
      bool ext_zfinx;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64f;
      bool ext_zve64d;
-     bool ext_zmmul;
++    bool ext_zve64x;
-+    bool ext_zvfbfmin;
+     bool ext_zvbb;
-+    bool ext_zvfbfwma;
+     bool ext_zvbc;
-     bool ext_zvfh;
+     bool ext_zvkb;
      bool ext_zvfhmin;
      bool ext_smaia;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
++    ISA_EXT_DATA_ENTRY(zve64x, PRIV_VERSION_1_10_0, ext_zve64x),
+     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+     MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
+     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
+     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
++    MULTI_EXT_CFG_BOOL("zve64x", ext_zve64x, false),
+     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
+     MULTI_EXT_CFG_BOOL("zvfbfwma", ext_zvfbfwma, false),
+     MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+     /* The Zve64d extension depends on the Zve64f extension */
+     if (cpu->cfg.ext_zve64d) {
++        if (!riscv_has_ext(env, RVD)) {
++            error_setg(errp, "Zve64d/V extensions require D extension");
++            return;
++        }
+         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve64f), true);
+     }
+-    /* The Zve64f extension depends on the Zve32f extension */
++    /* The Zve64f extension depends on the Zve64x and Zve32f extensions */
+     if (cpu->cfg.ext_zve64f) {
++        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve64x), true);
+         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32f), true);
+     }
+-    if (cpu->cfg.ext_zve64d && !riscv_has_ext(env, RVD)) {
+-        error_setg(errp, "Zve64d/V extensions require D extension");
+-        return;
++    /* The Zve64x extension depends on the Zve32x extension */
++    if (cpu->cfg.ext_zve64x) {
++        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
+     }
+     /* The Zve32f extension depends on the Zve32x extension */
 @@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-+    if (cpu->cfg.ext_zfbfmin && !riscv_has_ext(env, RVF)) {
+-    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
-+        error_setg(errp, "Zfbfmin extension depends on F extension");
++    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64x) {
-+        return;
+         error_setg(
-+    }
+             errp,
-+
+-            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
-     if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
++            "Zvbc and Zvknhb extensions require V or Zve64x extensions");
          error_setg(errp, "D extension requires F extension");
          return;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zfbfmin) {
-+        error_setg(errp, "Zvfbfmin extension depends on Zfbfmin extension");
-+        return;
-+    }
-+
-+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zve32f) {
-+        error_setg(errp, "Zvfbfmin extension depends on Zve32f extension");
-+        return;
-+    }
-+
-+    if (cpu->cfg.ext_zvfbfwma && !cpu->cfg.ext_zvfbfmin) {
-+        error_setg(errp, "Zvfbfwma extension depends on Zvfbfmin extension");
-+        return;
-+    }
-+
-     /* Set the ISA extensions, checks should have happened above */
-     if (cpu->cfg.ext_zhinx) {
-         cpu->cfg.ext_zhinxmin = true;
 --
-.40.1
+.45.1

-[PULL 30/54] target/riscv: Set the correct exception for implict G-stage translation fail
+[PULL 12/28] target/riscv: Relax vector register check in RISCV gdbstub
 From: Jason Chien <jason.chien@sifive.com>
-The privileged spec states:
+In current implementation, the gdbstub allows reading vector registers
-For a memory access made to support VS-stage address translation (such as
+only if V extension is supported. However, all vector extensions and
-to read/write a VS-level page table), permissions are checked as though
+vector crypto extensions have the vector registers and they all depend
-for a load or store, not for the original access type. However, any
+on Zve32x. The gdbstub should check for Zve32x instead.
 exception is always reported for the original access type (instruction,
 load, or store/AMO).
 The current implementation converts the access type to LOAD if implicit
 G-stage translation fails which results in only reporting "Load guest-page
 fault". This commit removes the convertion of access type, so the reported
 exception conforms to the spec.
 Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
-Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
+Message-ID: <20240328022343.6871-4-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 1 -
+ target/riscv/gdbstub.c | 2 +-
-file changed, 1 deletion(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/gdbstub.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
-         if (ret == TRANSLATE_G_STAGE_FAIL) {
+                                  gdb_find_static_feature("riscv-32bit-fpu.xml"),
-             first_stage_error = false;
+);
-             two_stage_indirect_error = true;
+     }
--            access_type = MMU_DATA_LOAD;
+-    if (env->misa_ext & RVV) {
-         }
++    if (cpu->cfg.ext_zve32x) {
+         gdb_register_coprocessor(cs, riscv_gdb_get_vector,
-         qemu_log_mask(CPU_LOG_MMU,
+                                  riscv_gdb_set_vector,
                                   ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
 --
-.40.1
+.45.1

-[PULL 41/54] target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
+[PULL 13/28] target/riscv: Fix the element agnostic function problem
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Huang Tao <eric.huang@linux.alibaba.com>
-Allow 'marchid' and 'mimpid' to also be initialized in
+In RVV and vcrypto instructions, the masked and tail elements are set to 1s
-kvm_riscv_init_machine_ids().
+using vext_set_elems_1s function if the vma/vta bit is set. It is the element
 agnostic policy.
-After this change, the handling of mvendorid/marchid/mimpid for the
+However, this function can't deal the big endian situation. This patch fixes
-'host' CPU type will be equal to what we already have for TCG named
+the problem by adding handling of such case.
 CPUs, i.e. the user is not able to set these values to a different val
 than the one that is already preset.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240325021654.6594-1-eric.huang@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 16 ++++++++++++++++
+ target/riscv/vector_internals.c | 22 ++++++++++++++++++++++
-file changed, 16 insertions(+)
+file changed, 22 insertions(+)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/vector_internals.c
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/vector_internals.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-     if (ret != 0) {
+     if (tot - cnt == 0) {
-         error_report("Unable to retrieve mvendorid from host, error %d", ret);
+         return ;
      }
 +
-+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    if (HOST_BIG_ENDIAN) {
-+                              KVM_REG_RISCV_CONFIG_REG(marchid));
++        /*
-+    reg.addr = (uint64_t)&cpu->cfg.marchid;
++         * Deal the situation when the elements are insdie
-+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
++         * only one uint64 block including setting the
-+    if (ret != 0) {
++         * masked-off element.
-+        error_report("Unable to retrieve marchid from host, error %d", ret);
++         */
 +        if (((tot - 1) ^ cnt) < 8) {
 +            memset(base + H1(tot - 1), -1, tot - cnt);
 +            return;
 +        }
 +        /*
 +         * Otherwise, at least cross two uint64_t blocks.
 +         * Set first unaligned block.
 +         */
 +        if (cnt % 8 != 0) {
 +            uint32_t j = ROUND_UP(cnt, 8);
 +            memset(base + H1(j - 1), -1, j - cnt);
 +            cnt = j;
 +        }
 +        /* Set other 64bit aligend blocks */
 +    }
-+
+     memset(base + cnt, -1, tot - cnt);
 +    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 +                              KVM_REG_RISCV_CONFIG_REG(mimpid));
 +    reg.addr = (uint64_t)&cpu->cfg.mimpid;
 +    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +    if (ret != 0) {
 +        error_report("Unable to retrieve mimpid from host, error %d", ret);
 +    }
  }
- void kvm_riscv_init_user_properties(Object *cpu_obj)
 --
-.40.1
+.45.1

-[PULL 48/54] target/riscv/cpu.c: add satp_mode properties earlier
+[PULL 14/28] target/riscv/cpu.c: fix Zvkb extension config
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yangyu Chen <cyy@cyyself.name>
-riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
+This code has a typo that writes zvkb to zvkg, causing users can't
-CONFIG_USER_ONLY" blocks after changes that added KVM properties
+enable zvkb through the config. This patch gets this fixed.
 handling.
-KVM specific properties are required to be created earlier than their
+Signed-off-by: Yangyu Chen <cyy@cyyself.name>
-TCG counterparts, but the remaining props can be created at any order.
+Fixes: ea61ef7097d0 ("target/riscv: Move vector crypto extensions to riscv_cpu_extensions")
-Move riscv_add_satp_mode_properties() to the start of the function,
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 inside the !CONFIG_USER_ONLY block already present there, to remove the
 last ifndef block.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
 Reviewed-by:  Weiwei Li <liwei1518@gmail.com>
 Message-ID: <tencent_7E34EEF0F90B9A68BF38BEE09EC6D4877C0A@qq.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 6 ++----
+ target/riscv/cpu.c | 2 +-
-file changed, 2 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-     DeviceState *dev = DEVICE(obj);
+     /* Vector cryptography extensions */
+     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
- #ifndef CONFIG_USER_ONLY
+     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
-+    riscv_add_satp_mode_properties(obj);
+-    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
-+
++    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkb, false),
-     if (kvm_enabled()) {
+     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
-         kvm_riscv_init_user_properties(obj);
+     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
-     }
+     MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
  #endif
          qdev_property_add_static(dev, prop);
      }
 -
 -#ifndef CONFIG_USER_ONLY
 -    riscv_add_satp_mode_properties(obj);
 -#endif
  }
  static Property riscv_cpu_properties[] = {
 --
-.40.1
+.45.1

-[PULL 13/54] target/riscv: Add additional xlen for address when MPRV=1
+[PULL 15/28] target/riscv: Implement dynamic establishment of custom decoder
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Huang Tao <eric.huang@linux.alibaba.com>
-As specified in privilege spec:"When MPRV=1, load and store memory
+In this patch, we modify the decoder to be a freely composable data
-addresses are treated as though the current XLEN were set to MPP’s
+structure instead of a hardcoded one. It can be dynamically builded up
-XLEN". So the xlen for address may be different from current xlen.
+according to the extensions.
 This approach has several benefits:
 . Provides support for heterogeneous cpu architectures. As we add decoder in
    RISCVCPU, each cpu can have their own decoder, and the decoders can be
    different due to cpu's features.
 . Improve the decoding efficiency. We run the guard_func to see if the decoder
    can be added to the dynamic_decoder when building up the decoder. Therefore,
    there is no need to run the guard_func when decoding each instruction. It can
    improve the decoding efficiency
 . For vendor or dynamic cpus, it allows them to customize their own decoder
    functions to improve decoding efficiency, especially when vendor-defined
    instruction sets increase. Because of dynamic building up, it can skip the other
    decoder guard functions when decoding.
 . Pre patch for allowing adding a vendor decoder before decode_insn32() with minimal
    overhead for users that don't need this particular vendor decoder.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Suggested-by: Christoph Muellner <christoph.muellner@vrull.eu>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Co-authored-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240506023607.29544-1-eric.huang@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
+ target/riscv/cpu.h         |  1 +
- target/riscv/cpu_helper.c |  1 +
+ target/riscv/tcg/tcg-cpu.h | 15 +++++++++++++++
- target/riscv/translate.c  | 13 ++++++++++-
+ target/riscv/cpu.c         |  1 +
-files changed, 55 insertions(+), 8 deletions(-)
+ target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++
  target/riscv/translate.c   | 31 +++++++++++++++----------------
 files changed, 47 insertions(+), 16 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
- /* Virtual mode enabled */
+     uint32_t pmu_avail_ctrs;
- FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
+     /* Mapping of events to counters */
- FIELD(TB_FLAGS, PRIV, 24, 2)
+     GHashTable *pmu_event_ctr_map;
-+FIELD(TB_FLAGS, AXL, 26, 2)
++    const GPtrArray *decoders;
+ };
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
+ /**
-@@ -XXX,XX +XXX,XX @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
+diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
-     return &env_archcpu(env)->cfg;
+index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.h
 +++ b/target/riscv/tcg/tcg-cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
  void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
  bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
 +struct DisasContext;
 +struct RISCVCPUConfig;
 +typedef struct RISCVDecoder {
 +    bool (*guard_func)(const struct RISCVCPUConfig *);
 +    bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
 +} RISCVDecoder;
 +
 +typedef bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
 +
 +extern const size_t decoder_table_size;
 +
 +extern const RISCVDecoder decoder_table[];
 +
 +void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu);
 +
  #endif
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
              error_propagate(errp, local_err);
              return;
          }
 +        riscv_tcg_cpu_finalize_dynamic_decoder(cpu);
      } else if (kvm_enabled()) {
          riscv_kvm_cpu_finalize_features(cpu, &local_err);
          if (local_err != NULL) {
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
      }
  }
--#if defined(TARGET_RISCV32)
++void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
 -#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
 -#else
 -static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
 +#if !defined(CONFIG_USER_ONLY)
 +static inline int cpu_address_mode(CPURISCVState *env)
 +{
-+    int mode = env->priv;
++    GPtrArray *dynamic_decoders;
 +    dynamic_decoders = g_ptr_array_sized_new(decoder_table_size);
 +    for (size_t i = 0; i < decoder_table_size; ++i) {
 +        if (decoder_table[i].guard_func &&
 +            decoder_table[i].guard_func(&cpu->cfg)) {
 +            g_ptr_array_add(dynamic_decoders,
 +                            (gpointer)decoder_table[i].riscv_cpu_decode_fn);
 +        }
 +    }
 +
-+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
++    cpu->decoders = dynamic_decoders;
 +        mode = get_field(env->mstatus, MSTATUS_MPP);
 +    }
 +    return mode;
 +}
 +
-+static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
+ bool riscv_cpu_tcg_compatible(RISCVCPU *cpu)
  {
-     RISCVMXL xl = env->misa_mxl;
+     return object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST) == NULL;
 -#if !defined(CONFIG_USER_ONLY)
      /*
       * When emulating a 32-bit-only cpu, use RV32.
       * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
       * back to RV64 for lower privs.
       */
      if (xl != MXL_RV32) {
 -        switch (env->priv) {
 +        switch (mode) {
          case PRV_M:
              break;
          case PRV_U:
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
              break;
          }
      }
 -#endif
      return xl;
  }
  #endif
 +#if defined(TARGET_RISCV32)
 +#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
 +#else
 +static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
 +{
 +#if !defined(CONFIG_USER_ONLY)
 +    return cpu_get_xl(env, env->priv);
 +#else
 +    return env->misa_mxl;
 +#endif
 +}
 +#endif
 +
 +#if defined(TARGET_RISCV32)
 +#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
 +#else
 +static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
 +{
 +#ifdef CONFIG_USER_ONLY
 +    return env->xl;
 +#else
 +    int mode = cpu_address_mode(env);
 +
 +    return cpu_get_xl(env, mode);
 +#endif
 +}
 +#endif
 +
  static inline int riscv_cpu_xlen(CPURISCVState *env)
  {
      return 16 << env->xl;
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
      flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
      flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
      flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
 +    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
      if (env->cur_pmmask != 0) {
          flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
      }
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/helper-info.c.inc"
+ #undef  HELPER_H
++#include "tcg/tcg-cpu.h"
++
+ /* global register indices */
+ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
+ static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
 @@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     target_ulong priv_ver;
+     /* FRM is known to contain a valid value. */
-     RISCVMXL misa_mxl_max;
+     bool frm_valid;
-     RISCVMXL xl;
+     bool insn_start_updated;
-+    RISCVMXL address_xl;
++    const GPtrArray *decoders;
-     uint32_t misa_ext;
+ } DisasContext;
-     uint32_t opcode;
-     RISCVExtStatus mstatus_fs;
+ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
-@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
+@@ -XXX,XX +XXX,XX @@ static inline int insn_len(uint16_t first_word)
- #define get_xl(ctx)    ((ctx)->xl)
+     return (first_word & 3) == 3 ? 4 : 2;
- #endif
+ }
-+#ifdef TARGET_RISCV32
++const RISCVDecoder decoder_table[] = {
-+#define get_address_xl(ctx)    MXL_RV32
++    { always_true_p, decode_insn32 },
-+#elif defined(CONFIG_USER_ONLY)
++    { has_xthead_p, decode_xthead},
-+#define get_address_xl(ctx)    MXL_RV64
++    { has_XVentanaCondOps_p, decode_XVentanaCodeOps},
-+#else
++};
 +#define get_address_xl(ctx)    ((ctx)->address_xl)
 +#endif
 +
- /* The word size for this machine mode. */
++const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
- static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
++
  static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
  {
-@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
+-    /*
-     tcg_gen_addi_tl(addr, src1, imm);
+-     * A table with predicate (i.e., guard) functions and decoder functions
-     if (ctx->pm_mask_enabled) {
+-     * that are tested in-order until a decoder matches onto the opcode.
-         tcg_gen_andc_tl(addr, addr, pm_mask);
+-     */
--    } else if (get_xl(ctx) == MXL_RV32) {
+-    static const struct {
-+    } else if (get_address_xl(ctx) == MXL_RV32) {
+-        bool (*guard_func)(const RISCVCPUConfig *);
-         tcg_gen_ext32u_tl(addr, addr);
+-        bool (*decode_func)(DisasContext *, uint32_t);
-     }
+-    } decoders[] = {
-     if (ctx->pm_base_enabled) {
+-        { always_true_p,  decode_insn32 },
-         tcg_gen_or_tl(addr, addr, pm_base);
+-        { has_xthead_p, decode_xthead },
-     }
+-        { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
-+
+-    };
-     return addr;
+-
      ctx->virt_inst_excp = false;
      ctx->cur_insn_len = insn_len(opcode);
      /* Check for compressed insn */
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
                                               ctx->base.pc_next + 2));
          ctx->opcode = opcode32;
 -        for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
 -            if (decoders[i].guard_func(ctx->cfg_ptr) &&
 -                decoders[i].decode_func(ctx, opcode32)) {
 +        for (guint i = 0; i < ctx->decoders->len; ++i) {
 +            riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
 +            if (func(ctx, opcode32)) {
                  return;
              }
          }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
      ctx->zero = tcg_constant_tl(0);
      ctx->virt_inst_excp = false;
 +    ctx->decoders = cpu->decoders;
  }
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+ static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu)
      ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
      ctx->misa_mxl_max = env->misa_mxl_max;
      ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
 +    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
      ctx->cs = cs;
      ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
      ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
 --
-.40.1
+.45.1

-[PULL 17/54] hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
+[PULL 16/28] riscv: thead: Add th.sxstatus CSR emulation
-From: Tommy Wu <tommy.wu@sifive.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-The watchdog timer is in the always-on domain device of HiFive 1 rev b,
+The th.sxstatus CSR can be used to identify available custom extension
-so this patch added the AON device to the sifive_e machine. This patch
+on T-Head CPUs. The CSR is documented here:
-only implemented the functionality of the watchdog timer.
+  https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadsxstatus.adoc
-Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
+An important property of this patch is, that the th.sxstatus MAEE field
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+is not set (indicating that XTheadMae is not available).
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+XTheadMae is a memory attribute extension (similar to Svpbmt) which is
-Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
+implemented in many T-Head CPUs (C906, C910, etc.) and utilizes bits
 in PTEs that are marked as reserved. QEMU maintainers prefer to not
 implement XTheadMae, so we need give kernels a mechanism to identify
 if XTheadMae is available in a system or not. And this patch introduces
 this mechanism in QEMU in a way that's compatible with real HW
 (i.e., probing the th.sxstatus.MAEE bit).
 Further context can be found on the list:
 https://lists.gnu.org/archive/html/qemu-devel/2024-02/msg00775.html
 Reviewed-by: LIU Zhiwei <zhiwe_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-ID: <20240429073656.2486732-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/misc/sifive_e_aon.h |  60 +++++++
+ MAINTAINERS              |  1 +
- hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
+ target/riscv/cpu.h       |  3 ++
- hw/misc/Kconfig                |   3 +
+ target/riscv/cpu.c       |  1 +
- hw/misc/meson.build            |   1 +
+ target/riscv/th_csr.c    | 79 ++++++++++++++++++++++++++++++++++++++++
-files changed, 383 insertions(+)
+ target/riscv/meson.build |  1 +
- create mode 100644 include/hw/misc/sifive_e_aon.h
+files changed, 85 insertions(+)
- create mode 100644 hw/misc/sifive_e_aon.c
+ create mode 100644 target/riscv/th_csr.c
-diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-riscv@nongnu.org
  S: Supported
  F: target/riscv/insn_trans/trans_xthead.c.inc
  F: target/riscv/xthead*.decode
 +F: target/riscv/th_*
  F: disas/riscv-xthead*
  RISC-V XVentanaCondOps extension
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
  uint8_t satp_mode_max_from_map(uint32_t map);
  const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 +/* Implemented in th_csr.c */
 +void th_register_custom_csrs(RISCVCPU *cpu);
 +
  #endif /* RISCV_CPU_H */
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
      cpu->cfg.mvendorid = THEAD_VENDOR_ID;
  #ifndef CONFIG_USER_ONLY
      set_satp_mode_max_supported(cpu, VM_1_10_SV39);
 +    th_register_custom_csrs(cpu);
  #endif
      /* inherited from parent obj via riscv_cpu_init() */
 diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/sifive_e_aon.h
++++ b/target/riscv/th_csr.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * SiFive HiFive1 AON (Always On Domain) interface.
++ * T-Head-specific CSRs.
 + *
-+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
++ * Copyright (c) 2024 VRULL GmbH
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_SIFIVE_AON_H
 +#define HW_SIFIVE_AON_H
 +
 +#include "hw/sysbus.h"
 +#include "qom/object.h"
 +
 +#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
 +OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
 +
 +#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
 +#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
 +#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
 +
 +enum {
 +    SIFIVE_E_AON_WDT    = 0x0,
 +    SIFIVE_E_AON_RTC    = 0x40,
 +    SIFIVE_E_AON_LFROSC = 0x70,
 +    SIFIVE_E_AON_BACKUP = 0x80,
 +    SIFIVE_E_AON_PMU    = 0x100,
 +    SIFIVE_E_AON_MAX    = 0x150
 +};
 +
 +struct SiFiveEAONState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    MemoryRegion mmio;
 +
 +    /*< watchdog timer >*/
 +    QEMUTimer *wdog_timer;
 +    qemu_irq wdog_irq;
 +    uint64_t wdog_restart_time;
 +    uint64_t wdogclk_freq;
 +
 +    uint32_t wdogcfg;
 +    uint16_t wdogcmp0;
 +    uint32_t wdogcount;
 +    uint8_t wdogunlock;
 +};
 +
 +#endif
 diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/sifive_e_aon.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * SiFive HiFive1 AON (Always On Domain) for QEMU.
 + *
 + * Copyright (c) 2022 SiFive, Inc. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "qemu/timer.h"
++#include "cpu.h"
-+#include "qemu/log.h"
++#include "cpu_vendorid.h"
 +#include "hw/irq.h"
 +#include "hw/registerfields.h"
 +#include "hw/misc/sifive_e_aon.h"
 +#include "qapi/visitor.h"
 +#include "qapi/error.h"
 +#include "sysemu/watchdog.h"
 +#include "hw/qdev-properties.h"
 +
-+REG32(AON_WDT_WDOGCFG, 0x0)
++#define CSR_TH_SXSTATUS 0x5c0
 +    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
 +    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
 +    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
 +    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
 +    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
 +    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
 +    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
 +REG32(AON_WDT_WDOGCOUNT, 0x8)
 +    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
 +REG32(AON_WDT_WDOGS, 0x10)
 +REG32(AON_WDT_WDOGFEED, 0x18)
 +REG32(AON_WDT_WDOGKEY, 0x1c)
 +REG32(AON_WDT_WDOGCMP0, 0x20)
 +
-+static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
++/* TH_SXSTATUS bits */
 +#define TH_SXSTATUS_UCME        BIT(16)
 +#define TH_SXSTATUS_MAEE        BIT(21)
 +#define TH_SXSTATUS_THEADISAEE  BIT(22)
 +
 +typedef struct {
 +    int csrno;
 +    int (*insertion_test)(RISCVCPU *cpu);
 +    riscv_csr_operations csr_ops;
 +} riscv_csr;
 +
 +static RISCVException smode(CPURISCVState *env, int csrno)
 +{
-+    int64_t now;
++    if (riscv_has_ext(env, RVS)) {
-+    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
++        return RISCV_EXCP_NONE;
 +        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
 +        return;
 +    }
 +
-+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
++    return RISCV_EXCP_ILLEGAL_INST;
 +    r->wdogcount += muldiv64(now - r->wdog_restart_time,
 +                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
 +
 +    /* Clean the most significant bit. */
 +    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
 +    r->wdog_restart_time = now;
 +}
 +
-+static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
++static int test_thead_mvendorid(RISCVCPU *cpu)
 +{
-+    uint16_t wdogs;
++    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
-+    bool cmp_signal = false;
++        return -1;
 +    sifive_e_aon_wdt_update_wdogcount(r);
 +    wdogs = (uint16_t)(r->wdogcount >>
 +                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
 +
 +    if (wdogs >= r->wdogcmp0) {
 +        cmp_signal = true;
 +        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
 +            r->wdogcount = 0;
 +            wdogs = 0;
 +        }
 +    }
 +
 +    if (cmp_signal) {
 +        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
 +            watchdog_perform_action();
 +        }
 +        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
 +    }
 +
 +    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
 +
 +    if (wdogs < r->wdogcmp0 &&
 +        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
 +         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
 +        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        next += muldiv64((r->wdogcmp0 - wdogs) <<
 +                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
 +                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
 +        timer_mod(r->wdog_timer, next);
 +    } else {
 +        timer_mod(r->wdog_timer, INT64_MAX);
 +    }
 +}
 +
 +/*
 + * Callback used when the timer set using timer_mod expires.
 + */
 +static void sifive_e_aon_wdt_expired_cb(void *opaque)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
 +    sifive_e_aon_wdt_update_state(r);
 +}
 +
 +static uint64_t
 +sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
 +
 +    switch (addr) {
 +    case A_AON_WDT_WDOGCFG:
 +        return r->wdogcfg;
 +    case A_AON_WDT_WDOGCOUNT:
 +        sifive_e_aon_wdt_update_wdogcount(r);
 +        return r->wdogcount;
 +    case A_AON_WDT_WDOGS:
 +        sifive_e_aon_wdt_update_wdogcount(r);
 +        return r->wdogcount >>
 +               FIELD_EX32(r->wdogcfg,
 +                          AON_WDT_WDOGCFG,
 +                          SCALE);
 +    case A_AON_WDT_WDOGFEED:
 +        return 0;
 +    case A_AON_WDT_WDOGKEY:
 +        return r->wdogunlock;
 +    case A_AON_WDT_WDOGCMP0:
 +        return r->wdogcmp0;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +
 +    return 0;
 +}
 +
-+static void
++static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
-+sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
++                                       target_ulong *val)
 +                       uint64_t val64, unsigned int size)
 +{
-+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
++    /* We don't set MAEE here, because QEMU does not implement MAEE. */
-+    uint32_t value = val64;
++    *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
-+
++    return RISCV_EXCP_NONE;
 +    switch (addr) {
 +    case A_AON_WDT_WDOGCFG: {
 +        uint8_t new_en_always;
 +        uint8_t new_en_core_awake;
 +        uint8_t old_en_always;
 +        uint8_t old_en_core_awake;
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +
 +        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
 +        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
 +        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
 +        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
 +                                       EN_CORE_AWAKE);
 +
 +        if ((old_en_always ||
 +             old_en_core_awake) == 1 &&
 +            (new_en_always ||
 +             new_en_core_awake) == 0) {
 +            sifive_e_aon_wdt_update_wdogcount(r);
 +        } else if ((old_en_always ||
 +                    old_en_core_awake) == 0 &&
 +                   (new_en_always ||
 +                    new_en_core_awake) == 1) {
 +            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        }
 +        r->wdogcfg = value;
 +        r->wdogunlock = 0;
 +        break;
 +    }
 +    case A_AON_WDT_WDOGCOUNT:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
 +        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        r->wdogunlock = 0;
 +        break;
 +    case A_AON_WDT_WDOGS:
 +        return;
 +    case A_AON_WDT_WDOGFEED:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        if (value == SIFIVE_E_AON_WDOGFEED) {
 +            r->wdogcount = 0;
 +            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        }
 +        r->wdogunlock = 0;
 +        break;
 +    case A_AON_WDT_WDOGKEY:
 +        if (value == SIFIVE_E_AON_WDOGKEY) {
 +            r->wdogunlock = 1;
 +        }
 +        break;
 +    case A_AON_WDT_WDOGCMP0:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        r->wdogcmp0 = (uint16_t) value;
 +        r->wdogunlock = 0;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
 +                      __func__, (int)addr, (int)value);
 +    }
 +    sifive_e_aon_wdt_update_state(r);
 +}
 +
-+static uint64_t
++static riscv_csr th_csr_list[] = {
-+sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
++    {
-+{
++        .csrno = CSR_TH_SXSTATUS,
-+    if (addr < SIFIVE_E_AON_RTC) {
++        .insertion_test = test_thead_mvendorid,
-+        return sifive_e_aon_wdt_read(opaque, addr, size);
++        .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
 +    } else if (addr < SIFIVE_E_AON_MAX) {
 +        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +    return 0;
 +}
 +
 +static void
 +sifive_e_aon_write(void *opaque, hwaddr addr,
 +                   uint64_t val64, unsigned int size)
 +{
 +    if (addr < SIFIVE_E_AON_RTC) {
 +        sifive_e_aon_wdt_write(opaque, addr, val64, size);
 +    } else if (addr < SIFIVE_E_AON_MAX) {
 +        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +}
 +
 +static const MemoryRegionOps sifive_e_aon_ops = {
 +    .read = sifive_e_aon_read,
 +    .write = sifive_e_aon_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    }
 +};
 +
-+static void sifive_e_aon_reset(DeviceState *dev)
++void th_register_custom_csrs(RISCVCPU *cpu)
 +{
-+    SiFiveEAONState *r = SIFIVE_E_AON(dev);
++    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
-+
++        int csrno = th_csr_list[i].csrno;
-+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
++        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
-+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
++        if (!th_csr_list[i].insertion_test(cpu)) {
-+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
++            riscv_set_csr_ops(csrno, csr_ops);
-+    r->wdogcmp0 = 0xbeef;
++        }
-+
++    }
 +    sifive_e_aon_wdt_update_state(r);
 +}
-+
+diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 +static void sifive_e_aon_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    SiFiveEAONState *r = SIFIVE_E_AON(obj);
 +
 +    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
 +                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
 +    sysbus_init_mmio(sbd, &r->mmio);
 +
 +    /* watchdog timer */
 +    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                 sifive_e_aon_wdt_expired_cb, r);
 +    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
 +    sysbus_init_irq(sbd, &r->wdog_irq);
 +}
 +
 +static Property sifive_e_aon_properties[] = {
 +    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
 +                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
 +    dc->reset = sifive_e_aon_reset;
 +    device_class_set_props(dc, sifive_e_aon_properties);
 +}
 +
 +static const TypeInfo sifive_e_aon_info = {
 +    .name          = TYPE_SIFIVE_E_AON,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(SiFiveEAONState),
 +    .instance_init = sifive_e_aon_init,
 +    .class_init    = sifive_e_aon_class_init,
 +};
 +
 +static void sifive_e_aon_register_types(void)
 +{
 +    type_register_static(&sifive_e_aon_info);
 +}
 +
 +type_init(sifive_e_aon_register_types)
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Kconfig
+--- a/target/riscv/meson.build
-+++ b/hw/misc/Kconfig
++++ b/target/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_TEST
+@@ -XXX,XX +XXX,XX @@ riscv_system_ss.add(files(
- config SIFIVE_E_PRCI
+   'monitor.c',
-     bool
+   'machine.c',
+   'pmu.c',
-+config SIFIVE_E_AON
++  'th_csr.c',
-+    bool
+   'time_helper.c',
-+
+   'riscv-qmp-cmds.c',
- config SIFIVE_U_OTP
+ ))
      bool
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
  system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
 +system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 --
-.40.1
+.45.1

-[PULL 47/54] target/riscv/kvm.c: add multi-letter extension KVM properties
+[PULL 17/28] target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Max Chou <max.chou@sifive.com>
-Let's add KVM user properties for the multi-letter extensions that KVM
+According v spec 18.4, only the vfwcvt.f.f.v and vfncvt.f.f.w
-currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
+instructions will be affected by Zvfhmin extension.
-svinval and svpbmt.
+And the vfwcvt.f.f.v and vfncvt.f.f.w instructions only support the
 conversions of
-As with MISA extensions, we're using the KVMCPUConfig type to hold
+* From 1*SEW(16/32) to 2*SEW(32/64)
-information about the state of each extension. However, multi-letter
+* From 2*SEW(32/64) to 1*SEW(16/32)
 extensions have more cases to cover than MISA extensions, so we're
 adding an extra 'supported' flag as well. This flag will reflect if a
 given extension is supported by KVM, i.e. KVM knows how to handle it.
 This is determined during KVM extension discovery in
 kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
 other error will cause an abort.
-The use of the 'user_set' is similar to what we already do with MISA
+Signed-off-by: Max Chou <max.chou@sifive.com>
-extensions: the flag set only if the user is changing the extension
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-state.
+Cc: qemu-stable <qemu-stable@nongnu.org>
+Message-ID: <20240322092600.1198921-2-max.chou@sifive.com>
 The 'supported' flag will be used later on to make an exception for
 users that are disabling multi-letter extensions that are unknown to
 KVM.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c |   8 +++
+ target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++--
- target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
+file changed, 18 insertions(+), 2 deletions(-)
 files changed, 127 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static bool require_rvf(DisasContext *s)
      riscv_cpu_add_misa_properties(obj);
      for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
 +#ifndef CONFIG_USER_ONLY
 +        if (kvm_enabled()) {
 +            /* Check if KVM created the property already */
 +            if (object_property_find(obj, prop->name)) {
 +                continue;
 +            }
 +        }
 +#endif
          qdev_property_add_static(dev, prop);
      }
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ typedef struct KVMCPUConfig {
      target_ulong offset;
      int kvm_reg_id;
      bool user_set;
 +    bool supported;
  } KVMCPUConfig;
  #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
      }
  }
-+#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
++static bool require_rvfmin(DisasContext *s)
 +
 +#define KVM_EXT_CFG(_name, _prop, _reg_id) \
 +    {.name = _name, .offset = CPUCFG(_prop), \
 +     .kvm_reg_id = _reg_id}
 +
 +static KVMCPUConfig kvm_multi_ext_cfgs[] = {
 +    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
 +    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
 +    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
 +    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
 +    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
 +    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
 +    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
 +    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 +};
 +
 +static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 +                            uint32_t val)
 +{
-+    int cpu_cfg_offset = multi_ext->offset;
++    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
-+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
++        return false;
 +
 +    *ext_enabled = val;
 +}
 +
 +static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
 +                                KVMCPUConfig *multi_ext)
 +{
 +    int cpu_cfg_offset = multi_ext->offset;
 +    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
 +
 +    return *ext_enabled;
 +}
 +
 +static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
 +                                      const char *name,
 +                                      void *opaque, Error **errp)
 +{
 +    KVMCPUConfig *multi_ext_cfg = opaque;
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    bool value, host_val;
 +
 +    if (!visit_type_bool(v, name, &value, errp)) {
 +        return;
 +    }
 +
-+    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
++    switch (s->sew) {
-+
++    case MO_16:
-+    /*
++        return s->cfg_ptr->ext_zvfhmin;
-+     * Ignore if the user is setting the same value
++    case MO_32:
-+     * as the host.
++        return s->cfg_ptr->ext_zve32f;
-+     */
++    default:
-+    if (value == host_val) {
++        return false;
 +        return;
 +    }
 +
 +    if (!multi_ext_cfg->supported) {
 +        /*
 +         * Error out if the user is trying to enable an
 +         * extension that KVM doesn't support. Ignore
 +         * option otherwise.
 +         */
 +        if (value) {
 +            error_setg(errp, "KVM does not support disabling extension %s",
 +                       multi_ext_cfg->name);
 +        }
 +
 +        return;
 +    }
 +
 +    multi_ext_cfg->user_set = true;
 +    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 +}
 +
  static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
  {
      int i;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
          object_property_set_description(cpu_obj, misa_cfg->name,
                                          misa_cfg->description);
      }
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
 +        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
 +
 +        object_property_add(cpu_obj, multi_cfg->name, "bool",
 +                            NULL,
 +                            kvm_cpu_set_multi_ext_cfg,
 +                            NULL, multi_cfg);
 +    }
  }
  static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
      env->misa_ext = env->misa_ext_mask;
  }
 +static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    uint64_t val;
 +    int i, ret;
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
 +        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
 +        struct kvm_one_reg reg;
 +
 +        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
 +                                  multi_ext_cfg->kvm_reg_id);
 +        reg.addr = (uint64_t)&val;
 +        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +        if (ret != 0) {
 +            if (errno == EINVAL) {
 +                /* Silently default to 'false' if KVM does not support it. */
 +                multi_ext_cfg->supported = false;
 +                val = false;
 +            } else {
 +                error_report("Unable to read ISA_EXT KVM register %s, "
 +                             "error %d", multi_ext_cfg->name, ret);
 +                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
 +                exit(EXIT_FAILURE);
 +            }
 +        } else {
 +            multi_ext_cfg->supported = true;
 +        }
 +
 +        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
 +    }
 +}
 +
- void kvm_riscv_init_user_properties(Object *cpu_obj)
+ static bool require_scale_rvf(DisasContext *s)
  {
-     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+     if (s->mstatus_fs == EXT_STATUS_DISABLED) {
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvfmin(DisasContext *s)
-     kvm_riscv_add_cpu_user_properties(cpu_obj);
+     }
-     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
-     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+     switch (s->sew) {
-+    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
+-    case MO_8:
+-        return s->cfg_ptr->ext_zvfhmin;
-     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+     case MO_16:
          return s->cfg_ptr->ext_zve32f;
      case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool opxfv_widen_check(DisasContext *s, arg_rmr *a)
  static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
  {
      return opfv_widen_check(s, a) &&
 +           require_rvfmin(s) &&
             require_scale_rvfmin(s) &&
             (s->sew != MO_8);
  }
@@ -XXX,XX +XXX,XX @@ static bool opfxv_narrow_check(DisasContext *s, arg_rmr *a)
  static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
  {
      return opfv_narrow_check(s, a) &&
 +           require_rvfmin(s) &&
             require_scale_rvfmin(s) &&
             (s->sew != MO_8);
  }
 --
-.40.1
+.45.1

-[PULL 01/54] target/riscv: Use xl instead of mxl for disassemble
+[PULL 18/28] target/riscv: rvv: Check single width operator for vector fp widen instructions
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Max Chou <max.chou@sifive.com>
-Disassemble function(plugin_disas, target_disas, monitor_disas) will
+The require_scale_rvf function only checks the double width operator for
-always call set_disas_info before disassembling instructions.
+the vector floating point widen instructions, so most of the widen
 checking functions need to add require_rvf for single width operator.
-plugin_disas  and target_disas will always be called under a TB, which
+The vfwcvt.f.x.v and vfwcvt.f.xu.v instructions convert single width
-has the same XLEN.
+integer to double width float, so the opfxv_widen_check function doesn’t
 need require_rvf for the single width operator(integer).
-We can't ensure that monitor_disas will always be called under a TB,
+Signed-off-by: Max Chou <max.chou@sifive.com>
-but current XLEN will still be a better choice, thus we can ensure at
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-least the disassemble of the nearest one TB is right.
+Cc: qemu-stable <qemu-stable@nongnu.org>
+Message-ID: <20240322092600.1198921-3-max.chou@sifive.com>
 Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 3 ++-
+ target/riscv/insn_trans/trans_rvv.c.inc | 5 +++++
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 5 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVF_TRANS(vfrsub_vf,  opfvf_check)
- static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
+ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
  {
-     RISCVCPU *cpu = RISCV_CPU(s);
+     return require_rvv(s) &&
-+    CPURISCVState *env = &cpu->env;
++           require_rvf(s) &&
-     info->target_info = &cpu->cfg;
+            require_scale_rvf(s) &&
+            (s->sew != MO_8) &&
--    switch (riscv_cpu_mxl(&cpu->env)) {
+            vext_check_isa_ill(s) &&
-+    switch (env->xl) {
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVV_WIDEN_TRANS(vfwsub_vv, opfvv_widen_check)
-     case MXL_RV32:
+ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
-         info->print_insn = print_insn_riscv32;
+ {
-         break;
+     return require_rvv(s) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFVF_WIDEN_TRANS(vfwsub_vf)
  static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return require_rvv(s) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFWV_WIDEN_TRANS(vfwsub_wv)
  static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return require_rvv(s) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFVV_TRANS(vfredmin_vs, freduction_check)
  static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return reduction_widen_check(s, a) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8);
  }
 --
-.40.1
+.45.1

-[PULL 02/54] target/riscv: Factor out extension tests to cpu_cfg.h
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-This patch moves the extension test functions that are used
-to gate vendor extension decoders, into cpu_cfg.h.
-This allows to reuse them in the disassembler.
-This patch does not introduce new functionality.
-However, the patch includes a small change:
-The parameter for the extension test functions has been changed
-from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
-the code in cpu_cfg.h self-contained.
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
- target/riscv/translate.c | 27 ++-------------------------
-files changed, 28 insertions(+), 25 deletions(-)
-diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
- };
- typedef struct RISCVCPUConfig RISCVCPUConfig;
-+
-+/* Helper functions to test for extensions.  */
-+
-+static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
-+{
-+    return true;
-+}
-+
-+static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
-+{
-+    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
-+           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
-+           cfg->ext_xtheadcondmov ||
-+           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
-+           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
-+           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
-+}
-+
-+#define MATERIALISE_EXT_PREDICATE(ext) \
-+    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
-+    { \
-+        return cfg->ext_ ## ext ; \
-+    }
-+
-+MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
-+
- #endif
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
-     return ctx->misa_ext & ext;
- }
--static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
--{
--    return true;
--}
--
--static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
--{
--    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
--           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
--           ctx->cfg_ptr->ext_xtheadcondmov ||
--           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
--           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
--           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
--}
--
--#define MATERIALISE_EXT_PREDICATE(ext)  \
--    static bool has_ ## ext ## _p(DisasContext *ctx)    \
--    { \
--        return ctx->cfg_ptr->ext_ ## ext ; \
--    }
--
--MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
--
- #ifdef TARGET_RISCV32
- #define get_xl(ctx)    MXL_RV32
- #elif defined(CONFIG_USER_ONLY)
-@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
-      * that are tested in-order until a decoder matches onto the opcode.
-      */
-     static const struct {
--        bool (*guard_func)(DisasContext *);
-+        bool (*guard_func)(const RISCVCPUConfig *);
-         bool (*decode_func)(DisasContext *, uint32_t);
-     } decoders[] = {
-         { always_true_p,  decode_insn32 },
-@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
-         ctx->opcode = opcode32;
-         for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
--            if (decoders[i].guard_func(ctx) &&
-+            if (decoders[i].guard_func(ctx->cfg_ptr) &&
-                 decoders[i].decode_func(ctx, opcode32)) {
-                 return;
-             }
---
-.40.1

-[PULL 03/54] disas/riscv: Move types/constants to new header file
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-In order to enable vendor disassembler support, we need to
-move types and constants into a header file so that other
-compilation units can use them as well.
-This patch does not introduce any functional changes.
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
- disas/riscv.c | 270 +----------------------------------------------
-files changed, 283 insertions(+), 269 deletions(-)
- create mode 100644 disas/riscv.h
-diff --git a/disas/riscv.h b/disas/riscv.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU disassembler -- RISC-V specific header.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef DISAS_RISCV_H
-+#define DISAS_RISCV_H
-+
-+#include "qemu/osdep.h"
-+#include "target/riscv/cpu_cfg.h"
-+
-+/* types */
-+
-+typedef uint64_t rv_inst;
-+typedef uint16_t rv_opcode;
-+
-+/* enums */
-+
-+typedef enum {
-+    rv32,
-+    rv64,
-+    rv128
-+} rv_isa;
-+
-+typedef enum {
-+    rv_rm_rne = 0,
-+    rv_rm_rtz = 1,
-+    rv_rm_rdn = 2,
-+    rv_rm_rup = 3,
-+    rv_rm_rmm = 4,
-+    rv_rm_dyn = 7,
-+} rv_rm;
-+
-+typedef enum {
-+    rv_fence_i = 8,
-+    rv_fence_o = 4,
-+    rv_fence_r = 2,
-+    rv_fence_w = 1,
-+} rv_fence;
-+
-+typedef enum {
-+    rv_ireg_zero,
-+    rv_ireg_ra,
-+    rv_ireg_sp,
-+    rv_ireg_gp,
-+    rv_ireg_tp,
-+    rv_ireg_t0,
-+    rv_ireg_t1,
-+    rv_ireg_t2,
-+    rv_ireg_s0,
-+    rv_ireg_s1,
-+    rv_ireg_a0,
-+    rv_ireg_a1,
-+    rv_ireg_a2,
-+    rv_ireg_a3,
-+    rv_ireg_a4,
-+    rv_ireg_a5,
-+    rv_ireg_a6,
-+    rv_ireg_a7,
-+    rv_ireg_s2,
-+    rv_ireg_s3,
-+    rv_ireg_s4,
-+    rv_ireg_s5,
-+    rv_ireg_s6,
-+    rv_ireg_s7,
-+    rv_ireg_s8,
-+    rv_ireg_s9,
-+    rv_ireg_s10,
-+    rv_ireg_s11,
-+    rv_ireg_t3,
-+    rv_ireg_t4,
-+    rv_ireg_t5,
-+    rv_ireg_t6,
-+} rv_ireg;
-+
-+typedef enum {
-+    rvc_end,
-+    rvc_rd_eq_ra,
-+    rvc_rd_eq_x0,
-+    rvc_rs1_eq_x0,
-+    rvc_rs2_eq_x0,
-+    rvc_rs2_eq_rs1,
-+    rvc_rs1_eq_ra,
-+    rvc_imm_eq_zero,
-+    rvc_imm_eq_n1,
-+    rvc_imm_eq_p1,
-+    rvc_csr_eq_0x001,
-+    rvc_csr_eq_0x002,
-+    rvc_csr_eq_0x003,
-+    rvc_csr_eq_0xc00,
-+    rvc_csr_eq_0xc01,
-+    rvc_csr_eq_0xc02,
-+    rvc_csr_eq_0xc80,
-+    rvc_csr_eq_0xc81,
-+    rvc_csr_eq_0xc82,
-+} rvc_constraint;
-+
-+typedef enum {
-+    rv_codec_illegal,
-+    rv_codec_none,
-+    rv_codec_u,
-+    rv_codec_uj,
-+    rv_codec_i,
-+    rv_codec_i_sh5,
-+    rv_codec_i_sh6,
-+    rv_codec_i_sh7,
-+    rv_codec_i_csr,
-+    rv_codec_s,
-+    rv_codec_sb,
-+    rv_codec_r,
-+    rv_codec_r_m,
-+    rv_codec_r4_m,
-+    rv_codec_r_a,
-+    rv_codec_r_l,
-+    rv_codec_r_f,
-+    rv_codec_cb,
-+    rv_codec_cb_imm,
-+    rv_codec_cb_sh5,
-+    rv_codec_cb_sh6,
-+    rv_codec_ci,
-+    rv_codec_ci_sh5,
-+    rv_codec_ci_sh6,
-+    rv_codec_ci_16sp,
-+    rv_codec_ci_lwsp,
-+    rv_codec_ci_ldsp,
-+    rv_codec_ci_lqsp,
-+    rv_codec_ci_li,
-+    rv_codec_ci_lui,
-+    rv_codec_ci_none,
-+    rv_codec_ciw_4spn,
-+    rv_codec_cj,
-+    rv_codec_cj_jal,
-+    rv_codec_cl_lw,
-+    rv_codec_cl_ld,
-+    rv_codec_cl_lq,
-+    rv_codec_cr,
-+    rv_codec_cr_mv,
-+    rv_codec_cr_jalr,
-+    rv_codec_cr_jr,
-+    rv_codec_cs,
-+    rv_codec_cs_sw,
-+    rv_codec_cs_sd,
-+    rv_codec_cs_sq,
-+    rv_codec_css_swsp,
-+    rv_codec_css_sdsp,
-+    rv_codec_css_sqsp,
-+    rv_codec_k_bs,
-+    rv_codec_k_rnum,
-+    rv_codec_v_r,
-+    rv_codec_v_ldst,
-+    rv_codec_v_i,
-+    rv_codec_vsetvli,
-+    rv_codec_vsetivli,
-+    rv_codec_zcb_ext,
-+    rv_codec_zcb_mul,
-+    rv_codec_zcb_lb,
-+    rv_codec_zcb_lh,
-+    rv_codec_zcmp_cm_pushpop,
-+    rv_codec_zcmp_cm_mv,
-+    rv_codec_zcmt_jt,
-+} rv_codec;
-+
-+/* structures */
-+
-+typedef struct {
-+    RISCVCPUConfig *cfg;
-+    uint64_t  pc;
-+    uint64_t  inst;
-+    int32_t   imm;
-+    uint16_t  op;
-+    uint8_t   codec;
-+    uint8_t   rd;
-+    uint8_t   rs1;
-+    uint8_t   rs2;
-+    uint8_t   rs3;
-+    uint8_t   rm;
-+    uint8_t   pred;
-+    uint8_t   succ;
-+    uint8_t   aq;
-+    uint8_t   rl;
-+    uint8_t   bs;
-+    uint8_t   rnum;
-+    uint8_t   vm;
-+    uint32_t  vzimm;
-+    uint8_t   rlist;
-+} rv_decode;
-+
-+typedef struct {
-+    const int op;
-+    const rvc_constraint *constraints;
-+} rv_comp_data;
-+
-+enum {
-+    rvcd_imm_nz = 0x1
-+};
-+
-+typedef struct {
-+    const char * const name;
-+    const rv_codec codec;
-+    const char * const format;
-+    const rv_comp_data *pseudo;
-+    const short decomp_rv32;
-+    const short decomp_rv64;
-+    const short decomp_rv128;
-+    const short decomp_data;
-+} rv_opcode_data;
-+
-+/* instruction formats */
-+
-+#define rv_fmt_none                   "O\t"
-+#define rv_fmt_rs1                    "O\t1"
-+#define rv_fmt_offset                 "O\to"
-+#define rv_fmt_pred_succ              "O\tp,s"
-+#define rv_fmt_rs1_rs2                "O\t1,2"
-+#define rv_fmt_rd_imm                 "O\t0,i"
-+#define rv_fmt_rd_offset              "O\t0,o"
-+#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
-+#define rv_fmt_frd_rs1                "O\t3,1"
-+#define rv_fmt_frd_frs1               "O\t3,4"
-+#define rv_fmt_rd_frs1                "O\t0,4"
-+#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-+#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
-+#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
-+#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
-+#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
-+#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
-+#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
-+#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
-+#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
-+#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
-+#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
-+#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
-+#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
-+#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
-+#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
-+#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
-+#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
-+#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
-+#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
-+#define rv_fmt_rd                     "O\t0"
-+#define rv_fmt_rd_zimm                "O\t0,7"
-+#define rv_fmt_rd_rs1                 "O\t0,1"
-+#define rv_fmt_rd_rs2                 "O\t0,2"
-+#define rv_fmt_rs1_offset             "O\t1,o"
-+#define rv_fmt_rs2_offset             "O\t2,o"
-+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
-+#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
-+#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
-+#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
-+#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
-+#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
-+#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
-+#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
-+#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
-+#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
-+#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
-+#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
-+#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
-+#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
-+#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
-+#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
-+#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
-+#define rv_fmt_vd_vs1                 "O\tD,E"
-+#define rv_fmt_vd_rs1                 "O\tD,1"
-+#define rv_fmt_vd_fs1                 "O\tD,4"
-+#define rv_fmt_vd_imm                 "O\tD,i"
-+#define rv_fmt_vd_vs2                 "O\tD,F"
-+#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
-+#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
-+#define rv_fmt_rd_vs2                 "O\t0,F"
-+#define rv_fmt_fd_vs2                 "O\t3,F"
-+#define rv_fmt_vd_vm                  "O\tDm"
-+#define rv_fmt_vsetvli                "O\t0,1,v"
-+#define rv_fmt_vsetivli               "O\t0,u,v"
-+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-+#define rv_fmt_push_rlist             "O\tx,-i"
-+#define rv_fmt_pop_rlist              "O\tx,i"
-+#define rv_fmt_zcmt_index             "O\ti"
-+
-+#endif /* DISAS_RISCV_H */
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "disas/dis-asm.h"
- #include "target/riscv/cpu_cfg.h"
--
--/* types */
--
--typedef uint64_t rv_inst;
--typedef uint16_t rv_opcode;
--
--/* enums */
--
--typedef enum {
--    rv32,
--    rv64,
--    rv128
--} rv_isa;
--
--typedef enum {
--    rv_rm_rne = 0,
--    rv_rm_rtz = 1,
--    rv_rm_rdn = 2,
--    rv_rm_rup = 3,
--    rv_rm_rmm = 4,
--    rv_rm_dyn = 7,
--} rv_rm;
--
--typedef enum {
--    rv_fence_i = 8,
--    rv_fence_o = 4,
--    rv_fence_r = 2,
--    rv_fence_w = 1,
--} rv_fence;
--
--typedef enum {
--    rv_ireg_zero,
--    rv_ireg_ra,
--    rv_ireg_sp,
--    rv_ireg_gp,
--    rv_ireg_tp,
--    rv_ireg_t0,
--    rv_ireg_t1,
--    rv_ireg_t2,
--    rv_ireg_s0,
--    rv_ireg_s1,
--    rv_ireg_a0,
--    rv_ireg_a1,
--    rv_ireg_a2,
--    rv_ireg_a3,
--    rv_ireg_a4,
--    rv_ireg_a5,
--    rv_ireg_a6,
--    rv_ireg_a7,
--    rv_ireg_s2,
--    rv_ireg_s3,
--    rv_ireg_s4,
--    rv_ireg_s5,
--    rv_ireg_s6,
--    rv_ireg_s7,
--    rv_ireg_s8,
--    rv_ireg_s9,
--    rv_ireg_s10,
--    rv_ireg_s11,
--    rv_ireg_t3,
--    rv_ireg_t4,
--    rv_ireg_t5,
--    rv_ireg_t6,
--} rv_ireg;
--
--typedef enum {
--    rvc_end,
--    rvc_rd_eq_ra,
--    rvc_rd_eq_x0,
--    rvc_rs1_eq_x0,
--    rvc_rs2_eq_x0,
--    rvc_rs2_eq_rs1,
--    rvc_rs1_eq_ra,
--    rvc_imm_eq_zero,
--    rvc_imm_eq_n1,
--    rvc_imm_eq_p1,
--    rvc_csr_eq_0x001,
--    rvc_csr_eq_0x002,
--    rvc_csr_eq_0x003,
--    rvc_csr_eq_0xc00,
--    rvc_csr_eq_0xc01,
--    rvc_csr_eq_0xc02,
--    rvc_csr_eq_0xc80,
--    rvc_csr_eq_0xc81,
--    rvc_csr_eq_0xc82,
--} rvc_constraint;
--
--typedef enum {
--    rv_codec_illegal,
--    rv_codec_none,
--    rv_codec_u,
--    rv_codec_uj,
--    rv_codec_i,
--    rv_codec_i_sh5,
--    rv_codec_i_sh6,
--    rv_codec_i_sh7,
--    rv_codec_i_csr,
--    rv_codec_s,
--    rv_codec_sb,
--    rv_codec_r,
--    rv_codec_r_m,
--    rv_codec_r4_m,
--    rv_codec_r_a,
--    rv_codec_r_l,
--    rv_codec_r_f,
--    rv_codec_cb,
--    rv_codec_cb_imm,
--    rv_codec_cb_sh5,
--    rv_codec_cb_sh6,
--    rv_codec_ci,
--    rv_codec_ci_sh5,
--    rv_codec_ci_sh6,
--    rv_codec_ci_16sp,
--    rv_codec_ci_lwsp,
--    rv_codec_ci_ldsp,
--    rv_codec_ci_lqsp,
--    rv_codec_ci_li,
--    rv_codec_ci_lui,
--    rv_codec_ci_none,
--    rv_codec_ciw_4spn,
--    rv_codec_cj,
--    rv_codec_cj_jal,
--    rv_codec_cl_lw,
--    rv_codec_cl_ld,
--    rv_codec_cl_lq,
--    rv_codec_cr,
--    rv_codec_cr_mv,
--    rv_codec_cr_jalr,
--    rv_codec_cr_jr,
--    rv_codec_cs,
--    rv_codec_cs_sw,
--    rv_codec_cs_sd,
--    rv_codec_cs_sq,
--    rv_codec_css_swsp,
--    rv_codec_css_sdsp,
--    rv_codec_css_sqsp,
--    rv_codec_k_bs,
--    rv_codec_k_rnum,
--    rv_codec_v_r,
--    rv_codec_v_ldst,
--    rv_codec_v_i,
--    rv_codec_vsetvli,
--    rv_codec_vsetivli,
--    rv_codec_zcb_ext,
--    rv_codec_zcb_mul,
--    rv_codec_zcb_lb,
--    rv_codec_zcb_lh,
--    rv_codec_zcmp_cm_pushpop,
--    rv_codec_zcmp_cm_mv,
--    rv_codec_zcmt_jt,
--} rv_codec;
-+#include "disas/riscv.h"
- typedef enum {
-     rv_op_illegal = 0,
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_op_czero_nez = 790,
- } rv_op;
--/* structures */
--
--typedef struct {
--    RISCVCPUConfig *cfg;
--    uint64_t  pc;
--    uint64_t  inst;
--    int32_t   imm;
--    uint16_t  op;
--    uint8_t   codec;
--    uint8_t   rd;
--    uint8_t   rs1;
--    uint8_t   rs2;
--    uint8_t   rs3;
--    uint8_t   rm;
--    uint8_t   pred;
--    uint8_t   succ;
--    uint8_t   aq;
--    uint8_t   rl;
--    uint8_t   bs;
--    uint8_t   rnum;
--    uint8_t   vm;
--    uint32_t  vzimm;
--    uint8_t   rlist;
--} rv_decode;
--
--typedef struct {
--    const int op;
--    const rvc_constraint *constraints;
--} rv_comp_data;
--
--enum {
--    rvcd_imm_nz = 0x1
--};
--
--typedef struct {
--    const char * const name;
--    const rv_codec codec;
--    const char * const format;
--    const rv_comp_data *pseudo;
--    const short decomp_rv32;
--    const short decomp_rv64;
--    const short decomp_rv128;
--    const short decomp_data;
--} rv_opcode_data;
--
- /* register names */
- static const char rv_ireg_name_sym[32][5] = {
-@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
-     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
- };
--/* instruction formats */
--
--#define rv_fmt_none                   "O\t"
--#define rv_fmt_rs1                    "O\t1"
--#define rv_fmt_offset                 "O\to"
--#define rv_fmt_pred_succ              "O\tp,s"
--#define rv_fmt_rs1_rs2                "O\t1,2"
--#define rv_fmt_rd_imm                 "O\t0,i"
--#define rv_fmt_rd_offset              "O\t0,o"
--#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
--#define rv_fmt_frd_rs1                "O\t3,1"
--#define rv_fmt_frd_frs1               "O\t3,4"
--#define rv_fmt_rd_frs1                "O\t0,4"
--#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
--#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
--#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
--#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
--#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
--#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
--#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
--#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
--#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
--#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
--#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
--#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
--#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
--#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
--#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
--#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
--#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
--#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
--#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
--#define rv_fmt_rd                     "O\t0"
--#define rv_fmt_rd_zimm                "O\t0,7"
--#define rv_fmt_rd_rs1                 "O\t0,1"
--#define rv_fmt_rd_rs2                 "O\t0,2"
--#define rv_fmt_rs1_offset             "O\t1,o"
--#define rv_fmt_rs2_offset             "O\t2,o"
--#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
--#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
--#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
--#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
--#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
--#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
--#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
--#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
--#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
--#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
--#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
--#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
--#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
--#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
--#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
--#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
--#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
--#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
--#define rv_fmt_vd_vs1                 "O\tD,E"
--#define rv_fmt_vd_rs1                 "O\tD,1"
--#define rv_fmt_vd_fs1                 "O\tD,4"
--#define rv_fmt_vd_imm                 "O\tD,i"
--#define rv_fmt_vd_vs2                 "O\tD,F"
--#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
--#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
--#define rv_fmt_rd_vs2                 "O\t0,F"
--#define rv_fmt_fd_vs2                 "O\t3,F"
--#define rv_fmt_vd_vm                  "O\tDm"
--#define rv_fmt_vsetvli                "O\t0,1,v"
--#define rv_fmt_vsetivli               "O\t0,u,v"
--#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
--#define rv_fmt_push_rlist             "O\tx,-i"
--#define rv_fmt_pop_rlist              "O\tx,i"
--#define rv_fmt_zcmt_index             "O\ti"
--
- /* pseudo-instruction constraints */
- static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
---
-.40.1

-[PULL 05/54] disas/riscv: Encapsulate opcode_data into decode
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-This patch adds a reference to a struct rv_opcode_data object
-into struct rv_decode. This further allows to remove all references
-to the global variable opcode_data (which is renamed to rvi_opcode_data).
-This patch does not introduce any functional change, but prepares
-the code for more struct rv_opcode_data objects in the future.
-This patch is based on previous work from Liu Zhiwei:
-  https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html
-Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.h | 33 +++++++++++++++++----------------
- disas/riscv.c |  9 ++++++++-
-files changed, 25 insertions(+), 17 deletions(-)
-diff --git a/disas/riscv.h b/disas/riscv.h
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- /* structures */
-+typedef struct {
-+    const int op;
-+    const rvc_constraint *constraints;
-+} rv_comp_data;
-+
-+typedef struct {
-+    const char * const name;
-+    const rv_codec codec;
-+    const char * const format;
-+    const rv_comp_data *pseudo;
-+    const short decomp_rv32;
-+    const short decomp_rv64;
-+    const short decomp_rv128;
-+    const short decomp_data;
-+} rv_opcode_data;
-+
- typedef struct {
-     RISCVCPUConfig *cfg;
-     uint64_t  pc;
-     uint64_t  inst;
-+    const rv_opcode_data *opcode_data;
-     int32_t   imm;
-     uint16_t  op;
-     uint8_t   codec;
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint8_t   rlist;
- } rv_decode;
--typedef struct {
--    const int op;
--    const rvc_constraint *constraints;
--} rv_comp_data;
--
- enum {
-     rv_op_illegal = 0
- };
-@@ -XXX,XX +XXX,XX @@ enum {
-     rvcd_imm_nz = 0x1
- };
--typedef struct {
--    const char * const name;
--    const rv_codec codec;
--    const char * const format;
--    const rv_comp_data *pseudo;
--    const short decomp_rv32;
--    const short decomp_rv64;
--    const short decomp_rv128;
--    const short decomp_data;
--} rv_opcode_data;
--
- /* instruction formats */
- #define rv_fmt_none                   "O\t"
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
- /* instruction metadata */
--const rv_opcode_data opcode_data[] = {
-+const rv_opcode_data rvi_opcode_data[] = {
-     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
-     { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
-@@ -XXX,XX +XXX,XX @@ static uint32_t operand_tbl_index(rv_inst inst)
- static void decode_inst_operands(rv_decode *dec, rv_isa isa)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     rv_inst inst = dec->inst;
-     dec->codec = opcode_data[dec->op].codec;
-     switch (dec->codec) {
-@@ -XXX,XX +XXX,XX @@ static void append(char *s1, const char *s2, size_t n)
- static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     char tmp[64];
-     const char *fmt;
-@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
- static void decode_inst_lift_pseudo(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
-     if (!comp_data) {
-         return;
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_lift_pseudo(rv_decode *dec)
- static void decode_inst_decompress_rv32(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     int decomp_op = opcode_data[dec->op].decomp_rv32;
-     if (decomp_op != rv_op_illegal) {
-         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv32(rv_decode *dec)
- static void decode_inst_decompress_rv64(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     int decomp_op = opcode_data[dec->op].decomp_rv64;
-     if (decomp_op != rv_op_illegal) {
-         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv64(rv_decode *dec)
- static void decode_inst_decompress_rv128(rv_decode *dec)
- {
-+    const rv_opcode_data *opcode_data = dec->opcode_data;
-     int decomp_op = opcode_data[dec->op].decomp_rv128;
-     if (decomp_op != rv_op_illegal) {
-         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-     rv_decode dec = { 0 };
-     dec.pc = pc;
-     dec.inst = inst;
-+    dec.opcode_data = rvi_opcode_data;
-     dec.cfg = cfg;
-     decode_inst_opcode(&dec, isa);
-     decode_inst_operands(&dec, isa);
---
-.40.1

-[PULL 06/54] disas/riscv: Provide infrastructure for vendor extensions
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-A previous patch provides a pointer to the RISCVCPUConfig data.
-Let's use this to add the necessary code for vendor extensions.
-This patch does not change the current behaviour, but clearly
-defines how vendor extension support can be added to the disassembler.
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.c | 28 ++++++++++++++++++++++++++--
-file changed, 26 insertions(+), 2 deletions(-)
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-     rv_decode dec = { 0 };
-     dec.pc = pc;
-     dec.inst = inst;
--    dec.opcode_data = rvi_opcode_data;
-     dec.cfg = cfg;
--    decode_inst_opcode(&dec, isa);
-+
-+    static const struct {
-+        bool (*guard_func)(const RISCVCPUConfig *);
-+        const rv_opcode_data *opcode_data;
-+        void (*decode_func)(rv_decode *, rv_isa);
-+    } decoders[] = {
-+        { always_true_p, rvi_opcode_data, decode_inst_opcode },
-+    };
-+
-+    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
-+        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
-+        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
-+        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
-+
-+        if (guard_func(cfg)) {
-+            dec.opcode_data = opcode_data;
-+            decode_func(&dec, isa);
-+            if (dec.op != rv_op_illegal)
-+                break;
-+        }
-+    }
-+
-+    if (dec.op == rv_op_illegal) {
-+        dec.opcode_data = rvi_opcode_data;
-+    }
-+
-     decode_inst_operands(&dec, isa);
-     decode_inst_decompress(&dec, isa);
-     decode_inst_lift_pseudo(&dec);
---
-.40.1

-[PULL 07/54] disas/riscv: Add support for XVentanaCondOps
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-This patch adds XVentanaCondOps support to the RISC-V disassembler.
-Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv-xventana.h | 18 ++++++++++++++++++
- disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
- disas/riscv.c          |  4 ++++
- disas/meson.build      |  5 ++++-
-files changed, 67 insertions(+), 1 deletion(-)
- create mode 100644 disas/riscv-xventana.h
- create mode 100644 disas/riscv-xventana.c
-diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv-xventana.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU disassembler -- RISC-V specific header (xventana*).
-+ *
-+ * Copyright (c) 2023 VRULL GmbH
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef DISAS_RISCV_XVENTANA_H
-+#define DISAS_RISCV_XVENTANA_H
-+
-+#include "disas/riscv.h"
-+
-+extern const rv_opcode_data ventana_opcode_data[];
-+
-+void decode_xventanacondops(rv_decode*, rv_isa);
-+
-+#endif /* DISAS_RISCV_XVENTANA_H */
-diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv-xventana.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU RISC-V Disassembler for xventana.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "disas/riscv.h"
-+#include "disas/riscv-xventana.h"
-+
-+typedef enum {
-+    /* 0 is reserved for rv_op_illegal. */
-+    ventana_op_vt_maskc = 1,
-+    ventana_op_vt_maskcn = 2,
-+} rv_ventana_op;
-+
-+const rv_opcode_data ventana_opcode_data[] = {
-+    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+};
-+
-+void decode_xventanacondops(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 30:
-+            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
-+            case 6: op = ventana_op_vt_maskc; break;
-+            case 7: op = ventana_op_vt_maskcn; break;
-+            }
-+            break;
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu_cfg.h"
- #include "disas/riscv.h"
-+/* Vendor extensions */
-+#include "disas/riscv-xventana.h"
-+
- typedef enum {
-     /* 0 is reserved for rv_op_illegal. */
-     rv_op_lui = 1,
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-         void (*decode_func)(rv_decode *, rv_isa);
-     } decoders[] = {
-         { always_true_p, rvi_opcode_data, decode_inst_opcode },
-+        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
-     };
-     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
-diff --git a/disas/meson.build b/disas/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/disas/meson.build
-+++ b/disas/meson.build
-@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
- common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
- common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
- common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
--common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
-+common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
-+    'riscv.c',
-+    'riscv-xventana.c'
-+))
- common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
- common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
- common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
---
-.40.1

-[PULL 08/54] disas/riscv: Add support for XThead* instructions
+Deleted patch
-From: Christoph Müllner <christoph.muellner@vrull.eu>
-Support for emulating XThead* instruction has been added recently.
-This patch adds support for these instructions to the RISC-V disassembler.
-Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv-xthead.h   |  28 ++
- disas/riscv.h          |  12 +
- target/riscv/cpu_cfg.h |  11 +
- disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
- disas/riscv.c          |  69 ++++
- disas/meson.build      |   1 +
-files changed, 828 insertions(+)
- create mode 100644 disas/riscv-xthead.h
- create mode 100644 disas/riscv-xthead.c
-diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv-xthead.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU disassembler -- RISC-V specific header (xthead*).
-+ *
-+ * Copyright (c) 2023 VRULL GmbH
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef DISAS_RISCV_XTHEAD_H
-+#define DISAS_RISCV_XTHEAD_H
-+
-+#include "disas/riscv.h"
-+
-+extern const rv_opcode_data xthead_opcode_data[];
-+
-+void decode_xtheadba(rv_decode *, rv_isa);
-+void decode_xtheadbb(rv_decode *, rv_isa);
-+void decode_xtheadbs(rv_decode *, rv_isa);
-+void decode_xtheadcmo(rv_decode *, rv_isa);
-+void decode_xtheadcondmov(rv_decode *, rv_isa);
-+void decode_xtheadfmemidx(rv_decode *, rv_isa);
-+void decode_xtheadfmv(rv_decode *, rv_isa);
-+void decode_xtheadmac(rv_decode *, rv_isa);
-+void decode_xtheadmemidx(rv_decode *, rv_isa);
-+void decode_xtheadmempair(rv_decode *, rv_isa);
-+void decode_xtheadsync(rv_decode *, rv_isa);
-+
-+#endif /* DISAS_RISCV_XTHEAD_H */
-diff --git a/disas/riscv.h b/disas/riscv.h
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.h
-+++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_codec_zcmp_cm_pushpop,
-     rv_codec_zcmp_cm_mv,
-     rv_codec_zcmt_jt,
-+    rv_codec_r2_imm5,
-+    rv_codec_r2,
-+    rv_codec_r2_imm6,
-+    rv_codec_r_imm2,
-+    rv_codec_r2_immhl,
-+    rv_codec_r2_imm2_imm5,
- } rv_codec;
- /* structures */
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint64_t  inst;
-     const rv_opcode_data *opcode_data;
-     int32_t   imm;
-+    int32_t   imm1;
-     uint16_t  op;
-     uint8_t   codec;
-     uint8_t   rd;
-@@ -XXX,XX +XXX,XX @@ enum {
- #define rv_fmt_push_rlist             "O\tx,-i"
- #define rv_fmt_pop_rlist              "O\tx,i"
- #define rv_fmt_zcmt_index             "O\ti"
-+#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
-+#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
-+#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
-+#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
-+#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
- #endif /* DISAS_RISCV_H */
-diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
-         return cfg->ext_ ## ext ; \
-     }
-+MATERIALISE_EXT_PREDICATE(xtheadba)
-+MATERIALISE_EXT_PREDICATE(xtheadbb)
-+MATERIALISE_EXT_PREDICATE(xtheadbs)
-+MATERIALISE_EXT_PREDICATE(xtheadcmo)
-+MATERIALISE_EXT_PREDICATE(xtheadcondmov)
-+MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
-+MATERIALISE_EXT_PREDICATE(xtheadfmv)
-+MATERIALISE_EXT_PREDICATE(xtheadmac)
-+MATERIALISE_EXT_PREDICATE(xtheadmemidx)
-+MATERIALISE_EXT_PREDICATE(xtheadmempair)
-+MATERIALISE_EXT_PREDICATE(xtheadsync)
- MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
- #endif
-diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/disas/riscv-xthead.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU RISC-V Disassembler for xthead.
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "disas/riscv.h"
-+#include "disas/riscv-xthead.h"
-+
-+typedef enum {
-+    /* 0 is reserved for rv_op_illegal. */
-+    /* XTheadBa */
-+    rv_op_th_addsl = 1,
-+    /* XTheadBb */
-+    rv_op_th_srri,
-+    rv_op_th_srriw,
-+    rv_op_th_ext,
-+    rv_op_th_extu,
-+    rv_op_th_ff0,
-+    rv_op_th_ff1,
-+    rv_op_th_rev,
-+    rv_op_th_revw,
-+    rv_op_th_tstnbz,
-+    /* XTheadBs */
-+    rv_op_th_tst,
-+    /* XTheadCmo */
-+    rv_op_th_dcache_call,
-+    rv_op_th_dcache_ciall,
-+    rv_op_th_dcache_iall,
-+    rv_op_th_dcache_cpa,
-+    rv_op_th_dcache_cipa,
-+    rv_op_th_dcache_ipa,
-+    rv_op_th_dcache_cva,
-+    rv_op_th_dcache_civa,
-+    rv_op_th_dcache_iva,
-+    rv_op_th_dcache_csw,
-+    rv_op_th_dcache_cisw,
-+    rv_op_th_dcache_isw,
-+    rv_op_th_dcache_cpal1,
-+    rv_op_th_dcache_cval1,
-+    rv_op_th_icache_iall,
-+    rv_op_th_icache_ialls,
-+    rv_op_th_icache_ipa,
-+    rv_op_th_icache_iva,
-+    rv_op_th_l2cache_call,
-+    rv_op_th_l2cache_ciall,
-+    rv_op_th_l2cache_iall,
-+    /* XTheadCondMov */
-+    rv_op_th_mveqz,
-+    rv_op_th_mvnez,
-+    /* XTheadFMemIdx */
-+    rv_op_th_flrd,
-+    rv_op_th_flrw,
-+    rv_op_th_flurd,
-+    rv_op_th_flurw,
-+    rv_op_th_fsrd,
-+    rv_op_th_fsrw,
-+    rv_op_th_fsurd,
-+    rv_op_th_fsurw,
-+    /* XTheadFmv */
-+    rv_op_th_fmv_hw_x,
-+    rv_op_th_fmv_x_hw,
-+    /* XTheadMac */
-+    rv_op_th_mula,
-+    rv_op_th_mulah,
-+    rv_op_th_mulaw,
-+    rv_op_th_muls,
-+    rv_op_th_mulsw,
-+    rv_op_th_mulsh,
-+    /* XTheadMemIdx */
-+    rv_op_th_lbia,
-+    rv_op_th_lbib,
-+    rv_op_th_lbuia,
-+    rv_op_th_lbuib,
-+    rv_op_th_lhia,
-+    rv_op_th_lhib,
-+    rv_op_th_lhuia,
-+    rv_op_th_lhuib,
-+    rv_op_th_lwia,
-+    rv_op_th_lwib,
-+    rv_op_th_lwuia,
-+    rv_op_th_lwuib,
-+    rv_op_th_ldia,
-+    rv_op_th_ldib,
-+    rv_op_th_sbia,
-+    rv_op_th_sbib,
-+    rv_op_th_shia,
-+    rv_op_th_shib,
-+    rv_op_th_swia,
-+    rv_op_th_swib,
-+    rv_op_th_sdia,
-+    rv_op_th_sdib,
-+    rv_op_th_lrb,
-+    rv_op_th_lrbu,
-+    rv_op_th_lrh,
-+    rv_op_th_lrhu,
-+    rv_op_th_lrw,
-+    rv_op_th_lrwu,
-+    rv_op_th_lrd,
-+    rv_op_th_srb,
-+    rv_op_th_srh,
-+    rv_op_th_srw,
-+    rv_op_th_srd,
-+    rv_op_th_lurb,
-+    rv_op_th_lurbu,
-+    rv_op_th_lurh,
-+    rv_op_th_lurhu,
-+    rv_op_th_lurw,
-+    rv_op_th_lurwu,
-+    rv_op_th_lurd,
-+    rv_op_th_surb,
-+    rv_op_th_surh,
-+    rv_op_th_surw,
-+    rv_op_th_surd,
-+    /* XTheadMemPair */
-+    rv_op_th_ldd,
-+    rv_op_th_lwd,
-+    rv_op_th_lwud,
-+    rv_op_th_sdd,
-+    rv_op_th_swd,
-+    /* XTheadSync */
-+    rv_op_th_sfence_vmas,
-+    rv_op_th_sync,
-+    rv_op_th_sync_i,
-+    rv_op_th_sync_is,
-+    rv_op_th_sync_s,
-+} rv_xthead_op;
-+
-+const rv_opcode_data xthead_opcode_data[] = {
-+    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-+    /* XTheadBa */
-+    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    /* XTheadBb */
-+    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
-+    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
-+    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
-+    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
-+    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    /* XTheadBs */
-+    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
-+    /* XTheadCmo */
-+    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
-+    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    /* XTheadCondMov */
-+    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    /* XTheadFMemIdx */
-+    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    /* XTheadFmv */
-+    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
-+    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
-+    /* XTheadMac */
-+    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    /* XTheadMemIdx */
-+    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
-+    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
-+    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
-+    /* XTheadMemPair */
-+    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
-+    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
-+    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
-+    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
-+    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
-+    /* XTheadSync */
-+    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
-+    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
-+};
-+
-+void decode_xtheadba(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 1:
-+                switch ((inst >> 25) & 0b1111111) {
-+                case 0b0000000:
-+                case 0b0000001:
-+                case 0b0000010:
-+                case 0b0000011: op = rv_op_th_addsl; break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadbb(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 1:
-+                switch ((inst >> 25) & 0b1111111) {
-+                case 0b0001010: op = rv_op_th_srriw; break;
-+                case 0b1000000:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_tstnbz;
-+                    }
-+                    break;
-+                case 0b1000001:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_rev;
-+                    }
-+                    break;
-+                case 0b1000010:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_ff0;
-+                    }
-+                    break;
-+                case 0b1000011:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_ff1;
-+                    }
-+                    break;
-+                case 0b1000100:
-+                case 0b1001000:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_revw;
-+                    }
-+                    break;
-+                case 0b0000100:
-+                case 0b0000101: op = rv_op_th_srri; break;
-+                }
-+                break;
-+            case 2: op = rv_op_th_ext; break;
-+            case 3: op = rv_op_th_extu; break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadbs(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 1:
-+                switch ((inst >> 26) & 0b111111) {
-+                case 0b100010: op = rv_op_th_tst; break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 0:
-+                switch ((inst >> 20 & 0b111111111111)) {
-+                case 0b000000000001:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_dcache_call;
-+                    }
-+                    break;
-+                case 0b000000000011:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_dcache_ciall;
-+                    }
-+                    break;
-+                case 0b000000000010:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_dcache_iall;
-+                    }
-+                    break;
-+                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
-+                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
-+                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
-+                case 0b000000100101: op = rv_op_th_dcache_cva; break;
-+                case 0b000000100111: op = rv_op_th_dcache_civa; break;
-+                case 0b000000100110: op = rv_op_th_dcache_iva; break;
-+                case 0b000000100001: op = rv_op_th_dcache_csw; break;
-+                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
-+                case 0b000000100010: op = rv_op_th_dcache_isw; break;
-+                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
-+                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
-+                case 0b000000010000:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_icache_iall;
-+                    }
-+                    break;
-+                case 0b000000010001:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_icache_ialls;
-+                    }
-+                    break;
-+                case 0b000000111000: op = rv_op_th_icache_ipa; break;
-+                case 0b000000110000: op = rv_op_th_icache_iva; break;
-+                case 0b000000010101:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_l2cache_call;
-+                    }
-+                    break;
-+                case 0b000000010111:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_l2cache_ciall;
-+                    }
-+                    break;
-+                case 0b000000010110:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_l2cache_iall;
-+                    }
-+                    break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 1:
-+                switch ((inst >> 25) & 0b1111111) {
-+                case 0b0100000: op = rv_op_th_mveqz; break;
-+                case 0b0100001: op = rv_op_th_mvnez; break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 6:
-+                switch ((inst >> 27) & 0b11111) {
-+                case 8: op = rv_op_th_flrw; break;
-+                case 10: op = rv_op_th_flurw; break;
-+                case 12: op = rv_op_th_flrd; break;
-+                case 14: op = rv_op_th_flurd; break;
-+                }
-+                break;
-+            case 7:
-+                switch ((inst >> 27) & 0b11111) {
-+                case 8: op = rv_op_th_fsrw; break;
-+                case 10: op = rv_op_th_fsurw; break;
-+                case 12: op = rv_op_th_fsrd; break;
-+                case 14: op = rv_op_th_fsurd; break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 1:
-+                switch ((inst >> 25) & 0b1111111) {
-+                case 0b1010000:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_fmv_hw_x;
-+                    }
-+                    break;
-+                case 0b1100000:
-+                    if (((inst >> 20) & 0b11111) == 0) {
-+                        op = rv_op_th_fmv_x_hw;
-+                    }
-+                    break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadmac(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 1:
-+                switch ((inst >> 25) & 0b1111111) {
-+                case 0b0010000: op = rv_op_th_mula; break;
-+                case 0b0010001: op = rv_op_th_muls; break;
-+                case 0b0010010: op = rv_op_th_mulaw; break;
-+                case 0b0010011: op = rv_op_th_mulsw; break;
-+                case 0b0010100: op = rv_op_th_mulah; break;
-+                case 0b0010101: op = rv_op_th_mulsh; break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 4:
-+                switch ((inst >> 27) & 0b11111) {
-+                case 0: op = rv_op_th_lrb; break;
-+                case 1: op = rv_op_th_lbib; break;
-+                case 2: op = rv_op_th_lurb; break;
-+                case 3: op = rv_op_th_lbia; break;
-+                case 4: op = rv_op_th_lrh; break;
-+                case 5: op = rv_op_th_lhib; break;
-+                case 6: op = rv_op_th_lurh; break;
-+                case 7: op = rv_op_th_lhia; break;
-+                case 8: op = rv_op_th_lrw; break;
-+                case 9: op = rv_op_th_lwib; break;
-+                case 10: op = rv_op_th_lurw; break;
-+                case 11: op = rv_op_th_lwia; break;
-+                case 12: op = rv_op_th_lrd; break;
-+                case 13: op = rv_op_th_ldib; break;
-+                case 14: op = rv_op_th_lurd; break;
-+                case 15: op = rv_op_th_ldia; break;
-+                case 16: op = rv_op_th_lrbu; break;
-+                case 17: op = rv_op_th_lbuib; break;
-+                case 18: op = rv_op_th_lurbu; break;
-+                case 19: op = rv_op_th_lbuia; break;
-+                case 20: op = rv_op_th_lrhu; break;
-+                case 21: op = rv_op_th_lhuib; break;
-+                case 22: op = rv_op_th_lurhu; break;
-+                case 23: op = rv_op_th_lhuia; break;
-+                case 24: op = rv_op_th_lrwu; break;
-+                case 25: op = rv_op_th_lwuib; break;
-+                case 26: op = rv_op_th_lurwu; break;
-+                case 27: op = rv_op_th_lwuia; break;
-+                }
-+                break;
-+            case 5:
-+                switch ((inst >> 27) & 0b11111) {
-+                case 0: op = rv_op_th_srb; break;
-+                case 1: op = rv_op_th_sbib; break;
-+                case 2: op = rv_op_th_surb; break;
-+                case 3: op = rv_op_th_sbia; break;
-+                case 4: op = rv_op_th_srh; break;
-+                case 5: op = rv_op_th_shib; break;
-+                case 6: op = rv_op_th_surh; break;
-+                case 7: op = rv_op_th_shia; break;
-+                case 8: op = rv_op_th_srw; break;
-+                case 9: op = rv_op_th_swib; break;
-+                case 10: op = rv_op_th_surw; break;
-+                case 11: op = rv_op_th_swia; break;
-+                case 12: op = rv_op_th_srd; break;
-+                case 13: op = rv_op_th_sdib; break;
-+                case 14: op = rv_op_th_surd; break;
-+                case 15: op = rv_op_th_sdia; break;
-+                }
-+                break;
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 4:
-+                switch ((inst >> 27) & 0b11111) {
-+                case 28: op = rv_op_th_lwd; break;
-+                case 30: op = rv_op_th_lwud; break;
-+                case 31: op = rv_op_th_ldd; break;
-+                }
-+                break;
-+            case 5:
-+                switch ((inst >> 27) & 0b11111) {
-+                case 28: op = rv_op_th_swd; break;
-+                case 31: op = rv_op_th_sdd; break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-+
-+void decode_xtheadsync(rv_decode *dec, rv_isa isa)
-+{
-+    rv_inst inst = dec->inst;
-+    rv_opcode op = rv_op_illegal;
-+
-+    switch (((inst >> 0) & 0b11)) {
-+    case 3:
-+        switch (((inst >> 2) & 0b11111)) {
-+        case 2:
-+            /* custom-0 */
-+            switch ((inst >> 12) & 0b111) {
-+            case 0:
-+                switch ((inst >> 25) & 0b1111111) {
-+                case 0b0000010: op = rv_op_th_sfence_vmas; break;
-+                case 0b0000000:
-+                    switch ((inst >> 20) & 0b11111) {
-+                    case 0b11000: op = rv_op_th_sync; break;
-+                    case 0b11010: op = rv_op_th_sync_i; break;
-+                    case 0b11011: op = rv_op_th_sync_is; break;
-+                    case 0b11001: op = rv_op_th_sync_s; break;
-+                    }
-+                    break;
-+                }
-+                break;
-+            }
-+            break;
-+            /* custom-0 */
-+        }
-+        break;
-+    }
-+
-+    dec->op = op;
-+}
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qemu/bitops.h"
- #include "disas/dis-asm.h"
- #include "target/riscv/cpu_cfg.h"
- #include "disas/riscv.h"
- /* Vendor extensions */
-+#include "disas/riscv-xthead.h"
- #include "disas/riscv-xventana.h"
- typedef enum {
-@@ -XXX,XX +XXX,XX @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
-     return ((inst << 56) >> 60);
- }
-+static uint32_t operand_imm6(rv_inst inst)
-+{
-+    return (inst << 38) >> 60;
-+}
-+
-+static uint32_t operand_imm2(rv_inst inst)
-+{
-+    return (inst << 37) >> 62;
-+}
-+
-+static uint32_t operand_immh(rv_inst inst)
-+{
-+    return (inst << 32) >> 58;
-+}
-+
-+static uint32_t operand_imml(rv_inst inst)
-+{
-+    return (inst << 38) >> 58;
-+}
-+
- static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
- {
-     int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
-     case rv_codec_zcmt_jt:
-         dec->imm = operand_tbl_index(inst);
-         break;
-+    case rv_codec_r2_imm5:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        dec->imm = operand_rs2(inst);
-+        break;
-+    case rv_codec_r2:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        break;
-+    case rv_codec_r2_imm6:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        dec->imm = operand_imm6(inst);
-+        break;
-+    case rv_codec_r_imm2:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        dec->rs2 = operand_rs2(inst);
-+        dec->imm = operand_imm2(inst);
-+        break;
-+    case rv_codec_r2_immhl:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        dec->imm = operand_immh(inst);
-+        dec->imm1 = operand_imml(inst);
-+        break;
-+    case rv_codec_r2_imm2_imm5:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        dec->imm = sextract32(operand_rs2(inst), 0, 5);
-+        dec->imm1 = operand_imm2(inst);
-+        break;
-     };
- }
-@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
-             snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
-             append(buf, tmp, buflen);
-             break;
-+        case 'j':
-+            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
-+            append(buf, tmp, buflen);
-+            break;
-         case 'o':
-             snprintf(tmp, sizeof(tmp), "%d", dec->imm);
-             append(buf, tmp, buflen);
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-         void (*decode_func)(rv_decode *, rv_isa);
-     } decoders[] = {
-         { always_true_p, rvi_opcode_data, decode_inst_opcode },
-+        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
-+        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
-+        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
-+        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
-+        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
-+        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
-+        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
-+        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
-+        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
-+        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
-+        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
-         { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
-     };
-diff --git a/disas/meson.build b/disas/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/disas/meson.build
-+++ b/disas/meson.build
-@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
- common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
- common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
-     'riscv.c',
-+    'riscv-xthead.c',
-     'riscv-xventana.c'
- ))
- common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
---
-.40.1

-[PULL 52/54] target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
+[PULL 19/28] target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Max Chou <max.chou@sifive.com>
-There are 2 places in which we need to get a pointer to a certain
+The opfv_narrow_check needs to check the single width float operator by
-property of the cpu->cfg struct based on property offset. Next patch
+require_rvf.
 will add a couple more.
-Create a helper to avoid repeating this code over and over.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20240322092600.1198921-4-max.chou@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 11 +++++++----
+ target/riscv/insn_trans/trans_rvv.c.inc | 1 +
-file changed, 7 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
-     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+ static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
  };
 +static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
 +{
 +    return (void *)&cpu->cfg + kvmcfg->offset;
 +}
 +
  static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
                              uint32_t val)
  {
--    int cpu_cfg_offset = multi_ext->offset;
+     return opfv_narrow_check(s, a) &&
--    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
++           require_rvf(s) &&
-+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
+            require_scale_rvf(s) &&
+            (s->sew != MO_8);
      *ext_enabled = val;
  }
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
  static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
                                  KVMCPUConfig *multi_ext)
  {
 -    int cpu_cfg_offset = multi_ext->offset;
 -    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
 +    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
      return *ext_enabled;
  }
 --
-.40.1
+.45.1

-[PULL 53/54] target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM
+[PULL 20/28] target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Max Chou <max.chou@sifive.com>
-If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
+If the checking functions check both the single and double width
-Linux Kernel will fail to detect the availability of the CBOM/CBOZ
+operators at the same time, then the single width operator checking
-extensions, regardless of the contents of the 'riscv,isa' DT prop.
+functions (require_rvf[min]) will check whether the SEW is 8.
-The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
+Signed-off-by: Max Chou <max.chou@sifive.com>
-so let's expose them as user properties like it is already done with
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-TCG.
+Cc: qemu-stable <qemu-stable@nongnu.org>
+Message-ID: <20240322092600.1198921-5-max.chou@sifive.com>
 This will also require us to determine proper blocksize values during
 init() time since the FDT is already created during realize(). We'll
 take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
 don't need to fetch both cbom and cboz blocksizes every time: check for
 their parent extensions (icbom and icboz) and only read the blocksizes
 if needed.
 In contrast with cbom|z_blocksize properties from TCG, the user is not
 able to set any value that is different from the 'host' value when
 running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
 can be thrown for the mere attempt of executing kvm_set_one_reg() for
 these 2 regs.
 Hopefully we don't need to call kvm_set_one_reg() for these regs.
 We'll check if the user input matches the host value in
 kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
 properties. We'll fail fast since it's already known to not be
 supported.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++------------
-file changed, 70 insertions(+)
+file changed, 4 insertions(+), 12 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
-     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+     return require_rvv(s) &&
             require_rvf(s) &&
             require_scale_rvf(s) &&
 -           (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
             vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
  }
+@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
-+static KVMCPUConfig kvm_cbom_blocksize = {
+     return require_rvv(s) &&
-+    .name = "cbom_blocksize",
+            require_rvf(s) &&
-+    .offset = CPUCFG(cbom_blocksize),
+            require_scale_rvf(s) &&
-+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
+-           (s->sew != MO_8) &&
-+};
+            vext_check_isa_ill(s) &&
-+
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
-+static KVMCPUConfig kvm_cboz_blocksize = {
+ }
-+    .name = "cboz_blocksize",
+@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
-+    .offset = CPUCFG(cboz_blocksize),
+     return require_rvv(s) &&
-+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
+            require_rvf(s) &&
-+};
+            require_scale_rvf(s) &&
-+
+-           (s->sew != MO_8) &&
-+static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
+            vext_check_isa_ill(s) &&
-+                                      const char *name,
+            vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
-+                                      void *opaque, Error **errp)
+ }
-+{
+@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
-+    KVMCPUConfig *cbomz_cfg = opaque;
+     return require_rvv(s) &&
-+    RISCVCPU *cpu = RISCV_CPU(obj);
+            require_rvf(s) &&
-+    uint16_t value, *host_val;
+            require_scale_rvf(s) &&
-+
+-           (s->sew != MO_8) &&
-+    if (!visit_type_uint16(v, name, &value, errp)) {
+            vext_check_isa_ill(s) &&
-+        return;
+            vext_check_dd(s, a->rd, a->rs2, a->vm);
-+    }
+ }
-+
+@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
 +    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
 +
 +    if (value != *host_val) {
 +        error_report("Unable to set %s to a different value than "
 +                     "the host (%u)",
 +                     cbomz_cfg->name, *host_val);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    cbomz_cfg->user_set = true;
 +}
 +
  static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
  {
-     CPURISCVState *env = &cpu->env;
+     return opfv_widen_check(s, a) &&
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+            require_rvfmin(s) &&
-                             kvm_cpu_set_multi_ext_cfg,
+-           require_scale_rvfmin(s) &&
-                             NULL, multi_cfg);
+-           (s->sew != MO_8);
-     }
++           require_scale_rvfmin(s);
 +
 +    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
 +                        NULL, kvm_cpu_set_cbomz_blksize,
 +                        NULL, &kvm_cbom_blocksize);
 +
 +    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
 +                        NULL, kvm_cpu_set_cbomz_blksize,
 +                        NULL, &kvm_cboz_blocksize);
  }
- static int kvm_riscv_get_regs_core(CPUState *cs)
+ #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
-     env->misa_ext = env->misa_ext_mask;
+ {
      return opfv_narrow_check(s, a) &&
             require_rvfmin(s) &&
 -           require_scale_rvfmin(s) &&
 -           (s->sew != MO_8);
 +           require_scale_rvfmin(s);
  }
-+static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
+ static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
 +                                         KVMCPUConfig *cbomz_cfg)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    struct kvm_one_reg reg;
 +    int ret;
 +
 +    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 +                              cbomz_cfg->kvm_reg_id);
 +    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
 +    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +    if (ret != 0) {
 +        error_report("Unable to read KVM reg %s, error %d",
 +                     cbomz_cfg->name, ret);
 +        exit(EXIT_FAILURE);
 +    }
 +}
 +
  static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
  {
-     CPURISCVState *env = &cpu->env;
+     return opfv_narrow_check(s, a) &&
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+            require_rvf(s) &&
+-           require_scale_rvf(s) &&
-         kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
+-           (s->sew != MO_8);
-     }
++           require_scale_rvf(s);
 +
 +    if (cpu->cfg.ext_icbom) {
 +        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
 +    }
 +
 +    if (cpu->cfg.ext_icboz) {
 +        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
 +    }
  }
- void kvm_riscv_init_user_properties(Object *cpu_obj)
+ #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return reduction_widen_check(s, a) &&
             require_rvf(s) &&
 -           require_scale_rvf(s) &&
 -           (s->sew != MO_8);
 +           require_scale_rvf(s);
  }
  GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
 --
-.40.1
+.45.1

-[PULL 14/54] target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
+[PULL 21/28] target/riscv: prioritize pmp errors in raise_mmu_exception()
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
+raise_mmu_exception(), as is today, is prioritizing guest page faults by
-should also take MPRV into consideration. As pointer mask for instruction
+checking first if virt_enabled && !first_stage, and then considering the
-is not supported currently, so we can directly update cur_pmbase/pmmask
+regular inst/load/store faults.
 based on address related mode and xlen affected by MPRV now.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+There's no mention in the spec about guest page fault being a higher
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+priority that PMP faults. In fact, privileged spec section 3.7.1 says:
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
+"Attempting to fetch an instruction from a PMP region that does not have
 execute permissions raises an instruction access-fault exception.
 Attempting to execute a load or load-reserved instruction which accesses
 a physical address within a PMP region without read permissions raises a
 load access-fault exception. Attempting to execute a store,
 store-conditional, or AMO instruction which accesses a physical address
 within a PMP region without write permissions raises a store
 access-fault exception."
 So, in fact, we're doing it wrong - PMP faults should always be thrown,
 regardless of also being a first or second stage fault.
 The way riscv_cpu_tlb_fill() and get_physical_address() work is
 adequate: a TRANSLATE_PMP_FAIL error is immediately reported and
 reflected in the 'pmp_violation' flag. What we need is to change
 raise_mmu_exception() to prioritize it.
 Reported-by: Joseph Chan <jchan@ventanamicro.com>
 Fixes: 82d53adfbb ("target/riscv/cpu_helper.c: Invalid exception on MMU translation stage")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240413105929.7030-1-alexei.filippov@syntacore.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c |  7 +++++--
+ target/riscv/cpu_helper.c | 22 ++++++++++++----------
- target/riscv/csr.c        | 27 ++++++++++++++++++++-------
+file changed, 12 insertions(+), 10 deletions(-)
 files changed, 25 insertions(+), 9 deletions(-)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
- void riscv_cpu_update_mask(CPURISCVState *env)
- {
+     switch (access_type) {
-     target_ulong mask = 0, base = 0;
+     case MMU_INST_FETCH:
-+    RISCVMXL xl = env->xl;
+-        if (env->virt_enabled && !first_stage) {
-     /*
++        if (pmp_violation) {
-      * TODO: Current RVJ spec does not specify
++            cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
-      * how the extension interacts with XLEN.
++        } else if (env->virt_enabled && !first_stage) {
-      */
+             cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
- #ifndef CONFIG_USER_ONLY
+         } else {
-+    int mode = cpu_address_mode(env);
+-            cs->exception_index = pmp_violation ?
-+    xl = cpu_get_xl(env, mode);
+-                RISCV_EXCP_INST_ACCESS_FAULT : RISCV_EXCP_INST_PAGE_FAULT;
-     if (riscv_has_ext(env, RVJ)) {
++            cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
 -        switch (env->priv) {
 +        switch (mode) {
          case PRV_M:
              if (env->mmte & M_PM_ENABLE) {
                  mask = env->mpmmask;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_update_mask(CPURISCVState *env)
          }
-     }
+         break;
- #endif
+     case MMU_DATA_LOAD:
--    if (env->xl == MXL_RV32) {
+-        if (two_stage && !first_stage) {
-+    if (xl == MXL_RV32) {
++        if (pmp_violation) {
-         env->cur_pmmask = mask & UINT32_MAX;
++            cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
-         env->cur_pmbase = base & UINT32_MAX;
++        } else if (two_stage && !first_stage) {
-     } else {
+             cs->exception_index = RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT;
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+         } else {
-index XXXXXXX..XXXXXXX 100644
+-            cs->exception_index = pmp_violation ?
---- a/target/riscv/csr.c
+-                RISCV_EXCP_LOAD_ACCESS_FAULT : RISCV_EXCP_LOAD_PAGE_FAULT;
-+++ b/target/riscv/csr.c
++            cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+         }
-      */
+         break;
-     if (env->debugger) {
+     case MMU_DATA_STORE:
-         env->xl = cpu_recompute_xl(env);
+-        if (two_stage && !first_stage) {
--        riscv_cpu_update_mask(env);
++        if (pmp_violation) {
-     }
++            cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
-+
++        } else if (two_stage && !first_stage) {
-+    riscv_cpu_update_mask(env);
+             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
-     return RISCV_EXCP_NONE;
+         } else {
- }
+-            cs->exception_index = pmp_violation ?
+-                RISCV_EXCP_STORE_AMO_ACCESS_FAULT :
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
+-                RISCV_EXCP_STORE_PAGE_FAULT;
-     uint64_t mstatus;
++            cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
+         }
-     env->mpmmask = val;
+         break;
--    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+     default:
 +    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
          env->cur_pmmask = val;
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->spmmask = val;
 -    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
          env->cur_pmmask = val;
 +        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 +            env->cur_pmmask &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->upmmask = val;
 -    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
          env->cur_pmmask = val;
 +        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 +            env->cur_pmmask &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
      uint64_t mstatus;
      env->mpmbase = val;
 -    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
          env->cur_pmbase = val;
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->spmbase = val;
 -    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
          env->cur_pmbase = val;
 +        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 +            env->cur_pmbase &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->upmbase = val;
 -    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
          env->cur_pmbase = val;
 +        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 +            env->cur_pmbase &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
 --
-.40.1
+.45.1

-[PULL 09/54] target/riscv: Make MPV only work when MPP != PRV_M
+[PULL 22/28] target/riscv: do not set mtval2 for non guest-page faults
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Alexei Filippov <alexei.filippov@syntacore.com>
-Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
+Previous patch fixed the PMP priority in raise_mmu_exception() but we're still
-when MPP=PRV_M.
+setting mtval2 incorrectly. In riscv_cpu_tlb_fill(), after pmp check in 2 stage
 translation part, mtval2 will be set in case of successes 2 stage translation but
 failed pmp check.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+In this case we gonna set mtval2 via env->guest_phys_fault_addr in context of
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+riscv_cpu_tlb_fill(), as this was a guest-page-fault, but it didn't and mtval2
 should be zero, according to RISCV privileged spec sect. 9.4.4: When a guest
 page-fault is taken into M-mode, mtval2 is written with either zero or guest
 physical address that faulted, shifted by 2 bits. *For other traps, mtval2
 is set to zero...*
 Signed-off-by: Alexei Filippov <alexei.filippov@syntacore.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
+Message-ID: <20240503103052.6819-1-alexei.filippov@syntacore.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 3 ++-
+ target/riscv/cpu_helper.c | 12 ++++++------
- target/riscv/op_helper.c  | 3 ++-
+file changed, 6 insertions(+), 6 deletions(-)
 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                               __func__, pa, ret, prot_pmp, tlb_size);
-         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
-             mode = get_field(env->mstatus, MSTATUS_MPP);
+                 prot &= prot_pmp;
--            virt = get_field(env->mstatus, MSTATUS_MPV);
+-            }
-+            virt = get_field(env->mstatus, MSTATUS_MPV) &&
+-
-+                   (mode != PRV_M);
+-            if (ret != TRANSLATE_SUCCESS) {
-             if (virt) {
++            } else {
-                 status = env->vsstatus;
+                 /*
                   * Guest physical address translation failed, this is a HS
                   * level exception
                   */
                  first_stage_error = false;
 -                env->guest_phys_fault_addr = (im_address |
 -                                              (address &
 -                                               (TARGET_PAGE_SIZE - 1))) >> 2;
 +                if (ret != TRANSLATE_PMP_FAIL) {
 +                    env->guest_phys_fault_addr = (im_address |
 +                                                  (address &
 +                                                   (TARGET_PAGE_SIZE - 1))) >> 2;
 +                }
              }
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+         }
-index XXXXXXX..XXXXXXX 100644
+     } else {
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
          riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
      }
 -    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
 +    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
 +                             (prev_priv != PRV_M);
      mstatus = set_field(mstatus, MSTATUS_MIE,
                          get_field(mstatus, MSTATUS_MPIE));
      mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
 --
-.40.1
+.45.1

-[PULL 10/54] target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-MPV and GVA bits are added by hypervisor extension to mstatus
-and mstatush (if MXLEN=32).
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c | 10 ++++------
-file changed, 4 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-     }
-     if (xl != MXL_RV32 || env->debugger) {
--        /*
--         * RV32: MPV and GVA are not in mstatus. The current plan is to
--         * add them to mstatush. For now, we just don't support it.
--         */
--        mask |= MSTATUS_MPV | MSTATUS_GVA;
-+        if (riscv_has_ext(env, RVH)) {
-+            mask |= MSTATUS_MPV | MSTATUS_GVA;
-+        }
-         if ((val & MSTATUS64_UXL) != 0) {
-             mask |= MSTATUS64_UXL;
-         }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
-                                      target_ulong val)
- {
-     uint64_t valh = (uint64_t)val << 32;
--    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
-+    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
-     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
---
-.40.1

-[PULL 11/54] target/riscv: Remove redundant assignment to SXL
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-SXL is initialized as env->misa_mxl which is also the mxl value.
-So we can just remain it unchanged to keep it read-only.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c | 4 ----
-file changed, 4 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-     mstatus = (mstatus & ~mask) | (val & mask);
--    if (xl > MXL_RV32) {
--        /* SXL field is for now read only */
--        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
--    }
-     env->mstatus = mstatus;
-     /*
---
-.40.1

-[PULL 15/54] roms/opensbi: Upgrade from v1.2 to v1.3
+Deleted patch
-From: Bin Meng <bmeng@tinylab.org>
-Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.
-The v1.3 release includes the following commits:
-fa81 treewide: Replace TRUE/FALSE with true/false
-6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
-f8 lib: utils/sys: Allow custom HTIF base address for RV32
-f14595a lib: sbi: Allow platform to influence cold boot HART selection
-ae0 platform: generic: Allow platform_override to select cold boot HART
-cb7e7c3 platform: generic: Allow platform_override to perform firmware init
-df8 generic/starfive: Add Starfive JH7110 platform implementation
-6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
-e397e3 docs: domain_support: Use capital letter for privilege modes
-e0ba09 include: sbi: Fine grain the permissions for M and SU modes
-aace1e1 lib: sbi: Use finer permission semantics for address validation
-dbdb3 lib: sbi: Add permissions for the firmware start till end
-ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
-f736c lib: sbi: Modify the boot time region flag prints
-e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
-e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
-a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
-d docs: Update domain's region permissions and requirements
-da5594b platform: generic: allwinner: Fix PLIC array bounds
-ce2a834 docs: generic.md: fix typo of andes-ae350
-ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
-b1818ee include: types: add always inline compiler attribute
-c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
-a platform: andes/ae350: Implement hart hotplug using HSM extension
-aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
-a990309 lib: utils: Fix reserved memory node for firmware memory
-fefa548 firmware: Split RO/RX and RW sections
-f40a99 firmware: Move dynsym and reladyn sections to RX section
-c10e3fe firmware: Add RW section offset in scratch
-b666760 lib: sbi: Print the RW section offset
-d lib: sbi: Add separate entries for firmware RX and RW regions
-dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
-bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
-c45992c platform: generic: allwinner: Advertise nonretentive suspend
-c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
-8050081 firmware: Not to clear all the MIP
-d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
-b lib: utils: Mark only the largest region as reserved in FDT
-b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
-f3de Makefile: Add missing .dep files for fw_*.elf.ld
-b34d8 include: Add support for byteorder/endianness conversion
-bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
-b224ddb include: types: Add typedefs for endianness
-aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
-e3bf1af include: Add defines for SBI debug console extension
-ee3a86 lib: sbi: Add sbi_nputs() function
-e0572f lib: sbi: Add sbi_ngets() function
-eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
-a41a38 lib: sbi: Implement SBI debug console extension
-c43903c lib: sbi: Add console_puts() callback in the console device
-ae lib: utils/serial: Implement console_puts() for semihosting
-c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
-c lib: utils/fdt: Fix fdt_pmu.c header dependency
-aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
-aaec platform: generic/andes: Fix ae350.c header dependency
-d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
-ee9 lib: utils: fdt_fixup: Fix compile error
-f2be40 docs: fix typo in fw.md
-ea806 lib: sbi_hart: Enable hcontext and scontext
-adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
-b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
-c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
-2491242 platform: generic: renesas: rzfive: Configure the PMA region
-b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
-a75f53 lib: sbi/sbi_domain: cosmetic style fixes
-bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
-b3776 docs: domain_support: Update the DT example
-d5a lib: sbi_hsm: Factor out invalid state detection
-f16a8 lib: sbi_hsm: Don't try to restore state on failed change
-c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
-b1ae6ef lib: sbi_hsm: Move misplaced comment
-fc lib: sbi_hsm: Remove unnecessary include
-a40306 lib: sbi_hsm: Export some functions
-a0 lib: sbi: Add system suspend skeleton
-c9917b6 lib: sbi: Add system_suspend_allowed domain property
-c964e2 lib: sbi: Implement system suspend
-dc docs: Correct opensbi-domain property name
-ccebf0 platform: generic: Add system suspend test
-be1b gpio/starfive: add gpio driver and support gpio reset
-b28afc make: Add a command line option for debugging OpenSBI
-e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
-ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
-f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
-fe8dc9 lib: sbi_pmu: add callback for counter width
-d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
-c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
-e4b4 lib: sbi_pmu: Rename fw_counter_value
-b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
-d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
-d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
-c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
-d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
-e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
-c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
-ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
-ab11d lib: sbi: Fix how to check whether the domain contains fw_region
-f64dfcd lib: sbi: Introduce sbi_entry_count() function
-b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
-e90259 lib: sbi_hart: clear mip csr during hart init
-ba2b2 include: Add defines for SBI CPPC extension
-caae8 lib: sbi: Implement SBI CPPC extension
-d0 lib: sbi: Print the CPPC device name
-edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
-ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
-f26 lib: utils: fdt_fixup: avoid buffer overrun
-fa925 lib: sbi: Optimize sbi_tlb
-dde46 lib: sbi: Optimize sbi_ipi
-ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
-bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
-eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
-f692289 firmware: Optimize loading relocation type
-e41dbb5 firmware: Change to use positive offset to access relocation entries
-bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
-e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
-f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
-7919530 lib: sbi: Add debug print when sbi_pmu_init fails
-e33530 lib: sbi: Remove unnecessary semicolon
-bc02de lib: sbi: Simplify sbi_ipi_process remove goto
-dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
-f58c140 lib: sbi: Introduce register_extensions extension callback
-e307ba7 lib: sbi: Narrow vendor extension range
-f0c3 lib: sbi: pmu: Remove unnecessary probe function
-b952d4 lib: sbi: Only register available extensions
-b5fc lib: sbi: Optimize probe of srst/susp
-c3e31cb lib: sbi: Remove 0/1 probe implementations
-f1722 lib: sbi: Document sbi_ecall_extension members
-d4c46e0 Makefile: Dereference symlinks on install
-b99a7f lib: sbi: Fix return of sbi_console_init
-d0be lib: utils: Improve fdt_serial_init
-a0bdd0 lib: utils: Improve fdt_ipi
-f226 lib: utils: Improve fdt_timer
-df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
-bdde2ec lib: sbi: Align system suspend errors with spec
-aad7a37 include: sbi_scratch: Add helper macros to access data type
-cf9a54 platform: Allow platforms to specify heap size
-d36a6 lib: sbi: Introduce simple heap allocator
-a04f70 lib: sbi: Print scratch size and usage at boot time
-bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
-ef4542d lib: sbi: Use heap for root domain creation
-daafe lib: sbi: Use scratch space to save per-HART domain pointer
-fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
-e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
-a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
-3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
-e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
-c1c972 lib: utils/fdt: Use heap in FDT domain parsing
-acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
-f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
-b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
-df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
-c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
-feec docs: Add OpenSBI logo and use it in the top-level README.md
-be2c README.md: Improve project copyright information
-b26 platform/lib: Set no-map attribute on all PMP regions
-d64942f firmware: Fix find hart index
-c957a lib: reset: Move fdt_reset_init into generic_early_init
-bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
-2552799 include: Bump-up version to 1.3
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
-Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
-Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
- .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
- roms/opensbi                                  |   2 +-
-files changed, 1 insertion(+), 1 deletion(-)
-diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
-diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
-diff --git a/roms/opensbi b/roms/opensbi
-index XXXXXXX..XXXXXXX 160000
---- a/roms/opensbi
-+++ b/roms/opensbi
-@@ -1 +1 @@
--Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
-+Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
---
-.40.1

-[PULL 16/54] tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing
+Deleted patch
-From: Bin Meng <bmeng@tinylab.org>
-The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
-Let's enable the 32-bit Spike OpenSBI boot testing.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
-Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- tests/avocado/riscv_opensbi.py | 2 --
-file changed, 2 deletions(-)
-diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/riscv_opensbi.py
-+++ b/tests/avocado/riscv_opensbi.py
-@@ -XXX,XX +XXX,XX @@
- # later.  See the COPYING file in the top-level directory.
- from avocado_qemu import QemuSystemTest
--from avocado import skip
- from avocado_qemu import wait_for_console_pattern
- class RiscvOpenSBI(QemuSystemTest):
-@@ -XXX,XX +XXX,XX @@ def boot_opensbi(self):
-         wait_for_console_pattern(self, 'Platform Name')
-         wait_for_console_pattern(self, 'Boot HART MEDELEG')
--    @skip("requires OpenSBI fix to work")
-     def test_riscv32_spike(self):
-         """
-         :avocado: tags=arch:riscv32
---
-.40.1

-[PULL 18/54] hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
+Deleted patch
-From: Tommy Wu <tommy.wu@sifive.com>
-Create the AON device when we realize the sifive_e machine.
-This patch only implemented the functionality of the watchdog timer,
-not all the functionality of the AON device.
-Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/riscv/sifive_e.h |  9 ++++++---
- hw/riscv/sifive_e.c         | 17 +++++++++++++++--
- hw/riscv/Kconfig            |  1 +
-files changed, 22 insertions(+), 5 deletions(-)
-diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_e.h
-+++ b/include/hw/riscv/sifive_e.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_cpu.h"
- #include "hw/gpio/sifive_gpio.h"
-+#include "hw/misc/sifive_e_aon.h"
- #include "hw/boards.h"
- #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
-@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
-     /*< public >*/
-     RISCVHartArrayState cpus;
-     DeviceState *plic;
-+    SiFiveEAONState aon;
-     SIFIVEGPIOState gpio;
-     MemoryRegion xip_mem;
-     MemoryRegion mask_rom;
-@@ -XXX,XX +XXX,XX @@ enum {
- };
- enum {
--    SIFIVE_E_UART0_IRQ  = 3,
--    SIFIVE_E_UART1_IRQ  = 4,
--    SIFIVE_E_GPIO0_IRQ0 = 8
-+    SIFIVE_E_AON_WDT_IRQ  = 1,
-+    SIFIVE_E_UART0_IRQ    = 3,
-+    SIFIVE_E_UART1_IRQ    = 4,
-+    SIFIVE_E_GPIO0_IRQ0   = 8
- };
- #define SIFIVE_E_PLIC_HART_CONFIG "M"
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/intc/riscv_aclint.h"
- #include "hw/intc/sifive_plic.h"
- #include "hw/misc/sifive_e_prci.h"
-+#include "hw/misc/sifive_e_aon.h"
- #include "chardev/char.h"
- #include "sysemu/sysemu.h"
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
-     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
-     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
-                             TYPE_SIFIVE_GPIO);
-+    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
-+                            TYPE_SIFIVE_E_AON);
- }
- static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
-         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
-         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
--    create_unimplemented_device("riscv.sifive.e.aon",
--        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
-     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
-+    /* AON */
-+
-+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
-+        return;
-+    }
-+
-+    /* Map AON registers */
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
-+
-     /* GPIO */
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-                            qdev_get_gpio_in(DEVICE(s->plic),
-                                             SIFIVE_E_GPIO0_IRQ0 + i));
-     }
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
-+                       qdev_get_gpio_in(DEVICE(s->plic),
-+                                        SIFIVE_E_AON_WDT_IRQ));
-     sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
-         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
-+++ b/hw/riscv/Kconfig
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
-     select SIFIVE_PLIC
-     select SIFIVE_UART
-     select SIFIVE_E_PRCI
-+    select SIFIVE_E_AON
-     select UNIMP
- config SIFIVE_U
---
-.40.1

-[PULL 19/54] tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e
+Deleted patch
-From: Tommy Wu <tommy.wu@sifive.com>
-Add some simple tests of the watchdog timer in the always-on domain device
-of HiFive 1 rev b.
-Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
- tests/qtest/meson.build                  |   3 +
-files changed, 453 insertions(+)
- create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
-diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/qtest/sifive-e-aon-watchdog-test.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QTest testcase for the watchdog timer of HiFive 1 rev b.
-+ *
-+ * Copyright (c) 2023 SiFive, Inc.
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2 or later, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/timer.h"
-+#include "qemu/bitops.h"
-+#include "libqtest.h"
-+#include "hw/registerfields.h"
-+#include "hw/misc/sifive_e_aon.h"
-+
-+FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
-+FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
-+FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
-+FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
-+FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
-+FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
-+FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
-+FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
-+FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
-+FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
-+
-+#define WDOG_BASE (0x10000000)
-+#define WDOGCFG (0x0)
-+#define WDOGCOUNT (0x8)
-+#define WDOGS (0x10)
-+#define WDOGFEED (0x18)
-+#define WDOGKEY (0x1c)
-+#define WDOGCMP0 (0x20)
-+
-+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
-+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
-+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
-+
-+static void test_init(QTestState *qts)
-+{
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
-+}
-+
-+static void test_wdogcount(void)
-+{
-+    uint64_t tmp;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
-+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
-+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
-+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_wdogcfg(void)
-+{
-+    uint32_t tmp_cfg;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
-+    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
-+
-+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
-+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_wdogcmp0(void)
-+{
-+    uint32_t tmp;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
-+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_wdogkey(void)
-+{
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_wdogfeed(void)
-+{
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_scaled_wdogs(void)
-+{
-+    uint32_t cfg;
-+    uint32_t fake_count = 0x12345678;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
-+    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
-+             (uint16_t)fake_count);
-+
-+    for (int i = 0; i < 16; i++) {
-+        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
-+        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
-+                 (uint16_t)(fake_count >>
-+                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
-+    }
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_watchdog(void)
-+{
-+    uint32_t cfg;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
-+
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
-+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
-+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_scaled_watchdog(void)
-+{
-+    uint32_t cfg;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
-+
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
-+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
-+
-+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_periodic_int(void)
-+{
-+    uint32_t cfg;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
-+
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
-+
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
-+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_quit(qts);
-+}
-+
-+static void test_enable_disable(void)
-+{
-+    uint32_t cfg;
-+    QTestState *qts = qtest_init("-machine sifive_e");
-+
-+    test_init(qts);
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
-+
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
-+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
-+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
-+
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
-+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
-+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+
-+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
-+
-+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
-+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
-+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
-+
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
-+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
-+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
-+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
-+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
-+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
-+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
-+
-+    qtest_quit(qts);
-+}
-+
-+int main(int argc, char *argv[])
-+{
-+    g_test_init(&argc, &argv, NULL);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
-+                   test_wdogcount);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
-+                   test_wdogcfg);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
-+                   test_wdogcmp0);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
-+                   test_wdogkey);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
-+                   test_wdogfeed);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
-+                   test_scaled_wdogs);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
-+                   test_watchdog);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
-+                   test_scaled_watchdog);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
-+                   test_periodic_int);
-+    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
-+                   test_enable_disable);
-+    return g_test_run();
-+}
-diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/meson.build
-+++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ qtests_s390x = \
-    'cpu-plug-test',
-    'migration-test']
-+qtests_riscv32 = \
-+  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
-+
- qos_test_ss = ss.source_set()
- qos_test_ss.add(
-   'ac97-test.c',
---
-.40.1

-[PULL 20/54] target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-We want to keep the ability to distinct between 32/64-bit host.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627143235.29947-2-philmd@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- meson.build | 11 ++++-------
-file changed, 4 insertions(+), 7 deletions(-)
-diff --git a/meson.build b/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/meson.build
-+++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
- bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
- supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
--supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
-+supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
-   'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
- cpu = host_machine.cpu_family()
--# Unify riscv* to a single family.
--if cpu in ['riscv32', 'riscv64']
--  cpu = 'riscv'
--endif
--
- target_dirs = config_host['TARGET_DIRS'].split()
- have_linux_user = false
- have_bsd_user = false
-@@ -XXX,XX +XXX,XX @@ elif cpu == 'x86'
-   host_arch = 'i386'
- elif cpu == 'mips64'
-   host_arch = 'mips'
-+elif cpu in ['riscv32', 'riscv64']
-+  host_arch = 'riscv'
- else
-   host_arch = cpu
- endif
-@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
-   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
- elif cpu in ['mips', 'mips64']
-   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
--elif cpu in ['riscv']
-+elif cpu in ['riscv32', 'riscv64']
-   kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
- else
-   kvm_targets = []
---
-.40.1

-[PULL 21/54] target/riscv: Only build KVM guest with same wordsize as host
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Per Anup Patel in [*]:
- > Currently, we only support running rv64 guest on rv64 host
- > and rv32 guest on rv32 host.
- >
- > In the future, we might support running rv32 guest on rv64
- > host but as of now we don't see a strong push for it.
-Therefore, when only using the KVM accelerator it is pointless
-to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
-on a rv32 host). Restrict meson to only build the correct binary,
-avoiding to waste ressources building unusable code.
-[*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230627143235.29947-3-philmd@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- meson.build | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/meson.build b/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/meson.build
-+++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
-   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
- elif cpu in ['mips', 'mips64']
-   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
--elif cpu in ['riscv32', 'riscv64']
--  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
-+elif cpu in ['riscv32']
-+  kvm_targets = ['riscv32-softmmu']
-+elif cpu in ['riscv64']
-+  kvm_targets = ['riscv64-softmmu']
- else
-   kvm_targets = []
- endif
---
-.40.1

-[PULL 22/54] target/riscv: Add RVV registers to log
+Deleted patch
-From: Ivan Klokov <ivan.klokov@syntacore.com>
-Print RvV extension register to log if VPU option is enabled.
-Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
-file changed, 56 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
- #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
-     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
-+/*
-+ * From vector_helper.c
-+ * Note that vector data is stored in host-endian 64-bit chunks,
-+ * so addressing bytes needs a host-endian fixup.
-+ */
-+#if HOST_BIG_ENDIAN
-+#define BYTE(x)   ((x) ^ 7)
-+#else
-+#define BYTE(x)   (x)
-+#endif
-+
- /*
-  * Here are the ordering rules of extension naming defined by RISC-V
-  * specification :
-@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
-     "f30/ft10", "f31/ft11"
- };
-+const char * const riscv_rvv_regnames[] = {
-+  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
-+  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
-+  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
-+  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
-+  "v28", "v29", "v30", "v31"
-+};
-+
- static const char * const riscv_excp_names[] = {
-     "misaligned_fetch",
-     "fault_fetch",
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
- {
-     RISCVCPU *cpu = RISCV_CPU(cs);
-     CPURISCVState *env = &cpu->env;
--    int i;
-+    int i, j;
-+    uint8_t *p;
- #if !defined(CONFIG_USER_ONLY)
-     if (riscv_has_ext(env, RVH)) {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-             }
-         }
-     }
-+    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
-+        static const int dump_rvv_csrs[] = {
-+                    CSR_VSTART,
-+                    CSR_VXSAT,
-+                    CSR_VXRM,
-+                    CSR_VCSR,
-+                    CSR_VL,
-+                    CSR_VTYPE,
-+                    CSR_VLENB,
-+                };
-+        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
-+            int csrno = dump_rvv_csrs[i];
-+            target_ulong val = 0;
-+            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
-+
-+            /*
-+             * Rely on the smode, hmode, etc, predicates within csr.c
-+             * to do the filtering of the registers that are present.
-+             */
-+            if (res == RISCV_EXCP_NONE) {
-+                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
-+                             csr_ops[csrno].name, val);
-+            }
-+        }
-+        uint16_t vlenb = cpu->cfg.vlen >> 3;
-+
-+        for (i = 0; i < 32; i++) {
-+            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
-+            p = (uint8_t *)env->vreg;
-+            for (j = vlenb - 1 ; j >= 0; j--) {
-+                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
-+            }
-+            qemu_fprintf(f, "\n");
-+        }
-+    }
- }
- static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
---
-.40.1

-[PULL 23/54] hw/riscv/virt: Restrict ACLINT to TCG
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The Advanced Core Local Interruptor (ACLINT) device can
-only be used with TCG. Check for TCG enabled instead of
-KVM being not. Only add the property when TCG is used.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230629121103.87733-3-philmd@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- docs/system/riscv/virt.rst |  1 +
- hw/riscv/virt.c            | 18 ++++++++++--------
-files changed, 11 insertions(+), 8 deletions(-)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
-+++ b/docs/system/riscv/virt.rst
-@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
-   When this option is "on", ACLINT devices will be emulated instead of
-   SiFive CLINT. When not specified, this option is assumed to be "off".
-+  This option is restricted to the TCG accelerator.
- - aia=[none|aplic|aplic-imsic]
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
- #include "chardev/char.h"
- #include "sysemu/device_tree.h"
- #include "sysemu/sysemu.h"
-+#include "sysemu/tcg.h"
- #include "sysemu/kvm.h"
- #include "sysemu/tpm.h"
- #include "hw/pci/pci.h"
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-         g_free(clust_name);
--        if (!kvm_enabled()) {
-+        if (tcg_enabled()) {
-             if (s->have_aclint) {
-                 create_fdt_socket_aclint(s, memmap, socket,
-                     &intc_phandles[phandle_pos]);
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-                                 hart_count, &error_abort);
-         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
--        if (!kvm_enabled()) {
-+        if (tcg_enabled()) {
-             if (s->have_aclint) {
-                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-                     /* Per-socket ACLINT MTIMER */
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
-     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
- #endif
--    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
--                                   virt_set_aclint);
--    object_class_property_set_description(oc, "aclint",
--                                          "Set on/off to enable/disable "
--                                          "emulating ACLINT devices");
--
-+    if (tcg_enabled()) {
-+        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
-+                                       virt_set_aclint);
-+        object_class_property_set_description(oc, "aclint",
-+                                              "Set on/off to enable/disable "
-+                                              "emulating ACLINT devices");
-+    }
-     object_class_property_add_str(oc, "aia", virt_get_aia,
-                                   virt_set_aia);
-     object_class_property_set_description(oc, "aia",
---
-.40.1

-[PULL 24/54] linux-user/riscv: Add syscall riscv_hwprobe
+Deleted patch
-From: Robbin Ehn <rehn@rivosinc.com>
-This patch adds the new syscall for the
-"RISC-V Hardware Probing Interface"
-(https://docs.kernel.org/riscv/hwprobe.html).
-Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
-Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
-Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- linux-user/riscv/syscall32_nr.h |   1 +
- linux-user/riscv/syscall64_nr.h |   1 +
- linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
-files changed, 148 insertions(+)
-diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/riscv/syscall32_nr.h
-+++ b/linux-user/riscv/syscall32_nr.h
-@@ -XXX,XX +XXX,XX @@
- #define TARGET_NR_accept4 242
- #define TARGET_NR_arch_specific_syscall 244
- #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
-+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
- #define TARGET_NR_prlimit64 261
- #define TARGET_NR_fanotify_init 262
- #define TARGET_NR_fanotify_mark 263
-diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/riscv/syscall64_nr.h
-+++ b/linux-user/riscv/syscall64_nr.h
-@@ -XXX,XX +XXX,XX @@
- #define TARGET_NR_recvmmsg 243
- #define TARGET_NR_arch_specific_syscall 244
- #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
-+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
- #define TARGET_NR_wait4 260
- #define TARGET_NR_prlimit64 261
- #define TARGET_NR_fanotify_init 262
-diff --git a/linux-user/syscall.c b/linux-user/syscall.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/syscall.c
-+++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
- }
- #endif /* TARGET_NR_getdents64 */
-+#if defined(TARGET_NR_riscv_hwprobe)
-+
-+#define RISCV_HWPROBE_KEY_MVENDORID     0
-+#define RISCV_HWPROBE_KEY_MARCHID       1
-+#define RISCV_HWPROBE_KEY_MIMPID        2
-+
-+#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
-+#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
-+
-+#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
-+#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
-+#define     RISCV_HWPROBE_IMA_C        (1 << 1)
-+
-+#define RISCV_HWPROBE_KEY_CPUPERF_0     5
-+#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
-+#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
-+#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
-+#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
-+#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
-+#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
-+
-+struct riscv_hwprobe {
-+    abi_llong  key;
-+    abi_ullong value;
-+};
-+
-+static void risc_hwprobe_fill_pairs(CPURISCVState *env,
-+                                    struct riscv_hwprobe *pair,
-+                                    size_t pair_count)
-+{
-+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
-+
-+    for (; pair_count > 0; pair_count--, pair++) {
-+        abi_llong key;
-+        abi_ullong value;
-+        __put_user(0, &pair->value);
-+        __get_user(key, &pair->key);
-+        switch (key) {
-+        case RISCV_HWPROBE_KEY_MVENDORID:
-+            __put_user(cfg->mvendorid, &pair->value);
-+            break;
-+        case RISCV_HWPROBE_KEY_MARCHID:
-+            __put_user(cfg->marchid, &pair->value);
-+            break;
-+        case RISCV_HWPROBE_KEY_MIMPID:
-+            __put_user(cfg->mimpid, &pair->value);
-+            break;
-+        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
-+            value = riscv_has_ext(env, RVI) &&
-+                    riscv_has_ext(env, RVM) &&
-+                    riscv_has_ext(env, RVA) ?
-+                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
-+            __put_user(value, &pair->value);
-+            break;
-+        case RISCV_HWPROBE_KEY_IMA_EXT_0:
-+            value = riscv_has_ext(env, RVF) &&
-+                    riscv_has_ext(env, RVD) ?
-+                    RISCV_HWPROBE_IMA_FD : 0;
-+            value |= riscv_has_ext(env, RVC) ?
-+                     RISCV_HWPROBE_IMA_C : pair->value;
-+            __put_user(value, &pair->value);
-+            break;
-+        case RISCV_HWPROBE_KEY_CPUPERF_0:
-+            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
-+            break;
-+        default:
-+            __put_user(-1, &pair->key);
-+            break;
-+        }
-+    }
-+}
-+
-+static int cpu_set_valid(abi_long arg3, abi_long arg4)
-+{
-+    int ret, i, tmp;
-+    size_t host_mask_size, target_mask_size;
-+    unsigned long *host_mask;
-+
-+    /*
-+     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
-+     * arg3 contains the cpu count.
-+     */
-+    tmp = (8 * sizeof(abi_ulong));
-+    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
-+    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
-+                     ~(sizeof(*host_mask) - 1);
-+
-+    host_mask = alloca(host_mask_size);
-+
-+    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
-+                                  arg4, target_mask_size);
-+    if (ret != 0) {
-+        return ret;
-+    }
-+
-+    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
-+        if (host_mask[i] != 0) {
-+            return 0;
-+        }
-+    }
-+    return -TARGET_EINVAL;
-+}
-+
-+static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
-+                                 abi_long arg2, abi_long arg3,
-+                                 abi_long arg4, abi_long arg5)
-+{
-+    int ret;
-+    struct riscv_hwprobe *host_pairs;
-+
-+    /* flags must be 0 */
-+    if (arg5 != 0) {
-+        return -TARGET_EINVAL;
-+    }
-+
-+    /* check cpu_set */
-+    if (arg3 != 0) {
-+        ret = cpu_set_valid(arg3, arg4);
-+        if (ret != 0) {
-+            return ret;
-+        }
-+    } else if (arg4 != 0) {
-+        return -TARGET_EINVAL;
-+    }
-+
-+    /* no pairs */
-+    if (arg2 == 0) {
-+        return 0;
-+    }
-+
-+    host_pairs = lock_user(VERIFY_WRITE, arg1,
-+                           sizeof(*host_pairs) * (size_t)arg2, 0);
-+    if (host_pairs == NULL) {
-+        return -TARGET_EFAULT;
-+    }
-+    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
-+    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
-+    return 0;
-+}
-+#endif /* TARGET_NR_riscv_hwprobe */
-+
- #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
- _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
- #endif
-@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
-         return ret;
- #endif
-+#if defined(TARGET_NR_riscv_hwprobe)
-+    case TARGET_NR_riscv_hwprobe:
-+        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
-+#endif
-+
-     default:
-         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
-         return -TARGET_ENOSYS;
---
-.40.1

-[PULL 26/54] target/riscv: Add support for Zfbfmin extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add trans_* and helper function for Zfbfmin instructions.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/helper.h                      |  4 ++
- target/riscv/insn32.decode                 |  4 ++
- target/riscv/fpu_helper.c                  | 12 +++++
- target/riscv/translate.c                   |  1 +
- target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
- target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
-files changed, 80 insertions(+), 6 deletions(-)
- create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
-+++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
- /* Zce helper */
- DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
-+
-+/* BF16 functions */
-+DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
-+DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
- # *** RV32 Zicond Standard Extension ***
- czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
- czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
-+
-+# *** Zfbfmin Standard Extension ***
-+fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
-+fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
-diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/fpu_helper.c
-+++ b/target/riscv/fpu_helper.c
-@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
-     float16 frs1 = check_nanbox_h(env, rs1);
-     return float16_to_float64(frs1, true, &env->fp_status);
- }
-+
-+uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
-+{
-+    float32 frs1 = check_nanbox_s(env, rs1);
-+    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
-+}
-+
-+uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
-+{
-+    float16 frs1 = check_nanbox_h(env, rs1);
-+    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
-+}
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
- #include "insn_trans/trans_rvk.c.inc"
- #include "insn_trans/trans_privileged.c.inc"
- #include "insn_trans/trans_svinval.c.inc"
-+#include "insn_trans/trans_rvbf16.c.inc"
- #include "decode-xthead.c.inc"
- #include "insn_trans/trans_xthead.c.inc"
- #include "insn_trans/trans_xventanacondops.c.inc"
-diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * RISC-V translation routines for the BF16 Standard Extensions.
-+ *
-+ * Copyright (c) 2020-2023 PLCT Lab
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2 or later, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#define REQUIRE_ZFBFMIN(ctx) do { \
-+    if (!ctx->cfg_ptr->ext_zfbfmin) { \
-+        return false; \
-+    } \
-+} while (0)
-+
-+static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
-+{
-+    REQUIRE_FPU;
-+    REQUIRE_ZFBFMIN(ctx);
-+
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
-+
-+    gen_set_rm(ctx, a->rm);
-+    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
-+    gen_set_fpr_hs(ctx, a->rd, dest);
-+    mark_fs_dirty(ctx);
-+    return true;
-+}
-+
-+static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
-+{
-+    REQUIRE_FPU;
-+    REQUIRE_ZFBFMIN(ctx);
-+
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
-+
-+    gen_set_rm(ctx, a->rm);
-+    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
-+    gen_set_fpr_hs(ctx, a->rd, dest);
-+    mark_fs_dirty(ctx);
-+    return true;
-+}
-diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvzfh.c.inc
-+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
-@@ -XXX,XX +XXX,XX @@
-     }                                  \
- } while (0)
--#define REQUIRE_ZFHMIN(ctx) do {              \
--    if (!ctx->cfg_ptr->ext_zfhmin) {          \
-+#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
-+    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
-         return false;                         \
-     }                                         \
- } while (0)
-@@ -XXX,XX +XXX,XX @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
-     TCGv t0;
-     REQUIRE_FPU;
--    REQUIRE_ZFHMIN(ctx);
-+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
-     decode_save_opc(ctx);
-     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
-     TCGv t0;
-     REQUIRE_FPU;
--    REQUIRE_ZFHMIN(ctx);
-+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
-     decode_save_opc(ctx);
-     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
- static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_ZFHMIN(ctx);
-+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
-     TCGv dest = dest_gpr(ctx, a->rd);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
- static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_ZFHMIN(ctx);
-+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
-     TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
---
-.40.1

-[PULL 27/54] target/riscv: Add support for Zvfbfmin extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add trans_* and helper function for Zvfbfmin instructions.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/helper.h                      |  3 +
- target/riscv/insn32.decode                 |  4 ++
- target/riscv/vector_helper.c               |  6 ++
- target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
-files changed, 77 insertions(+)
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
-+++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
- /* BF16 functions */
- DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
- DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
-+
-+DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
-+DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
- # *** Zfbfmin Standard Extension ***
- fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
- fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
-+
-+# *** Zvfbfmin Standard Extension ***
-+vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
-+vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
- GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
- GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
-+RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
-+GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
-+
- /* Narrowing Floating-Point/Integer Type-Convert Instructions */
- /* (TD, T2, TX2) */
- #define NOP_UU_B uint8_t,  uint16_t, uint32_t
-@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
- GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
- GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
-+RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
-+GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
-+
- /*
-  * Vector Reduction Operations
-  */
-diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvbf16.c.inc
-+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
-@@ -XXX,XX +XXX,XX @@
-     } \
- } while (0)
-+#define REQUIRE_ZVFBFMIN(ctx) do { \
-+    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
-+        return false; \
-+    } \
-+} while (0)
-+
- static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
- {
-     REQUIRE_FPU;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
-     mark_fs_dirty(ctx);
-     return true;
- }
-+
-+static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
-+{
-+    REQUIRE_FPU;
-+    REQUIRE_ZVFBFMIN(ctx);
-+
-+    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
-+        uint32_t data = 0;
-+        TCGLabel *over = gen_new_label();
-+
-+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
-+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+
-+        data = FIELD_DP32(data, VDATA, VM, a->vm);
-+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
-+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
-+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
-+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
-+                           vreg_ofs(ctx, a->rs2), cpu_env,
-+                           ctx->cfg_ptr->vlen / 8,
-+                           ctx->cfg_ptr->vlen / 8, data,
-+                           gen_helper_vfncvtbf16_f_f_w);
-+        mark_vs_dirty(ctx);
-+        gen_set_label(over);
-+        return true;
-+    }
-+    return false;
-+}
-+
-+static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
-+{
-+    REQUIRE_FPU;
-+    REQUIRE_ZVFBFMIN(ctx);
-+
-+    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
-+        uint32_t data = 0;
-+        TCGLabel *over = gen_new_label();
-+
-+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
-+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+
-+        data = FIELD_DP32(data, VDATA, VM, a->vm);
-+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
-+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
-+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
-+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
-+                           vreg_ofs(ctx, a->rs2), cpu_env,
-+                           ctx->cfg_ptr->vlen / 8,
-+                           ctx->cfg_ptr->vlen / 8, data,
-+                           gen_helper_vfwcvtbf16_f_f_v);
-+        mark_vs_dirty(ctx);
-+        gen_set_label(over);
-+        return true;
-+    }
-+    return false;
-+}
---
-.40.1

-[PULL 29/54] target/riscv: Expose properties for BF16 extensions
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 7 +++++++
-file changed, 7 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-+    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
-     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
-     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
-     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-+    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
-+    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
-     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
-     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
-     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
-     DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
-+    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
-+    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
-+    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
-+
-     DEFINE_PROP_END_OF_LIST(),
- };
---
-.40.1

-[PULL 37/54] target/riscv/cpu.c: restrict 'mvendorid' value
+[PULL 23/28] target/riscv: Remove experimental prefix from "B" extension
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Rob Bradford <rbradford@rivosinc.com>
-We're going to change the handling of mvendorid/marchid/mimpid by the
+This extension has now been ratified:
-KVM driver. Since these are always present in all CPUs let's put the
+https://jira.riscv.org/browse/RVS-2006 so the "x-" prefix can be
-same validation for everyone.
+removed.
-It doesn't make sense to allow 'mvendorid' to be different than it
+Since this is now a ratified extension add it to the list of extensions
-is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
+included in the "max" CPU variant.
 any 'mvendorid' they want.
-Change 'mvendorid' to be a class property created via
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
 'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
 macro. This allow us to define a custom setter for it that will verify,
 for named CPUs, if mvendorid is different than it is already set by the
 CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
 set to an invalid value:
 $ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
 qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
     Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-ID: <20240514110217.22516-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
+ target/riscv/cpu.c         | 2 +-
-file changed, 37 insertions(+), 1 deletion(-)
+ target/riscv/tcg/tcg-cpu.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
- static Property riscv_cpu_properties[] = {
+     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
-     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
+     MISA_EXT_INFO(RVV, "v", "Vector operations"),
+     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
--    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
+-    MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
-     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
++    MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
      DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
  #endif /* !CONFIG_USER_ONLY */
  };
-+static bool riscv_cpu_is_dynamic(Object *cpu_obj)
+ static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
-+{
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/target/riscv/tcg/tcg-cpu.c
-+
++++ b/target/riscv/tcg/tcg-cpu.c
-+static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
-+                              void *opaque, Error **errp)
+     const RISCVCPUMultiExtConfig *prop;
-+{
-+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+     /* Enable RVG, RVJ and RVV that are disabled by default */
-+    RISCVCPU *cpu = RISCV_CPU(obj);
+-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVG | RVJ | RVV);
-+    uint32_t prev_val = cpu->cfg.mvendorid;
++    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
-+    uint32_t value;
-+
+     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
-+    if (!visit_type_uint32(v, name, &value, errp)) {
+         isa_ext_update_enabled(cpu, prop->offset, true);
 +        return;
 +    }
 +
 +    if (!dynamic_cpu && prev_val != value) {
 +        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
 +                   object_get_typename(obj), prev_val);
 +        return;
 +    }
 +
 +    cpu->cfg.mvendorid = value;
 +}
 +
 +static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
 +                              void *opaque, Error **errp)
 +{
 +    bool value = RISCV_CPU(obj)->cfg.mvendorid;
 +
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
      cc->tcg_ops = &riscv_tcg_ops;
 +    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
 +                              cpu_set_mvendorid, NULL, NULL);
 +
      device_class_set_props(dc, riscv_cpu_properties);
  }
 --
-.40.1
+.45.1

-[PULL 51/54] target/riscv: update multi-letter extension KVM properties
+[PULL 24/28] target/riscv: rvzicbo: Fixup CBO extension register calculation
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Alistair Francis <alistair23@gmail.com>
-We're now ready to update the multi-letter extensions status for KVM.
+When running the instruction
-kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
+```
-time to verify which user options changes host defaults (via the 'user_set'
+    cbo.flush 0(x0)
-flag) and tries to write them back to KVM.
+```
-Failure to commit a change to KVM is only ignored in case KVM doesn't
+QEMU would segfault.
 know about the extension (-EINVAL error code) and the user wanted to
 disable the given extension. Otherwise we're going to abort the boot
 process.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+The issue was in cpu_gpr[a->rs1] as QEMU does not have cpu_gpr[0]
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+allocated.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
+In order to fix this let's use the existing get_address()
 helper. This also has the benefit of performing pointer mask
 calculations on the address specified in rs1.
 The pointer masking specificiation specifically states:
 """
 Cache Management Operations: All instructions in Zicbom, Zicbop and Zicboz
 """
 So this is the correct behaviour and we previously have been incorrectly
 not masking the address.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reported-by: Fabian Thomas <fabian.thomas@cispa.de>
 Fixes: e05da09b7cfd ("target/riscv: implement Zicbom extension")
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240514023910.301766-1-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzicbo.c.inc | 16 ++++++++++++----
-file changed, 27 insertions(+)
+file changed, 12 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/insn_trans/trans_rvzicbo.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/insn_trans/trans_rvzicbo.c.inc
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/insn_trans/trans_rvzicbo.c.inc
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@
-     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+ static bool trans_cbo_clean(DisasContext *ctx, arg_cbo_clean *a)
  {
      REQUIRE_ZICBOM(ctx);
 -    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
 +    TCGv src = get_address(ctx, a->rs1, 0);
 +
 +    gen_helper_cbo_clean_flush(tcg_env, src);
      return true;
  }
-+static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
+ static bool trans_cbo_flush(DisasContext *ctx, arg_cbo_flush *a)
-+{
+ {
-+    CPURISCVState *env = &cpu->env;
+     REQUIRE_ZICBOM(ctx);
-+    uint64_t id, reg;
+-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
-+    int i, ret;
++    TCGv src = get_address(ctx, a->rs1, 0);
 +
-+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
++    gen_helper_cbo_clean_flush(tcg_env, src);
-+        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
+     return true;
  }
  static bool trans_cbo_inval(DisasContext *ctx, arg_cbo_inval *a)
  {
      REQUIRE_ZICBOM(ctx);
 -    gen_helper_cbo_inval(tcg_env, cpu_gpr[a->rs1]);
 +    TCGv src = get_address(ctx, a->rs1, 0);
 +
-+        if (!multi_ext_cfg->user_set) {
++    gen_helper_cbo_inval(tcg_env, src);
-+            continue;
+     return true;
-+        }
+ }
  static bool trans_cbo_zero(DisasContext *ctx, arg_cbo_zero *a)
  {
      REQUIRE_ZICBOZ(ctx);
 -    gen_helper_cbo_zero(tcg_env, cpu_gpr[a->rs1]);
 +    TCGv src = get_address(ctx, a->rs1, 0);
 +
-+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
++    gen_helper_cbo_zero(tcg_env, src);
-+                              multi_ext_cfg->kvm_reg_id);
+     return true;
 +        reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
 +        ret = kvm_set_one_reg(cs, id, &reg);
 +        if (ret != 0) {
 +            error_report("Unable to %s extension %s in KVM, error %d",
 +                         reg ? "enable" : "disable",
 +                         multi_ext_cfg->name, ret);
 +            exit(EXIT_FAILURE);
 +        }
 +    }
 +}
 +
  static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
  {
      int i;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      }
      kvm_riscv_update_cpu_misa_ext(cpu, cs);
 +    kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
      return ret;
  }
 --
-.40.1
+.45.1

-[PULL 39/54] target/riscv/cpu.c: restrict 'marchid' value
+[PULL 25/28] target/riscv/kvm.c: Fix the hart bit setting of AIA
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-'marchid' shouldn't be set to a different value as previously set for
+In AIA spec, each hart (or each hart within a group) has a unique hart
-named CPUs.
+number to locate the memory pages of interrupt files in the address
 space. The number of bits required to represent any hart number is equal
 to ceil(log2(hmax + 1)), where hmax is the largest hart number among
 groups.
-For all other CPUs it shouldn't be freely set either - the spec requires
+However, if the largest hart number among groups is a power of 2, QEMU
-that 'marchid' can't have the MSB (most significant bit) set and every
+will pass an inaccurate hart-index-bit setting to Linux. For example, when
-other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
+the guest OS has 4 harts, only ceil(log2(3 + 1)) = 2 bits are sufficient
-bit CPUs.
+to represent 4 harts, but we passes 3 to Linux. The code needs to be
 updated to ensure accurate hart-index-bit settings.
-As with 'mimpid', setting a default value based on the current QEMU
+Additionally, a Linux patch[1] is necessary to correctly recover the hart
-version is not a good idea because it implies that the CPU
+index when the guest OS has only 1 hart, where the hart-index-bit is 0.
 implementation changes from one QEMU version to the other. Named CPUs
 should set 'marchid' to a meaningful value instead, and generic CPUs can
 set to any valid value.
-For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
+[1] https://lore.kernel.org/lkml/20240415064905.25184-1-yongxuan.wang@sifive.com/t/
 a different val:
-$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
 qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
     Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)
 And, for generics CPUs, this is the error when trying to set to an
 invalid val:
 $ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
 qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
     Unable to set marchid with MSB (64) bit set and the remaining bits zero
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
+Message-ID: <20240515091129.28116-1-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
+ target/riscv/kvm/kvm-cpu.c | 9 ++++++++-
-file changed, 53 insertions(+), 7 deletions(-)
+file changed, 8 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
- #include "tcg/tcg.h"
+         }
+     }
- /* RISC-V CPU definitions */
--
+-    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
 -#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
 -                             (QEMU_VERSION_MINOR << 8)  | \
 -                             (QEMU_VERSION_MICRO))
 -
  static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
  struct isa_ext_data {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
  static Property riscv_cpu_properties[] = {
      DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 -    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
 -
  #ifndef CONFIG_USER_ONLY
      DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
  #endif
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
      visit_type_bool(v, name, &value, errp);
  }
 +static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
 +                            void *opaque, Error **errp)
 +{
 +    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    uint64_t prev_val = cpu->cfg.marchid;
 +    uint64_t value, invalid_val;
 +    uint32_t mxlen = 0;
 +
-+    if (!visit_type_uint64(v, name, &value, errp)) {
++    if (max_hart_per_socket > 1) {
-+        return;
++        max_hart_per_socket--;
 +        hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
 +    } else {
 +        hart_bits = 0;
 +    }
 +
-+    if (!dynamic_cpu && prev_val != value) {
+     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
+                             KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
-+                   object_get_typename(obj), prev_val);
+                             &hart_bits, true, NULL);
 +        return;
 +    }
 +
 +    switch (riscv_cpu_mxl(&cpu->env)) {
 +    case MXL_RV32:
 +        mxlen = 32;
 +        break;
 +    case MXL_RV64:
 +    case MXL_RV128:
 +        mxlen = 64;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    invalid_val = 1LL << (mxlen - 1);
 +
 +    if (value == invalid_val) {
 +        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
 +                         "and the remaining bits zero", mxlen);
 +        return;
 +    }
 +
 +    cpu->cfg.marchid = value;
 +}
 +
 +static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
 +                           void *opaque, Error **errp)
 +{
 +    bool value = RISCV_CPU(obj)->cfg.marchid;
 +
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
                                cpu_set_mimpid, NULL, NULL);
 +    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
 +                              cpu_set_marchid, NULL, NULL);
 +
      device_class_set_props(dc, riscv_cpu_properties);
  }
 --
-.40.1
+.45.1

-[PULL 36/54] hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
+[PULL 26/28] riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The absence of a satp mode in riscv_host_cpu_init() is causing the
+Commit 33a24910ae changed 'reg_width' to use 'vlenb', i.e. vector length
-following error:
+in bytes, when in this context we want 'reg_width' as the length in
 bits.
-$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
+Fix 'reg_width' back to the value in bits like 7cb59921c05a
-    -m 2G -smp 1  -nographic -snapshot \
+("target/riscv/gdbstub.c: use 'vlenb' instead of shifting 'vlen'") set
-    -kernel ./guest_imgs/Image \
+beforehand.
     -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
     -append "earlycon=sbi root=/dev/ram rw" \
     -cpu host
 **
 ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
 reached
 Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
 not be reached
 Aborted
-The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
+While we're at it, rename 'reg_width' to 'bitsize' to provide a bit more
-It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.
+clarity about what the variable represents. 'bitsize' is also used in
 riscv_gen_dynamic_csr_feature() with the same purpose, i.e. as an input to
 gdb_feature_builder_append_reg().
-For this KVM cpu we would need to inherit the satp supported modes
+Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
-from the RISC-V host. At this moment this is not possible because the
+Cc: Alex Bennée <alex.bennee@linaro.org>
-KVM driver does not support it. And even when it does we can't just let
+Reported-by: Robin Dapp <rdapp.gcc@gmail.com>
-this broken for every other older kernel.
+Fixes: 33a24910ae ("target/riscv: Use GDBFeature for dynamic XML")
 Since mmu-type is not a required node, according to [1], skip the
 'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
 logic when we can get satp information from KVM.
 [1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
+Message-ID: <20240517203054.880861-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 14 +++++++-------
+ target/riscv/gdbstub.c | 6 +++---
-file changed, 7 insertions(+), 7 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/gdbstub.c
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
-             s->soc[socket].hartid_base + cpu);
+ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
-         qemu_fdt_add_subnode(ms->fdt, cpu_name);
+ {
+     RISCVCPU *cpu = RISCV_CPU(cs);
--        satp_mode_max = satp_mode_max_from_map(
+-    int reg_width = cpu->cfg.vlenb;
--            s->soc[socket].harts[cpu].cfg.satp_mode.map);
++    int bitsize = cpu->cfg.vlenb << 3;
--        sv_name = g_strdup_printf("riscv,%s",
+     GDBFeatureBuilder builder;
--                                  satp_mode_str(satp_mode_max, is_32_bit));
+     int i;
--        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
--        g_free(sv_name);
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
--
-+        if (cpu_ptr->cfg.satp_mode.supported != 0) {
+     /* First define types and totals in a whole VL */
-+            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
+     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-+            sv_name = g_strdup_printf("riscv,%s",
+-        int count = reg_width / vec_lanes[i].size;
-+                                      satp_mode_str(satp_mode_max, is_32_bit));
++        int count = bitsize / vec_lanes[i].size;
-+            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+         gdb_feature_builder_append_tag(
-+            g_free(sv_name);
+             &builder, "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
-+        }
+             vec_lanes[i].id, vec_lanes[i].gdb_type, count);
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
-         name = riscv_isa_string(cpu_ptr);
+     /* Define vector registers */
-         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);
+     for (i = 0; i < 32; i++) {
          gdb_feature_builder_append_reg(&builder, g_strdup_printf("v%d", i),
 -                                       reg_width, i, "riscv_vector", "vector");
 +                                       bitsize, i, "riscv_vector", "vector");
      }
      gdb_feature_builder_end(&builder);
 --
-.40.1
+.45.1

-[PULL 31/54] target/riscv: Add disas support for BF16 extensions
+[PULL 27/28] disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Alistair Francis <alistair23@gmail.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Previously we only listed a single pmpcfg CSR and the first 16 pmpaddr
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+CSRs. This patch fixes this to list all 16 pmpcfg and all 64 pmpaddr
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+CSRs are part of the disassembly.
-Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
 Reported-by: Eric DeVolder <eric_devolder@yahoo.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Fixes: ea10325917 ("RISC-V Disassembler")
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240514051615.330979-1-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ disas/riscv.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++-
-file changed, 44 insertions(+)
+file changed, 64 insertions(+), 1 deletion(-)
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
-     rv_op_cm_jalt = 788,
+     case 0x0383: return "mibound";
-     rv_op_czero_eqz = 789,
+     case 0x0384: return "mdbase";
-     rv_op_czero_nez = 790,
+     case 0x0385: return "mdbound";
-+    rv_op_fcvt_bf16_s = 791,
+-    case 0x03a0: return "pmpcfg3";
-+    rv_op_fcvt_s_bf16 = 792,
++    case 0x03a0: return "pmpcfg0";
-+    rv_op_vfncvtbf16_f_f_w = 793,
++    case 0x03a1: return "pmpcfg1";
-+    rv_op_vfwcvtbf16_f_f_v = 794,
++    case 0x03a2: return "pmpcfg2";
-+    rv_op_vfwmaccbf16_vv = 795,
++    case 0x03a3: return "pmpcfg3";
-+    rv_op_vfwmaccbf16_vf = 796,
++    case 0x03a4: return "pmpcfg4";
-+    rv_op_flh = 797,
++    case 0x03a5: return "pmpcfg5";
-+    rv_op_fsh = 798,
++    case 0x03a6: return "pmpcfg6";
-+    rv_op_fmv_h_x = 799,
++    case 0x03a7: return "pmpcfg7";
-+    rv_op_fmv_x_h = 800,
++    case 0x03a8: return "pmpcfg8";
- } rv_op;
++    case 0x03a9: return "pmpcfg9";
++    case 0x03aa: return "pmpcfg10";
- /* register names */
++    case 0x03ab: return "pmpcfg11";
-@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
++    case 0x03ac: return "pmpcfg12";
-     { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
++    case 0x03ad: return "pmpcfg13";
-     { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
++    case 0x03ae: return "pmpcfg14";
-     { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
++    case 0x03af: return "pmpcfg15";
-+    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+     case 0x03b0: return "pmpaddr0";
-+    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+     case 0x03b1: return "pmpaddr1";
-+    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+     case 0x03b2: return "pmpaddr2";
-+    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
-+    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
+     case 0x03bd: return "pmpaddr13";
-+    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
+     case 0x03be: return "pmpaddr14";
-+    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
+     case 0x03bf: return "pmpaddr15";
-+    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
++    case 0x03c0: return "pmpaddr16";
-+    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
++    case 0x03c1: return "pmpaddr17";
-+    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
++    case 0x03c2: return "pmpaddr18";
- };
++    case 0x03c3: return "pmpaddr19";
++    case 0x03c4: return "pmpaddr20";
- /* CSR names */
++    case 0x03c5: return "pmpaddr21";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03c6: return "pmpaddr22";
-                 case 3: op = rv_op_vloxei8_v; break;
++    case 0x03c7: return "pmpaddr23";
-                 }
++    case 0x03c8: return "pmpaddr24";
-                 break;
++    case 0x03c9: return "pmpaddr25";
-+            case 1: op = rv_op_flh; break;
++    case 0x03ca: return "pmpaddr26";
-             case 2: op = rv_op_flw; break;
++    case 0x03cb: return "pmpaddr27";
-             case 3: op = rv_op_fld; break;
++    case 0x03cc: return "pmpaddr28";
-             case 4: op = rv_op_flq; break;
++    case 0x03cd: return "pmpaddr29";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03ce: return "pmpaddr30";
-                 case 3: op = rv_op_vsoxei8_v; break;
++    case 0x03cf: return "pmpaddr31";
-                 }
++    case 0x03d0: return "pmpaddr32";
-                 break;
++    case 0x03d1: return "pmpaddr33";
-+            case 1: op = rv_op_fsh; break;
++    case 0x03d2: return "pmpaddr34";
-             case 2: op = rv_op_fsw; break;
++    case 0x03d3: return "pmpaddr35";
-             case 3: op = rv_op_fsd; break;
++    case 0x03d4: return "pmpaddr36";
-             case 4: op = rv_op_fsq; break;
++    case 0x03d5: return "pmpaddr37";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03d6: return "pmpaddr38";
-                 switch ((inst >> 20) & 0b11111) {
++    case 0x03d7: return "pmpaddr39";
-                 case 1: op = rv_op_fcvt_s_d; break;
++    case 0x03d8: return "pmpaddr40";
-                 case 3: op = rv_op_fcvt_s_q; break;
++    case 0x03d9: return "pmpaddr41";
-+                case 6: op = rv_op_fcvt_s_bf16; break;
++    case 0x03da: return "pmpaddr42";
-                 }
++    case 0x03db: return "pmpaddr43";
-                 break;
++    case 0x03dc: return "pmpaddr44";
-             case 33:
++    case 0x03dd: return "pmpaddr45";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03de: return "pmpaddr46";
-                 case 3: op = rv_op_fcvt_d_q; break;
++    case 0x03df: return "pmpaddr47";
-                 }
++    case 0x03e0: return "pmpaddr48";
-                 break;
++    case 0x03e1: return "pmpaddr49";
-+            case 34:
++    case 0x03e2: return "pmpaddr50";
-+                switch (((inst >> 20) & 0b11111)) {
++    case 0x03e3: return "pmpaddr51";
-+                case 8: op = rv_op_fcvt_bf16_s; break;
++    case 0x03e4: return "pmpaddr52";
-+                }
++    case 0x03e5: return "pmpaddr53";
-+                break;
++    case 0x03e6: return "pmpaddr54";
-             case 35:
++    case 0x03e7: return "pmpaddr55";
-                 switch ((inst >> 20) & 0b11111) {
++    case 0x03e8: return "pmpaddr56";
-                 case 0: op = rv_op_fcvt_q_s; break;
++    case 0x03e9: return "pmpaddr57";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
++    case 0x03ea: return "pmpaddr58";
-                 case 1: op = rv_op_fclass_d; break;
++    case 0x03eb: return "pmpaddr59";
-                 }
++    case 0x03ec: return "pmpaddr60";
-                 break;
++    case 0x03ed: return "pmpaddr61";
-+            case 114:
++    case 0x03ee: return "pmpaddr62";
-+                switch (((inst >> 17) & 0b11111000) |
++    case 0x03ef: return "pmpaddr63";
-+                        ((inst >> 12) & 0b00000111)) {
+     case 0x0780: return "mtohost";
-+                case 0: op = rv_op_fmv_x_h; break;
+     case 0x0781: return "mfromhost";
-+                }
+     case 0x0782: return "mreset";
 +                break;
              case 115:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fmv_d_x; break;
                  }
                  break;
 +            case 122:
 +                switch (((inst >> 17) & 0b11111000) |
 +                        ((inst >> 12) & 0b00000111)) {
 +                case 0: op = rv_op_fmv_h_x; break;
 +                }
 +                break;
              case 123:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                      case 10: op = rv_op_vfwcvt_f_xu_v; break;
                      case 11: op = rv_op_vfwcvt_f_x_v; break;
                      case 12: op = rv_op_vfwcvt_f_f_v; break;
 +                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
                      case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
                      case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
                      case 16: op = rv_op_vfncvt_xu_f_w; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                      case 21: op = rv_op_vfncvt_rod_f_f_w; break;
                      case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
                      case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
 +                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
                      }
                      break;
                  case 19:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 52: op = rv_op_vfwadd_wv; break;
                  case 54: op = rv_op_vfwsub_wv; break;
                  case 56: op = rv_op_vfwmul_vv; break;
 +                case 59: op = rv_op_vfwmaccbf16_vv; break;
                  case 60: op = rv_op_vfwmacc_vv; break;
                  case 61: op = rv_op_vfwnmacc_vv; break;
                  case 62: op = rv_op_vfwmsac_vv; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 52: op = rv_op_vfwadd_wf; break;
                  case 54: op = rv_op_vfwsub_wf; break;
                  case 56: op = rv_op_vfwmul_vf; break;
 +                case 59: op = rv_op_vfwmaccbf16_vf; break;
                  case 60: op = rv_op_vfwmacc_vf; break;
                  case 61: op = rv_op_vfwnmacc_vf; break;
                  case 62: op = rv_op_vfwmsac_vf; break;
 --
-.40.1
+.45.1

-[PULL 32/54] target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly
+Deleted patch
-From: "yang.zhang" <yang.zhang@hexintek.com>
-Should set/get riscv all reg timer,i.e, time/compare/frequency/state.
-Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
-+++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
- #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
-     do { \
--        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
-+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
-         if (ret) { \
-             abort(); \
-         } \
---
-.40.1

-[PULL 34/54] hw/riscv: virt: Convert fdt_load_addr to uint64_t
+Deleted patch
-From: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
-fdt_load_addr was previously declared as uint32_t which doe not match
-with the return type of riscv_compute_fdt_addr().
-This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
-to match the riscv_compute_fdt_addr() return type.
-This fixes calculating the fdt address when DRAM is mapped to higher
--bit address.
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
-[ Change by AF:
- - Cleanup commit title and message
-]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
-     target_ulong start_addr = memmap[VIRT_DRAM].base;
-     target_ulong firmware_end_addr, kernel_start_addr;
-     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
--    uint32_t fdt_load_addr;
-+    uint64_t fdt_load_addr;
-     uint64_t kernel_entry = 0;
-     BlockBackend *pflash_blk0;
---
-.40.1

-[PULL 35/54] target/riscv: skip features setup for KVM CPUs
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-As it is today it's not possible to use '-cpu host' if the RISC-V host
-has RVH enabled. This is the resulting error:
-$ ./qemu/build/qemu-system-riscv64 \
-    -machine virt,accel=kvm -m 2G -smp 1 \
-    -nographic -snapshot -kernel ./guest_imgs/Image  \
-    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
-    -append "earlycon=sbi root=/dev/ram rw" \
-    -cpu host
-qemu-system-riscv64: H extension requires priv spec 1.12.0
-This happens because we're checking for priv spec for all CPUs, and
-since we're not setting  env->priv_ver for the 'host' CPU, it's being
-default to zero (i.e. PRIV_SPEC_1_10_0).
-In reality env->priv_ver does not make sense when running with the KVM
-'host' CPU. It's used to gate certain CSRs/extensions during translation
-to make them unavailable if the hart declares an older spec version. It
-doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
-checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
-are available [1].
-'priv_ver' is just one example. We're doing a lot of feature validation
-and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
-Validating the feature set for those CPUs is a KVM problem that should
-be handled in KVM specific code.
-The new riscv_cpu_realize_tcg() helper contains all validation logic that
-are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
-running TCG and, if it's the case, proceed with the usual TCG realize()
-logic.
-[1] lib/sbi/sbi_hart.c, hart_detect_features()
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
-file changed, 25 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #include "migration/vmstate.h"
- #include "fpu/softfloat-helpers.h"
- #include "sysemu/kvm.h"
-+#include "sysemu/tcg.h"
- #include "kvm_riscv.h"
- #include "tcg/tcg.h"
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
-     }
- }
--static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-+static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
- {
--    CPUState *cs = CPU(dev);
-     RISCVCPU *cpu = RISCV_CPU(dev);
-     CPURISCVState *env = &cpu->env;
--    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
-     Error *local_err = NULL;
--    cpu_exec_realizefn(cs, &local_err);
--    if (local_err != NULL) {
--        error_propagate(errp, local_err);
--        return;
--    }
--
-     riscv_cpu_validate_misa_mxl(cpu, &local_err);
-     if (local_err != NULL) {
-         error_propagate(errp, local_err);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-     }
- #ifndef CONFIG_USER_ONLY
--    cs->tcg_cflags |= CF_PCREL;
-+    CPU(dev)->tcg_cflags |= CF_PCREL;
-     if (cpu->cfg.ext_sstc) {
-         riscv_timer_init(cpu);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-         }
-      }
- #endif
-+}
-+
-+static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-+{
-+    CPUState *cs = CPU(dev);
-+    RISCVCPU *cpu = RISCV_CPU(dev);
-+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
-+    Error *local_err = NULL;
-+
-+    cpu_exec_realizefn(cs, &local_err);
-+    if (local_err != NULL) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+
-+    if (tcg_enabled()) {
-+        riscv_cpu_realize_tcg(dev, &local_err);
-+        if (local_err != NULL) {
-+            error_propagate(errp, local_err);
-+            return;
-+        }
-+    }
-     riscv_cpu_finalize_features(cpu, &local_err);
-     if (local_err != NULL) {
---
-.40.1

-[PULL 38/54] target/riscv/cpu.c: restrict 'mimpid' value
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Following the same logic used with 'mvendorid' let's also restrict
-'mimpid' for named CPUs. Generic CPUs keep setting the value freely.
-Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
-reason is that this is not a good default since it's dynamic, changing
-with with every QEMU version, regardless of whether the actual
-implementation of the CPU changed from one QEMU version to the other.
-Named CPU should set it to a meaningful value instead and generic CPUs
-can set whatever they want.
-This is the error thrown for an invalid 'mimpid' value for the veyron-v1
-CPU:
-$ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
-qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
-    Unable to change veyron-v1-riscv-cpu mimpid (0x111)
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
-file changed, 32 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
-                              (QEMU_VERSION_MINOR << 8)  | \
-                              (QEMU_VERSION_MICRO))
--#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
- static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
-     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
-     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
--    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
- #ifndef CONFIG_USER_ONLY
-     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
-@@ -XXX,XX +XXX,XX @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
-     visit_type_bool(v, name, &value, errp);
- }
-+static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
-+                           void *opaque, Error **errp)
-+{
-+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
-+    RISCVCPU *cpu = RISCV_CPU(obj);
-+    uint64_t prev_val = cpu->cfg.mimpid;
-+    uint64_t value;
-+
-+    if (!visit_type_uint64(v, name, &value, errp)) {
-+        return;
-+    }
-+
-+    if (!dynamic_cpu && prev_val != value) {
-+        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
-+                   object_get_typename(obj), prev_val);
-+        return;
-+    }
-+
-+    cpu->cfg.mimpid = value;
-+}
-+
-+static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
-+                           void *opaque, Error **errp)
-+{
-+    bool value = RISCV_CPU(obj)->cfg.mimpid;
-+
-+    visit_type_bool(v, name, &value, errp);
-+}
-+
- static void riscv_cpu_class_init(ObjectClass *c, void *data)
- {
-     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
-                               cpu_set_mvendorid, NULL, NULL);
-+    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
-+                              cpu_set_mimpid, NULL, NULL);
-+
-     device_class_set_props(dc, riscv_cpu_properties);
- }
---
-.40.1

-[PULL 42/54] target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
+[PULL 28/28] target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yu-Ming Chang <yumin686@andestech.com>
-After changing user validation for mvendorid/marchid/mimpid to guarantee
+Both CSRRS and CSRRC always read the addressed CSR and cause any read side
-that the value is validated on user input time, coupled with the work in
+effects regardless of rs1 and rd fields. Note that if rs1 specifies a register
-fetching KVM default values for them by using a scratch CPU, we're
+holding a zero value other than x0, the instruction will still attempt to write
-certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
+the unmodified value back to the CSR and will cause any attendant side effects.
 already good to be written back to KVM.
-There's no need to write the values back for 'host' type CPUs since the
+So if CSRRS or CSRRC tries to write a read-only CSR with rs1 which specifies
-values can't be changed, so let's do that just for generic CPUs.
+a register holding a zero value, an illegal instruction exception should be
 raised.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20240403070823.80897-1-yumin686@andestech.com>
 Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
+ target/riscv/cpu.h       |  4 ++++
-file changed, 31 insertions(+)
+ target/riscv/csr.c       | 51 ++++++++++++++++++++++++++++++++++++----
  target/riscv/op_helper.c |  6 ++---
 files changed, 53 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/cpu.h
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
  void riscv_cpu_update_mask(CPURISCVState *env);
  bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 +RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 +                          target_ulong *ret_value);
  RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                             target_ulong *ret_value,
                             target_ulong new_value, target_ulong write_mask);
@@ -XXX,XX +XXX,XX @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
                                            target_ulong new_value,
                                            target_ulong write_mask);
 +RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
 +                               Int128 *ret_value);
  RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                  Int128 *ret_value,
                                  Int128 new_value, Int128 write_mask);
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
  static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                 int csrno,
 -                                               bool write_mask)
 +                                               bool write)
  {
+     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
+     bool read_only = get_field(csrno, 0xC00) == 3;
+@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
+     }
+     /* read / write check */
+-    if (write_mask && read_only) {
++    if (write && read_only) {
+         return RISCV_EXCP_ILLEGAL_INST;
+     }
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
+     return RISCV_EXCP_NONE;
  }
-+static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
++RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 +                           target_ulong *ret_value)
 +{
-+    CPURISCVState *env = &cpu->env;
++    RISCVException ret = riscv_csrrw_check(env, csrno, false);
-+    uint64_t id;
++    if (ret != RISCV_EXCP_NONE) {
 +    int ret;
 +
 +    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 +                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
 +    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
 +    if (ret != 0) {
 +        return ret;
 +    }
 +
-+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
-+                          KVM_REG_RISCV_CONFIG_REG(marchid));
++}
-+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
++
-+    if (ret != 0) {
+ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                             target_ulong *ret_value,
                             target_ulong new_value, target_ulong write_mask)
  {
 -    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
 +    RISCVException ret = riscv_csrrw_check(env, csrno, true);
      if (ret != RISCV_EXCP_NONE) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
 +                               Int128 *ret_value)
 +{
 +    RISCVException ret;
 +
 +    ret = riscv_csrrw_check(env, csrno, false);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
-+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    if (csr_ops[csrno].read128) {
-+                          KVM_REG_RISCV_CONFIG_REG(mimpid));
++        return riscv_csrrw_do128(env, csrno, ret_value,
-+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
++                                 int128_zero(), int128_zero());
 +    }
 +
++    /*
++     * Fall back to 64-bit version for now, if the 128-bit alternative isn't
++     * at all defined.
++     * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
++     * significant), for those, this fallback is correctly handling the
++     * accesses
++     */
++    target_ulong old_value;
++    ret = riscv_csrrw_do64(env, csrno, &old_value,
++                           (target_ulong)0,
++                           (target_ulong)0);
++    if (ret == RISCV_EXCP_NONE && ret_value) {
++        *ret_value = int128_make64(old_value);
++    }
 +    return ret;
 +}
 +
- int kvm_arch_init_vcpu(CPUState *cs)
+ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                  Int128 *ret_value,
                                  Int128 new_value, Int128 write_mask)
  {
-     int ret = 0;
+     RISCVException ret;
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
 -    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
 +    ret = riscv_csrrw_check(env, csrno, true);
      if (ret != RISCV_EXCP_NONE) {
          return ret;
      }
-     env->misa_ext = isa;
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+index XXXXXXX..XXXXXXX 100644
-+    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+--- a/target/riscv/op_helper.c
-+        ret = kvm_vcpu_set_machine_ids(cpu, cs);
++++ b/target/riscv/op_helper.c
-+    }
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
-+
+     }
-     return ret;
- }
+     target_ulong val = 0;
+-    RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
 +    RISCVException ret = riscv_csrr(env, csr, &val);
      if (ret != RISCV_EXCP_NONE) {
          riscv_raise_exception(env, ret, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
  target_ulong helper_csrr_i128(CPURISCVState *env, int csr)
  {
      Int128 rv = int128_zero();
 -    RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
 -                                          int128_zero(),
 -                                          int128_zero());
 +    RISCVException ret = riscv_csrr_i128(env, csr, &rv);
      if (ret != RISCV_EXCP_NONE) {
          riscv_raise_exception(env, ret, GETPC());
 --
-.40.1
+.45.1

-[PULL 49/54] target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-riscv_isa_string_ext() is being used by riscv_isa_string(), which is
-then used by boards to retrieve the 'riscv,isa' string to be written in
-the FDT. All this happens after riscv_cpu_realize(), meaning that we're
-already past riscv_cpu_validate_set_extensions() and, more important,
-riscv_cpu_disable_priv_spec_isa_exts().
-This means that all extensions that needed to be disabled due to
-priv_spec mismatch are already disabled. Checking this again during
-riscv_isa_string_ext() is unneeded. Remove it.
-As a bonus, riscv_isa_string_ext() can now be used with the 'host'
-KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
-would fail this check for no good reason.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
-     int i;
-     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
--        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
--            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
-+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
-             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
-             g_free(old);
-             old = new;
---
-.40.1

The following changes since commit fcb237e64f9d026c03d635579c7b288d0008a6e5:

Merge tag 'pull-vfio-20230710' of https://github.com/legoater/qemu into staging (2023-07-10 09:17:06 +0100)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230710-1

for you to fetch changes up to a47842d16653b4f73b5d56ff0c252dd8a329481b:

riscv: Add support for the Zfa extension (2023-07-10 22:29:20 +1000)

----------------------------------------------------------------
Third RISC-V PR for 8.1

* Use xl instead of mxl for disassemble
* Factor out extension tests to cpu_cfg.h
* disas/riscv: Add vendor extension support
* disas/riscv: Add support for XVentanaCondOps
* disas/riscv: Add support for XThead* instructions
* Fix mstatus related problems
* Fix veyron-v1 CPU properties
* Fix the xlen for data address when MPRV=1
* opensbi: Upgrade from v1.2 to v1.3
* Enable 32-bit Spike OpenSBI boot testing
* Support the watchdog timer of HiFive 1 rev b
* Only build qemu-system-riscv$$ on rv$$ host
* Add RVV registers to log
* Restrict ACLINT to TCG
* Add syscall riscv_hwprobe
* Add support for BF16 extensions
* KVM_RISCV_SET_TIMER macro is not configured correctly
* Generate devicetree only after machine initialization is complete
* virt: Convert fdt_load_addr to uint64_t
* KVM: fixes and enhancements
* Add support for the Zfa extension

----------------------------------------------------------------
Bin Meng (2):
      roms/opensbi: Upgrade from v1.2 to v1.3
      tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing

Christoph Müllner (8):
      target/riscv: Factor out extension tests to cpu_cfg.h
      disas/riscv: Move types/constants to new header file
      disas/riscv: Make rv_op_illegal a shared enum value
      disas/riscv: Encapsulate opcode_data into decode
      disas/riscv: Provide infrastructure for vendor extensions
      disas/riscv: Add support for XVentanaCondOps
      disas/riscv: Add support for XThead* instructions
      riscv: Add support for the Zfa extension

Daniel Henrique Barboza (20):
      target/riscv/cpu.c: fix veyron-v1 CPU properties
      target/riscv: skip features setup for KVM CPUs
      hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
      target/riscv/cpu.c: restrict 'mvendorid' value
      target/riscv/cpu.c: restrict 'mimpid' value
      target/riscv/cpu.c: restrict 'marchid' value
      target/riscv: use KVM scratch CPUs to init KVM properties
      target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
      target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
      target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
      target/riscv/cpu: add misa_ext_info_arr[]
      target/riscv: add KVM specific MISA properties
      target/riscv/kvm.c: update KVM MISA bits
      target/riscv/kvm.c: add multi-letter extension KVM properties
      target/riscv/cpu.c: add satp_mode properties earlier
      target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
      target/riscv/cpu.c: create KVM mock properties
      target/riscv: update multi-letter extension KVM properties
      target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
      target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM

Guenter Roeck (1):
      riscv: Generate devicetree only after machine initialization is complete

Ivan Klokov (1):
      target/riscv: Add RVV registers to log

Jason Chien (1):
      target/riscv: Set the correct exception for implict G-stage translation fail

LIU Zhiwei (1):
      target/riscv: Use xl instead of mxl for disassemble

Lakshmi Bai Raja Subramanian (1):
      hw/riscv: virt: Convert fdt_load_addr to uint64_t

Philippe Mathieu-Daudé (3):
      target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
      target/riscv: Only build KVM guest with same wordsize as host
      hw/riscv/virt: Restrict ACLINT to TCG

Robbin Ehn (1):
      linux-user/riscv: Add syscall riscv_hwprobe

Tommy Wu (3):
      hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
      hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
      tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e

Weiwei Li (11):
      target/riscv: Make MPV only work when MPP != PRV_M
      target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
      target/riscv: Remove redundant assignment to SXL
      target/riscv: Add additional xlen for address when MPRV=1
      target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
      target/riscv: Add properties for BF16 extensions
      target/riscv: Add support for Zfbfmin extension
      target/riscv: Add support for Zvfbfmin extension
      target/riscv: Add support for Zvfbfwma extension
      target/riscv: Expose properties for BF16 extensions
      target/riscv: Add disas support for BF16 extensions

yang.zhang (1):
      target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly

docs/system/riscv/virt.rst                     |   1 +
 meson.build                                    |  15 +-
 disas/riscv-xthead.h                           |  28 +
 disas/riscv-xventana.h                         |  18 +
 disas/riscv.h                                  | 302 +++++++++++
 include/hw/misc/sifive_e_aon.h                 |  60 +++
 include/hw/riscv/sifive_e.h                    |   9 +-
 linux-user/riscv/syscall32_nr.h                |   1 +
 linux-user/riscv/syscall64_nr.h                |   1 +
 target/riscv/cpu.h                             |  56 +-
 target/riscv/cpu_cfg.h                         |  41 ++
 target/riscv/helper.h                          |  29 +
 target/riscv/kvm_riscv.h                       |   1 +
 target/riscv/insn32.decode                     |  38 ++
 disas/riscv-xthead.c                           | 707 +++++++++++++++++++++++++
 disas/riscv-xventana.c                         |  41 ++
 disas/riscv.c                                  | 559 +++++++++----------
 hw/misc/sifive_e_aon.c                         | 319 +++++++++++
 hw/riscv/sifive_e.c                            |  17 +-
 hw/riscv/virt.c                                |  56 +-
 linux-user/syscall.c                           | 146 +++++
 target/riscv/cpu.c                             | 439 +++++++++++++--
 target/riscv/cpu_helper.c                      |  12 +-
 target/riscv/csr.c                             |  41 +-
 target/riscv/fpu_helper.c                      | 166 ++++++
 target/riscv/kvm.c                             | 501 +++++++++++++++++-
 target/riscv/op_helper.c                       |   3 +-
 target/riscv/translate.c                       |  42 +-
 target/riscv/vector_helper.c                   |  17 +
 tests/qtest/sifive-e-aon-watchdog-test.c       | 450 ++++++++++++++++
 tests/tcg/riscv64/test-fcvtmod.c               | 345 ++++++++++++
 target/riscv/insn_trans/trans_rvbf16.c.inc     | 175 ++++++
 target/riscv/insn_trans/trans_rvzfa.c.inc      | 521 ++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc      |  12 +-
 disas/meson.build                              |   6 +-
 hw/misc/Kconfig                                |   3 +
 hw/misc/meson.build                            |   1 +
 hw/riscv/Kconfig                               |   1 +
 pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 123072 -> 135344 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 121800 -> 138304 bytes
 roms/opensbi                                   |   2 +-
 tests/avocado/riscv_opensbi.py                 |   2 -
 tests/qtest/meson.build                        |   3 +
 tests/tcg/riscv64/Makefile.target              |   6 +
 44 files changed, 4751 insertions(+), 442 deletions(-)
 create mode 100644 disas/riscv-xthead.h
 create mode 100644 disas/riscv-xventana.h
 create mode 100644 disas/riscv.h
 create mode 100644 include/hw/misc/sifive_e_aon.h
 create mode 100644 disas/riscv-xthead.c
 create mode 100644 disas/riscv-xventana.c
 create mode 100644 hw/misc/sifive_e_aon.c
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Disassemble function(plugin_disas, target_disas, monitor_disas) will
always call set_disas_info before disassembling instructions.

plugin_disas  and target_disas will always be called under a TB, which
has the same XLEN.

We can't ensure that monitor_disas will always be called under a TB,
but current XLEN will still be a better choice, thus we can ensure at
least the disassemble of the nearest one TB is right.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 {
     RISCVCPU *cpu = RISCV_CPU(s);
+    CPURISCVState *env = &cpu->env;
     info->target_info = &cpu->cfg;
 
-    switch (riscv_cpu_mxl(&cpu->env)) {
+    switch (env->xl) {
     case MXL_RV32:
         info->print_insn = print_insn_riscv32;
         break;
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch moves the extension test functions that are used
to gate vendor extension decoders, into cpu_cfg.h.
This allows to reuse them in the disassembler.

This patch does not introduce new functionality.
However, the patch includes a small change:
The parameter for the extension test functions has been changed
from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
the code in cpu_cfg.h self-contained.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
 target/riscv/translate.c | 27 ++-------------------------
 2 files changed, 28 insertions(+), 25 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
+
+/* Helper functions to test for extensions.  */
+
+static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
+{
+    return true;
+}
+
+static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
+{
+    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
+           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
+           cfg->ext_xtheadcondmov ||
+           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
+           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
+           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
+}
+
+#define MATERIALISE_EXT_PREDICATE(ext) \
+    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
+    { \
+        return cfg->ext_ ## ext ; \
+    }
+
+MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
+
 #endif
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
     return ctx->misa_ext & ext;
 }
 
-static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return true;
-}
-
-static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
-           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
-           ctx->cfg_ptr->ext_xtheadcondmov ||
-           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
-           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
-           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
-}
-
-#define MATERIALISE_EXT_PREDICATE(ext)  \
-    static bool has_ ## ext ## _p(DisasContext *ctx)    \
-    { \
-        return ctx->cfg_ptr->ext_ ## ext ; \
-    }
-
-MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
-
 #ifdef TARGET_RISCV32
 #define get_xl(ctx)    MXL_RV32
 #elif defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
      * that are tested in-order until a decoder matches onto the opcode.
      */
     static const struct {
-        bool (*guard_func)(DisasContext *);
+        bool (*guard_func)(const RISCVCPUConfig *);
         bool (*decode_func)(DisasContext *, uint32_t);
     } decoders[] = {
         { always_true_p,  decode_insn32 },
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         ctx->opcode = opcode32;
 
         for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx) &&
+            if (decoders[i].guard_func(ctx->cfg_ptr) &&
                 decoders[i].decode_func(ctx, opcode32)) {
                 return;
             }
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

In order to enable vendor disassembler support, we need to
move types and constants into a header file so that other
compilation units can use them as well.

This patch does not introduce any functional changes.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c | 270 +----------------------------------------------
 2 files changed, 283 insertions(+), 269 deletions(-)
 create mode 100644 disas/riscv.h

diff --git a/disas/riscv.h b/disas/riscv.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_H
+#define DISAS_RISCV_H
+
+#include "qemu/osdep.h"
+#include "target/riscv/cpu_cfg.h"
+
+/* types */
+
+typedef uint64_t rv_inst;
+typedef uint16_t rv_opcode;
+
+/* enums */
+
+typedef enum {
+    rv32,
+    rv64,
+    rv128
+} rv_isa;
+
+typedef enum {
+    rv_rm_rne = 0,
+    rv_rm_rtz = 1,
+    rv_rm_rdn = 2,
+    rv_rm_rup = 3,
+    rv_rm_rmm = 4,
+    rv_rm_dyn = 7,
+} rv_rm;
+
+typedef enum {
+    rv_fence_i = 8,
+    rv_fence_o = 4,
+    rv_fence_r = 2,
+    rv_fence_w = 1,
+} rv_fence;
+
+typedef enum {
+    rv_ireg_zero,
+    rv_ireg_ra,
+    rv_ireg_sp,
+    rv_ireg_gp,
+    rv_ireg_tp,
+    rv_ireg_t0,
+    rv_ireg_t1,
+    rv_ireg_t2,
+    rv_ireg_s0,
+    rv_ireg_s1,
+    rv_ireg_a0,
+    rv_ireg_a1,
+    rv_ireg_a2,
+    rv_ireg_a3,
+    rv_ireg_a4,
+    rv_ireg_a5,
+    rv_ireg_a6,
+    rv_ireg_a7,
+    rv_ireg_s2,
+    rv_ireg_s3,
+    rv_ireg_s4,
+    rv_ireg_s5,
+    rv_ireg_s6,
+    rv_ireg_s7,
+    rv_ireg_s8,
+    rv_ireg_s9,
+    rv_ireg_s10,
+    rv_ireg_s11,
+    rv_ireg_t3,
+    rv_ireg_t4,
+    rv_ireg_t5,
+    rv_ireg_t6,
+} rv_ireg;
+
+typedef enum {
+    rvc_end,
+    rvc_rd_eq_ra,
+    rvc_rd_eq_x0,
+    rvc_rs1_eq_x0,
+    rvc_rs2_eq_x0,
+    rvc_rs2_eq_rs1,
+    rvc_rs1_eq_ra,
+    rvc_imm_eq_zero,
+    rvc_imm_eq_n1,
+    rvc_imm_eq_p1,
+    rvc_csr_eq_0x001,
+    rvc_csr_eq_0x002,
+    rvc_csr_eq_0x003,
+    rvc_csr_eq_0xc00,
+    rvc_csr_eq_0xc01,
+    rvc_csr_eq_0xc02,
+    rvc_csr_eq_0xc80,
+    rvc_csr_eq_0xc81,
+    rvc_csr_eq_0xc82,
+} rvc_constraint;
+
+typedef enum {
+    rv_codec_illegal,
+    rv_codec_none,
+    rv_codec_u,
+    rv_codec_uj,
+    rv_codec_i,
+    rv_codec_i_sh5,
+    rv_codec_i_sh6,
+    rv_codec_i_sh7,
+    rv_codec_i_csr,
+    rv_codec_s,
+    rv_codec_sb,
+    rv_codec_r,
+    rv_codec_r_m,
+    rv_codec_r4_m,
+    rv_codec_r_a,
+    rv_codec_r_l,
+    rv_codec_r_f,
+    rv_codec_cb,
+    rv_codec_cb_imm,
+    rv_codec_cb_sh5,
+    rv_codec_cb_sh6,
+    rv_codec_ci,
+    rv_codec_ci_sh5,
+    rv_codec_ci_sh6,
+    rv_codec_ci_16sp,
+    rv_codec_ci_lwsp,
+    rv_codec_ci_ldsp,
+    rv_codec_ci_lqsp,
+    rv_codec_ci_li,
+    rv_codec_ci_lui,
+    rv_codec_ci_none,
+    rv_codec_ciw_4spn,
+    rv_codec_cj,
+    rv_codec_cj_jal,
+    rv_codec_cl_lw,
+    rv_codec_cl_ld,
+    rv_codec_cl_lq,
+    rv_codec_cr,
+    rv_codec_cr_mv,
+    rv_codec_cr_jalr,
+    rv_codec_cr_jr,
+    rv_codec_cs,
+    rv_codec_cs_sw,
+    rv_codec_cs_sd,
+    rv_codec_cs_sq,
+    rv_codec_css_swsp,
+    rv_codec_css_sdsp,
+    rv_codec_css_sqsp,
+    rv_codec_k_bs,
+    rv_codec_k_rnum,
+    rv_codec_v_r,
+    rv_codec_v_ldst,
+    rv_codec_v_i,
+    rv_codec_vsetvli,
+    rv_codec_vsetivli,
+    rv_codec_zcb_ext,
+    rv_codec_zcb_mul,
+    rv_codec_zcb_lb,
+    rv_codec_zcb_lh,
+    rv_codec_zcmp_cm_pushpop,
+    rv_codec_zcmp_cm_mv,
+    rv_codec_zcmt_jt,
+} rv_codec;
+
+/* structures */
+
+typedef struct {
+    RISCVCPUConfig *cfg;
+    uint64_t  pc;
+    uint64_t  inst;
+    int32_t   imm;
+    uint16_t  op;
+    uint8_t   codec;
+    uint8_t   rd;
+    uint8_t   rs1;
+    uint8_t   rs2;
+    uint8_t   rs3;
+    uint8_t   rm;
+    uint8_t   pred;
+    uint8_t   succ;
+    uint8_t   aq;
+    uint8_t   rl;
+    uint8_t   bs;
+    uint8_t   rnum;
+    uint8_t   vm;
+    uint32_t  vzimm;
+    uint8_t   rlist;
+} rv_decode;
+
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+enum {
+    rvcd_imm_nz = 0x1
+};
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
+/* instruction formats */
+
+#define rv_fmt_none                   "O\t"
+#define rv_fmt_rs1                    "O\t1"
+#define rv_fmt_offset                 "O\to"
+#define rv_fmt_pred_succ              "O\tp,s"
+#define rv_fmt_rs1_rs2                "O\t1,2"
+#define rv_fmt_rd_imm                 "O\t0,i"
+#define rv_fmt_rd_offset              "O\t0,o"
+#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
+#define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_frs1               "O\t3,4"
+#define rv_fmt_rd_frs1                "O\t0,4"
+#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
+#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
+#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
+#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
+#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
+#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
+#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
+#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
+#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
+#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
+#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
+#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
+#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
+#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
+#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
+#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
+#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
+#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
+#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
+#define rv_fmt_rd                     "O\t0"
+#define rv_fmt_rd_zimm                "O\t0,7"
+#define rv_fmt_rd_rs1                 "O\t0,1"
+#define rv_fmt_rd_rs2                 "O\t0,2"
+#define rv_fmt_rs1_offset             "O\t1,o"
+#define rv_fmt_rs2_offset             "O\t2,o"
+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
+#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
+#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
+#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
+#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
+#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
+#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
+#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
+#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
+#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
+#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
+#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
+#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
+#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
+#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
+#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
+#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
+#define rv_fmt_vd_vs1                 "O\tD,E"
+#define rv_fmt_vd_rs1                 "O\tD,1"
+#define rv_fmt_vd_fs1                 "O\tD,4"
+#define rv_fmt_vd_imm                 "O\tD,i"
+#define rv_fmt_vd_vs2                 "O\tD,F"
+#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
+#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
+#define rv_fmt_rd_vs2                 "O\t0,F"
+#define rv_fmt_fd_vs2                 "O\t3,F"
+#define rv_fmt_vd_vm                  "O\tDm"
+#define rv_fmt_vsetvli                "O\t0,1,v"
+#define rv_fmt_vsetivli               "O\t0,u,v"
+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
+#define rv_fmt_push_rlist             "O\tx,-i"
+#define rv_fmt_pop_rlist              "O\tx,i"
+#define rv_fmt_zcmt_index             "O\ti"
+
+#endif /* DISAS_RISCV_H */
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
-
-/* types */
-
-typedef uint64_t rv_inst;
-typedef uint16_t rv_opcode;
-
-/* enums */
-
-typedef enum {
-    rv32,
-    rv64,
-    rv128
-} rv_isa;
-
-typedef enum {
-    rv_rm_rne = 0,
-    rv_rm_rtz = 1,
-    rv_rm_rdn = 2,
-    rv_rm_rup = 3,
-    rv_rm_rmm = 4,
-    rv_rm_dyn = 7,
-} rv_rm;
-
-typedef enum {
-    rv_fence_i = 8,
-    rv_fence_o = 4,
-    rv_fence_r = 2,
-    rv_fence_w = 1,
-} rv_fence;
-
-typedef enum {
-    rv_ireg_zero,
-    rv_ireg_ra,
-    rv_ireg_sp,
-    rv_ireg_gp,
-    rv_ireg_tp,
-    rv_ireg_t0,
-    rv_ireg_t1,
-    rv_ireg_t2,
-    rv_ireg_s0,
-    rv_ireg_s1,
-    rv_ireg_a0,
-    rv_ireg_a1,
-    rv_ireg_a2,
-    rv_ireg_a3,
-    rv_ireg_a4,
-    rv_ireg_a5,
-    rv_ireg_a6,
-    rv_ireg_a7,
-    rv_ireg_s2,
-    rv_ireg_s3,
-    rv_ireg_s4,
-    rv_ireg_s5,
-    rv_ireg_s6,
-    rv_ireg_s7,
-    rv_ireg_s8,
-    rv_ireg_s9,
-    rv_ireg_s10,
-    rv_ireg_s11,
-    rv_ireg_t3,
-    rv_ireg_t4,
-    rv_ireg_t5,
-    rv_ireg_t6,
-} rv_ireg;
-
-typedef enum {
-    rvc_end,
-    rvc_rd_eq_ra,
-    rvc_rd_eq_x0,
-    rvc_rs1_eq_x0,
-    rvc_rs2_eq_x0,
-    rvc_rs2_eq_rs1,
-    rvc_rs1_eq_ra,
-    rvc_imm_eq_zero,
-    rvc_imm_eq_n1,
-    rvc_imm_eq_p1,
-    rvc_csr_eq_0x001,
-    rvc_csr_eq_0x002,
-    rvc_csr_eq_0x003,
-    rvc_csr_eq_0xc00,
-    rvc_csr_eq_0xc01,
-    rvc_csr_eq_0xc02,
-    rvc_csr_eq_0xc80,
-    rvc_csr_eq_0xc81,
-    rvc_csr_eq_0xc82,
-} rvc_constraint;
-
-typedef enum {
-    rv_codec_illegal,
-    rv_codec_none,
-    rv_codec_u,
-    rv_codec_uj,
-    rv_codec_i,
-    rv_codec_i_sh5,
-    rv_codec_i_sh6,
-    rv_codec_i_sh7,
-    rv_codec_i_csr,
-    rv_codec_s,
-    rv_codec_sb,
-    rv_codec_r,
-    rv_codec_r_m,
-    rv_codec_r4_m,
-    rv_codec_r_a,
-    rv_codec_r_l,
-    rv_codec_r_f,
-    rv_codec_cb,
-    rv_codec_cb_imm,
-    rv_codec_cb_sh5,
-    rv_codec_cb_sh6,
-    rv_codec_ci,
-    rv_codec_ci_sh5,
-    rv_codec_ci_sh6,
-    rv_codec_ci_16sp,
-    rv_codec_ci_lwsp,
-    rv_codec_ci_ldsp,
-    rv_codec_ci_lqsp,
-    rv_codec_ci_li,
-    rv_codec_ci_lui,
-    rv_codec_ci_none,
-    rv_codec_ciw_4spn,
-    rv_codec_cj,
-    rv_codec_cj_jal,
-    rv_codec_cl_lw,
-    rv_codec_cl_ld,
-    rv_codec_cl_lq,
-    rv_codec_cr,
-    rv_codec_cr_mv,
-    rv_codec_cr_jalr,
-    rv_codec_cr_jr,
-    rv_codec_cs,
-    rv_codec_cs_sw,
-    rv_codec_cs_sd,
-    rv_codec_cs_sq,
-    rv_codec_css_swsp,
-    rv_codec_css_sdsp,
-    rv_codec_css_sqsp,
-    rv_codec_k_bs,
-    rv_codec_k_rnum,
-    rv_codec_v_r,
-    rv_codec_v_ldst,
-    rv_codec_v_i,
-    rv_codec_vsetvli,
-    rv_codec_vsetivli,
-    rv_codec_zcb_ext,
-    rv_codec_zcb_mul,
-    rv_codec_zcb_lb,
-    rv_codec_zcb_lh,
-    rv_codec_zcmp_cm_pushpop,
-    rv_codec_zcmp_cm_mv,
-    rv_codec_zcmt_jt,
-} rv_codec;
+#include "disas/riscv.h"
 
 typedef enum {
     rv_op_illegal = 0,
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_czero_nez = 790,
 } rv_op;
 
-/* structures */
-
-typedef struct {
-    RISCVCPUConfig *cfg;
-    uint64_t  pc;
-    uint64_t  inst;
-    int32_t   imm;
-    uint16_t  op;
-    uint8_t   codec;
-    uint8_t   rd;
-    uint8_t   rs1;
-    uint8_t   rs2;
-    uint8_t   rs3;
-    uint8_t   rm;
-    uint8_t   pred;
-    uint8_t   succ;
-    uint8_t   aq;
-    uint8_t   rl;
-    uint8_t   bs;
-    uint8_t   rnum;
-    uint8_t   vm;
-    uint32_t  vzimm;
-    uint8_t   rlist;
-} rv_decode;
-
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
-enum {
-    rvcd_imm_nz = 0x1
-};
-
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* register names */
 
 static const char rv_ireg_name_sym[32][5] = {
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
-/* instruction formats */
-
-#define rv_fmt_none                   "O\t"
-#define rv_fmt_rs1                    "O\t1"
-#define rv_fmt_offset                 "O\to"
-#define rv_fmt_pred_succ              "O\tp,s"
-#define rv_fmt_rs1_rs2                "O\t1,2"
-#define rv_fmt_rd_imm                 "O\t0,i"
-#define rv_fmt_rd_offset              "O\t0,o"
-#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
-#define rv_fmt_frd_rs1                "O\t3,1"
-#define rv_fmt_frd_frs1               "O\t3,4"
-#define rv_fmt_rd_frs1                "O\t0,4"
-#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
-#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
-#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
-#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
-#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
-#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
-#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
-#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
-#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
-#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
-#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
-#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
-#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
-#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
-#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
-#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
-#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
-#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
-#define rv_fmt_rd                     "O\t0"
-#define rv_fmt_rd_zimm                "O\t0,7"
-#define rv_fmt_rd_rs1                 "O\t0,1"
-#define rv_fmt_rd_rs2                 "O\t0,2"
-#define rv_fmt_rs1_offset             "O\t1,o"
-#define rv_fmt_rs2_offset             "O\t2,o"
-#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
-#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
-#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
-#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
-#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
-#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
-#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
-#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
-#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
-#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
-#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
-#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
-#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
-#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
-#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
-#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
-#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
-#define rv_fmt_vd_vs1                 "O\tD,E"
-#define rv_fmt_vd_rs1                 "O\tD,1"
-#define rv_fmt_vd_fs1                 "O\tD,4"
-#define rv_fmt_vd_imm                 "O\tD,i"
-#define rv_fmt_vd_vs2                 "O\tD,F"
-#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
-#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
-#define rv_fmt_rd_vs2                 "O\t0,F"
-#define rv_fmt_fd_vs2                 "O\t3,F"
-#define rv_fmt_vd_vm                  "O\tDm"
-#define rv_fmt_vsetvli                "O\t0,1,v"
-#define rv_fmt_vsetivli               "O\t0,u,v"
-#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-#define rv_fmt_push_rlist             "O\tx,-i"
-#define rv_fmt_pop_rlist              "O\tx,i"
-#define rv_fmt_zcmt_index             "O\ti"
-
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

The enum value 'rv_op_illegal' does not represent an
instruction, but is a catch-all value in case we have
no match in the decoder. Let's make the value a shared
one, so that other compile units can reuse it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 4 ++++
 disas/riscv.c | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     const rvc_constraint *constraints;
 } rv_comp_data;
 
+enum {
+    rv_op_illegal = 0
+};
+
 enum {
     rvcd_imm_nz = 0x1
 };
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "disas/riscv.h"
 
 typedef enum {
-    rv_op_illegal = 0,
+    /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
     rv_op_auipc = 2,
     rv_op_jal = 3,
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch adds a reference to a struct rv_opcode_data object
into struct rv_decode. This further allows to remove all references
to the global variable opcode_data (which is renamed to rvi_opcode_data).

This patch does not introduce any functional change, but prepares
the code for more struct rv_opcode_data objects in the future.

This patch is based on previous work from Liu Zhiwei:
  https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 33 +++++++++++++++++----------------
 disas/riscv.c |  9 ++++++++-
 2 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 /* structures */
 
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
 typedef struct {
     RISCVCPUConfig *cfg;
     uint64_t  pc;
     uint64_t  inst;
+    const rv_opcode_data *opcode_data;
     int32_t   imm;
     uint16_t  op;
     uint8_t   codec;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint8_t   rlist;
 } rv_decode;
 
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
 enum {
     rv_op_illegal = 0
 };
@@ -XXX,XX +XXX,XX @@ enum {
     rvcd_imm_nz = 0x1
 };
 
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* instruction formats */
 
 #define rv_fmt_none                   "O\t"
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
 
 /* instruction metadata */
 
-const rv_opcode_data opcode_data[] = {
+const rv_opcode_data rvi_opcode_data[] = {
     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
     { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_tbl_index(rv_inst inst)
 
 static void decode_inst_operands(rv_decode *dec, rv_isa isa)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     rv_inst inst = dec->inst;
     dec->codec = opcode_data[dec->op].codec;
     switch (dec->codec) {
@@ -XXX,XX +XXX,XX @@ static void append(char *s1, const char *s2, size_t n)
 
 static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     char tmp[64];
     const char *fmt;
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 
 static void decode_inst_lift_pseudo(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
     if (!comp_data) {
         return;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_lift_pseudo(rv_decode *dec)
 
 static void decode_inst_decompress_rv32(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv32;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv32(rv_decode *dec)
 
 static void decode_inst_decompress_rv64(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv64;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv64(rv_decode *dec)
 
 static void decode_inst_decompress_rv128(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv128;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
+    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
     decode_inst_opcode(&dec, isa);
     decode_inst_operands(&dec, isa);
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

A previous patch provides a pointer to the RISCVCPUConfig data.
Let's use this to add the necessary code for vendor extensions.
This patch does not change the current behaviour, but clearly
defines how vendor extension support can be added to the disassembler.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
-    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
-    decode_inst_opcode(&dec, isa);
+
+    static const struct {
+        bool (*guard_func)(const RISCVCPUConfig *);
+        const rv_opcode_data *opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa);
+    } decoders[] = {
+        { always_true_p, rvi_opcode_data, decode_inst_opcode },
+    };
+
+    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
+        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
+        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
+
+        if (guard_func(cfg)) {
+            dec.opcode_data = opcode_data;
+            decode_func(&dec, isa);
+            if (dec.op != rv_op_illegal)
+                break;
+        }
+    }
+
+    if (dec.op == rv_op_illegal) {
+        dec.opcode_data = rvi_opcode_data;
+    }
+
     decode_inst_operands(&dec, isa);
     decode_inst_decompress(&dec, isa);
     decode_inst_lift_pseudo(&dec);
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch adds XVentanaCondOps support to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv-xventana.h | 18 ++++++++++++++++++
 disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c          |  4 ++++
 disas/meson.build      |  5 ++++-
 4 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 disas/riscv-xventana.h
 create mode 100644 disas/riscv-xventana.c

diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xventana.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xventana*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XVENTANA_H
+#define DISAS_RISCV_XVENTANA_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data ventana_opcode_data[];
+
+void decode_xventanacondops(rv_decode*, rv_isa);
+
+#endif /* DISAS_RISCV_XVENTANA_H */
diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xventana.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Disassembler for xventana.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xventana.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    ventana_op_vt_maskc = 1,
+    ventana_op_vt_maskcn = 2,
+} rv_ventana_op;
+
+const rv_opcode_data ventana_opcode_data[] = {
+    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+};
+
+void decode_xventanacondops(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 30:
+            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
+            case 6: op = ventana_op_vt_maskc; break;
+            case 7: op = ventana_op_vt_maskcn; break;
+            }
+            break;
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
+/* Vendor extensions */
+#include "disas/riscv-xventana.h"
+
 typedef enum {
     /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
diff --git a/disas/meson.build b/disas/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
 common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
 common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
-common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
+common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
+    'riscv.c',
+    'riscv-xventana.c'
+))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
 common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
 common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

Support for emulating XThead* instruction has been added recently.
This patch adds support for these instructions to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv-xthead.h   |  28 ++
 disas/riscv.h          |  12 +
 target/riscv/cpu_cfg.h |  11 +
 disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c          |  69 ++++
 disas/meson.build      |   1 +
 6 files changed, 828 insertions(+)
 create mode 100644 disas/riscv-xthead.h
 create mode 100644 disas/riscv-xthead.c

diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xthead.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xthead*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XTHEAD_H
+#define DISAS_RISCV_XTHEAD_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data xthead_opcode_data[];
+
+void decode_xtheadba(rv_decode *, rv_isa);
+void decode_xtheadbb(rv_decode *, rv_isa);
+void decode_xtheadbs(rv_decode *, rv_isa);
+void decode_xtheadcmo(rv_decode *, rv_isa);
+void decode_xtheadcondmov(rv_decode *, rv_isa);
+void decode_xtheadfmemidx(rv_decode *, rv_isa);
+void decode_xtheadfmv(rv_decode *, rv_isa);
+void decode_xtheadmac(rv_decode *, rv_isa);
+void decode_xtheadmemidx(rv_decode *, rv_isa);
+void decode_xtheadmempair(rv_decode *, rv_isa);
+void decode_xtheadsync(rv_decode *, rv_isa);
+
+#endif /* DISAS_RISCV_XTHEAD_H */
diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_zcmp_cm_pushpop,
     rv_codec_zcmp_cm_mv,
     rv_codec_zcmt_jt,
+    rv_codec_r2_imm5,
+    rv_codec_r2,
+    rv_codec_r2_imm6,
+    rv_codec_r_imm2,
+    rv_codec_r2_immhl,
+    rv_codec_r2_imm2_imm5,
 } rv_codec;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint64_t  inst;
     const rv_opcode_data *opcode_data;
     int32_t   imm;
+    int32_t   imm1;
     uint16_t  op;
     uint8_t   codec;
     uint8_t   rd;
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_push_rlist             "O\tx,-i"
 #define rv_fmt_pop_rlist              "O\tx,i"
 #define rv_fmt_zcmt_index             "O\ti"
+#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
+#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
+#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
+#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
+#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
         return cfg->ext_ ## ext ; \
     }
 
+MATERIALISE_EXT_PREDICATE(xtheadba)
+MATERIALISE_EXT_PREDICATE(xtheadbb)
+MATERIALISE_EXT_PREDICATE(xtheadbs)
+MATERIALISE_EXT_PREDICATE(xtheadcmo)
+MATERIALISE_EXT_PREDICATE(xtheadcondmov)
+MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadfmv)
+MATERIALISE_EXT_PREDICATE(xtheadmac)
+MATERIALISE_EXT_PREDICATE(xtheadmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadmempair)
+MATERIALISE_EXT_PREDICATE(xtheadsync)
 MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
 
 #endif
diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xthead.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Disassembler for xthead.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xthead.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    /* XTheadBa */
+    rv_op_th_addsl = 1,
+    /* XTheadBb */
+    rv_op_th_srri,
+    rv_op_th_srriw,
+    rv_op_th_ext,
+    rv_op_th_extu,
+    rv_op_th_ff0,
+    rv_op_th_ff1,
+    rv_op_th_rev,
+    rv_op_th_revw,
+    rv_op_th_tstnbz,
+    /* XTheadBs */
+    rv_op_th_tst,
+    /* XTheadCmo */
+    rv_op_th_dcache_call,
+    rv_op_th_dcache_ciall,
+    rv_op_th_dcache_iall,
+    rv_op_th_dcache_cpa,
+    rv_op_th_dcache_cipa,
+    rv_op_th_dcache_ipa,
+    rv_op_th_dcache_cva,
+    rv_op_th_dcache_civa,
+    rv_op_th_dcache_iva,
+    rv_op_th_dcache_csw,
+    rv_op_th_dcache_cisw,
+    rv_op_th_dcache_isw,
+    rv_op_th_dcache_cpal1,
+    rv_op_th_dcache_cval1,
+    rv_op_th_icache_iall,
+    rv_op_th_icache_ialls,
+    rv_op_th_icache_ipa,
+    rv_op_th_icache_iva,
+    rv_op_th_l2cache_call,
+    rv_op_th_l2cache_ciall,
+    rv_op_th_l2cache_iall,
+    /* XTheadCondMov */
+    rv_op_th_mveqz,
+    rv_op_th_mvnez,
+    /* XTheadFMemIdx */
+    rv_op_th_flrd,
+    rv_op_th_flrw,
+    rv_op_th_flurd,
+    rv_op_th_flurw,
+    rv_op_th_fsrd,
+    rv_op_th_fsrw,
+    rv_op_th_fsurd,
+    rv_op_th_fsurw,
+    /* XTheadFmv */
+    rv_op_th_fmv_hw_x,
+    rv_op_th_fmv_x_hw,
+    /* XTheadMac */
+    rv_op_th_mula,
+    rv_op_th_mulah,
+    rv_op_th_mulaw,
+    rv_op_th_muls,
+    rv_op_th_mulsw,
+    rv_op_th_mulsh,
+    /* XTheadMemIdx */
+    rv_op_th_lbia,
+    rv_op_th_lbib,
+    rv_op_th_lbuia,
+    rv_op_th_lbuib,
+    rv_op_th_lhia,
+    rv_op_th_lhib,
+    rv_op_th_lhuia,
+    rv_op_th_lhuib,
+    rv_op_th_lwia,
+    rv_op_th_lwib,
+    rv_op_th_lwuia,
+    rv_op_th_lwuib,
+    rv_op_th_ldia,
+    rv_op_th_ldib,
+    rv_op_th_sbia,
+    rv_op_th_sbib,
+    rv_op_th_shia,
+    rv_op_th_shib,
+    rv_op_th_swia,
+    rv_op_th_swib,
+    rv_op_th_sdia,
+    rv_op_th_sdib,
+    rv_op_th_lrb,
+    rv_op_th_lrbu,
+    rv_op_th_lrh,
+    rv_op_th_lrhu,
+    rv_op_th_lrw,
+    rv_op_th_lrwu,
+    rv_op_th_lrd,
+    rv_op_th_srb,
+    rv_op_th_srh,
+    rv_op_th_srw,
+    rv_op_th_srd,
+    rv_op_th_lurb,
+    rv_op_th_lurbu,
+    rv_op_th_lurh,
+    rv_op_th_lurhu,
+    rv_op_th_lurw,
+    rv_op_th_lurwu,
+    rv_op_th_lurd,
+    rv_op_th_surb,
+    rv_op_th_surh,
+    rv_op_th_surw,
+    rv_op_th_surd,
+    /* XTheadMemPair */
+    rv_op_th_ldd,
+    rv_op_th_lwd,
+    rv_op_th_lwud,
+    rv_op_th_sdd,
+    rv_op_th_swd,
+    /* XTheadSync */
+    rv_op_th_sfence_vmas,
+    rv_op_th_sync,
+    rv_op_th_sync_i,
+    rv_op_th_sync_is,
+    rv_op_th_sync_s,
+} rv_xthead_op;
+
+const rv_opcode_data xthead_opcode_data[] = {
+    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadBa */
+    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadBb */
+    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    /* XTheadBs */
+    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    /* XTheadCmo */
+    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadCondMov */
+    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadFMemIdx */
+    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadFmv */
+    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    /* XTheadMac */
+    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadMemIdx */
+    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadMemPair */
+    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    /* XTheadSync */
+    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+};
+
+void decode_xtheadba(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000000:
+                case 0b0000001:
+                case 0b0000010:
+                case 0b0000011: op = rv_op_th_addsl; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbb(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0001010: op = rv_op_th_srriw; break;
+                case 0b1000000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_tstnbz;
+                    }
+                    break;
+                case 0b1000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_rev;
+                    }
+                    break;
+                case 0b1000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff0;
+                    }
+                    break;
+                case 0b1000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff1;
+                    }
+                    break;
+                case 0b1000100:
+                case 0b1001000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_revw;
+                    }
+                    break;
+                case 0b0000100:
+                case 0b0000101: op = rv_op_th_srri; break;
+                }
+                break;
+            case 2: op = rv_op_th_ext; break;
+            case 3: op = rv_op_th_extu; break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbs(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 26) & 0b111111) {
+                case 0b100010: op = rv_op_th_tst; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 20 & 0b111111111111)) {
+                case 0b000000000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_call;
+                    }
+                    break;
+                case 0b000000000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_ciall;
+                    }
+                    break;
+                case 0b000000000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_iall;
+                    }
+                    break;
+                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
+                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
+                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
+                case 0b000000100101: op = rv_op_th_dcache_cva; break;
+                case 0b000000100111: op = rv_op_th_dcache_civa; break;
+                case 0b000000100110: op = rv_op_th_dcache_iva; break;
+                case 0b000000100001: op = rv_op_th_dcache_csw; break;
+                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
+                case 0b000000100010: op = rv_op_th_dcache_isw; break;
+                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
+                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
+                case 0b000000010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_iall;
+                    }
+                    break;
+                case 0b000000010001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_ialls;
+                    }
+                    break;
+                case 0b000000111000: op = rv_op_th_icache_ipa; break;
+                case 0b000000110000: op = rv_op_th_icache_iva; break;
+                case 0b000000010101:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_call;
+                    }
+                    break;
+                case 0b000000010111:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_ciall;
+                    }
+                    break;
+                case 0b000000010110:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_iall;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0100000: op = rv_op_th_mveqz; break;
+                case 0b0100001: op = rv_op_th_mvnez; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 6:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_flrw; break;
+                case 10: op = rv_op_th_flurw; break;
+                case 12: op = rv_op_th_flrd; break;
+                case 14: op = rv_op_th_flurd; break;
+                }
+                break;
+            case 7:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_fsrw; break;
+                case 10: op = rv_op_th_fsurw; break;
+                case 12: op = rv_op_th_fsrd; break;
+                case 14: op = rv_op_th_fsurd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b1010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_hw_x;
+                    }
+                    break;
+                case 0b1100000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_x_hw;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmac(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0010000: op = rv_op_th_mula; break;
+                case 0b0010001: op = rv_op_th_muls; break;
+                case 0b0010010: op = rv_op_th_mulaw; break;
+                case 0b0010011: op = rv_op_th_mulsw; break;
+                case 0b0010100: op = rv_op_th_mulah; break;
+                case 0b0010101: op = rv_op_th_mulsh; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_lrb; break;
+                case 1: op = rv_op_th_lbib; break;
+                case 2: op = rv_op_th_lurb; break;
+                case 3: op = rv_op_th_lbia; break;
+                case 4: op = rv_op_th_lrh; break;
+                case 5: op = rv_op_th_lhib; break;
+                case 6: op = rv_op_th_lurh; break;
+                case 7: op = rv_op_th_lhia; break;
+                case 8: op = rv_op_th_lrw; break;
+                case 9: op = rv_op_th_lwib; break;
+                case 10: op = rv_op_th_lurw; break;
+                case 11: op = rv_op_th_lwia; break;
+                case 12: op = rv_op_th_lrd; break;
+                case 13: op = rv_op_th_ldib; break;
+                case 14: op = rv_op_th_lurd; break;
+                case 15: op = rv_op_th_ldia; break;
+                case 16: op = rv_op_th_lrbu; break;
+                case 17: op = rv_op_th_lbuib; break;
+                case 18: op = rv_op_th_lurbu; break;
+                case 19: op = rv_op_th_lbuia; break;
+                case 20: op = rv_op_th_lrhu; break;
+                case 21: op = rv_op_th_lhuib; break;
+                case 22: op = rv_op_th_lurhu; break;
+                case 23: op = rv_op_th_lhuia; break;
+                case 24: op = rv_op_th_lrwu; break;
+                case 25: op = rv_op_th_lwuib; break;
+                case 26: op = rv_op_th_lurwu; break;
+                case 27: op = rv_op_th_lwuia; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_srb; break;
+                case 1: op = rv_op_th_sbib; break;
+                case 2: op = rv_op_th_surb; break;
+                case 3: op = rv_op_th_sbia; break;
+                case 4: op = rv_op_th_srh; break;
+                case 5: op = rv_op_th_shib; break;
+                case 6: op = rv_op_th_surh; break;
+                case 7: op = rv_op_th_shia; break;
+                case 8: op = rv_op_th_srw; break;
+                case 9: op = rv_op_th_swib; break;
+                case 10: op = rv_op_th_surw; break;
+                case 11: op = rv_op_th_swia; break;
+                case 12: op = rv_op_th_srd; break;
+                case 13: op = rv_op_th_sdib; break;
+                case 14: op = rv_op_th_surd; break;
+                case 15: op = rv_op_th_sdia; break;
+                }
+                break;
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_lwd; break;
+                case 30: op = rv_op_th_lwud; break;
+                case 31: op = rv_op_th_ldd; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_swd; break;
+                case 31: op = rv_op_th_sdd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadsync(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000010: op = rv_op_th_sfence_vmas; break;
+                case 0b0000000:
+                    switch ((inst >> 20) & 0b11111) {
+                    case 0b11000: op = rv_op_th_sync; break;
+                    case 0b11010: op = rv_op_th_sync_i; break;
+                    case 0b11011: op = rv_op_th_sync_is; break;
+                    case 0b11001: op = rv_op_th_sync_s; break;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
 /* Vendor extensions */
+#include "disas/riscv-xthead.h"
 #include "disas/riscv-xventana.h"
 
 typedef enum {
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
     return ((inst << 56) >> 60);
 }
 
+static uint32_t operand_imm6(rv_inst inst)
+{
+    return (inst << 38) >> 60;
+}
+
+static uint32_t operand_imm2(rv_inst inst)
+{
+    return (inst << 37) >> 62;
+}
+
+static uint32_t operand_immh(rv_inst inst)
+{
+    return (inst << 32) >> 58;
+}
+
+static uint32_t operand_imml(rv_inst inst)
+{
+    return (inst << 38) >> 58;
+}
+
 static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
 {
     int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
         break;
+    case rv_codec_r2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_rs2(inst);
+        break;
+    case rv_codec_r2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        break;
+    case rv_codec_r2_imm6:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_imm6(inst);
+        break;
+    case rv_codec_r_imm2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->rs2 = operand_rs2(inst);
+        dec->imm = operand_imm2(inst);
+        break;
+    case rv_codec_r2_immhl:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_immh(inst);
+        dec->imm1 = operand_imml(inst);
+        break;
+    case rv_codec_r2_imm2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = sextract32(operand_rs2(inst), 0, 5);
+        dec->imm1 = operand_imm2(inst);
+        break;
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
             append(buf, tmp, buflen);
             break;
+        case 'j':
+            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
+            append(buf, tmp, buflen);
+            break;
         case 'o':
             snprintf(tmp, sizeof(tmp), "%d", dec->imm);
             append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
+        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
+        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
+        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
+        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
+        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
+        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
+        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
+        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
+        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
+        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
         { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
diff --git a/disas/meson.build b/disas/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
 common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
     'riscv.c',
+    'riscv-xthead.c',
     'riscv-xventana.c'
 ))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
when MPP=PRV_M.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 3 ++-
 target/riscv/op_helper.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 
         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
-            virt = get_field(env->mstatus, MSTATUS_MPV);
+            virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                   (mode != PRV_M);
             if (virt) {
                 status = env->vsstatus;
             }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
 
-    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
+    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                             (prev_priv != PRV_M);
     mstatus = set_field(mstatus, MSTATUS_MIE,
                         get_field(mstatus, MSTATUS_MPIE));
     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

MPV and GVA bits are added by hypervisor extension to mstatus
and mstatush (if MXLEN=32).

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     }
 
     if (xl != MXL_RV32 || env->debugger) {
-        /*
-         * RV32: MPV and GVA are not in mstatus. The current plan is to
-         * add them to mstatush. For now, we just don't support it.
-         */
-        mask |= MSTATUS_MPV | MSTATUS_GVA;
+        if (riscv_has_ext(env, RVH)) {
+            mask |= MSTATUS_MPV | MSTATUS_GVA;
+        }
         if ((val & MSTATUS64_UXL) != 0) {
             mask |= MSTATUS64_UXL;
         }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t valh = (uint64_t)val << 32;
-    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
+    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
 
     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

SXL is initialized as env->misa_mxl which is also the mxl value.
So we can just remain it unchanged to keep it read-only.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 
     mstatus = (mstatus & ~mask) | (val & mask);
 
-    if (xl > MXL_RV32) {
-        /* SXL field is for now read only */
-        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
-    }
     env->mstatus = mstatus;
 
     /*
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
and ext_icsr from riscv_cpu_init(), the init() function of
TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
CPUs to explictly enable all extensions and features it requires,
without any 'magic values' that were inherited by the parent type.

This commit failed to make appropriate changes in the 'veyron-v1' CPU,
added earlier by commit e1d084a8524a. The result is that the veyron-v1
CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
case.

The reason why it took this long to notice (thanks LIU Zhiwei for
reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
absent in the 'riscv,isa' DT, implying that they're both present if the
'i' extension is enabled. OpenSBI also doesn't error out or warns about
the lack of 'pmp', it'll just not protect memory pages.

Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
7f0bdfb5bfc2 already did with other CPUs.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
 
     /* Enable ISA extensions */
     cpu->cfg.mmu = true;
+    cpu->cfg.ext_ifencei = true;
+    cpu->cfg.ext_icsr = true;
+    cpu->cfg.pmp = true;
     cpu->cfg.ext_icbom = true;
     cpu->cfg.cbom_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

As specified in privilege spec:"When MPRV=1, load and store memory
addresses are treated as though the current XLEN were set to MPP’s
XLEN". So the xlen for address may be different from current xlen.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
 target/riscv/cpu_helper.c |  1 +
 target/riscv/translate.c  | 13 ++++++++++-
 3 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 FIELD(TB_FLAGS, PRIV, 24, 2)
+FIELD(TB_FLAGS, AXL, 26, 2)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
@@ -XXX,XX +XXX,XX @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
     return &env_archcpu(env)->cfg;
 }
 
-#if defined(TARGET_RISCV32)
-#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
-#else
-static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+#if !defined(CONFIG_USER_ONLY)
+static inline int cpu_address_mode(CPURISCVState *env)
+{
+    int mode = env->priv;
+
+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+    }
+    return mode;
+}
+
+static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
 {
     RISCVMXL xl = env->misa_mxl;
-#if !defined(CONFIG_USER_ONLY)
     /*
      * When emulating a 32-bit-only cpu, use RV32.
      * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
      * back to RV64 for lower privs.
      */
     if (xl != MXL_RV32) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             break;
         case PRV_U:
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
             break;
         }
     }
-#endif
     return xl;
 }
 #endif
 
+#if defined(TARGET_RISCV32)
+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    return cpu_get_xl(env, env->priv);
+#else
+    return env->misa_mxl;
+#endif
+}
+#endif
+
+#if defined(TARGET_RISCV32)
+#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
+{
+#ifdef CONFIG_USER_ONLY
+    return env->xl;
+#else
+    int mode = cpu_address_mode(env);
+
+    return cpu_get_xl(env, mode);
+#endif
+}
+#endif
+
 static inline int riscv_cpu_xlen(CPURISCVState *env)
 {
     return 16 << env->xl;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
     if (env->cur_pmmask != 0) {
         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     target_ulong priv_ver;
     RISCVMXL misa_mxl_max;
     RISCVMXL xl;
+    RISCVMXL address_xl;
     uint32_t misa_ext;
     uint32_t opcode;
     RISCVExtStatus mstatus_fs;
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 #define get_xl(ctx)    ((ctx)->xl)
 #endif
 
+#ifdef TARGET_RISCV32
+#define get_address_xl(ctx)    MXL_RV32
+#elif defined(CONFIG_USER_ONLY)
+#define get_address_xl(ctx)    MXL_RV64
+#else
+#define get_address_xl(ctx)    ((ctx)->address_xl)
+#endif
+
 /* The word size for this machine mode. */
 static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
 {
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     tcg_gen_addi_tl(addr, src1, imm);
     if (ctx->pm_mask_enabled) {
         tcg_gen_andc_tl(addr, addr, pm_mask);
-    } else if (get_xl(ctx) == MXL_RV32) {
+    } else if (get_address_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
     if (ctx->pm_base_enabled) {
         tcg_gen_or_tl(addr, addr, pm_base);
     }
+
     return addr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
     ctx->misa_mxl_max = env->misa_mxl_max;
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
+    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
should also take MPRV into consideration. As pointer mask for instruction
is not supported currently, so we can directly update cur_pmbase/pmmask
based on address related mode and xlen affected by MPRV now.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  7 +++++--
 target/riscv/csr.c        | 27 ++++++++++++++++++++-------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env)
 {
     target_ulong mask = 0, base = 0;
+    RISCVMXL xl = env->xl;
     /*
      * TODO: Current RVJ spec does not specify
      * how the extension interacts with XLEN.
      */
 #ifndef CONFIG_USER_ONLY
+    int mode = cpu_address_mode(env);
+    xl = cpu_get_xl(env, mode);
     if (riscv_has_ext(env, RVJ)) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             if (env->mmte & M_PM_ENABLE) {
                 mask = env->mpmmask;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_update_mask(CPURISCVState *env)
         }
     }
 #endif
-    if (env->xl == MXL_RV32) {
+    if (xl == MXL_RV32) {
         env->cur_pmmask = mask & UINT32_MAX;
         env->cur_pmbase = base & UINT32_MAX;
     } else {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
      */
     if (env->debugger) {
         env->xl = cpu_recompute_xl(env);
-        riscv_cpu_update_mask(env);
     }
+
+    riscv_cpu_update_mask(env);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmmask = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmmask = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmmask = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmbase = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmbase = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmbase = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
-- 
2.40.1

From: Bin Meng <bmeng@tinylab.org>

Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.

The v1.3 release includes the following commits:

440fa81 treewide: Replace TRUE/FALSE with true/false
6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
65638f8 lib: utils/sys: Allow custom HTIF base address for RV32
f14595a lib: sbi: Allow platform to influence cold boot HART selection
6957ae0 platform: generic: Allow platform_override to select cold boot HART
cb7e7c3 platform: generic: Allow platform_override to perform firmware init
8020df8 generic/starfive: Add Starfive JH7110 platform implementation
6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
9e397e3 docs: domain_support: Use capital letter for privilege modes
9e0ba09 include: sbi: Fine grain the permissions for M and SU modes
aace1e1 lib: sbi: Use finer permission semantics for address validation
22dbdb3 lib: sbi: Add permissions for the firmware start till end
1ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
44f736c lib: sbi: Modify the boot time region flag prints
20646e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
3e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
59a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
001106d docs: Update domain's region permissions and requirements
da5594b platform: generic: allwinner: Fix PLIC array bounds
ce2a834 docs: generic.md: fix typo of andes-ae350
8ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
b1818ee include: types: add always inline compiler attribute
9c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
787296a platform: andes/ae350: Implement hart hotplug using HSM extension
7aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
a990309 lib: utils: Fix reserved memory node for firmware memory
fefa548 firmware: Split RO/RX and RW sections
2f40a99 firmware: Move dynsym and reladyn sections to RX section
c10e3fe firmware: Add RW section offset in scratch
b666760 lib: sbi: Print the RW section offset
230278d lib: sbi: Add separate entries for firmware RX and RW regions
dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
33bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
c45992c platform: generic: allwinner: Advertise nonretentive suspend
c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
8050081 firmware: Not to clear all the MIP
84d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
199189b lib: utils: Mark only the largest region as reserved in FDT
66b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
642f3de Makefile: Add missing .dep files for fw_*.elf.ld
09b34d8 include: Add support for byteorder/endianness conversion
680bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
b224ddb include: types: Add typedefs for endianness
aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
e3bf1af include: Add defines for SBI debug console extension
0ee3a86 lib: sbi: Add sbi_nputs() function
4e0572f lib: sbi: Add sbi_ngets() function
eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
5a41a38 lib: sbi: Implement SBI debug console extension
c43903c lib: sbi: Add console_puts() callback in the console device
29285ae lib: utils/serial: Implement console_puts() for semihosting
65c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
321293c lib: utils/fdt: Fix fdt_pmu.c header dependency
aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
745aaec platform: generic/andes: Fix ae350.c header dependency
99d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
6861ee9 lib: utils: fdt_fixup: Fix compile error
4f2be40 docs: fix typo in fw.md
30ea806 lib: sbi_hart: Enable hcontext and scontext
81adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
31b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
2491242 platform: generic: renesas: rzfive: Configure the PMA region
67b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
5a75f53 lib: sbi/sbi_domain: cosmetic style fixes
bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
17b3776 docs: domain_support: Update the DT example
1364d5a lib: sbi_hsm: Factor out invalid state detection
40f16a8 lib: sbi_hsm: Don't try to restore state on failed change
c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
b1ae6ef lib: sbi_hsm: Move misplaced comment
07673fc lib: sbi_hsm: Remove unnecessary include
8a40306 lib: sbi_hsm: Export some functions
73623a0 lib: sbi: Add system suspend skeleton
c9917b6 lib: sbi: Add system_suspend_allowed domain property
7c964e2 lib: sbi: Implement system suspend
37558dc docs: Correct opensbi-domain property name
5ccebf0 platform: generic: Add system suspend test
908be1b gpio/starfive: add gpio driver and support gpio reset
4b28afc make: Add a command line option for debugging OpenSBI
e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
568ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
506144f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
1fe8dc9 lib: sbi_pmu: add callback for counter width
51951d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
60c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
548e4b4 lib: sbi_pmu: Rename fw_counter_value
b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
641d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
57d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
73ab11d lib: sbi: Fix how to check whether the domain contains fw_region
f64dfcd lib: sbi: Introduce sbi_entry_count() function
30b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
8e90259 lib: sbi_hart: clear mip csr during hart init
45ba2b2 include: Add defines for SBI CPPC extension
33caae8 lib: sbi: Implement SBI CPPC extension
91767d0 lib: sbi: Print the CPPC device name
edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
2868f26 lib: utils: fdt_fixup: avoid buffer overrun
66fa925 lib: sbi: Optimize sbi_tlb
24dde46 lib: sbi: Optimize sbi_ipi
80078ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
f692289 firmware: Optimize loading relocation type
e41dbb5 firmware: Change to use positive offset to access relocation entries
bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
674e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
7919530 lib: sbi: Add debug print when sbi_pmu_init fails
4e33530 lib: sbi: Remove unnecessary semicolon
6bc02de lib: sbi: Simplify sbi_ipi_process remove goto
dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
f58c140 lib: sbi: Introduce register_extensions extension callback
e307ba7 lib: sbi: Narrow vendor extension range
042f0c3 lib: sbi: pmu: Remove unnecessary probe function
8b952d4 lib: sbi: Only register available extensions
767b5fc lib: sbi: Optimize probe of srst/susp
c3e31cb lib: sbi: Remove 0/1 probe implementations
33f1722 lib: sbi: Document sbi_ecall_extension members
d4c46e0 Makefile: Dereference symlinks on install
8b99a7f lib: sbi: Fix return of sbi_console_init
264d0be lib: utils: Improve fdt_serial_init
9a0bdd0 lib: utils: Improve fdt_ipi
122f226 lib: utils: Improve fdt_timer
df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
bdde2ec lib: sbi: Align system suspend errors with spec
aad7a37 include: sbi_scratch: Add helper macros to access data type
5cf9a54 platform: Allow platforms to specify heap size
40d36a6 lib: sbi: Introduce simple heap allocator
2a04f70 lib: sbi: Print scratch size and usage at boot time
bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
ef4542d lib: sbi: Use heap for root domain creation
66daafe lib: sbi: Use scratch space to save per-HART domain pointer
fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
903e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
5a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
7e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
3c1c972 lib: utils/fdt: Use heap in FDT domain parsing
acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
1df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
355796c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
524feec docs: Add OpenSBI logo and use it in the top-level README.md
932be2c README.md: Improve project copyright information
8153b26 platform/lib: Set no-map attribute on all PMP regions
d64942f firmware: Fix find hart index
27c957a lib: reset: Move fdt_reset_init into generic_early_init
8bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
2552799 include: Bump-up version to 1.3

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index XXXXXXX..XXXXXXX 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
+Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
-- 
2.40.1

From: Bin Meng <bmeng@tinylab.org>

The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
Let's enable the 32-bit Spike OpenSBI boot testing.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/avocado/riscv_opensbi.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/riscv_opensbi.py
+++ b/tests/avocado/riscv_opensbi.py
@@ -XXX,XX +XXX,XX @@
 # later.  See the COPYING file in the top-level directory.
 
 from avocado_qemu import QemuSystemTest
-from avocado import skip
 from avocado_qemu import wait_for_console_pattern
 
 class RiscvOpenSBI(QemuSystemTest):
@@ -XXX,XX +XXX,XX @@ def boot_opensbi(self):
         wait_for_console_pattern(self, 'Platform Name')
         wait_for_console_pattern(self, 'Boot HART MEDELEG')
 
-    @skip("requires OpenSBI fix to work")
     def test_riscv32_spike(self):
         """
         :avocado: tags=arch:riscv32
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

The watchdog timer is in the always-on domain device of HiFive 1 rev b,
so this patch added the AON device to the sifive_e machine. This patch
only implemented the functionality of the watchdog timer.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/misc/sifive_e_aon.h |  60 +++++++
 hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
 hw/misc/Kconfig                |   3 +
 hw/misc/meson.build            |   1 +
 4 files changed, 383 insertions(+)
 create mode 100644 include/hw/misc/sifive_e_aon.h
 create mode 100644 hw/misc/sifive_e_aon.c

diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/sifive_e_aon.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) interface.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_SIFIVE_AON_H
+#define HW_SIFIVE_AON_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
+OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+enum {
+    SIFIVE_E_AON_WDT    = 0x0,
+    SIFIVE_E_AON_RTC    = 0x40,
+    SIFIVE_E_AON_LFROSC = 0x70,
+    SIFIVE_E_AON_BACKUP = 0x80,
+    SIFIVE_E_AON_PMU    = 0x100,
+    SIFIVE_E_AON_MAX    = 0x150
+};
+
+struct SiFiveEAONState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion mmio;
+
+    /*< watchdog timer >*/
+    QEMUTimer *wdog_timer;
+    qemu_irq wdog_irq;
+    uint64_t wdog_restart_time;
+    uint64_t wdogclk_freq;
+
+    uint32_t wdogcfg;
+    uint16_t wdogcmp0;
+    uint32_t wdogcount;
+    uint8_t wdogunlock;
+};
+
+#endif
diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/sifive_e_aon.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) for QEMU.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "sysemu/watchdog.h"
+#include "hw/qdev-properties.h"
+
+REG32(AON_WDT_WDOGCFG, 0x0)
+    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+REG32(AON_WDT_WDOGCOUNT, 0x8)
+    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
+REG32(AON_WDT_WDOGS, 0x10)
+REG32(AON_WDT_WDOGFEED, 0x18)
+REG32(AON_WDT_WDOGKEY, 0x1c)
+REG32(AON_WDT_WDOGCMP0, 0x20)
+
+static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
+{
+    int64_t now;
+    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
+        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
+        return;
+    }
+
+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    r->wdogcount += muldiv64(now - r->wdog_restart_time,
+                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
+
+    /* Clean the most significant bit. */
+    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+    r->wdog_restart_time = now;
+}
+
+static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
+{
+    uint16_t wdogs;
+    bool cmp_signal = false;
+    sifive_e_aon_wdt_update_wdogcount(r);
+    wdogs = (uint16_t)(r->wdogcount >>
+                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
+
+    if (wdogs >= r->wdogcmp0) {
+        cmp_signal = true;
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
+            r->wdogcount = 0;
+            wdogs = 0;
+        }
+    }
+
+    if (cmp_signal) {
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
+            watchdog_perform_action();
+        }
+        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
+    }
+
+    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
+
+    if (wdogs < r->wdogcmp0 &&
+        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
+         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
+        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        next += muldiv64((r->wdogcmp0 - wdogs) <<
+                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
+                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
+        timer_mod(r->wdog_timer, next);
+    } else {
+        timer_mod(r->wdog_timer, INT64_MAX);
+    }
+}
+
+/*
+ * Callback used when the timer set using timer_mod expires.
+ */
+static void sifive_e_aon_wdt_expired_cb(void *opaque)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG:
+        return r->wdogcfg;
+    case A_AON_WDT_WDOGCOUNT:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount;
+    case A_AON_WDT_WDOGS:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount >>
+               FIELD_EX32(r->wdogcfg,
+                          AON_WDT_WDOGCFG,
+                          SCALE);
+    case A_AON_WDT_WDOGFEED:
+        return 0;
+    case A_AON_WDT_WDOGKEY:
+        return r->wdogunlock;
+    case A_AON_WDT_WDOGCMP0:
+        return r->wdogcmp0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+
+    return 0;
+}
+
+static void
+sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    uint32_t value = val64;
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG: {
+        uint8_t new_en_always;
+        uint8_t new_en_core_awake;
+        uint8_t old_en_always;
+        uint8_t old_en_core_awake;
+        if (r->wdogunlock == 0) {
+            return;
+        }
+
+        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
+        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
+        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
+        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
+                                       EN_CORE_AWAKE);
+
+        if ((old_en_always ||
+             old_en_core_awake) == 1 &&
+            (new_en_always ||
+             new_en_core_awake) == 0) {
+            sifive_e_aon_wdt_update_wdogcount(r);
+        } else if ((old_en_always ||
+                    old_en_core_awake) == 0 &&
+                   (new_en_always ||
+                    new_en_core_awake) == 1) {
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogcfg = value;
+        r->wdogunlock = 0;
+        break;
+    }
+    case A_AON_WDT_WDOGCOUNT:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGS:
+        return;
+    case A_AON_WDT_WDOGFEED:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        if (value == SIFIVE_E_AON_WDOGFEED) {
+            r->wdogcount = 0;
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGKEY:
+        if (value == SIFIVE_E_AON_WDOGKEY) {
+            r->wdogunlock = 1;
+        }
+        break;
+    case A_AON_WDT_WDOGCMP0:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcmp0 = (uint16_t) value;
+        r->wdogunlock = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
+                      __func__, (int)addr, (int)value);
+    }
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        return sifive_e_aon_wdt_read(opaque, addr, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+    return 0;
+}
+
+static void
+sifive_e_aon_write(void *opaque, hwaddr addr,
+                   uint64_t val64, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        sifive_e_aon_wdt_write(opaque, addr, val64, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+}
+
+static const MemoryRegionOps sifive_e_aon_ops = {
+    .read = sifive_e_aon_read,
+    .write = sifive_e_aon_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static void sifive_e_aon_reset(DeviceState *dev)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(dev);
+
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
+    r->wdogcmp0 = 0xbeef;
+
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static void sifive_e_aon_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    SiFiveEAONState *r = SIFIVE_E_AON(obj);
+
+    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
+                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
+    sysbus_init_mmio(sbd, &r->mmio);
+
+    /* watchdog timer */
+    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                 sifive_e_aon_wdt_expired_cb, r);
+    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
+    sysbus_init_irq(sbd, &r->wdog_irq);
+}
+
+static Property sifive_e_aon_properties[] = {
+    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
+                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->reset = sifive_e_aon_reset;
+    device_class_set_props(dc, sifive_e_aon_properties);
+}
+
+static const TypeInfo sifive_e_aon_info = {
+    .name          = TYPE_SIFIVE_E_AON,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SiFiveEAONState),
+    .instance_init = sifive_e_aon_init,
+    .class_init    = sifive_e_aon_class_init,
+};
+
+static void sifive_e_aon_register_types(void)
+{
+    type_register_static(&sifive_e_aon_info);
+}
+
+type_init(sifive_e_aon_register_types)
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_TEST
 config SIFIVE_E_PRCI
     bool
 
+config SIFIVE_E_AON
+    bool
+
 config SIFIVE_U_OTP
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
 system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

Create the AON device when we realize the sifive_e machine.
This patch only implemented the functionality of the watchdog timer,
not all the functionality of the AON device.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_e.h |  9 ++++++---
 hw/riscv/sifive_e.c         | 17 +++++++++++++++--
 hw/riscv/Kconfig            |  1 +
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/gpio/sifive_gpio.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "hw/boards.h"
 
 #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
     /*< public >*/
     RISCVHartArrayState cpus;
     DeviceState *plic;
+    SiFiveEAONState aon;
     SIFIVEGPIOState gpio;
     MemoryRegion xip_mem;
     MemoryRegion mask_rom;
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 enum {
-    SIFIVE_E_UART0_IRQ  = 3,
-    SIFIVE_E_UART1_IRQ  = 4,
-    SIFIVE_E_GPIO0_IRQ0 = 8
+    SIFIVE_E_AON_WDT_IRQ  = 1,
+    SIFIVE_E_UART0_IRQ    = 3,
+    SIFIVE_E_UART1_IRQ    = 4,
+    SIFIVE_E_GPIO0_IRQ0   = 8
 };
 
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "chardev/char.h"
 #include "sysemu/sysemu.h"
 
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
                             TYPE_SIFIVE_GPIO);
+    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
+                            TYPE_SIFIVE_E_AON);
 }
 
 static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
-    create_unimplemented_device("riscv.sifive.e.aon",
-        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
 
+    /* AON */
+
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
+        return;
+    }
+
+    /* Map AON registers */
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
+
     /* GPIO */
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
                            qdev_get_gpio_in(DEVICE(s->plic),
                                             SIFIVE_E_GPIO0_IRQ0 + i));
     }
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
+                       qdev_get_gpio_in(DEVICE(s->plic),
+                                        SIFIVE_E_AON_WDT_IRQ));
 
     sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     select SIFIVE_PLIC
     select SIFIVE_UART
     select SIFIVE_E_PRCI
+    select SIFIVE_E_AON
     select UNIMP
 
 config SIFIVE_U
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

Add some simple tests of the watchdog timer in the always-on domain device
of HiFive 1 rev b.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
 tests/qtest/meson.build                  |   3 +
 2 files changed, 453 insertions(+)
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c

diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/sifive-e-aon-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the watchdog timer of HiFive 1 rev b.
+ *
+ * Copyright (c) 2023 SiFive, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/bitops.h"
+#include "libqtest.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+
+FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+
+#define WDOG_BASE (0x10000000)
+#define WDOGCFG (0x0)
+#define WDOGCOUNT (0x8)
+#define WDOGS (0x10)
+#define WDOGFEED (0x18)
+#define WDOGKEY (0x1c)
+#define WDOGCMP0 (0x20)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+static void test_init(QTestState *qts)
+{
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+}
+
+static void test_wdogcount(void)
+{
+    uint64_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcfg(void)
+{
+    uint32_t tmp_cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcmp0(void)
+{
+    uint32_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogkey(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogfeed(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_wdogs(void)
+{
+    uint32_t cfg;
+    uint32_t fake_count = 0x12345678;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
+    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             (uint16_t)fake_count);
+
+    for (int i = 0; i < 16; i++) {
+        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
+        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+                 (uint16_t)(fake_count >>
+                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
+    }
+
+    qtest_quit(qts);
+}
+
+static void test_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_periodic_int(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_enable_disable(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char *argv[])
+{
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
+                   test_wdogcount);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
+                   test_wdogcfg);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
+                   test_wdogcmp0);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
+                   test_wdogkey);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
+                   test_wdogfeed);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
+                   test_scaled_wdogs);
+    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
+                   test_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
+                   test_scaled_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
+                   test_periodic_int);
+    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
+                   test_enable_disable);
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_s390x = \
    'cpu-plug-test',
    'migration-test']
 
+qtests_riscv32 = \
+  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
+
 qos_test_ss = ss.source_set()
 qos_test_ss.add(
   'ac97-test.c',
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

We want to keep the ability to distinct between 32/64-bit host.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-2-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
 
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
 supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
-supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
+supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
   'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
 
 cpu = host_machine.cpu_family()
 
-# Unify riscv* to a single family.
-if cpu in ['riscv32', 'riscv64']
-  cpu = 'riscv'
-endif
-
 target_dirs = config_host['TARGET_DIRS'].split()
 have_linux_user = false
 have_bsd_user = false
@@ -XXX,XX +XXX,XX @@ elif cpu == 'x86'
   host_arch = 'i386'
 elif cpu == 'mips64'
   host_arch = 'mips'
+elif cpu in ['riscv32', 'riscv64']
+  host_arch = 'riscv'
 else
   host_arch = cpu
 endif
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv']
+elif cpu in ['riscv32', 'riscv64']
   kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
 else
   kvm_targets = []
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Per Anup Patel in [*]:

> Currently, we only support running rv64 guest on rv64 host
 > and rv32 guest on rv32 host.
 >
 > In the future, we might support running rv32 guest on rv64
 > host but as of now we don't see a strong push for it.

Therefore, when only using the KVM accelerator it is pointless
to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
on a rv32 host). Restrict meson to only build the correct binary,
avoiding to waste ressources building unusable code.

[*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv32', 'riscv64']
-  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
+elif cpu in ['riscv32']
+  kvm_targets = ['riscv32-softmmu']
+elif cpu in ['riscv64']
+  kvm_targets = ['riscv64-softmmu']
 else
   kvm_targets = []
 endif
-- 
2.40.1

From: Ivan Klokov <ivan.klokov@syntacore.com>

Print RvV extension register to log if VPU option is enabled.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
+/*
+ * From vector_helper.c
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing bytes needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define BYTE(x)   ((x) ^ 7)
+#else
+#define BYTE(x)   (x)
+#endif
+
 /*
  * Here are the ordering rules of extension naming defined by RISC-V
  * specification :
@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
     "f30/ft10", "f31/ft11"
 };
 
+const char * const riscv_rvv_regnames[] = {
+  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
+  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
+  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
+  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
+  "v28", "v29", "v30", "v31"
+};
+
 static const char * const riscv_excp_names[] = {
     "misaligned_fetch",
     "fault_fetch",
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    int i;
+    int i, j;
+    uint8_t *p;
 
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVH)) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             }
         }
     }
+    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
+        static const int dump_rvv_csrs[] = {
+                    CSR_VSTART,
+                    CSR_VXSAT,
+                    CSR_VXRM,
+                    CSR_VCSR,
+                    CSR_VL,
+                    CSR_VTYPE,
+                    CSR_VLENB,
+                };
+        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
+            int csrno = dump_rvv_csrs[i];
+            target_ulong val = 0;
+            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
+
+            /*
+             * Rely on the smode, hmode, etc, predicates within csr.c
+             * to do the filtering of the registers that are present.
+             */
+            if (res == RISCV_EXCP_NONE) {
+                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
+                             csr_ops[csrno].name, val);
+            }
+        }
+        uint16_t vlenb = cpu->cfg.vlen >> 3;
+
+        for (i = 0; i < 32; i++) {
+            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
+            p = (uint8_t *)env->vreg;
+            for (j = vlenb - 1 ; j >= 0; j--) {
+                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
+            }
+            qemu_fprintf(f, "\n");
+        }
+    }
 }
 
 static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The Advanced Core Local Interruptor (ACLINT) device can
only be used with TCG. Check for TCG enabled instead of
KVM being not. Only add the property when TCG is used.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629121103.87733-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst |  1 +
 hw/riscv/virt.c            | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
 
   When this option is "on", ACLINT devices will be emulated instead of
   SiFive CLINT. When not specified, this option is assumed to be "off".
+  This option is restricted to the TCG accelerator.
 
 - aia=[none|aplic|aplic-imsic]
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/tcg.h"
 #include "sysemu/kvm.h"
 #include "sysemu/tpm.h"
 #include "hw/pci/pci.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         g_free(clust_name);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 create_fdt_socket_aclint(s, memmap, socket,
                     &intc_phandles[phandle_pos]);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                 hart_count, &error_abort);
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
                     /* Per-socket ACLINT MTIMER */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
 
-    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
-                                   virt_set_aclint);
-    object_class_property_set_description(oc, "aclint",
-                                          "Set on/off to enable/disable "
-                                          "emulating ACLINT devices");
-
+    if (tcg_enabled()) {
+        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
+                                       virt_set_aclint);
+        object_class_property_set_description(oc, "aclint",
+                                              "Set on/off to enable/disable "
+                                              "emulating ACLINT devices");
+    }
     object_class_property_add_str(oc, "aia", virt_get_aia,
                                   virt_set_aia);
     object_class_property_set_description(oc, "aia",
-- 
2.40.1

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new syscall for the
"RISC-V Hardware Probing Interface"
(https://docs.kernel.org/riscv/hwprobe.html).

Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/syscall32_nr.h |   1 +
 linux-user/riscv/syscall64_nr.h |   1 +
 linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
 3 files changed, 148 insertions(+)

diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/syscall32_nr.h
+++ b/linux-user/riscv/syscall32_nr.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_NR_accept4 242
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
 #define TARGET_NR_fanotify_mark 263
diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/syscall64_nr.h
+++ b/linux-user/riscv/syscall64_nr.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_NR_recvmmsg 243
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_wait4 260
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 }
 #endif /* TARGET_NR_getdents64 */
 
+#if defined(TARGET_NR_riscv_hwprobe)
+
+#define RISCV_HWPROBE_KEY_MVENDORID     0
+#define RISCV_HWPROBE_KEY_MARCHID       1
+#define RISCV_HWPROBE_KEY_MIMPID        2
+
+#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
+#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+
+#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
+#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+#define     RISCV_HWPROBE_IMA_C        (1 << 1)
+
+#define RISCV_HWPROBE_KEY_CPUPERF_0     5
+#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
+
+struct riscv_hwprobe {
+    abi_llong  key;
+    abi_ullong value;
+};
+
+static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+                                    struct riscv_hwprobe *pair,
+                                    size_t pair_count)
+{
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
+
+    for (; pair_count > 0; pair_count--, pair++) {
+        abi_llong key;
+        abi_ullong value;
+        __put_user(0, &pair->value);
+        __get_user(key, &pair->key);
+        switch (key) {
+        case RISCV_HWPROBE_KEY_MVENDORID:
+            __put_user(cfg->mvendorid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MARCHID:
+            __put_user(cfg->marchid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MIMPID:
+            __put_user(cfg->mimpid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
+            value = riscv_has_ext(env, RVI) &&
+                    riscv_has_ext(env, RVM) &&
+                    riscv_has_ext(env, RVA) ?
+                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_IMA_EXT_0:
+            value = riscv_has_ext(env, RVF) &&
+                    riscv_has_ext(env, RVD) ?
+                    RISCV_HWPROBE_IMA_FD : 0;
+            value |= riscv_has_ext(env, RVC) ?
+                     RISCV_HWPROBE_IMA_C : pair->value;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_CPUPERF_0:
+            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
+            break;
+        default:
+            __put_user(-1, &pair->key);
+            break;
+        }
+    }
+}
+
+static int cpu_set_valid(abi_long arg3, abi_long arg4)
+{
+    int ret, i, tmp;
+    size_t host_mask_size, target_mask_size;
+    unsigned long *host_mask;
+
+    /*
+     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
+     * arg3 contains the cpu count.
+     */
+    tmp = (8 * sizeof(abi_ulong));
+    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
+    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
+                     ~(sizeof(*host_mask) - 1);
+
+    host_mask = alloca(host_mask_size);
+
+    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
+                                  arg4, target_mask_size);
+    if (ret != 0) {
+        return ret;
+    }
+
+    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
+        if (host_mask[i] != 0) {
+            return 0;
+        }
+    }
+    return -TARGET_EINVAL;
+}
+
+static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
+                                 abi_long arg2, abi_long arg3,
+                                 abi_long arg4, abi_long arg5)
+{
+    int ret;
+    struct riscv_hwprobe *host_pairs;
+
+    /* flags must be 0 */
+    if (arg5 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* check cpu_set */
+    if (arg3 != 0) {
+        ret = cpu_set_valid(arg3, arg4);
+        if (ret != 0) {
+            return ret;
+        }
+    } else if (arg4 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* no pairs */
+    if (arg2 == 0) {
+        return 0;
+    }
+
+    host_pairs = lock_user(VERIFY_WRITE, arg1,
+                           sizeof(*host_pairs) * (size_t)arg2, 0);
+    if (host_pairs == NULL) {
+        return -TARGET_EFAULT;
+    }
+    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
+    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
+    return 0;
+}
+#endif /* TARGET_NR_riscv_hwprobe */
+
 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
 #endif
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return ret;
 #endif
 
+#if defined(TARGET_NR_riscv_hwprobe)
+    case TARGET_NR_riscv_hwprobe:
+        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
+#endif
+
     default:
         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
         return -TARGET_ENOSYS;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
Add require check for BF16 extensions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h |  3 +++
 target/riscv/cpu.c     | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  4 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/fpu_helper.c                  | 12 +++++
 target/riscv/translate.c                   |  1 +
 target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
 6 files changed, 80 insertions(+), 6 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 
 /* Zce helper */
 DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+
+/* BF16 functions */
+DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
 # *** RV32 Zicond Standard Extension ***
 czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
 czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+
+# *** Zfbfmin Standard Extension ***
+fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
+fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
     float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_float64(frs1, true, &env->fp_status);
 }
+
+uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
+}
+
+uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
 #include "insn_trans/trans_svinval.c.inc"
+#include "insn_trans/trans_rvbf16.c.inc"
 #include "decode-xthead.c.inc"
 #include "insn_trans/trans_xthead.c.inc"
 #include "insn_trans/trans_xventanacondops.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the BF16 Standard Extensions.
+ *
+ * Copyright (c) 2020-2023 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
+static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -XXX,XX +XXX,XX @@
     }                                  \
 } while (0)
 
-#define REQUIRE_ZFHMIN(ctx) do {              \
-    if (!ctx->cfg_ptr->ext_zfhmin) {          \
+#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
         return false;                         \
     }                                         \
 } while (0)
@@ -XXX,XX +XXX,XX @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
 static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
 
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zvfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 +
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/vector_helper.c               |  6 ++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
 4 files changed, 77 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
 /* BF16 functions */
 DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+
+DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
 # *** Zfbfmin Standard Extension ***
 fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
 fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+
+# *** Zvfbfmin Standard Extension ***
+vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
 
+RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
+GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
+
 /* Narrowing Floating-Point/Integer Type-Convert Instructions */
 /* (TD, T2, TX2) */
 #define NOP_UU_B uint8_t,  uint16_t, uint32_t
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
 
+RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
+GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
+
 /*
  * Vector Reduction Operations
  */
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
     mark_fs_dirty(ctx);
     return true;
 }
+
+static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfncvtbf16_f_f_w);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwcvtbf16_f_f_v);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zvfbfwma instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/vector_helper.c               | 11 ++++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
 4 files changed, 76 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
 
 DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
 DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
 # *** Zvfbfmin Standard Extension ***
 vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
 vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
+
+# *** Zvfbfwma Standard Extension ***
+vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
+vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
 GEN_VEXT_VF(vfwmacc_vf_h, 4)
 GEN_VEXT_VF(vfwmacc_vf_w, 8)
 
+static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
+{
+    return float32_muladd(bfloat16_to_float32(a, s),
+                          bfloat16_to_float32(b, s), d, 0, s);
+}
+
+RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
+GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
+RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
+GEN_VEXT_VF(vfwmaccbf16_vf, 4)
+
 static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFWMA(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
     }
     return false;
 }
+
+static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
+        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs1),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwmaccbf16_vv);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
+        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
+        uint32_t data = 0;
+
+        gen_set_rm(ctx, RISCV_FRM_DYN);
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
+                           gen_helper_vfwmaccbf16_vf, ctx);
+    }
+
+    return false;
+}
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
+    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
+    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
     DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
 
+    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
+
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.40.1

From: Jason Chien <jason.chien@sifive.com>

The privileged spec states:
For a memory access made to support VS-stage address translation (such as
to read/write a VS-level page table), permissions are checked as though
for a load or store, not for the original access type. However, any
exception is always reported for the original access type (instruction,
load, or store/AMO).

The current implementation converts the access type to LOAD if implicit
G-stage translation fails which results in only reporting "Load guest-page
fault". This commit removes the convertion of access type, so the reported
exception conforms to the spec.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_G_STAGE_FAIL) {
             first_stage_error = false;
             two_stage_indirect_error = true;
-            access_type = MMU_DATA_LOAD;
         }
 
         qemu_log_mask(CPU_LOG_MMU,
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_cm_jalt = 788,
     rv_op_czero_eqz = 789,
     rv_op_czero_nez = 790,
+    rv_op_fcvt_bf16_s = 791,
+    rv_op_fcvt_s_bf16 = 792,
+    rv_op_vfncvtbf16_f_f_w = 793,
+    rv_op_vfwcvtbf16_f_f_v = 794,
+    rv_op_vfwmaccbf16_vv = 795,
+    rv_op_vfwmaccbf16_vf = 796,
+    rv_op_flh = 797,
+    rv_op_fsh = 798,
+    rv_op_fmv_h_x = 799,
+    rv_op_fmv_x_h = 800,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
     { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
+    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
+    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
+    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
+    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vloxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_flh; break;
             case 2: op = rv_op_flw; break;
             case 3: op = rv_op_fld; break;
             case 4: op = rv_op_flq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vsoxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_fsh; break;
             case 2: op = rv_op_fsw; break;
             case 3: op = rv_op_fsd; break;
             case 4: op = rv_op_fsq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
             case 33:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_fcvt_d_q; break;
                 }
                 break;
+            case 34:
+                switch (((inst >> 20) & 0b11111)) {
+                case 8: op = rv_op_fcvt_bf16_s; break;
+                }
+                break;
             case 35:
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fclass_d; break;
                 }
                 break;
+            case 114:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_x_h; break;
+                }
+                break;
             case 115:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fmv_d_x; break;
                 }
                 break;
+            case 122:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_h_x; break;
+                }
+                break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 10: op = rv_op_vfwcvt_f_xu_v; break;
                     case 11: op = rv_op_vfwcvt_f_x_v; break;
                     case 12: op = rv_op_vfwcvt_f_f_v; break;
+                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
                     case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
                     case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
                     case 16: op = rv_op_vfncvt_xu_f_w; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 21: op = rv_op_vfncvt_rod_f_f_w; break;
                     case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
                     case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
+                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
                     }
                     break;
                 case 19:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wv; break;
                 case 54: op = rv_op_vfwsub_wv; break;
                 case 56: op = rv_op_vfwmul_vv; break;
+                case 59: op = rv_op_vfwmaccbf16_vv; break;
                 case 60: op = rv_op_vfwmacc_vv; break;
                 case 61: op = rv_op_vfwnmacc_vv; break;
                 case 62: op = rv_op_vfwmsac_vv; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wf; break;
                 case 54: op = rv_op_vfwsub_wf; break;
                 case 56: op = rv_op_vfwmul_vf; break;
+                case 59: op = rv_op_vfwmaccbf16_vf; break;
                 case 60: op = rv_op_vfwmacc_vf; break;
                 case 61: op = rv_op_vfwnmacc_vf; break;
                 case 62: op = rv_op_vfwmsac_vf; break;
-- 
2.40.1

From: "yang.zhang" <yang.zhang@hexintek.com>

Should set/get riscv all reg timer,i.e, time/compare/frequency/state.

Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 
 #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
     do { \
-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
         if (ret) { \
             abort(); \
         } \
-- 
2.40.1

From: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>

fdt_load_addr was previously declared as uint32_t which doe not match
with the return type of riscv_compute_fdt_addr().

This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
to match the riscv_compute_fdt_addr() return type.

This fixes calculating the fdt address when DRAM is mapped to higher
64-bit address.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
[ Change by AF:
 - Cleanup commit title and message
]
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
     target_ulong start_addr = memmap[VIRT_DRAM].base;
     target_ulong firmware_end_addr, kernel_start_addr;
     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     uint64_t kernel_entry = 0;
     BlockBackend *pflash_blk0;
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

As it is today it's not possible to use '-cpu host' if the RISC-V host
has RVH enabled. This is the resulting error:

$ ./qemu/build/qemu-system-riscv64 \
    -machine virt,accel=kvm -m 2G -smp 1 \
    -nographic -snapshot -kernel ./guest_imgs/Image  \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
qemu-system-riscv64: H extension requires priv spec 1.12.0

This happens because we're checking for priv spec for all CPUs, and
since we're not setting  env->priv_ver for the 'host' CPU, it's being
default to zero (i.e. PRIV_SPEC_1_10_0).

In reality env->priv_ver does not make sense when running with the KVM
'host' CPU. It's used to gate certain CSRs/extensions during translation
to make them unavailable if the hart declares an older spec version. It
doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
are available [1].

'priv_ver' is just one example. We're doing a lot of feature validation
and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
Validating the feature set for those CPUs is a KVM problem that should
be handled in KVM specific code.

The new riscv_cpu_realize_tcg() helper contains all validation logic that
are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
running TCG and, if it's the case, proceed with the usual TCG realize()
logic.

[1] lib/sbi/sbi_hart.c, hart_detect_features()

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "fpu/softfloat-helpers.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "kvm_riscv.h"
 #include "tcg/tcg.h"
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
     }
 }
 
-static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
 {
-    CPUState *cs = CPU(dev);
     RISCVCPU *cpu = RISCV_CPU(dev);
     CPURISCVState *env = &cpu->env;
-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
     Error *local_err = NULL;
 
-    cpu_exec_realizefn(cs, &local_err);
-    if (local_err != NULL) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     }
 
 #ifndef CONFIG_USER_ONLY
-    cs->tcg_cflags |= CF_PCREL;
+    CPU(dev)->tcg_cflags |= CF_PCREL;
 
     if (cpu->cfg.ext_sstc) {
         riscv_timer_init(cpu);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         }
      }
 #endif
+}
+
+static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+{
+    CPUState *cs = CPU(dev);
+    RISCVCPU *cpu = RISCV_CPU(dev);
+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+    Error *local_err = NULL;
+
+    cpu_exec_realizefn(cs, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (tcg_enabled()) {
+        riscv_cpu_realize_tcg(dev, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
 
     riscv_cpu_finalize_features(cpu, &local_err);
     if (local_err != NULL) {
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The absence of a satp mode in riscv_host_cpu_init() is causing the
following error:

$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
    -m 2G -smp 1  -nographic -snapshot \
    -kernel ./guest_imgs/Image \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
**
ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
reached
Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
not be reached
Aborted

The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.

For this KVM cpu we would need to inherit the satp supported modes
from the RISC-V host. At this moment this is not possible because the
KVM driver does not support it. And even when it does we can't just let
this broken for every other older kernel.

Since mmu-type is not a required node, according to [1], skip the
'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
logic when we can get satp information from KVM.

[1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
             s->soc[socket].hartid_base + cpu);
         qemu_fdt_add_subnode(ms->fdt, cpu_name);
 
-        satp_mode_max = satp_mode_max_from_map(
-            s->soc[socket].harts[cpu].cfg.satp_mode.map);
-        sv_name = g_strdup_printf("riscv,%s",
-                                  satp_mode_str(satp_mode_max, is_32_bit));
-        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
-        g_free(sv_name);
-
+        if (cpu_ptr->cfg.satp_mode.supported != 0) {
+            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
+            sv_name = g_strdup_printf("riscv,%s",
+                                      satp_mode_str(satp_mode_max, is_32_bit));
+            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+            g_free(sv_name);
+        }
 
         name = riscv_isa_string(cpu_ptr);
         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're going to change the handling of mvendorid/marchid/mimpid by the
KVM driver. Since these are always present in all CPUs let's put the
same validation for everyone.

It doesn't make sense to allow 'mvendorid' to be different than it
is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
any 'mvendorid' they want.

Change 'mvendorid' to be a class property created via
'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
macro. This allow us to define a custom setter for it that will verify,
for named CPUs, if mvendorid is different than it is already set by the
CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
set to an invalid value:

$ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
    Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
+static bool riscv_cpu_is_dynamic(Object *cpu_obj)
+{
+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
+}
+
+static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint32_t prev_val = cpu->cfg.mvendorid;
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mvendorid = value;
+}
+
+static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mvendorid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops = &riscv_tcg_ops;
 
+    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
+                              cpu_set_mvendorid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Following the same logic used with 'mvendorid' let's also restrict
'mimpid' for named CPUs. Generic CPUs keep setting the value freely.

Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
reason is that this is not a good default since it's dynamic, changing
with with every QEMU version, regardless of whether the actual
implementation of the CPU changed from one QEMU version to the other.
Named CPU should set it to a meaningful value instead and generic CPUs
can set whatever they want.

This is the error thrown for an invalid 'mimpid' value for the veyron-v1
CPU:

$ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
    Unable to change veyron-v1-riscv-cpu mimpid (0x111)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
                              (QEMU_VERSION_MINOR << 8)  | \
                              (QEMU_VERSION_MICRO))
-#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
 
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.mimpid;
+    uint64_t value;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mimpid = value;
+}
+
+static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mimpid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
                               cpu_set_mvendorid, NULL, NULL);
 
+    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
+                              cpu_set_mimpid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'marchid' shouldn't be set to a different value as previously set for
named CPUs.

For all other CPUs it shouldn't be freely set either - the spec requires
that 'marchid' can't have the MSB (most significant bit) set and every
other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
32 bit CPUs.

As with 'mimpid', setting a default value based on the current QEMU
version is not a good idea because it implies that the CPU
implementation changes from one QEMU version to the other. Named CPUs
should set 'marchid' to a meaningful value instead, and generic CPUs can
set to any valid value.

For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
a different val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
    Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)

And, for generics CPUs, this is the error when trying to set to an
invalid val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
    Unable to set marchid with MSB (64) bit set and the remaining bits zero

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 
 /* RISC-V CPU definitions */
-
-#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
-                             (QEMU_VERSION_MINOR << 8)  | \
-                             (QEMU_VERSION_MICRO))
-
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
 #endif
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.marchid;
+    uint64_t value, invalid_val;
+    uint32_t mxlen = 0;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    switch (riscv_cpu_mxl(&cpu->env)) {
+    case MXL_RV32:
+        mxlen = 32;
+        break;
+    case MXL_RV64:
+    case MXL_RV128:
+        mxlen = 64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    invalid_val = 1LL << (mxlen - 1);
+
+    if (value == invalid_val) {
+        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
+                         "and the remaining bits zero", mxlen);
+        return;
+    }
+
+    cpu->cfg.marchid = value;
+}
+
+static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.marchid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
                               cpu_set_mimpid, NULL, NULL);
 
+    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
+                              cpu_set_marchid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Certain validations, such as the validations done for the machine IDs
(mvendorid/marchid/mimpid), are done before starting the CPU.
Non-dynamic (named) CPUs tries to match user input with a preset
default. As it is today we can't prefetch a KVM default for these cases
because we're only able to read/write KVM regs after the vcpu is
spinning.

Our target/arm friends use a concept called "scratch CPU", which
consists of creating a vcpu for doing queries and validations and so on,
which is discarded shortly after use [1]. This is a suitable solution
for what we need so let's implement it in target/riscv as well.

kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
a KVM scratch CPU, fetch KVM regs that work as default values for user
properties, and then discard the scratch CPU afterwards.

We're starting by initializing 'mvendorid'. This concept will be used to
init other KVM specific properties in the next patches as well.

[1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |  1 +
 target/riscv/cpu.c       |  6 +++
 target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 92 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_KVM_RISCV_H
 #define QEMU_KVM_RISCV_H
 
+void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     Property *prop;
     DeviceState *dev = DEVICE(obj);
 
+#ifndef CONFIG_USER_ONLY
+    if (kvm_enabled()) {
+        kvm_riscv_init_user_properties(obj);
+    }
+#endif
+
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
+typedef struct KVMScratchCPU {
+    int kvmfd;
+    int vmfd;
+    int cpufd;
+} KVMScratchCPU;
+
+/*
+ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
+ * from target/arm/kvm.c.
+ */
+static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    int kvmfd = -1, vmfd = -1, cpufd = -1;
+
+    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+    if (kvmfd < 0) {
+        goto err;
+    }
+    do {
+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
+    } while (vmfd == -1 && errno == EINTR);
+    if (vmfd < 0) {
+        goto err;
+    }
+    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
+    if (cpufd < 0) {
+        goto err;
+    }
+
+    scratch->kvmfd =  kvmfd;
+    scratch->vmfd = vmfd;
+    scratch->cpufd = cpufd;
+
+    return true;
+
+ err:
+    if (cpufd >= 0) {
+        close(cpufd);
+    }
+    if (vmfd >= 0) {
+        close(vmfd);
+    }
+    if (kvmfd >= 0) {
+        close(kvmfd);
+    }
+
+    return false;
+}
+
+static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    close(scratch->cpufd);
+    close(scratch->vmfd);
+    close(scratch->kvmfd);
+}
+
+static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mvendorid from host, error %d", ret);
+    }
+}
+
+void kvm_riscv_init_user_properties(Object *cpu_obj)
+{
+    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+    KVMScratchCPU kvmcpu;
+
+    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
+        return;
+    }
+
+    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+
+    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+}
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Allow 'marchid' and 'mimpid' to also be initialized in
kvm_riscv_init_machine_ids().

After this change, the handling of mvendorid/marchid/mimpid for the
'host' CPU type will be equal to what we already have for TCG named
CPUs, i.e. the user is not able to set these values to a different val
than the one that is already preset.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(marchid));
+    reg.addr = (uint64_t)&cpu->cfg.marchid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve marchid from host, error %d", ret);
+    }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mimpid));
+    reg.addr = (uint64_t)&cpu->cfg.mimpid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mimpid from host, error %d", ret);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

After changing user validation for mvendorid/marchid/mimpid to guarantee
that the value is validated on user input time, coupled with the work in
fetching KVM default values for them by using a scratch CPU, we're
certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
already good to be written back to KVM.

There's no need to write the values back for 'host' type CPUs since the
values can't be changed, so let's do that just for generic CPUs.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
 
+static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id;
+    int ret;
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(marchid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mimpid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
+
+    return ret;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
     env->misa_ext = isa;
 
+    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+        ret = kvm_vcpu_set_machine_ids(cpu, cs);
+    }
+
     return ret;
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

At this moment we're retrieving env->misa_ext during
kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.

We want to set env->misa_ext_mask, and we want to set it as early as
possible. The reason is that we're going to use it in the validation
process of the KVM MISA properties we're going to add next. Setting it
during arch_init_cpu() is too late for user validation.

Move the code to a new helper that is going to be called during init()
time, via kvm_riscv_init_user_properties(), like we're already doing for
the machine ID properties. Set both misa_ext and misa_ext_mask to the
same value retrieved by the 'isa' config reg.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     }
 }
 
+static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
+                                         KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(isa));
+    reg.addr = (uint64_t)&env->misa_ext_mask;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+
+    if (ret) {
+        error_report("Unable to fetch ISA register from KVM, "
+                     "error %d", ret);
+        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+        exit(EXIT_FAILURE);
+    }
+
+    env->misa_ext = env->misa_ext_mask;
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     }
 
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
-    target_ulong isa;
     RISCVCPU *cpu = RISCV_CPU(cs);
-    CPURISCVState *env = &cpu->env;
-    uint64_t id;
 
     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(isa));
-    ret = kvm_get_one_reg(cs, id, &isa);
-    if (ret) {
-        return ret;
-    }
-    env->misa_ext = isa;
-
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
     }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Next patch will add KVM specific user properties for both MISA and
multi-letter extensions. For MISA extensions we want to make use of what
is already available in misa_ext_cfgs[] to avoid code repetition.

misa_ext_info_arr[] array will hold name and description for each MISA
extension that misa_ext_cfgs[] is declaring. We'll then use this new
array in KVM code to avoid duplicating strings. Two getters were added
to allow KVM to retrieve the 'name' and 'description' for each MISA
property.

There's nothing holding us back from doing the same with multi-letter
extensions. For now doing just with MISA extensions is enough.

It is worth documenting that even using the __bultin_ctz() directive to
populate the misa_ext_info_arr[] we are forced to assign 'name' and
'description' during runtime in riscv_cpu_add_misa_properties(). The
reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
throw errors like this if we fetch 'name' and 'description' from the
array in the MISA_CFG() macro:

../target/riscv/cpu.c:1624:5: error: initializer element is not a
                              compile-time constant
    MISA_CFG(RVA, true),
    ^~~~~~~~~~~~~~~~~~~
../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
    {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~

gcc and others compilers/builders were fine with that change. We can't
ignore failures in the Gitlab pipeline though, so code was changed to
make every runner happy.

As a side effect, misa_ext_cfg[] is no longer a 'const' array because
it must be set during runtime.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |   7 ++-
 target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
 2 files changed, 88 insertions(+), 29 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
-/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
+/*
+ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
+ * when adding new MISA bits here.
+ */
 #define RVI RV('I')
 #define RVE RV('E') /* E and I are mutually exclusive */
 #define RVM RV('M')
@@ -XXX,XX +XXX,XX @@
 #define RVJ RV('J')
 #define RVG RV('G')
 
+const char *riscv_get_misa_ext_name(uint32_t bit);
+const char *riscv_get_misa_ext_description(uint32_t bit);
 
 /* Privileged specification version */
 enum {
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
-static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-    {.name = "a", .description = "Atomic instructions",
-     .misa_bit = RVA, .enabled = true},
-    {.name = "c", .description = "Compressed instructions",
-     .misa_bit = RVC, .enabled = true},
-    {.name = "d", .description = "Double-precision float point",
-     .misa_bit = RVD, .enabled = true},
-    {.name = "f", .description = "Single-precision float point",
-     .misa_bit = RVF, .enabled = true},
-    {.name = "i", .description = "Base integer instruction set",
-     .misa_bit = RVI, .enabled = true},
-    {.name = "e", .description = "Base integer instruction set (embedded)",
-     .misa_bit = RVE, .enabled = false},
-    {.name = "m", .description = "Integer multiplication and division",
-     .misa_bit = RVM, .enabled = true},
-    {.name = "s", .description = "Supervisor-level instructions",
-     .misa_bit = RVS, .enabled = true},
-    {.name = "u", .description = "User-level instructions",
-     .misa_bit = RVU, .enabled = true},
-    {.name = "h", .description = "Hypervisor",
-     .misa_bit = RVH, .enabled = true},
-    {.name = "x-j", .description = "Dynamic translated languages",
-     .misa_bit = RVJ, .enabled = false},
-    {.name = "v", .description = "Vector operations",
-     .misa_bit = RVV, .enabled = false},
-    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
-     .misa_bit = RVG, .enabled = false},
+typedef struct misa_ext_info {
+    const char *name;
+    const char *description;
+} MISAExtInfo;
+
+#define MISA_INFO_IDX(_bit) \
+    __builtin_ctz(_bit)
+
+#define MISA_EXT_INFO(_bit, _propname, _descr) \
+    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
+
+static const MISAExtInfo misa_ext_info_arr[] = {
+    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
+    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
+    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
+    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
+    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
+    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
+    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
+    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
+    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
+    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
+    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
+    MISA_EXT_INFO(RVV, "v", "Vector operations"),
+    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
+};
+
+static int riscv_validate_misa_info_idx(uint32_t bit)
+{
+    int idx;
+
+    /*
+     * Our lowest valid input (RVA) is 1 and
+     * __builtin_ctz() is UB with zero.
+     */
+    g_assert(bit != 0);
+    idx = MISA_INFO_IDX(bit);
+
+    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
+    return idx;
+}
+
+const char *riscv_get_misa_ext_name(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].name;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+const char *riscv_get_misa_ext_description(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].description;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+#define MISA_CFG(_bit, _enabled) \
+    {.misa_bit = _bit, .enabled = _enabled}
+
+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+    MISA_CFG(RVA, true),
+    MISA_CFG(RVC, true),
+    MISA_CFG(RVD, true),
+    MISA_CFG(RVF, true),
+    MISA_CFG(RVI, true),
+    MISA_CFG(RVE, false),
+    MISA_CFG(RVM, true),
+    MISA_CFG(RVS, true),
+    MISA_CFG(RVU, true),
+    MISA_CFG(RVH, true),
+    MISA_CFG(RVJ, false),
+    MISA_CFG(RVV, false),
+    MISA_CFG(RVG, false),
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
     int i;
 
     for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
-        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        int bit = misa_cfg->misa_bit;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
 
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Using all TCG user properties in KVM is tricky. First because KVM
supports only a small subset of what TCG provides, so most of the
cpu->cfg flags do nothing for KVM.

Second, and more important, we don't have a way of telling if any given
value is an user input or not. For TCG this has a small impact since we
just validating everything and error out if needed. But for KVM it would
be good to know if a given value was set by the user or if it's a value
already provided by KVM. Otherwise we don't know how to handle failed
kvm_set_one_regs() when writing the configurations back.

These characteristics make it overly complicated to use the same user
facing flags for both KVM and TCG. A simpler approach is to create KVM
specific properties that have specialized logic, forking KVM and TCG use
cases for those cases only. Fully separating KVM/TCG properties is
unneeded at this point - in fact we want the user experience to be as
equal as possible, regardless of the acceleration chosen.

We'll start this fork with the MISA properties, adding the MISA bits
that the KVM driver currently supports. A new KVMCPUConfig type is
introduced. It'll hold general information about an extension. For MISA
extensions we're going to use the newly created getters of
misa_ext_infos[] to populate their name and description. 'offset' holds
the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
'misa_bit' because this same KVMCPUConfig struct will be used to
multi-letter extensions later on.

This new type also holds a 'user_set' flag. This flag will be set when
the user set an option that's different than what is already configured
in the host, requiring KVM intervention to write the regs back during
kvm_arch_init_vcpu(). Similar mechanics will be implemented for
multi-letter extensions as well.

There is no need to duplicate more code than necessary, so we're going
to use the existing kvm_riscv_init_user_properties() to add the KVM
specific properties. Any code that is adding a TCG user prop is then
changed slightly to verify first if there's a KVM prop with the same
name already added.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |  5 +++
 target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
         misa_cfg->name = riscv_get_misa_ext_name(bit);
         misa_cfg->description = riscv_get_misa_ext_description(bit);
 
+        /* Check if KVM already created the property */
+        if (object_property_find(cpu_obj, misa_cfg->name)) {
+            continue;
+        }
+
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
                             cpu_set_misa_ext_cfg,
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include <linux/kvm.h>
 
 #include "qemu/timer.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "qapi/visitor.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sysemu/kvm_int.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
         } \
     } while (0)
 
+typedef struct KVMCPUConfig {
+    const char *name;
+    const char *description;
+    target_ulong offset;
+    int kvm_reg_id;
+    bool user_set;
+} KVMCPUConfig;
+
+#define KVM_MISA_CFG(_bit, _reg_id) \
+    {.offset = _bit, .kvm_reg_id = _reg_id}
+
+/* KVM ISA extensions */
+static KVMCPUConfig kvm_misa_ext_cfgs[] = {
+    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
+    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
+    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
+    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
+    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
+    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
+    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
+};
+
+static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
+                                     const char *name,
+                                     void *opaque, Error **errp)
+{
+    KVMCPUConfig *misa_ext_cfg = opaque;
+    target_ulong misa_bit = misa_ext_cfg->offset;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    CPURISCVState *env = &cpu->env;
+    bool value, host_bit;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_bit = env->misa_ext_mask & misa_bit;
+
+    if (value == host_bit) {
+        return;
+    }
+
+    if (!value) {
+        misa_ext_cfg->user_set = true;
+        return;
+    }
+
+    /*
+     * Forbid users to enable extensions that aren't
+     * available in the hart.
+     */
+    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
+               "enabled in the host", misa_ext_cfg->name);
+}
+
+static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        int bit = misa_cfg->offset;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
+
+        object_property_add(cpu_obj, misa_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_misa_ext_cfg,
+                            NULL, misa_cfg);
+        object_property_set_description(cpu_obj, misa_cfg->name,
+                                        misa_cfg->description);
+    }
+}
+
 static int kvm_riscv_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
         return;
     }
 
+    kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Our design philosophy with KVM properties can be resumed in two main
decisions based on KVM interface availability and what the user wants to
do:

- if the user disables an extension that the host KVM module doesn't
know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
keep booting the CPU. This will avoid users having to deal with issues
with older KVM versions while disabling features they don't care;

- for any other case we're going to error out immediately. If the user
wants to enable a feature that KVM doesn't know about this a problem that
is worth aborting - the user must know that the feature wasn't enabled
in the hart. Likewise, if KVM knows about the extension, the user wants
to enable/disable it, and we fail to do it so, that's also a problem we
can't shrug it off.

In the case of MISA bits we won't even try enabling bits that aren't
already available in the host. The ioctl() is so likely to fail that
it's not worth trying. This check is already done in the previous patch,
in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.

In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
option and do as follows:

- if the user didn't set the property or set to the same value of the
host, do nothing;

- Disable the given extension in KVM. Error out if anything goes wrong.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
                "enabled in the host", misa_ext_cfg->name);
 }
 
+static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id, reg;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        target_ulong misa_bit = misa_cfg->offset;
+
+        if (!misa_cfg->user_set) {
+            continue;
+        }
+
+        /* If we're here we're going to disable the MISA bit */
+        reg = 0;
+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                              misa_cfg->kvm_reg_id);
+        ret = kvm_set_one_reg(cs, id, &reg);
+        if (ret != 0) {
+            /*
+             * We're not checking for -EINVAL because if the bit is about
+             * to be disabled, it means that it was already enabled by
+             * KVM. We determined that by fetching the 'isa' register
+             * during init() time. Any error at this point is worth
+             * aborting.
+             */
+            error_report("Unable to set KVM reg %s, error %d",
+                         misa_cfg->name, ret);
+            exit(EXIT_FAILURE);
+        }
+        env->misa_ext &= ~misa_bit;
+    }
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
+        if (ret != 0) {
+            return ret;
+        }
     }
 
+    kvm_riscv_update_cpu_misa_ext(cpu, cs);
+
     return ret;
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Let's add KVM user properties for the multi-letter extensions that KVM
currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
svinval and svpbmt.

As with MISA extensions, we're using the KVMCPUConfig type to hold
information about the state of each extension. However, multi-letter
extensions have more cases to cover than MISA extensions, so we're
adding an extra 'supported' flag as well. This flag will reflect if a
given extension is supported by KVM, i.e. KVM knows how to handle it.
This is determined during KVM extension discovery in
kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
other error will cause an abort.

The use of the 'user_set' is similar to what we already do with MISA
extensions: the flag set only if the user is changing the extension
state.

The 'supported' flag will be used later on to make an exception for
users that are disabling multi-letter extensions that are unknown to
KVM.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |   8 +++
 target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 127 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+#ifndef CONFIG_USER_ONLY
+        if (kvm_enabled()) {
+            /* Check if KVM created the property already */
+            if (object_property_find(obj, prop->name)) {
+                continue;
+            }
+        }
+#endif
         qdev_property_add_static(dev, prop);
     }
 
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ typedef struct KVMCPUConfig {
     target_ulong offset;
     int kvm_reg_id;
     bool user_set;
+    bool supported;
 } KVMCPUConfig;
 
 #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
     }
 }
 
+#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
+
+#define KVM_EXT_CFG(_name, _prop, _reg_id) \
+    {.name = _name, .offset = CPUCFG(_prop), \
+     .kvm_reg_id = _reg_id}
+
+static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
+    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
+    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
+    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
+    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
+    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
+    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
+    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+};
+
+static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
+                            uint32_t val)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    *ext_enabled = val;
+}
+
+static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
+                                KVMCPUConfig *multi_ext)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    return *ext_enabled;
+}
+
+static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *multi_ext_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    bool value, host_val;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
+
+    /*
+     * Ignore if the user is setting the same value
+     * as the host.
+     */
+    if (value == host_val) {
+        return;
+    }
+
+    if (!multi_ext_cfg->supported) {
+        /*
+         * Error out if the user is trying to enable an
+         * extension that KVM doesn't support. Ignore
+         * option otherwise.
+         */
+        if (value) {
+            error_setg(errp, "KVM does not support disabling extension %s",
+                       multi_ext_cfg->name);
+        }
+
+        return;
+    }
+
+    multi_ext_cfg->user_set = true;
+    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
         object_property_set_description(cpu_obj, misa_cfg->name,
                                         misa_cfg->description);
     }
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
+
+        object_property_add(cpu_obj, multi_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_multi_ext_cfg,
+                            NULL, multi_cfg);
+    }
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t val;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
+        struct kvm_one_reg reg;
+
+        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                                  multi_ext_cfg->kvm_reg_id);
+        reg.addr = (uint64_t)&val;
+        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+        if (ret != 0) {
+            if (errno == EINVAL) {
+                /* Silently default to 'false' if KVM does not support it. */
+                multi_ext_cfg->supported = false;
+                val = false;
+            } else {
+                error_report("Unable to read ISA_EXT KVM register %s, "
+                             "error %d", multi_ext_cfg->name, ret);
+                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+                exit(EXIT_FAILURE);
+            }
+        } else {
+            multi_ext_cfg->supported = true;
+        }
+
+        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
+    }
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
CONFIG_USER_ONLY" blocks after changes that added KVM properties
handling.

KVM specific properties are required to be created earlier than their
TCG counterparts, but the remaining props can be created at any order.
Move riscv_add_satp_mode_properties() to the start of the function,
inside the !CONFIG_USER_ONLY block already present there, to remove the
last ifndef block.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     DeviceState *dev = DEVICE(obj);
 
 #ifndef CONFIG_USER_ONLY
+    riscv_add_satp_mode_properties(obj);
+
     if (kvm_enabled()) {
         kvm_riscv_init_user_properties(obj);
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 #endif
         qdev_property_add_static(dev, prop);
     }
-
-#ifndef CONFIG_USER_ONLY
-    riscv_add_satp_mode_properties(obj);
-#endif
 }
 
 static Property riscv_cpu_properties[] = {
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

riscv_isa_string_ext() is being used by riscv_isa_string(), which is
then used by boards to retrieve the 'riscv,isa' string to be written in
the FDT. All this happens after riscv_cpu_realize(), meaning that we're
already past riscv_cpu_validate_set_extensions() and, more important,
riscv_cpu_disable_priv_spec_isa_exts().

This means that all extensions that needed to be disabled due to
priv_spec mismatch are already disabled. Checking this again during
riscv_isa_string_ext() is unneeded. Remove it.

As a bonus, riscv_isa_string_ext() can now be used with the 'host'
KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
would fail this check for no good reason.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
     int i;
 
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
-            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
             g_free(old);
             old = new;
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM-specific properties are being created inside target/riscv/kvm.c. But
at this moment we're gathering all the remaining properties from TCG and
adding them as is when running KVM. This creates a situation where
non-KVM properties are setting flags to 'true' due to its default
settings (e.g.  Zawrs). Users can also freely enable them via command
line.

This doesn't impact runtime per se because KVM doesn't care about these
flags, but code such as riscv_isa_string_ext() take those flags into
account. The result is that, for a KVM guest, setting non-KVM properties
will make them appear in the riscv,isa DT.

We want to keep the same API for both TCG and KVM and at the same time,
when running KVM, forbid non-KVM extensions to be enabled internally. We
accomplish both by changing riscv_cpu_add_user_properties() to add a
mock boolean property for every non-KVM extension in
riscv_cpu_extensions[]. Then, when running KVM, users are still free to
set extensions at will, but we'll error out if a non-KVM extension is
enabled. Setting such extension to 'false' will be ignored.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+
+#ifndef CONFIG_USER_ONLY
+static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+                                    const char *name,
+                                    void *opaque, Error **errp)
+{
+    const char *propname = opaque;
+    bool value;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    if (value) {
+        error_setg(errp, "extension %s is not available with KVM",
+                   propname);
+    }
+}
+#endif
+
 /*
  * Add CPU properties with user-facing flags.
  *
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
             if (object_property_find(obj, prop->name)) {
                 continue;
             }
+
+            /*
+             * Set the default to disabled for every extension
+             * unknown to KVM and error out if the user attempts
+             * to enable any of them.
+             *
+             * We're giving a pass for non-bool properties since they're
+             * not related to the availability of extensions and can be
+             * safely ignored as is.
+             */
+            if (prop->info == &qdev_prop_bool) {
+                object_property_add(obj, prop->name, "bool",
+                                    NULL, cpu_set_cfg_unavailable,
+                                    NULL, (void *)prop->name);
+                continue;
+            }
         }
 #endif
         qdev_property_add_static(dev, prop);
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're now ready to update the multi-letter extensions status for KVM.

kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
time to verify which user options changes host defaults (via the 'user_set'
flag) and tries to write them back to KVM.

Failure to commit a change to KVM is only ignored in case KVM doesn't
know about the extension (-EINVAL error code) and the user wanted to
disable the given extension. Otherwise we're going to abort the boot
process.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

There are 2 places in which we need to get a pointer to a certain
property of the cpu->cfg struct based on property offset. Next patch
will add a couple more.

Create a helper to avoid repeating this code over and over.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 };
 
+static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
+{
+    return (void *)&cpu->cfg + kvmcfg->offset;
+}
+
 static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
                             uint32_t val)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     *ext_enabled = val;
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
                                 KVMCPUConfig *multi_ext)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     return *ext_enabled;
 }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
Linux Kernel will fail to detect the availability of the CBOM/CBOZ
extensions, regardless of the contents of the 'riscv,isa' DT prop.

The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
so let's expose them as user properties like it is already done with
TCG.

This will also require us to determine proper blocksize values during
init() time since the FDT is already created during realize(). We'll
take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
don't need to fetch both cbom and cboz blocksizes every time: check for
their parent extensions (icbom and icboz) and only read the blocksizes
if needed.

In contrast with cbom|z_blocksize properties from TCG, the user is not
able to set any value that is different from the 'host' value when
running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
can be thrown for the mere attempt of executing kvm_set_one_reg() for
these 2 regs.

Hopefully we don't need to call kvm_set_one_reg() for these regs.
We'll check if the user input matches the host value in
kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
properties. We'll fail fast since it's already known to not be
supported.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 }
 
+static KVMCPUConfig kvm_cbom_blocksize = {
+    .name = "cbom_blocksize",
+    .offset = CPUCFG(cbom_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
+};
+
+static KVMCPUConfig kvm_cboz_blocksize = {
+    .name = "cboz_blocksize",
+    .offset = CPUCFG(cboz_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
+};
+
+static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *cbomz_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint16_t value, *host_val;
+
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+
+    if (value != *host_val) {
+        error_report("Unable to set %s to a different value than "
+                     "the host (%u)",
+                     cbomz_cfg->name, *host_val);
+        exit(EXIT_FAILURE);
+    }
+
+    cbomz_cfg->user_set = true;
+}
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
                             kvm_cpu_set_multi_ext_cfg,
                             NULL, multi_cfg);
     }
+
+    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cbom_blocksize);
+
+    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cboz_blocksize);
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
+                                         KVMCPUConfig *cbomz_cfg)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              cbomz_cfg->kvm_reg_id);
+    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to read KVM reg %s, error %d",
+                     cbomz_cfg->name, ret);
+        exit(EXIT_FAILURE);
+    }
+}
+
 static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
         kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
     }
+
+    if (cpu->cfg.ext_icbom) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
+    }
+
+    if (cpu->cfg.ext_icboz) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch introduces the RISC-V Zfa extension, which introduces
additional floating-point instructions:
* fli (load-immediate) with pre-defined immediates
* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
* fround/froundmx (round to integer)
* fcvtmod.w.d (Modular Convert-to-Integer)
* fmv* to access high bits of float register bigger than XLEN
* Quiet comparison instructions (fleq/fltq)

Zfa defines its instructions in combination with the following extensions:
* single-precision floating-point (F)
* double-precision floating-point (D)
* quad-precision floating-point (Q)
* half-precision floating-point (Zfh)

Since QEMU does not support the RISC-V quad-precision floating-point
ISA extension (Q), this patch does not include the instructions that
depend on this extension. All other instructions are included in this
patch.

The Zfa specification can be found here:
  https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
The Zfa specifciation is frozen and is in public review since May 3, 2023:
  https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg

The patch also includes a TCG test for the fcvtmod.w.d instruction.
The test cases test for correct results and flag behaviour.
Note, that the Zfa specification requires fcvtmod's flag behaviour
to be identical to a fcvt with the same operands (which is also
tested).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h                             |   3 +
 target/riscv/cpu_cfg.h                    |   1 +
 target/riscv/helper.h                     |  19 +
 target/riscv/insn32.decode                |  26 ++
 disas/riscv.c                             | 139 ++++++
 target/riscv/cpu.c                        |   8 +
 target/riscv/fpu_helper.c                 | 154 +++++++
 target/riscv/translate.c                  |   1 +
 tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
 target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target         |   6 +
 11 files changed, 1223 insertions(+)
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_r_imm2,
     rv_codec_r2_immhl,
     rv_codec_r2_imm2_imm5,
+    rv_codec_fli,
 } rv_codec;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_rd_offset              "O\t0,o"
 #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 #define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
 #define rv_fmt_frd_frs1               "O\t3,4"
 #define rv_fmt_rd_frs1                "O\t0,4"
 #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
 #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
 #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
+#define rv_fmt_fli                    "O\t3,h"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svpbmt;
     bool ext_zdinx;
     bool ext_zawrs;
+    bool ext_zfa;
     bool ext_zfbfmin;
     bool ext_zfh;
     bool ext_zfhmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Floating Point - Double Precision */
 DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
+DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
+DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Bitmanip */
 DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Cache-block operations */
 DEF_HELPER_2(cbo_clean_flush, void, env, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
 bset       0010100 .......... 001 ..... 0110011 @r
 bseti      00101. ........... 001 ..... 0010011 @sh
 
+# *** Zfa Standard Extension ***
+fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
+fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
+fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
+fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
+fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
+fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
+fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
+fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
+fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
+fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
+fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
+fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
+fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
+fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
+fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
+fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
+fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
+fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
+fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
+fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
+fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
+
 # *** RV32 Zfh Extension ***
 flh        ............   ..... 001 ..... 0000111 @i
 fsh        .......  ..... ..... 001 ..... 0100111 @s
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_fsh = 798,
     rv_op_fmv_h_x = 799,
     rv_op_fmv_x_h = 800,
+    rv_op_fli_s = 801,
+    rv_op_fli_d = 802,
+    rv_op_fli_q = 803,
+    rv_op_fli_h = 804,
+    rv_op_fminm_s = 805,
+    rv_op_fmaxm_s = 806,
+    rv_op_fminm_d = 807,
+    rv_op_fmaxm_d = 808,
+    rv_op_fminm_q = 809,
+    rv_op_fmaxm_q = 810,
+    rv_op_fminm_h = 811,
+    rv_op_fmaxm_h = 812,
+    rv_op_fround_s = 813,
+    rv_op_froundnx_s = 814,
+    rv_op_fround_d = 815,
+    rv_op_froundnx_d = 816,
+    rv_op_fround_q = 817,
+    rv_op_froundnx_q = 818,
+    rv_op_fround_h = 819,
+    rv_op_froundnx_h = 820,
+    rv_op_fcvtmod_w_d = 821,
+    rv_op_fmvh_x_d = 822,
+    rv_op_fmvp_d_x = 823,
+    rv_op_fmvh_x_q = 824,
+    rv_op_fmvp_q_x = 825,
+    rv_op_fleq_s = 826,
+    rv_op_fltq_s = 827,
+    rv_op_fleq_d = 828,
+    rv_op_fltq_d = 829,
+    rv_op_fleq_q = 830,
+    rv_op_fltq_q = 831,
+    rv_op_fleq_h = 832,
+    rv_op_fltq_h = 833,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
+/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
+ * The constants use the hex floating-point literal representation
+ * that is printed when using the printf %a format specifier,
+ * which matches the output that is generated by the disassembler.
+ */
+static const char rv_fli_name_const[32][9] =
+{
+    "0x1p+0", "min", "0x1p-16", "0x1p-15",
+    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
+    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
+    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
+    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
+    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
+    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
+    "0x1p+15", "0x1p+16", "inf", "nan"
+};
+
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
     { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
     { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_s; break;
                 case 1: op = rv_op_fmax_s; break;
+                case 2: op = rv_op_fminm_s; break;
+                case 3: op = rv_op_fmaxm_s; break;
                 }
                 break;
             case 21:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_d; break;
                 case 1: op = rv_op_fmax_d; break;
+                case 2: op = rv_op_fminm_d; break;
+                case 3: op = rv_op_fmaxm_d; break;
+                }
+                break;
+            case 22:
+                switch (((inst >> 12) & 0b111)) {
+                case 2: op = rv_op_fminm_h; break;
+                case 3: op = rv_op_fmaxm_h; break;
                 }
                 break;
             case 23:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_q; break;
                 case 1: op = rv_op_fmax_q; break;
+                case 2: op = rv_op_fminm_q; break;
+                case 3: op = rv_op_fmaxm_q; break;
                 }
                 break;
             case 32:
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 4: op = rv_op_fround_s; break;
+                case 5: op = rv_op_froundnx_s; break;
                 case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_d_s; break;
                 case 3: op = rv_op_fcvt_d_q; break;
+                case 4: op = rv_op_fround_d; break;
+                case 5: op = rv_op_froundnx_d; break;
                 }
                 break;
             case 34:
                 switch (((inst >> 20) & 0b11111)) {
+                case 4: op = rv_op_fround_h; break;
+                case 5: op = rv_op_froundnx_h; break;
                 case 8: op = rv_op_fcvt_bf16_s; break;
                 }
                 break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
                 case 1: op = rv_op_fcvt_q_d; break;
+                case 4: op = rv_op_fround_q; break;
+                case 5: op = rv_op_froundnx_q; break;
                 }
                 break;
             case 44:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_s; break;
                 case 1: op = rv_op_flt_s; break;
                 case 2: op = rv_op_feq_s; break;
+                case 4: op = rv_op_fleq_s; break;
+                case 5: op = rv_op_fltq_s; break;
                 }
                 break;
             case 81:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_d; break;
                 case 1: op = rv_op_flt_d; break;
                 case 2: op = rv_op_feq_d; break;
+                case 4: op = rv_op_fleq_d; break;
+                case 5: op = rv_op_fltq_d; break;
+                }
+                break;
+            case 82:
+                switch (((inst >> 12) & 0b111)) {
+                case 4: op = rv_op_fleq_h; break;
+                case 5: op = rv_op_fltq_h; break;
                 }
                 break;
             case 83:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_q; break;
                 case 1: op = rv_op_flt_q; break;
                 case 2: op = rv_op_feq_q; break;
+                case 4: op = rv_op_fleq_q; break;
+                case 5: op = rv_op_fltq_q; break;
+                }
+                break;
+            case 89:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_d_x; break;
+                }
+                break;
+            case 91:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_q_x; break;
                 }
                 break;
             case 96:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fcvt_wu_d; break;
                 case 2: op = rv_op_fcvt_l_d; break;
                 case 3: op = rv_op_fcvt_lu_d; break;
+                case 8: op = rv_op_fcvtmod_w_d; break;
                 }
                 break;
             case 99:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_d; break;
                 case 1: op = rv_op_fclass_d; break;
+                case 8: op = rv_op_fmvh_x_d; break;
                 }
                 break;
             case 114:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_q; break;
                 case 1: op = rv_op_fclass_q; break;
+                case 8: op = rv_op_fmvh_x_q; break;
                 }
                 break;
             case 120:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_s_x; break;
+                case 8: op = rv_op_fli_s; break;
                 }
                 break;
             case 121:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_d_x; break;
+                case 8: op = rv_op_fli_d; break;
                 }
                 break;
             case 122:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_h_x; break;
+                case 8: op = rv_op_fli_h; break;
                 }
                 break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_q_x; break;
+                case 8: op = rv_op_fli_q; break;
                 }
                 break;
             }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
         break;
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
+	break;
+    case rv_codec_fli:
+        dec->rd = operand_rd(inst);
+        dec->imm = operand_rs1(inst);
         break;
     case rv_codec_r2_imm5:
         dec->rd = operand_rd(inst);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             append(buf, tmp, buflen);
             break;
         }
+        case 'h':
+            append(buf, rv_fli_name_const[dec->imm], buflen);
+            break;
         default:
             break;
         }
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
     env->priv_ver = PRIV_VERSION_1_11_0;
 
+    cpu->cfg.ext_zfa = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
     cpu->cfg.ext_xtheadba = true;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
+        error_setg(errp, "Zfa extension requires F extension");
+        return;
+    }
+
     if (cpu->cfg.ext_zfh) {
         cpu->cfg.ext_zfhmin = true;
     }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_min(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_max(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
     return fclass_s(frs1);
 }
 
+uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float32 frs1 = check_nanbox_s(env, rs1);
+
+    frs1 = float32_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_s(env, frs1);
+}
+
+uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float32_round_to_int(frs1, &env->fp_status);
+    return nanbox_s(env, frs1);
+}
+
 uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_add(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_minimum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_min(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_maximum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_max(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
 {
     return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
     return float64_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
     return float64_to_int32(frs1, &env->fp_status);
 }
 
+uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
+{
+    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
+}
+
 target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
 {
     return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
     return fclass_d(frs1);
 }
 
+uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+
+    frs1 = float64_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return frs1;
+}
+
+uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
+{
+    return float64_round_to_int(frs1, &env->fp_status);
+}
+
 uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_min(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_max(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
     return fclass_h(frs1);
 }
 
+uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float16 frs1 = check_nanbox_h(env, rs1);
+
+    frs1 = float16_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_h(env, frs1);
+}
+
+uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float16_round_to_int(frs1, &env->fp_status);
+    return nanbox_h(env, frs1);
+}
+
 target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvzicond.c.inc"
 #include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzicbo.c.inc"
+#include "insn_trans/trans_rvzfa.c.inc"
 #include "insn_trans/trans_rvzfh.c.inc"
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/test-fcvtmod.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define FFLAG_NX_SHIFT 0 /* inexact */
+#define FFLAG_UF_SHIFT 1 /* underflow */
+#define FFLAG_OF_SHIFT 2 /* overflow */
+#define FFLAG_DZ_SHIFT 3 /* divide by zero */
+#define FFLAG_NV_SHIFT 4 /* invalid operation */
+
+#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
+#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
+#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
+#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
+#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
+
+typedef struct fp64_fcvt_fcvtmod_testcase {
+    const char* name;
+    union {
+        uint64_t inp_lu;
+        double inp_lf;
+    };
+    uint64_t exp_fcvt;
+    uint8_t exp_fcvt_fflags;
+    uint64_t exp_fcvtmod;
+    uint8_t exp_fcvtmod_fflags;
+} fp64_fcvt_fcvtmod_testcase_t;
+
+void print_fflags(uint8_t fflags)
+{
+    int set = 0;
+
+    if (fflags == 0) {
+        printf("-");
+        return;
+    }
+
+    if (fflags & FFLAG_NV) {
+        printf("%sFFLAG_NV", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_DZ) {
+        printf("%sFFLAG_DZ", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_OF) {
+        printf("%sFFLAG_OF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_UF) {
+        printf("%sFFLAG_UF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_NX) {
+        printf("%sFFLAG_NX", set ? " | " : "");
+        set = 1;
+    }
+}
+
+/* Clear all FP flags. */
+static inline void clear_fflags()
+{
+    __asm__ __volatile__("fsflags zero");
+}
+
+/* Read all FP flags. */
+static inline uint8_t get_fflags()
+{
+    uint64_t v;
+    __asm__ __volatile__("frflags %0" : "=r"(v));
+    return (uint8_t)v;
+}
+
+/* Move input value (without conversations) into an FP register. */
+static inline double do_fmv_d_x(uint64_t inp)
+{
+    double fpr;
+    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
+    return fpr;
+}
+
+static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
+    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
+    /* Zero (exp=0, frac=0) */
+    { .name = "+0.0",
+      .inp_lf = 0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-0.0",
+      .inp_lf = -0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+
+    /* Subnormal: exp=0 frac!=0 */
+    { .name = "Subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Subnormal frac=0xf..f",
+      .inp_lu = 0x0000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=0xf..f",
+      .inp_lu = 0x8000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    /* Infinity: exp=0x7ff, frac=0 */
+    { .name = "+INF",
+      .inp_lu = 0x7ff0000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-INF",
+      .inp_lu = 0xfff0000000000000,
+      .exp_fcvt = 0xffffffff80000000, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* NaN: exp=7ff, frac!=0 */
+    { .name = "canonical NaN",
+      .inp_lu = 0x7ff8000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "non-canonical NaN",
+      .inp_lu = 0x7ff8000000100000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* Normal numbers: exp!=0, exp!=7ff */
+    { .name = "+smallest normal value",
+      .inp_lu = 0x0010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-smallest normal value",
+      .inp_lu = 0x8010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+0.5",
+      .inp_lf = 0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-0.5",
+      .inp_lf = -0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+value just below 1.0",
+      .inp_lu = 0x3fefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-value just above -1.0",
+      .inp_lu = 0xbfefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+1.0",
+      .inp_lf = 0x1p0,
+      .exp_fcvt = 0x0000000000000001,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000001,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-1.0",
+      .inp_lf = -0x1p0,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = 0 },
+
+    { .name = "+1.5",
+      .inp_lu = 0x3ff8000000000000,
+      .exp_fcvt = 1,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 1,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-1.5",
+      .inp_lu = 0xbff8000000000000,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+max int32 (2147483647)",
+      .inp_lu = 0x41dfffffffc00000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x000000007fffffff,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "+max int32 +1 (2147483648)",
+      .inp_lf = 0x1p31,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "+max int32 +2 (2147483649)",
+      .inp_lu = 0x41e0000000200000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    { .name = "-max int32 (-2147483648)",
+      .inp_lf = -0x1p31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffff80000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-max int32 -1 (-2147483649)",
+      .inp_lf = -0x1.00000002p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483647, /* int32 max */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-max int32 -2 (-2147483650)",
+      .inp_lf = -0x1.00000004p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483646, /* int32 max -1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+};
+
+int run_fcvtmod_tests()
+{
+    uint64_t act_fcvt;
+    uint8_t act_fcvt_fflags;
+    uint64_t act_fcvtmod;
+    uint8_t act_fcvtmod_fflags;
+
+    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
+        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
+
+        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
+        int fcvt_correct = act_fcvt == t->exp_fcvt &&
+                    act_fcvt_fflags == t->exp_fcvt_fflags;
+        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
+        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
+                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
+
+        if (fcvt_correct && fcvtmod_correct) {
+            continue;
+        }
+
+        printf("Test %zu (%s) failed!\n", i, t->name);
+
+        double fpr = do_fmv_d_x(t->inp_lu);
+        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
+        printf("inp_lf: %lf\n", t->inp_lf);
+
+        uint32_t sign = (t->inp_lu >> 63);
+        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
+        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
+        int true_exp = exp - 1023;
+        int shift = true_exp - 52;
+        uint64_t true_frac = frac | 1ull << 52;
+
+        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
+        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
+
+        if (!fcvt_correct) {
+            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
+            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
+            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
+            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
+        }
+
+        if (!fcvtmod_correct) {
+            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
+            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
+            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
+            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
+        }
+
+        return 1;
+    }
+
+    return 0;
+}
+
+int main()
+{
+    return run_fcvtmod_tests();
+}
diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the Zfa Standard Extension.
+ *
+ * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFA(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfa) { \
+        return false;             \
+    }                             \
+} while (0)
+
+#define REQUIRE_ZFH(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfh) { \
+        return false;             \
+    }                             \
+} while (0)
+
+static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
+    static const uint64_t fli_s_table[] = {
+        0xffffffffbf800000,  /* -1.0 */
+        0xffffffff00800000,  /* minimum positive normal */
+        0xffffffff37800000,  /* 1.0 * 2^-16 */
+        0xffffffff38000000,  /* 1.0 * 2^-15 */
+        0xffffffff3b800000,  /* 1.0 * 2^-8  */
+        0xffffffff3c000000,  /* 1.0 * 2^-7  */
+        0xffffffff3d800000,  /* 1.0 * 2^-4  */
+        0xffffffff3e000000,  /* 1.0 * 2^-3  */
+        0xffffffff3e800000,  /* 0.25 */
+        0xffffffff3ea00000,  /* 0.3125 */
+        0xffffffff3ec00000,  /* 0.375 */
+        0xffffffff3ee00000,  /* 0.4375 */
+        0xffffffff3f000000,  /* 0.5 */
+        0xffffffff3f200000,  /* 0.625 */
+        0xffffffff3f400000,  /* 0.75 */
+        0xffffffff3f600000,  /* 0.875 */
+        0xffffffff3f800000,  /* 1.0 */
+        0xffffffff3fa00000,  /* 1.25 */
+        0xffffffff3fc00000,  /* 1.5 */
+        0xffffffff3fe00000,  /* 1.75 */
+        0xffffffff40000000,  /* 2.0 */
+        0xffffffff40200000,  /* 2.5 */
+        0xffffffff40400000,  /* 3 */
+        0xffffffff40800000,  /* 4 */
+        0xffffffff41000000,  /* 8 */
+        0xffffffff41800000,  /* 16 */
+        0xffffffff43000000,  /* 2^7 */
+        0xffffffff43800000,  /* 2^8 */
+        0xffffffff47000000,  /* 2^15 */
+        0xffffffff47800000,  /* 2^16 */
+        0xffffffff7f800000,  /* +inf */
+        0xffffffff7fc00000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    static const uint64_t fli_d_table[] = {
+        0xbff0000000000000,  /* -1.0 */
+        0x0010000000000000,  /* minimum positive normal */
+        0x3ef0000000000000,  /* 1.0 * 2^-16 */
+        0x3f00000000000000,  /* 1.0 * 2^-15 */
+        0x3f70000000000000,  /* 1.0 * 2^-8  */
+        0x3f80000000000000,  /* 1.0 * 2^-7  */
+        0x3fb0000000000000,  /* 1.0 * 2^-4  */
+        0x3fc0000000000000,  /* 1.0 * 2^-3  */
+        0x3fd0000000000000,  /* 0.25 */
+        0x3fd4000000000000,  /* 0.3125 */
+        0x3fd8000000000000,  /* 0.375 */
+        0x3fdc000000000000,  /* 0.4375 */
+        0x3fe0000000000000,  /* 0.5 */
+        0x3fe4000000000000,  /* 0.625 */
+        0x3fe8000000000000,  /* 0.75 */
+        0x3fec000000000000,  /* 0.875 */
+        0x3ff0000000000000,  /* 1.0 */
+        0x3ff4000000000000,  /* 1.25 */
+        0x3ff8000000000000,  /* 1.5 */
+        0x3ffc000000000000,  /* 1.75 */
+        0x4000000000000000,  /* 2.0 */
+        0x4004000000000000,  /* 2.5 */
+        0x4008000000000000,  /* 3 */
+        0x4010000000000000,  /* 4 */
+        0x4020000000000000,  /* 8 */
+        0x4030000000000000,  /* 16 */
+        0x4060000000000000,  /* 2^7 */
+        0x4070000000000000,  /* 2^8 */
+        0x40e0000000000000,  /* 2^15 */
+        0x40f0000000000000,  /* 2^16 */
+        0x7ff0000000000000,  /* +inf */
+        0x7ff8000000000000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
+    static const uint64_t fli_h_table[] = {
+        0xffffffffffffbc00,  /* -1.0 */
+        0xffffffffffff0400,  /* minimum positive normal */
+        0xffffffffffff0100,  /* 1.0 * 2^-16 */
+        0xffffffffffff0200,  /* 1.0 * 2^-15 */
+        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
+        0xffffffffffff2000,  /* 1.0 * 2^-7  */
+        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
+        0xffffffffffff3000,  /* 1.0 * 2^-3  */
+        0xffffffffffff3400,  /* 0.25 */
+        0xffffffffffff3500,  /* 0.3125 */
+        0xffffffffffff3600,  /* 0.375 */
+        0xffffffffffff3700,  /* 0.4375 */
+        0xffffffffffff3800,  /* 0.5 */
+        0xffffffffffff3900,  /* 0.625 */
+        0xffffffffffff3a00,  /* 0.75 */
+        0xffffffffffff3b00,  /* 0.875 */
+        0xffffffffffff3c00,  /* 1.0 */
+        0xffffffffffff3d00,  /* 1.25 */
+        0xffffffffffff3e00,  /* 1.5 */
+        0xffffffffffff3f00,  /* 1.75 */
+        0xffffffffffff4000,  /* 2.0 */
+        0xffffffffffff4100,  /* 2.5 */
+        0xffffffffffff4200,  /* 3 */
+        0xffffffffffff4400,  /* 4 */
+        0xffffffffffff4800,  /* 8 */
+        0xffffffffffff4c00,  /* 16 */
+        0xffffffffffff5800,  /* 2^7 */
+        0xffffffffffff5c00,  /* 2^8 */
+        0xffffffffffff7800,  /* 2^15 */
+        0xffffffffffff7c00,  /* 2^16 */
+        0xffffffffffff7c00,  /* +inf */
+        0xffffffffffff7e00,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fminm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+
+    /* Rounding mode is RTZ. */
+    gen_set_rm(ctx, RISCV_FRM_RTZ);
+    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+
+    return true;
+}
+
+bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+    return true;
+}
+
+bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
 
 TESTS += test-aes
 run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
+
+# Test for fcvtmod
+TESTS += test-fcvtmod
+test-fcvtmod: CFLAGS += -march=rv64imafdc
+test-fcvtmod: LDFLAGS += -static
+run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
-- 
2.40.1

The following changes since commit ad10b4badc1dd5b28305f9b9f1168cf0aa3ae946:

Merge tag 'pull-error-2024-05-27' of https://repo.or.cz/qemu/armbru into staging (2024-05-27 06:40:42 -0700)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240528

for you to fetch changes up to 1806da76cb81088ea026ca3441551782b850e393:

target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR (2024-05-28 12:20:27 +1000)

----------------------------------------------------------------
RISC-V PR for 9.1

* APLICs add child earlier than realize
* Fix exposure of Zkr
* Raise exceptions on wrs.nto
* Implement SBI debug console (DBCN) calls for KVM
* Support 64-bit addresses for initrd
* Change RISCV_EXCP_SEMIHOST exception number to 63
* Tolerate KVM disable ext errors
* Set tval in breakpoints
* Add support for Zve32x extension
* Add support for Zve64x extension
* Relax vector register check in RISCV gdbstub
* Fix the element agnostic Vector function problem
* Fix Zvkb extension config
* Implement dynamic establishment of custom decoder
* Add th.sxstatus CSR emulation
* Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
* Check single width operator for vector fp widen instructions
* Check single width operator for vfncvt.rod.f.f.w
* Remove redudant SEW checking for vector fp narrow/widen instructions
* Prioritize pmp errors in raise_mmu_exception()
* Do not set mtval2 for non guest-page faults
* Remove experimental prefix from "B" extension
* Fixup CBO extension register calculation
* Fix the hart bit setting of AIA
* Fix reg_width in ricsv_gen_dynamic_vector_feature()
* Decode all of the pmpcfg and pmpaddr CSRs
* Raise an exception when CSRRS/CSRRC writes a read-only CSR

----------------------------------------------------------------
Alexei Filippov (1):
      target/riscv: do not set mtval2 for non guest-page faults

Alistair Francis (2):
      target/riscv: rvzicbo: Fixup CBO extension register calculation
      disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs

Andrew Jones (2):
      target/riscv/kvm: Fix exposure of Zkr
      target/riscv: Raise exceptions on wrs.nto

Cheng Yang (1):
      hw/riscv/boot.c: Support 64-bit address for initrd

Christoph Müllner (1):
      riscv: thead: Add th.sxstatus CSR emulation

Clément Léger (1):
      target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63

Daniel Henrique Barboza (6):
      target/riscv/kvm: implement SBI debug console (DBCN) calls
      target/riscv/kvm: tolerate KVM disable ext errors
      target/riscv/debug: set tval=pc in breakpoint exceptions
      trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
      target/riscv: prioritize pmp errors in raise_mmu_exception()
      riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()

Huang Tao (2):
      target/riscv: Fix the element agnostic function problem
      target/riscv: Implement dynamic establishment of custom decoder

Jason Chien (3):
      target/riscv: Add support for Zve32x extension
      target/riscv: Add support for Zve64x extension
      target/riscv: Relax vector register check in RISCV gdbstub

Max Chou (4):
      target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
      target/riscv: rvv: Check single width operator for vector fp widen instructions
      target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
      target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions

Rob Bradford (1):
      target/riscv: Remove experimental prefix from "B" extension

Yangyu Chen (1):
      target/riscv/cpu.c: fix Zvkb extension config

Yong-Xuan Wang (1):
      target/riscv/kvm.c: Fix the hart bit setting of AIA

Yu-Ming Chang (1):
      target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR

yang.zhang (1):
      hw/intc/riscv_aplic: APLICs should add child earlier than realize

From: "yang.zhang" <yang.zhang@hexintek.com>

Since only root APLICs can have hw IRQ lines, aplic->parent should
be initialized first.

Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: yang.zhang <yang.zhang@hexintek.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240409014445.278-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "msimode", msimode);
     qdev_prop_set_bit(dev, "mmode", mmode);
 
+    if (parent) {
+        riscv_aplic_add_child(parent, dev);
+    }
+
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     if (!is_kvm_aia(msimode)) {
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     }
 
-    if (parent) {
-        riscv_aplic_add_child(parent, dev);
-    }
-
     if (!msimode) {
         for (i = 0; i < num_harts; i++) {
             CPUState *cpu = cpu_by_arch_id(hartid_base + i);
-- 
2.45.1

From: Andrew Jones <ajones@ventanamicro.com>

The Zkr extension may only be exposed to KVM guests if the VMM
implements the SEED CSR. Use the same implementation as TCG.

Without this patch, running with a KVM which does not forward the
SEED CSR access to QEMU will result in an ILL exception being
injected into the guest (this results in Linux guests crashing on
boot). And, when running with a KVM which does forward the access,
QEMU will crash, since QEMU doesn't know what to do with the exit.

Fixes: 3108e2f1c69d ("target/riscv/kvm: update KVM exts to Linux 6.8")
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240422134605.534207-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  3 +++
 target/riscv/csr.c         | 18 ++++++++++++++----
 target/riscv/kvm/kvm-cpu.c | 25 +++++++++++++++++++++++++
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
 
 void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
 
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+                                target_ulong write_mask);
+
 uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
 #endif
 
 /* Crypto Extension */
-static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-                               target_ulong *ret_value,
-                               target_ulong new_value,
-                               target_ulong write_mask)
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+                                target_ulong write_mask)
 {
     uint16_t random_v;
     Error *random_e = NULL;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
         rval = random_v | SEED_OPST_ES16;
     }
 
+    return rval;
+}
+
+static RISCVException rmw_seed(CPURISCVState *env, int csrno,
+                               target_ulong *ret_value,
+                               target_ulong new_value,
+                               target_ulong write_mask)
+{
+    target_ulong rval;
+
+    rval = riscv_new_csr_seed(new_value, write_mask);
+
     if (ret_value) {
         *ret_value = rval;
     }
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
     return ret;
 }
 
+static int kvm_riscv_handle_csr(CPUState *cs, struct kvm_run *run)
+{
+    target_ulong csr_num = run->riscv_csr.csr_num;
+    target_ulong new_value = run->riscv_csr.new_value;
+    target_ulong write_mask = run->riscv_csr.write_mask;
+    int ret = 0;
+
+    switch (csr_num) {
+    case CSR_SEED:
+        run->riscv_csr.ret_value = riscv_new_csr_seed(new_value, write_mask);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: un-handled CSR EXIT for CSR %lx\n",
+                      __func__, csr_num);
+        ret = -1;
+        break;
+    }
+
+    return ret;
+}
+
 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     case KVM_EXIT_RISCV_SBI:
         ret = kvm_riscv_handle_sbi(cs, run);
         break;
+    case KVM_EXIT_RISCV_CSR:
+        ret = kvm_riscv_handle_csr(cs, run);
+        break;
     default:
         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
                       __func__, run->exit_reason);
-- 
2.45.1

From: Andrew Jones <ajones@ventanamicro.com>

Implementing wrs.nto to always just return is consistent with the
specification, as the instruction is permitted to terminate the
stall for any reason, but it's not useful for virtualization, where
we'd like the guest to trap to the hypervisor in order to allow
scheduling of the lock holding VCPU. Change to always immediately
raise exceptions when the appropriate conditions are present,
otherwise continue to just return. Note, immediately raising
exceptions is also consistent with the specification since the
time limit that should expire prior to the exception is
implementation-specific.

Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240424142808.62936-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                       |  1 +
 target/riscv/op_helper.c                    | 11 ++++++++
 target/riscv/insn_trans/trans_rvzawrs.c.inc | 29 ++++++++++++++-------
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
 DEF_HELPER_1(sret, tl, env)
 DEF_HELPER_1(mret, tl, env)
 DEF_HELPER_1(wfi, void, env)
+DEF_HELPER_1(wrs_nto, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
 DEF_HELPER_1(tlb_flush_all, void, env)
 /* Native Debug */
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
     }
 }
 
+void helper_wrs_nto(CPURISCVState *env)
+{
+    if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) &&
+        get_field(env->hstatus, HSTATUS_VTW) &&
+        !get_field(env->mstatus, MSTATUS_TW)) {
+        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
+    } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
 void helper_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzawrs.c.inc
+++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-static bool trans_wrs(DisasContext *ctx)
+static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
 {
     if (!ctx->cfg_ptr->ext_zawrs) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_wrs(DisasContext *ctx)
     return true;
 }
 
-#define GEN_TRANS_WRS(insn)                                     \
-static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
-{                                                               \
-    (void)a;                                                    \
-    return trans_wrs(ctx);                                      \
-}
+static bool trans_wrs_nto(DisasContext *ctx, arg_wrs_nto *a)
+{
+    if (!ctx->cfg_ptr->ext_zawrs) {
+        return false;
+    }
 
-GEN_TRANS_WRS(wrs_nto)
-GEN_TRANS_WRS(wrs_sto)
+    /*
+     * Depending on the mode of execution, mstatus.TW and hstatus.VTW, wrs.nto
+     * should raise an exception when the implementation-specific bounded time
+     * limit has expired. Our time limit is zero, so we either return
+     * immediately, as does our implementation of wrs.sto, or raise an
+     * exception, as handled by the wrs.nto helper.
+     */
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wrs_nto(tcg_env);
+#endif
+
+    /* We only get here when helper_wrs_nto() doesn't raise an exception. */
+    return trans_wrs_sto(ctx, NULL);
+}
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

SBI defines a Debug Console extension "DBCN" that will, in time, replace
the legacy console putchar and getchar SBI extensions.

The appeal of the DBCN extension is that it allows multiple bytes to be
read/written in the SBI console in a single SBI call.

As far as KVM goes, the DBCN calls are forwarded by an in-kernel KVM
module to userspace. But this will only happens if the KVM module
actually supports this SBI extension and we activate it.

We'll check for DBCN support during init time, checking if get-reg-list
is advertising KVM_RISCV_SBI_EXT_DBCN. In that case, we'll enable it via
kvm_set_one_reg() during kvm_arch_init_vcpu().

Finally, change kvm_riscv_handle_sbi() to handle the incoming calls for
SBI_EXT_DBCN, reading and writing as required.

A simple KVM guest with 'earlycon=sbi', running in an emulated RISC-V
host, takes around 20 seconds to boot without using DBCN. With this
patch we're taking around 14 seconds to boot due to the speed-up in the
terminal output.  There's no change in boot time if the guest isn't
using earlycon.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20240425155012.581366-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/sbi_ecall_interface.h |  17 +++++
 target/riscv/kvm/kvm-cpu.c         | 111 +++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+)

diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/sbi_ecall_interface.h
+++ b/target/riscv/sbi_ecall_interface.h
@@ -XXX,XX +XXX,XX @@
 
 /* clang-format off */
 
+#define SBI_SUCCESS                      0
+#define SBI_ERR_FAILED                  -1
+#define SBI_ERR_NOT_SUPPORTED           -2
+#define SBI_ERR_INVALID_PARAM           -3
+#define SBI_ERR_DENIED                  -4
+#define SBI_ERR_INVALID_ADDRESS         -5
+#define SBI_ERR_ALREADY_AVAILABLE       -6
+#define SBI_ERR_ALREADY_STARTED         -7
+#define SBI_ERR_ALREADY_STOPPED         -8
+#define SBI_ERR_NO_SHMEM                -9
+
 /* SBI Extension IDs */
 #define SBI_EXT_0_1_SET_TIMER           0x0
 #define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_IPI                     0x735049
 #define SBI_EXT_RFENCE                  0x52464E43
 #define SBI_EXT_HSM                     0x48534D
+#define SBI_EXT_DBCN                    0x4442434E
 
 /* SBI function IDs for BASE extension */
 #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_HSM_HART_STOP           0x1
 #define SBI_EXT_HSM_HART_GET_STATUS     0x2
 
+/* SBI function IDs for DBCN extension */
+#define SBI_EXT_DBCN_CONSOLE_WRITE      0x0
+#define SBI_EXT_DBCN_CONSOLE_READ       0x1
+#define SBI_EXT_DBCN_CONSOLE_WRITE_BYTE 0x2
+
 #define SBI_HSM_HART_STATUS_STARTED     0x0
 #define SBI_HSM_HART_STATUS_STOPPED     0x1
 #define SBI_HSM_HART_STATUS_START_PENDING   0x2
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_v_vlenb = {
                    KVM_REG_RISCV_VECTOR_CSR_REG(vlenb)
 };
 
+static KVMCPUConfig kvm_sbi_dbcn = {
+    .name = "sbi_dbcn",
+    .kvm_reg_id = KVM_REG_RISCV | KVM_REG_SIZE_U64 |
+                  KVM_REG_RISCV_SBI_EXT | KVM_RISCV_SBI_EXT_DBCN
+};
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int uint64_cmp(const void *a, const void *b)
     return 0;
 }
 
+static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
+                                             KVMScratchCPU *kvmcpu,
+                                             struct kvm_reg_list *reglist)
+{
+    struct kvm_reg_list *reg_search;
+
+    reg_search = bsearch(&kvm_sbi_dbcn.kvm_reg_id, reglist->reg, reglist->n,
+                         sizeof(uint64_t), uint64_cmp);
+
+    if (reg_search) {
+        kvm_sbi_dbcn.supported = true;
+    }
+}
+
 static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
                                  struct kvm_reg_list *reglist)
 {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (riscv_has_ext(&cpu->env, RVV)) {
         kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
     }
+
+    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
 }
 
 static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
     return ret;
 }
 
+static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
+{
+    target_ulong reg = 1;
+
+    if (!kvm_sbi_dbcn.supported) {
+        return 0;
+    }
+
+    return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     kvm_riscv_update_cpu_misa_ext(cpu, cs);
     kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
 
+    ret = kvm_vcpu_enable_sbi_dbcn(cpu, cs);
+
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
     return true;
 }
 
+static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
+{
+    g_autofree uint8_t *buf = NULL;
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    target_ulong num_bytes;
+    uint64_t addr;
+    unsigned char ch;
+    int ret;
+
+    switch (run->riscv_sbi.function_id) {
+    case SBI_EXT_DBCN_CONSOLE_READ:
+    case SBI_EXT_DBCN_CONSOLE_WRITE:
+        num_bytes = run->riscv_sbi.args[0];
+
+        if (num_bytes == 0) {
+            run->riscv_sbi.ret[0] = SBI_SUCCESS;
+            run->riscv_sbi.ret[1] = 0;
+            break;
+        }
+
+        addr = run->riscv_sbi.args[1];
+
+        /*
+         * Handle the case where a 32 bit CPU is running in a
+         * 64 bit addressing env.
+         */
+        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
+            addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
+        }
+
+        buf = g_malloc0(num_bytes);
+
+        if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
+            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
+            if (ret < 0) {
+                error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
+                             "reading chardev");
+                exit(1);
+            }
+
+            cpu_physical_memory_write(addr, buf, ret);
+        } else {
+            cpu_physical_memory_read(addr, buf, num_bytes);
+
+            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
+            if (ret < 0) {
+                error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
+                             "writing chardev");
+                exit(1);
+            }
+        }
+
+        run->riscv_sbi.ret[0] = SBI_SUCCESS;
+        run->riscv_sbi.ret[1] = ret;
+        break;
+    case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
+        ch = run->riscv_sbi.args[0];
+        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
+
+        if (ret < 0) {
+            error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
+                         "writing chardev");
+            exit(1);
+        }
+
+        run->riscv_sbi.ret[0] = SBI_SUCCESS;
+        run->riscv_sbi.ret[1] = 0;
+        break;
+    default:
+        run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
+    }
+}
+
 static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
         }
         ret = 0;
         break;
+    case SBI_EXT_DBCN:
+        kvm_riscv_handle_sbi_dbcn(cs, run);
+        break;
     default:
         qemu_log_mask(LOG_UNIMP,
                       "%s: un-handled SBI EXIT, specific reasons is %lu\n",
-- 
2.45.1

From: Cheng Yang <yangcheng.work@foxmail.com>

Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell()
to set the address of initrd in FDT to support 64-bit address.

Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/boot.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
     /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
     if (fdt) {
         end = start + size;
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", start);
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", end);
+        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-start", start);
+        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-end", end);
     }
 }
 
-- 
2.45.1

From: Clément Léger <cleger@rivosinc.com>

The current semihost exception number (16) is a reserved number (range
[16-17]). The upcoming double trap specification uses that number for
the double trap exception. Since the privileged spec (Table 22) defines
ranges for custom uses change the semihosting exception number to 63
which belongs to the range [48-63] in order to avoid any future
collisions with reserved exception.

Signed-off-by: Clément Léger <cleger@rivosinc.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240422135840.1959967-1-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
-    RISCV_EXCP_SEMIHOST = 0x10,
     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
     RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
     RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
     RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
+    RISCV_EXCP_SEMIHOST = 0x3f,
 } RISCVException;
 
 #define RISCV_EXCP_INT_FLAG                0x80000000
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Running a KVM guest using a 6.9-rc3 kernel, in a 6.8 host that has zkr
enabled, will fail with a kernel oops SIGILL right at the start. The
reason is that we can't expose zkr without implementing the SEED CSR.
Disabling zkr in the guest would be a workaround, but if the KVM doesn't
allow it we'll error out and never boot.

In hindsight this is too strict. If we keep proceeding, despite not
disabling the extension in the KVM vcpu, we'll not add the extension in
the riscv,isa. The guest kernel will be unaware of the extension, i.e.
it doesn't matter if the KVM vcpu has it enabled underneath or not. So
it's ok to keep booting in this case.

Change our current logic to not error out if we fail to disable an
extension in kvm_set_one_reg(), but show a warning and keep booting. It
is important to throw a warning because we must make the user aware that
the extension is still available in the vcpu, meaning that an
ill-behaved guest can ignore the riscv,isa settings and  use the
extension.

The case we're handling happens with an EINVAL error code. If we fail to
disable the extension in KVM for any other reason, error out.

We'll also keep erroring out when we fail to enable an extension in KVM,
since adding the extension in riscv,isa at this point will cause a guest
malfunction because the extension isn't enabled in the vcpu.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240422171425.333037-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
-            error_report("Unable to %s extension %s in KVM, error %d",
-                         reg ? "enable" : "disable",
-                         multi_ext_cfg->name, ret);
-            exit(EXIT_FAILURE);
+            if (!reg && ret == -EINVAL) {
+                warn_report("KVM cannot disable extension %s",
+                            multi_ext_cfg->name);
+            } else {
+                error_report("Unable to enable extension %s in KVM, error %d",
+                             multi_ext_cfg->name, ret);
+                exit(EXIT_FAILURE);
+            }
         }
     }
 }
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're not setting (s/m)tval when triggering breakpoints of type 2
(mcontrol) and 6 (mcontrol6). According to the debug spec section
5.7.12, "Match Control Type 6":

"The Privileged Spec says that breakpoint exceptions that occur on
instruction fetches, loads, or stores update the tval CSR with either
zero or the faulting virtual address. The faulting virtual address for
an mcontrol6 trigger with action = 0 is the address being accessed and
which caused that trigger to fire."

A similar text is also found in the Debug spec section 5.7.11 w.r.t.
mcontrol.

Note that what we're doing ATM is not violating the spec, but it's
simple enough to set mtval/stval and it makes life easier for any
software that relies on this info.

Given that we always use action = 0, save the faulting address for the
mcontrol and mcontrol6 trigger breakpoints into env->badaddr, which is
used as as scratch area for traps with address information. 'tval' is
then set during riscv_cpu_do_interrupt().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20240416230437.1869024-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 +
 target/riscv/debug.c      | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
             tval = env->bins;
             break;
         case RISCV_EXCP_BREAKPOINT:
+            tval = env->badaddr;
             if (cs->watchpoint_hit) {
                 tval = cs->watchpoint_hit->hitaddr;
                 cs->watchpoint_hit = NULL;
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
                     /* check U/S/M bit against current privilege level */
                     if ((ctrl >> 3) & BIT(env->priv)) {
+                        env->badaddr = pc;
                         return true;
                     }
                 }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                     if (env->virt_enabled) {
                         /* check VU/VS bit against current privilege level */
                         if ((ctrl >> 23) & BIT(env->priv)) {
+                            env->badaddr = pc;
                             return true;
                         }
                     } else {
                         /* check U/S/M bit against current privilege level */
                         if ((ctrl >> 3) & BIT(env->priv)) {
+                            env->badaddr = pc;
                             return true;
                         }
                     }
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Privileged spec section 4.1.9 mentions:

"When a trap is taken into S-mode, stval is written with
exception-specific information to assist software in handling the trap.
(...)

If stval is written with a nonzero value when a breakpoint,
address-misaligned, access-fault, or page-fault exception occurs on an
instruction fetch, load, or store, then stval will contain the faulting
virtual address."

A similar text is found for mtval in section 3.1.16.

Setting mtval/stval in this scenario is optional, but some softwares read
these regs when handling ebreaks.

Write 'badaddr' in all ebreak breakpoints to write the appropriate
'tval' during riscv_do_cpu_interrrupt().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240416230437.1869024-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_privileged.c.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
     if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
     } else {
+        tcg_gen_st_tl(tcg_constant_tl(ebreak_addr), tcg_env,
+                      offsetof(CPURISCVState, badaddr));
         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
     }
     return true;
-- 
2.45.1

From: Jason Chien <jason.chien@sifive.com>

Add support for Zve32x extension and replace some checks for Zve32f with
Zve32x, since Zve32f depends on Zve32x.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240328022343.6871-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                  |  1 +
 target/riscv/cpu.c                      |  2 ++
 target/riscv/cpu_helper.c               |  2 +-
 target/riscv/csr.c                      |  2 +-
 target/riscv/tcg/tcg-cpu.c              | 16 ++++++++--------
 target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zhinx;
     bool ext_zhinxmin;
     bool ext_zve32f;
+    bool ext_zve32x;
     bool ext_zve64f;
     bool ext_zve64d;
     bool ext_zvbb;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
+    ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
+    MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
     *cs_base = 0;
 
-    if (cpu->cfg.ext_zve32f) {
+    if (cpu->cfg.ext_zve32x) {
         /*
          * If env->vl equals to VLMAX, we can use generic vector operation
          * expanders (GVEC) to accerlate the vector operations.
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
 
 static RISCVException vs(CPURISCVState *env, int csrno)
 {
-    if (riscv_cpu_cfg(env)->ext_zve32f) {
+    if (riscv_cpu_cfg(env)->ext_zve32x) {
 #if !defined(CONFIG_USER_ONLY)
         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
             return RISCV_EXCP_ILLEGAL_INST;
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
-        error_setg(errp, "Zve32f/Zve64f extensions require F extension");
-        return;
+    /* The Zve32f extension depends on the Zve32x extension */
+    if (cpu->cfg.ext_zve32f) {
+        if (!riscv_has_ext(env, RVF)) {
+            error_setg(errp, "Zve32f/Zve64f extensions require F extension");
+            return;
+        }
+        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
     }
 
     if (cpu->cfg.ext_zvfh) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zvbc), true);
     }
 
-    /*
-     * In principle Zve*x would also suffice here, were they supported
-     * in qemu
-     */
     if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkb || cpu->cfg.ext_zvkg ||
          cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed ||
-         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
+         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32x) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
 {
     TCGv s1, dst;
 
-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
+    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
 {
     TCGv dst;
 
-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
+    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
         return false;
     }
 
-- 
2.45.1

From: Jason Chien <jason.chien@sifive.com>

Add support for Zve64x extension. Enabling Zve64f enables Zve64x and
enabling Zve64x enables Zve32x according to their dependency.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2107
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240328022343.6871-3-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     |  1 +
 target/riscv/cpu.c         |  2 ++
 target/riscv/tcg/tcg-cpu.c | 17 +++++++++++------
 3 files changed, 14 insertions(+), 6 deletions(-)

From: Jason Chien <jason.chien@sifive.com>

In current implementation, the gdbstub allows reading vector registers
only if V extension is supported. However, all vector extensions and
vector crypto extensions have the vector registers and they all depend
on Zve32x. The gdbstub should check for Zve32x instead.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Message-ID: <20240328022343.6871-4-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
                                  gdb_find_static_feature("riscv-32bit-fpu.xml"),
                                  0);
     }
-    if (env->misa_ext & RVV) {
+    if (cpu->cfg.ext_zve32x) {
         gdb_register_coprocessor(cs, riscv_gdb_get_vector,
                                  riscv_gdb_set_vector,
                                  ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
-- 
2.45.1

From: Huang Tao <eric.huang@linux.alibaba.com>

In RVV and vcrypto instructions, the masked and tail elements are set to 1s
using vext_set_elems_1s function if the vma/vta bit is set. It is the element
agnostic policy.

However, this function can't deal the big endian situation. This patch fixes
the problem by adding handling of such case.

Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240325021654.6594-1-eric.huang@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.c
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
     if (tot - cnt == 0) {
         return ;
     }
+
+    if (HOST_BIG_ENDIAN) {
+        /*
+         * Deal the situation when the elements are insdie
+         * only one uint64 block including setting the
+         * masked-off element.
+         */
+        if (((tot - 1) ^ cnt) < 8) {
+            memset(base + H1(tot - 1), -1, tot - cnt);
+            return;
+        }
+        /*
+         * Otherwise, at least cross two uint64_t blocks.
+         * Set first unaligned block.
+         */
+        if (cnt % 8 != 0) {
+            uint32_t j = ROUND_UP(cnt, 8);
+            memset(base + H1(j - 1), -1, j - cnt);
+            cnt = j;
+        }
+        /* Set other 64bit aligend blocks */
+    }
     memset(base + cnt, -1, tot - cnt);
 }
 
-- 
2.45.1

From: Yangyu Chen <cyy@cyyself.name>

This code has a typo that writes zvkb to zvkg, causing users can't
enable zvkb through the config. This patch gets this fixed.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Fixes: ea61ef7097d0 ("target/riscv: Move vector crypto extensions to riscv_cpu_extensions")
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by:  Weiwei Li <liwei1518@gmail.com>
Message-ID: <tencent_7E34EEF0F90B9A68BF38BEE09EC6D4877C0A@qq.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
-    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
+    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkb, false),
     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
     MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
-- 
2.45.1

From: Huang Tao <eric.huang@linux.alibaba.com>

In this patch, we modify the decoder to be a freely composable data
structure instead of a hardcoded one. It can be dynamically builded up
according to the extensions.
This approach has several benefits:
1. Provides support for heterogeneous cpu architectures. As we add decoder in
   RISCVCPU, each cpu can have their own decoder, and the decoders can be
   different due to cpu's features.
2. Improve the decoding efficiency. We run the guard_func to see if the decoder
   can be added to the dynamic_decoder when building up the decoder. Therefore,
   there is no need to run the guard_func when decoding each instruction. It can
   improve the decoding efficiency
3. For vendor or dynamic cpus, it allows them to customize their own decoder
   functions to improve decoding efficiency, especially when vendor-defined
   instruction sets increase. Because of dynamic building up, it can skip the other
   decoder guard functions when decoding.
4. Pre patch for allowing adding a vendor decoder before decode_insn32() with minimal
   overhead for users that don't need this particular vendor decoder.

Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
Suggested-by: Christoph Muellner <christoph.muellner@vrull.eu>
Co-authored-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240506023607.29544-1-eric.huang@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/tcg/tcg-cpu.h | 15 +++++++++++++++
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++
 target/riscv/translate.c   | 31 +++++++++++++++----------------
 5 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint32_t pmu_avail_ctrs;
     /* Mapping of events to counters */
     GHashTable *pmu_event_ctr_map;
+    const GPtrArray *decoders;
 };
 
 /**
diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.h
+++ b/target/riscv/tcg/tcg-cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
 void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
 
+struct DisasContext;
+struct RISCVCPUConfig;
+typedef struct RISCVDecoder {
+    bool (*guard_func)(const struct RISCVCPUConfig *);
+    bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
+} RISCVDecoder;
+
+typedef bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
+
+extern const size_t decoder_table_size;
+
+extern const RISCVDecoder decoder_table[];
+
+void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu);
+
 #endif
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
             error_propagate(errp, local_err);
             return;
         }
+        riscv_tcg_cpu_finalize_dynamic_decoder(cpu);
     } else if (kvm_enabled()) {
         riscv_kvm_cpu_finalize_features(cpu, &local_err);
         if (local_err != NULL) {
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     }
 }
 
+void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
+{
+    GPtrArray *dynamic_decoders;
+    dynamic_decoders = g_ptr_array_sized_new(decoder_table_size);
+    for (size_t i = 0; i < decoder_table_size; ++i) {
+        if (decoder_table[i].guard_func &&
+            decoder_table[i].guard_func(&cpu->cfg)) {
+            g_ptr_array_add(dynamic_decoders,
+                            (gpointer)decoder_table[i].riscv_cpu_decode_fn);
+        }
+    }
+
+    cpu->decoders = dynamic_decoders;
+}
+
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu)
 {
     return object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST) == NULL;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-info.c.inc"
 #undef  HELPER_H
 
+#include "tcg/tcg-cpu.h"
+
 /* global register indices */
 static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
 static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     /* FRM is known to contain a valid value. */
     bool frm_valid;
     bool insn_start_updated;
+    const GPtrArray *decoders;
 } DisasContext;
 
 static inline bool has_ext(DisasContext *ctx, uint32_t ext)
@@ -XXX,XX +XXX,XX @@ static inline int insn_len(uint16_t first_word)
     return (first_word & 3) == 3 ? 4 : 2;
 }
 
+const RISCVDecoder decoder_table[] = {
+    { always_true_p, decode_insn32 },
+    { has_xthead_p, decode_xthead},
+    { has_XVentanaCondOps_p, decode_XVentanaCodeOps},
+};
+
+const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
-    /*
-     * A table with predicate (i.e., guard) functions and decoder functions
-     * that are tested in-order until a decoder matches onto the opcode.
-     */
-    static const struct {
-        bool (*guard_func)(const RISCVCPUConfig *);
-        bool (*decode_func)(DisasContext *, uint32_t);
-    } decoders[] = {
-        { always_true_p,  decode_insn32 },
-        { has_xthead_p, decode_xthead },
-        { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
-    };
-
     ctx->virt_inst_excp = false;
     ctx->cur_insn_len = insn_len(opcode);
     /* Check for compressed insn */
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
                                              ctx->base.pc_next + 2));
         ctx->opcode = opcode32;
 
-        for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx->cfg_ptr) &&
-                decoders[i].decode_func(ctx, opcode32)) {
+        for (guint i = 0; i < ctx->decoders->len; ++i) {
+            riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
+            if (func(ctx, opcode32)) {
                 return;
             }
         }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->zero = tcg_constant_tl(0);
     ctx->virt_inst_excp = false;
+    ctx->decoders = cpu->decoders;
 }
 
 static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu)
-- 
2.45.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

The th.sxstatus CSR can be used to identify available custom extension
on T-Head CPUs. The CSR is documented here:
  https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadsxstatus.adoc

An important property of this patch is, that the th.sxstatus MAEE field
is not set (indicating that XTheadMae is not available).
XTheadMae is a memory attribute extension (similar to Svpbmt) which is
implemented in many T-Head CPUs (C906, C910, etc.) and utilizes bits
in PTEs that are marked as reserved. QEMU maintainers prefer to not
implement XTheadMae, so we need give kernels a mechanism to identify
if XTheadMae is available in a system or not. And this patch introduces
this mechanism in QEMU in a way that's compatible with real HW
(i.e., probing the th.sxstatus.MAEE bit).

Further context can be found on the list:
https://lists.gnu.org/archive/html/qemu-devel/2024-02/msg00775.html

Reviewed-by: LIU Zhiwei <zhiwe_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-ID: <20240429073656.2486732-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS              |  1 +
 target/riscv/cpu.h       |  3 ++
 target/riscv/cpu.c       |  1 +
 target/riscv/th_csr.c    | 79 ++++++++++++++++++++++++++++++++++++++++
 target/riscv/meson.build |  1 +
 5 files changed, 85 insertions(+)
 create mode 100644 target/riscv/th_csr.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-riscv@nongnu.org
 S: Supported
 F: target/riscv/insn_trans/trans_xthead.c.inc
 F: target/riscv/xthead*.decode
+F: target/riscv/th_*
 F: disas/riscv-xthead*
 
 RISC-V XVentanaCondOps extension
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
 uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
+/* Implemented in th_csr.c */
+void th_register_custom_csrs(RISCVCPU *cpu);
+
 #endif /* RISCV_CPU_H */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     cpu->cfg.mvendorid = THEAD_VENDOR_ID;
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(cpu, VM_1_10_SV39);
+    th_register_custom_csrs(cpu);
 #endif
 
     /* inherited from parent obj via riscv_cpu_init() */
diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/th_csr.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * T-Head-specific CSRs.
+ *
+ * Copyright (c) 2024 VRULL GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "cpu_vendorid.h"
+
+#define CSR_TH_SXSTATUS 0x5c0
+
+/* TH_SXSTATUS bits */
+#define TH_SXSTATUS_UCME        BIT(16)
+#define TH_SXSTATUS_MAEE        BIT(21)
+#define TH_SXSTATUS_THEADISAEE  BIT(22)
+
+typedef struct {
+    int csrno;
+    int (*insertion_test)(RISCVCPU *cpu);
+    riscv_csr_operations csr_ops;
+} riscv_csr;
+
+static RISCVException smode(CPURISCVState *env, int csrno)
+{
+    if (riscv_has_ext(env, RVS)) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return RISCV_EXCP_ILLEGAL_INST;
+}
+
+static int test_thead_mvendorid(RISCVCPU *cpu)
+{
+    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
+                                       target_ulong *val)
+{
+    /* We don't set MAEE here, because QEMU does not implement MAEE. */
+    *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
+    return RISCV_EXCP_NONE;
+}
+
+static riscv_csr th_csr_list[] = {
+    {
+        .csrno = CSR_TH_SXSTATUS,
+        .insertion_test = test_thead_mvendorid,
+        .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
+    }
+};
+
+void th_register_custom_csrs(RISCVCPU *cpu)
+{
+    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
+        int csrno = th_csr_list[i].csrno;
+        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
+        if (!th_csr_list[i].insertion_test(cpu)) {
+            riscv_set_csr_ops(csrno, csr_ops);
+        }
+    }
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_system_ss.add(files(
   'monitor.c',
   'machine.c',
   'pmu.c',
+  'th_csr.c',
   'time_helper.c',
   'riscv-qmp-cmds.c',
 ))
-- 
2.45.1

From: Max Chou <max.chou@sifive.com>

According v spec 18.4, only the vfwcvt.f.f.v and vfncvt.f.f.w
instructions will be affected by Zvfhmin extension.
And the vfwcvt.f.f.v and vfncvt.f.f.w instructions only support the
conversions of

* From 1*SEW(16/32) to 2*SEW(32/64)
* From 2*SEW(32/64) to 1*SEW(16/32)

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

The require_scale_rvf function only checks the double width operator for
the vector floating point widen instructions, so most of the widen
checking functions need to add require_rvf for single width operator.

The vfwcvt.f.x.v and vfwcvt.f.xu.v instructions convert single width
integer to double width float, so the opfxv_widen_check function doesn’t
need require_rvf for the single width operator(integer).

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 5 +++++
 1 file changed, 5 insertions(+)

From: Max Chou <max.chou@sifive.com>

If the checking functions check both the single and double width
operators at the same time, then the single width operator checking
functions (require_rvf[min]) will check whether the SEW is 8.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_ds(s, a->rd, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dd(s, a->rd, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_widen_check(s, a) &&
            require_rvfmin(s) &&
-           require_scale_rvfmin(s) &&
-           (s->sew != MO_8);
+           require_scale_rvfmin(s);
 }
 
 #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_narrow_check(s, a) &&
            require_rvfmin(s) &&
-           require_scale_rvfmin(s) &&
-           (s->sew != MO_8);
+           require_scale_rvfmin(s);
 }
 
 static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_narrow_check(s, a) &&
            require_rvf(s) &&
-           require_scale_rvf(s) &&
-           (s->sew != MO_8);
+           require_scale_rvf(s);
 }
 
 #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
 {
     return reduction_widen_check(s, a) &&
            require_rvf(s) &&
-           require_scale_rvf(s) &&
-           (s->sew != MO_8);
+           require_scale_rvf(s);
 }
 
 GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

raise_mmu_exception(), as is today, is prioritizing guest page faults by
checking first if virt_enabled && !first_stage, and then considering the
regular inst/load/store faults.

There's no mention in the spec about guest page fault being a higher
priority that PMP faults. In fact, privileged spec section 3.7.1 says:

"Attempting to fetch an instruction from a PMP region that does not have
execute permissions raises an instruction access-fault exception.
Attempting to execute a load or load-reserved instruction which accesses
a physical address within a PMP region without read permissions raises a
load access-fault exception. Attempting to execute a store,
store-conditional, or AMO instruction which accesses a physical address
within a PMP region without write permissions raises a store
access-fault exception."

So, in fact, we're doing it wrong - PMP faults should always be thrown,
regardless of also being a first or second stage fault.

The way riscv_cpu_tlb_fill() and get_physical_address() work is
adequate: a TRANSLATE_PMP_FAIL error is immediately reported and
reflected in the 'pmp_violation' flag. What we need is to change
raise_mmu_exception() to prioritize it.

Reported-by: Joseph Chan <jchan@ventanamicro.com>
Fixes: 82d53adfbb ("target/riscv/cpu_helper.c: Invalid exception on MMU translation stage")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240413105929.7030-1-alexei.filippov@syntacore.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
 
     switch (access_type) {
     case MMU_INST_FETCH:
-        if (env->virt_enabled && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
+        } else if (env->virt_enabled && !first_stage) {
             cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_INST_ACCESS_FAULT : RISCV_EXCP_INST_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
         }
         break;
     case MMU_DATA_LOAD:
-        if (two_stage && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
+        } else if (two_stage && !first_stage) {
             cs->exception_index = RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_LOAD_ACCESS_FAULT : RISCV_EXCP_LOAD_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
         }
         break;
     case MMU_DATA_STORE:
-        if (two_stage && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
+        } else if (two_stage && !first_stage) {
             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_STORE_AMO_ACCESS_FAULT :
-                RISCV_EXCP_STORE_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
         }
         break;
     default:
-- 
2.45.1

From: Alexei Filippov <alexei.filippov@syntacore.com>

Previous patch fixed the PMP priority in raise_mmu_exception() but we're still
setting mtval2 incorrectly. In riscv_cpu_tlb_fill(), after pmp check in 2 stage
translation part, mtval2 will be set in case of successes 2 stage translation but
failed pmp check.

In this case we gonna set mtval2 via env->guest_phys_fault_addr in context of
riscv_cpu_tlb_fill(), as this was a guest-page-fault, but it didn't and mtval2
should be zero, according to RISCV privileged spec sect. 9.4.4: When a guest
page-fault is taken into M-mode, mtval2 is written with either zero or guest
physical address that faulted, shifted by 2 bits. *For other traps, mtval2
is set to zero...*

Signed-off-by: Alexei Filippov <alexei.filippov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240503103052.6819-1-alexei.filippov@syntacore.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                               __func__, pa, ret, prot_pmp, tlb_size);
 
                 prot &= prot_pmp;
-            }
-
-            if (ret != TRANSLATE_SUCCESS) {
+            } else {
                 /*
                  * Guest physical address translation failed, this is a HS
                  * level exception
                  */
                 first_stage_error = false;
-                env->guest_phys_fault_addr = (im_address |
-                                              (address &
-                                               (TARGET_PAGE_SIZE - 1))) >> 2;
+                if (ret != TRANSLATE_PMP_FAIL) {
+                    env->guest_phys_fault_addr = (im_address |
+                                                  (address &
+                                                   (TARGET_PAGE_SIZE - 1))) >> 2;
+                }
             }
         }
     } else {
-- 
2.45.1

From: Rob Bradford <rbradford@rivosinc.com>

This extension has now been ratified:
https://jira.riscv.org/browse/RVS-2006 so the "x-" prefix can be
removed.

Since this is now a ratified extension add it to the list of extensions
included in the "max" CPU variant.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20240514110217.22516-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         | 2 +-
 target/riscv/tcg/tcg-cpu.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
     MISA_EXT_INFO(RVV, "v", "Vector operations"),
     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
-    MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
+    MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
 };
 
 static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
     const RISCVCPUMultiExtConfig *prop;
 
     /* Enable RVG, RVJ and RVV that are disabled by default */
-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVG | RVJ | RVV);
+    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
         isa_ext_update_enabled(cpu, prop->offset, true);
-- 
2.45.1

From: Alistair Francis <alistair23@gmail.com>

When running the instruction

```
    cbo.flush 0(x0)
```

QEMU would segfault.

The issue was in cpu_gpr[a->rs1] as QEMU does not have cpu_gpr[0]
allocated.

In order to fix this let's use the existing get_address()
helper. This also has the benefit of performing pointer mask
calculations on the address specified in rs1.

The pointer masking specificiation specifically states:

"""
Cache Management Operations: All instructions in Zicbom, Zicbop and Zicboz
"""

So this is the correct behaviour and we previously have been incorrectly
not masking the address.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reported-by: Fabian Thomas <fabian.thomas@cispa.de>
Fixes: e05da09b7cfd ("target/riscv: implement Zicbom extension")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240514023910.301766-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzicbo.c.inc | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/insn_trans/trans_rvzicbo.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzicbo.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicbo.c.inc
@@ -XXX,XX +XXX,XX @@
 static bool trans_cbo_clean(DisasContext *ctx, arg_cbo_clean *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_clean_flush(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_flush(DisasContext *ctx, arg_cbo_flush *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_clean_flush(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_inval(DisasContext *ctx, arg_cbo_inval *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_inval(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_inval(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_zero(DisasContext *ctx, arg_cbo_zero *a)
 {
     REQUIRE_ZICBOZ(ctx);
-    gen_helper_cbo_zero(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_zero(tcg_env, src);
     return true;
 }
-- 
2.45.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In AIA spec, each hart (or each hart within a group) has a unique hart
number to locate the memory pages of interrupt files in the address
space. The number of bits required to represent any hart number is equal
to ceil(log2(hmax + 1)), where hmax is the largest hart number among
groups.

However, if the largest hart number among groups is a power of 2, QEMU
will pass an inaccurate hart-index-bit setting to Linux. For example, when
the guest OS has 4 harts, only ceil(log2(3 + 1)) = 2 bits are sufficient
to represent 4 harts, but we passes 3 to Linux. The code needs to be
updated to ensure accurate hart-index-bit settings.

Additionally, a Linux patch[1] is necessary to correctly recover the hart
index when the guest OS has only 1 hart, where the hart-index-bit is 0.

[1] https://lore.kernel.org/lkml/20240415064905.25184-1-yongxuan.wang@sifive.com/t/

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240515091129.28116-1-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         }
     }
 
-    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+
+    if (max_hart_per_socket > 1) {
+        max_hart_per_socket--;
+        hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    } else {
+        hart_bits = 0;
+    }
+
     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
                             KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
                             &hart_bits, true, NULL);
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 33a24910ae changed 'reg_width' to use 'vlenb', i.e. vector length
in bytes, when in this context we want 'reg_width' as the length in
bits.

Fix 'reg_width' back to the value in bits like 7cb59921c05a
("target/riscv/gdbstub.c: use 'vlenb' instead of shifting 'vlen'") set
beforehand.

While we're at it, rename 'reg_width' to 'bitsize' to provide a bit more
clarity about what the variable represents. 'bitsize' is also used in
riscv_gen_dynamic_csr_feature() with the same purpose, i.e. as an input to
gdb_feature_builder_append_reg().

Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
Cc: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Robin Dapp <rdapp.gcc@gmail.com>
Fixes: 33a24910ae ("target/riscv: Use GDBFeature for dynamic XML")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240517203054.880861-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
 static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
-    int reg_width = cpu->cfg.vlenb;
+    int bitsize = cpu->cfg.vlenb << 3;
     GDBFeatureBuilder builder;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
+        int count = bitsize / vec_lanes[i].size;
         gdb_feature_builder_append_tag(
             &builder, "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
             vec_lanes[i].id, vec_lanes[i].gdb_type, count);
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
     /* Define vector registers */
     for (i = 0; i < 32; i++) {
         gdb_feature_builder_append_reg(&builder, g_strdup_printf("v%d", i),
-                                       reg_width, i, "riscv_vector", "vector");
+                                       bitsize, i, "riscv_vector", "vector");
     }
 
     gdb_feature_builder_end(&builder);
-- 
2.45.1

From: Alistair Francis <alistair23@gmail.com>

Previously we only listed a single pmpcfg CSR and the first 16 pmpaddr
CSRs. This patch fixes this to list all 16 pmpcfg and all 64 pmpaddr
CSRs are part of the disassembly.

Reported-by: Eric DeVolder <eric_devolder@yahoo.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Fixes: ea10325917 ("RISC-V Disassembler")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240514051615.330979-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 64 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x0383: return "mibound";
     case 0x0384: return "mdbase";
     case 0x0385: return "mdbound";
-    case 0x03a0: return "pmpcfg3";
+    case 0x03a0: return "pmpcfg0";
+    case 0x03a1: return "pmpcfg1";
+    case 0x03a2: return "pmpcfg2";
+    case 0x03a3: return "pmpcfg3";
+    case 0x03a4: return "pmpcfg4";
+    case 0x03a5: return "pmpcfg5";
+    case 0x03a6: return "pmpcfg6";
+    case 0x03a7: return "pmpcfg7";
+    case 0x03a8: return "pmpcfg8";
+    case 0x03a9: return "pmpcfg9";
+    case 0x03aa: return "pmpcfg10";
+    case 0x03ab: return "pmpcfg11";
+    case 0x03ac: return "pmpcfg12";
+    case 0x03ad: return "pmpcfg13";
+    case 0x03ae: return "pmpcfg14";
+    case 0x03af: return "pmpcfg15";
     case 0x03b0: return "pmpaddr0";
     case 0x03b1: return "pmpaddr1";
     case 0x03b2: return "pmpaddr2";
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x03bd: return "pmpaddr13";
     case 0x03be: return "pmpaddr14";
     case 0x03bf: return "pmpaddr15";
+    case 0x03c0: return "pmpaddr16";
+    case 0x03c1: return "pmpaddr17";
+    case 0x03c2: return "pmpaddr18";
+    case 0x03c3: return "pmpaddr19";
+    case 0x03c4: return "pmpaddr20";
+    case 0x03c5: return "pmpaddr21";
+    case 0x03c6: return "pmpaddr22";
+    case 0x03c7: return "pmpaddr23";
+    case 0x03c8: return "pmpaddr24";
+    case 0x03c9: return "pmpaddr25";
+    case 0x03ca: return "pmpaddr26";
+    case 0x03cb: return "pmpaddr27";
+    case 0x03cc: return "pmpaddr28";
+    case 0x03cd: return "pmpaddr29";
+    case 0x03ce: return "pmpaddr30";
+    case 0x03cf: return "pmpaddr31";
+    case 0x03d0: return "pmpaddr32";
+    case 0x03d1: return "pmpaddr33";
+    case 0x03d2: return "pmpaddr34";
+    case 0x03d3: return "pmpaddr35";
+    case 0x03d4: return "pmpaddr36";
+    case 0x03d5: return "pmpaddr37";
+    case 0x03d6: return "pmpaddr38";
+    case 0x03d7: return "pmpaddr39";
+    case 0x03d8: return "pmpaddr40";
+    case 0x03d9: return "pmpaddr41";
+    case 0x03da: return "pmpaddr42";
+    case 0x03db: return "pmpaddr43";
+    case 0x03dc: return "pmpaddr44";
+    case 0x03dd: return "pmpaddr45";
+    case 0x03de: return "pmpaddr46";
+    case 0x03df: return "pmpaddr47";
+    case 0x03e0: return "pmpaddr48";
+    case 0x03e1: return "pmpaddr49";
+    case 0x03e2: return "pmpaddr50";
+    case 0x03e3: return "pmpaddr51";
+    case 0x03e4: return "pmpaddr52";
+    case 0x03e5: return "pmpaddr53";
+    case 0x03e6: return "pmpaddr54";
+    case 0x03e7: return "pmpaddr55";
+    case 0x03e8: return "pmpaddr56";
+    case 0x03e9: return "pmpaddr57";
+    case 0x03ea: return "pmpaddr58";
+    case 0x03eb: return "pmpaddr59";
+    case 0x03ec: return "pmpaddr60";
+    case 0x03ed: return "pmpaddr61";
+    case 0x03ee: return "pmpaddr62";
+    case 0x03ef: return "pmpaddr63";
     case 0x0780: return "mtohost";
     case 0x0781: return "mfromhost";
     case 0x0782: return "mreset";
-- 
2.45.1

From: Yu-Ming Chang <yumin686@andestech.com>

Both CSRRS and CSRRC always read the addressed CSR and cause any read side
effects regardless of rs1 and rd fields. Note that if rs1 specifies a register
holding a zero value other than x0, the instruction will still attempt to write
the unmodified value back to the CSR and will cause any attendant side effects.

So if CSRRS or CSRRC tries to write a read-only CSR with rs1 which specifies
a register holding a zero value, an illegal instruction exception should be
raised.

Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240403070823.80897-1-yumin686@andestech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h       |  4 ++++
 target/riscv/csr.c       | 51 ++++++++++++++++++++++++++++++++++++----
 target/riscv/op_helper.c |  6 ++---
 3 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env);
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
+RISCVException riscv_csrr(CPURISCVState *env, int csrno,
+                          target_ulong *ret_value);
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask);
@@ -XXX,XX +XXX,XX @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
                                           target_ulong new_value,
                                           target_ulong write_mask);
 
+RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
+                               Int128 *ret_value);
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 *ret_value,
                                 Int128 new_value, Int128 write_mask);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
 
 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                int csrno,
-                                               bool write_mask)
+                                               bool write)
 {
     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
     bool read_only = get_field(csrno, 0xC00) == 3;
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
     }
 
     /* read / write check */
-    if (write_mask && read_only) {
+    if (write && read_only) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+RISCVException riscv_csrr(CPURISCVState *env, int csrno,
+                           target_ulong *ret_value)
+{
+    RISCVException ret = riscv_csrrw_check(env, csrno, false);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
+}
+
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask)
 {
-    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
+    RISCVException ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
+                               Int128 *ret_value)
+{
+    RISCVException ret;
+
+    ret = riscv_csrrw_check(env, csrno, false);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    if (csr_ops[csrno].read128) {
+        return riscv_csrrw_do128(env, csrno, ret_value,
+                                 int128_zero(), int128_zero());
+    }
+
+    /*
+     * Fall back to 64-bit version for now, if the 128-bit alternative isn't
+     * at all defined.
+     * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
+     * significant), for those, this fallback is correctly handling the
+     * accesses
+     */
+    target_ulong old_value;
+    ret = riscv_csrrw_do64(env, csrno, &old_value,
+                           (target_ulong)0,
+                           (target_ulong)0);
+    if (ret == RISCV_EXCP_NONE && ret_value) {
+        *ret_value = int128_make64(old_value);
+    }
+    return ret;
+}
+
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 *ret_value,
                                 Int128 new_value, Int128 write_mask)
 {
     RISCVException ret;
 
-    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
+    ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
     }
 
     target_ulong val = 0;
-    RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
+    RISCVException ret = riscv_csrr(env, csr, &val);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
 target_ulong helper_csrr_i128(CPURISCVState *env, int csr)
 {
     Int128 rv = int128_zero();
-    RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
-                                          int128_zero(),
-                                          int128_zero());
+    RISCVException ret = riscv_csrr_i128(env, csr, &rv);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
-- 
2.45.1