Series comparison

-[PULL 00/65] riscv-to-apply queue
+[PULL v2 00/50] riscv-to-apply queue
-The following changes since commit 9468484fe904ab4691de6d9c34616667f377ceac:
+The following changes since commit 0e3aff9ec34059512d597eacfcf4d1b5d4570c50:
-  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2024-01-09 10:32:23 +0000)
+  Merge tag 'pull-10.0-gdb-plugins-doc-updates-170125-1' of https://gitlab.com/stsquad/qemu into staging (2025-01-17 10:13:07 -0500)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240110
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20250119-1
-for you to fetch changes up to 71b76da33a1558bcd59100188f5753737ef6fa21:
+for you to fetch changes up to f04cac4f8f254931f2af9d059b2175769e576afa:
-  target/riscv: Ensure mideleg is set correctly on reset (2024-01-10 18:47:47 +1000)
+  hw/char/riscv_htif: Convert HTIF_DEBUG() to trace events (2025-01-19 09:44:35 +1000)
 ----------------------------------------------------------------
-RISC-V PR for 9.0
+Second RISC-V PR for 10.0
-* Make vector whole-register move (vmv) depend on vtype register
+* Reduce the overhead for simple RISC-V vector unit-stride loads and stores
-* Fix th.dcache.cval1 priviledge check
+* Add V bit to GDB priv reg
-* Don't allow write mstatus_vs without RVV
+* Add 'sha' support
-* Use hwaddr instead of target_ulong for RV32
+* Add traces for exceptions in user mode
-* Fix machine IDs QOM getters\
+* Update Pointer Masking to Zjpm v1.0
-* Fix KVM reg id sizes
+* Add Smrnmi support
-* ACPI: Enable AIA, PLIC and update RHCT
+* Fix timebase-frequency when using KVM acceleration
-* Fix the interrupts-extended property format of PLIC
+* Add RISC-V Counter delegation ISA extension support
-* Add support for Zacas extension
+* Add support for Smdbltrp and Ssdbltrp extensions
-* Add amocas.[w,d,q] instructions
+* Introduce a translation tag for the IOMMU page table cache
-* Document acpi parameter of virt machine
+* Support Supm and Sspm as part of Zjpm v1.0
-* RVA22 profiles support
+* Convert htif debug prints to trace event
 * Remove group setting of KVM AIA if the machine only has 1 socket
 * Add RVV CSRs to KVM
 * sifive_u: Update S-mode U-Boot image build instructions
 * Upgrade OpenSBI from v1.3.1 to v1.4
 * pmp: Ignore writes when RW=01 and MML=0
 * Assert that the CSR numbers will be correct
 * Don't adjust vscause for exceptions
 * Ensure mideleg is set correctly on reset
 ----------------------------------------------------------------
-Alistair Francis (3):
+Alexey Baturo (8):
-      target/riscv: Assert that the CSR numbers will be correct
+      target/riscv: Remove obsolete pointer masking extension code.
-      target/riscv: Don't adjust vscause for exceptions
+      target/riscv: Add new CSR fields for S{sn, mn, m}pm extensions as part of Zjpm v1.0
-      target/riscv: Ensure mideleg is set correctly on reset
+      target/riscv: Add helper functions to calculate current number of masked bits for pointer masking
       target/riscv: Add pointer masking tb flags
       target/riscv: Update address modify functions to take into account pointer masking
       target/riscv: Apply pointer masking for virtualized memory accesses
       target/riscv: Enable updates for pointer masking variables and thus enable pointer masking extension
       target/riscv: Support Supm and Sspm as part of Zjpm v1.0
-Bin Meng (2):
+Atish Patra (5):
-      docs/system/riscv: sifive_u: Update S-mode U-Boot image build instructions
+      target/riscv: Enable S*stateen bits for AIA
-      roms/opensbi: Upgrade from v1.3.1 to v1.4
+      target/riscv: Add properties for counter delegation ISA extensions
       target/riscv: Invoke pmu init after feature enable
       target/riscv: Add implied rule for counter delegation extensions
       target/riscv: Add configuration for S[m|s]csrind, Smcdeleg/Ssccfg
-Daniel Henrique Barboza (36):
+Clément Léger (9):
-      target/riscv/cpu.c: fix machine IDs getters
+      target/riscv: Fix henvcfg potentially containing stale bits
-      target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
+      target/riscv: Add Ssdbltrp CSRs handling
-      target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
+      target/riscv: Implement Ssdbltrp sret, mret and mnret behavior
-      target/riscv/kvm: change timer regs size to u64
+      target/riscv: Implement Ssdbltrp exception handling
-      target/riscv/kvm: add RISCV_CONFIG_REG()
+      target/riscv: Add Ssdbltrp ISA extension enable switch
-      target/riscv/kvm: rename riscv_reg_id() to riscv_reg_id_ulong()
+      target/riscv: Add Smdbltrp CSRs handling
-      target/riscv: create TYPE_RISCV_VENDOR_CPU
+      target/riscv: Implement Smdbltrp sret, mret and mnret behavior
-      target/riscv/tcg: do not use "!generic" CPU checks
+      target/riscv: Implement Smdbltrp behavior
-      target/riscv/tcg: update priv_ver on user_set extensions
+      target/riscv: Add Smdbltrp ISA extension enable switch
       target/riscv: add rv64i CPU
       target/riscv: add zicbop extension flag
       target/riscv/tcg: add 'zic64b' support
       riscv-qmp-cmds.c: expose named features in cpu_model_expansion
       target/riscv: add rva22u64 profile definition
       target/riscv/kvm: add 'rva22u64' flag as unavailable
       target/riscv/tcg: add user flag for profile support
       target/riscv/tcg: add MISA user options hash
       target/riscv/tcg: add riscv_cpu_write_misa_bit()
       target/riscv/tcg: handle profile MISA bits
       target/riscv/tcg: add hash table insert helpers
       target/riscv/tcg: honor user choice for G MISA bits
       target/riscv/tcg: validate profiles during finalize
       riscv-qmp-cmds.c: add profile flags in cpu-model-expansion
       target/riscv: add 'rva22u64' CPU
       target/riscv: implement svade
       target/riscv: add priv ver restriction to profiles
       target/riscv/cpu.c: finalize satp_mode earlier
       target/riscv/cpu.c: add riscv_cpu_is_32bit()
       target/riscv: add satp_mode profile support
       target/riscv: add 'parent' in profile description
       target/riscv: add RVA22S64 profile
       target/riscv: add rva22s64 cpu
       linux-headers: Update to Linux v6.7-rc5
       linux-headers: riscv: add ptrace.h
       target/riscv/kvm: do PR_RISCV_V_SET_CONTROL during realize()
       target/riscv/kvm: add RVV and Vector CSR regs
-Heinrich Schuchardt (1):
+Craig Blackmore (2):
-      docs/system/riscv: document acpi parameter of virt machine
+      target/riscv: rvv: fix typo in vext continuous ldst function names
       target/riscv: rvv: speed up small unit-stride loads and stores
-Ivan Klokov (2):
+Daniel Henrique Barboza (9):
-      target/riscv/pmp: Use hwaddr instead of target_ulong for RV32
+      target/riscv: add shcounterenw
-      target/riscv: pmp: Ignore writes when RW=01 and MML=0
+      target/riscv: add shvstvala
       target/riscv: add shtvala
       target/riscv: add shvstvecd
       target/riscv: add shvsatpa
       target/riscv: add shgatpa
       target/riscv/tcg: add sha
       target/riscv: use RISCVException enum in exception helpers
       target/riscv: add trace in riscv_raise_exception()
-LIU Zhiwei (2):
+Frank Chang (1):
-      target/riscv: Fix th.dcache.cval1 priviledge check
+      target/riscv: Add Zicfilp support for Smrnmi
       target/riscv: Not allow write mstatus_vs without RVV
-Max Chou (2):
+Jason Chien (1):
-      target/riscv: Add vill check for whole vector register move instructions
+      hw/riscv/riscv-iommu.c: Introduce a translation tag for the page table cache
       target/riscv: The whole vector register move instructions depend on vsew
-Rob Bradford (1):
+Kaiwen Xue (6):
-      disas/riscv: Add amocas.[w,d,q] instructions
+      target/riscv: Add properties for Indirect CSR Access extension
       target/riscv: Decouple AIA processing from xiselect and xireg
       target/riscv: Support generic CSR indirect access
       target/riscv: Add counter delegation definitions
       target/riscv: Add select value range check for counter delegation
       target/riscv: Add counter delegation/configuration support
-Sunil V L (13):
+Philippe Mathieu-Daudé (3):
-      hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
+      target/riscv: Have kvm_riscv_get_timebase_frequency() take RISCVCPU cpu
-      hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
+      hw/riscv/virt: Remove unnecessary use of &first_cpu
-      hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
+      hw/char/riscv_htif: Convert HTIF_DEBUG() to trace events
       hw/riscv: virt: Make few IMSIC macros and functions public
       hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
       hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
       hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
       hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
       hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
       hw/pci-host/gpex: Define properties for MMIO ranges
       hw/riscv/virt: Update GPEX MMIO related properties
       hw/riscv/virt-acpi-build.c: Add IO controllers and devices
       hw/riscv/virt-acpi-build.c: Add PLIC in MADT
-Weiwei Li (1):
+Tommy Wu (5):
-      target/riscv: Add support for Zacas extension
+      target/riscv: Add 'ext_smrnmi' in the RISCVCPUConfig
       target/riscv: Add Smrnmi CSRs
       target/riscv: Handle Smrnmi interrupt and exception
       target/riscv: Add Smrnmi mnret instruction
       target/riscv: Add Smrnmi cpu extension
-Yong-Xuan Wang (2):
+Yanfeng Liu (1):
-      hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
+      riscv/gdbstub: add V bit to priv reg
       target/riscv/kvm.c: remove group setting of KVM AIA if the machine only has 1 socket
- docs/system/riscv/sifive_u.rst                 |  33 +-
+ include/hw/riscv/riscv_hart.h                  |    4 +
- docs/system/riscv/virt.rst                     |   5 +
+ target/riscv/cpu.h                             |   65 +-
- include/hw/nvram/fw_cfg_acpi.h                 |  15 +
+ target/riscv/cpu_bits.h                        |  157 ++-
- include/hw/pci-host/gpex.h                     |  28 +-
+ target/riscv/cpu_cfg.h                         |   13 +
- include/hw/riscv/virt.h                        |  26 ++
+ target/riscv/helper.h                          |    1 +
- include/hw/virtio/virtio-acpi.h                |  16 +
+ target/riscv/internals.h                       |   54 +
- include/standard-headers/drm/drm_fourcc.h      |   2 +
+ target/riscv/kvm/kvm_riscv.h                   |    4 +-
- include/standard-headers/linux/pci_regs.h      |  24 +-
+ target/riscv/pmp.h                             |    1 +
- include/standard-headers/linux/vhost_types.h   |   7 +
+ target/riscv/insn32.decode                     |    3 +
- include/standard-headers/linux/virtio_config.h |   5 +
+ hw/char/riscv_htif.c                           |   15 +-
- include/standard-headers/linux/virtio_pci.h    |  11 +
+ hw/riscv/riscv-iommu.c                         |  205 +++-
- linux-headers/asm-arm64/kvm.h                  |  32 ++
+ hw/riscv/riscv_hart.c                          |   41 +
- linux-headers/asm-generic/unistd.h             |  14 +-
+ hw/riscv/virt.c                                |    2 +-
- linux-headers/asm-loongarch/bitsperlong.h      |   1 +
+ target/riscv/cpu.c                             |   97 +-
- linux-headers/asm-loongarch/kvm.h              | 108 ++++++
+ target/riscv/cpu_helper.c                      |  311 +++++-
- linux-headers/asm-loongarch/mman.h             |   1 +
+ target/riscv/csr.c                             | 1257 +++++++++++++++++-------
- linux-headers/asm-loongarch/unistd.h           |   5 +
+ target/riscv/gdbstub.c                         |   23 +-
- linux-headers/asm-mips/unistd_n32.h            |   4 +
+ target/riscv/kvm/kvm-cpu.c                     |    4 +-
- linux-headers/asm-mips/unistd_n64.h            |   4 +
+ target/riscv/machine.c                         |   18 +-
- linux-headers/asm-mips/unistd_o32.h            |   4 +
+ target/riscv/op_helper.c                       |  126 ++-
- linux-headers/asm-powerpc/unistd_32.h          |   4 +
+ target/riscv/pmp.c                             |   14 +-
- linux-headers/asm-powerpc/unistd_64.h          |   4 +
+ target/riscv/tcg/tcg-cpu.c                     |   60 +-
- linux-headers/asm-riscv/kvm.h                  |  12 +
+ target/riscv/translate.c                       |   49 +-
- linux-headers/asm-riscv/ptrace.h               | 132 +++++++
+ target/riscv/vector_helper.c                   |   31 +-
- linux-headers/asm-s390/unistd_32.h             |   4 +
+ target/riscv/insn_trans/trans_privileged.c.inc |   20 +
- linux-headers/asm-s390/unistd_64.h             |   4 +
+ hw/char/trace-events                           |    4 +
- linux-headers/asm-x86/unistd_32.h              |   4 +
+ target/riscv/trace-events                      |    3 +
- linux-headers/asm-x86/unistd_64.h              |   3 +
+ tests/data/acpi/riscv64/virt/RHCT              |  Bin 332 -> 390 bytes
- linux-headers/asm-x86/unistd_x32.h             |   3 +
+files changed, 1862 insertions(+), 720 deletions(-)
- linux-headers/linux/iommufd.h                  | 180 +++++++++-
  linux-headers/linux/kvm.h                      |  11 +
  linux-headers/linux/psp-sev.h                  |   1 +
  linux-headers/linux/stddef.h                   |   9 +-
  linux-headers/linux/userfaultfd.h              |   9 +-
  linux-headers/linux/vfio.h                     |  47 ++-
  linux-headers/linux/vhost.h                    |   8 +
  target/riscv/cpu-qom.h                         |   5 +
  target/riscv/cpu.h                             |  18 +
  target/riscv/cpu_cfg.h                         |   5 +
  target/riscv/pmp.h                             |   8 +-
  target/riscv/insn32.decode                     |   6 +
  disas/riscv.c                                  |   9 +
  hw/arm/virt-acpi-build.c                       |  51 +--
  hw/i386/acpi-microvm.c                         |  15 +-
  hw/nvram/fw_cfg-acpi.c                         |  23 ++
  hw/pci-host/gpex-acpi.c                        |  13 +
  hw/pci-host/gpex.c                             |  12 +
  hw/riscv/virt-acpi-build.c                     | 323 ++++++++++++++++--
  hw/riscv/virt.c                                | 124 +++----
  hw/virtio/virtio-acpi.c                        |  33 ++
  target/riscv/cpu.c                             | 223 ++++++++++--
  target/riscv/cpu_helper.c                      |   4 +-
  target/riscv/csr.c                             |  10 +-
  target/riscv/kvm/kvm-cpu.c                     | 250 ++++++++++----
  target/riscv/pmp.c                             |  28 +-
  target/riscv/riscv-qmp-cmds.c                  |  44 ++-
  target/riscv/tcg/tcg-cpu.c                     | 455 ++++++++++++++++++++++---
  target/riscv/translate.c                       |   1 +
  target/riscv/insn_trans/trans_rvv.c.inc        |   8 +-
  target/riscv/insn_trans/trans_rvzacas.c.inc    | 150 ++++++++
  target/riscv/insn_trans/trans_xthead.c.inc     |   2 +-
  hw/nvram/meson.build                           |   1 +
  hw/riscv/Kconfig                               |   1 +
  hw/virtio/meson.build                          |   1 +
  pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 135376 -> 267416 bytes
  pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 138368 -> 270808 bytes
  roms/opensbi                                   |   2 +-
  scripts/update-linux-headers.sh                |   3 +
 files changed, 2248 insertions(+), 360 deletions(-)
  create mode 100644 include/hw/nvram/fw_cfg_acpi.h
  create mode 100644 include/hw/virtio/virtio-acpi.h
  create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
  create mode 100644 linux-headers/asm-loongarch/kvm.h
  create mode 100644 linux-headers/asm-loongarch/mman.h
  create mode 100644 linux-headers/asm-loongarch/unistd.h
  create mode 100644 linux-headers/asm-riscv/ptrace.h
  create mode 100644 hw/nvram/fw_cfg-acpi.c
  create mode 100644 hw/virtio/virtio-acpi.c
  create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc

-[PULL 01/65] target/riscv: Add vill check for whole vector register move instructions
+Deleted patch
-From: Max Chou <max.chou@sifive.com>
-The ratified version of RISC-V V spec section 16.6 says that
-`The instructions operate as if EEW=SEW`.
-So the whole vector register move instructions depend on the vtype
-register that means the whole vector register move instructions should
-raise an illegal-instruction exception when vtype.vill=1.
-Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231129170400.21251-2-max.chou@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
- }
- /*
-- * Whole Vector Register Move Instructions ignore vtype and vl setting.
-- * Thus, we don't need to check vill bit. (Section 16.6)
-+ * Whole Vector Register Move Instructions depend on vtype register(vsew).
-+ * Thus, we need to check vill bit. (Section 16.6)
-  */
- #define GEN_VMV_WHOLE_TRANS(NAME, LEN)                             \
- static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
- {                                                                       \
-     if (require_rvv(s) &&                                               \
-+        vext_check_isa_ill(s) &&                                        \
-         QEMU_IS_ALIGNED(a->rd, LEN) &&                                  \
-         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
-         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
---
-.43.0

-[PULL 02/65] target/riscv: The whole vector register move instructions depend on vsew
+Deleted patch
-From: Max Chou <max.chou@sifive.com>
-The RISC-V v spec 16.6 section says that the whole vector register move
-instructions operate as if EEW=SEW. So it should depends on the vsew
-field of vtype register.
-Signed-off-by: Max Chou <max.chou@sifive.com>
-Acked-by: Richard Henderson <richard.henderson@linaro.org>
-Message-ID: <20231129170400.21251-3-max.chou@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
-         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
-         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
-         if (s->vstart_eq_zero) {                                        \
--            /* EEW = 8 */                                               \
--            tcg_gen_gvec_mov(MO_8, vreg_ofs(s, a->rd),                  \
-+            tcg_gen_gvec_mov(s->sew, vreg_ofs(s, a->rd),                \
-                              vreg_ofs(s, a->rs2), maxsz, maxsz);        \
-             mark_vs_dirty(s);                                           \
-         } else {                                                        \
---
-.43.0

-[PULL 03/65] target/riscv: Fix th.dcache.cval1 priviledge check
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-According to the specification, the th.dcache.cvall1 can be executed
-under all priviledges.
-The specification about xtheadcmo located in,
-https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadcmo/dcache_cval1.adoc
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Christoph Muellner <christoph.muellner@vrull.eu>
-Message-ID: <20231208094315.177-1-zhiwei_liu@linux.alibaba.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_xthead.c.inc | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_xthead.c.inc
-+++ b/target/riscv/insn_trans/trans_xthead.c.inc
-@@ -XXX,XX +XXX,XX @@ NOP_PRIVCHECK(th_dcache_csw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_dcache_cisw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_dcache_isw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_dcache_cpal1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
--NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
-+NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU)
- NOP_PRIVCHECK(th_icache_iall, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_icache_ialls, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
---
-.43.0

-[PULL 45/65] riscv-qmp-cmds.c: add profile flags in cpu-model-expansion
+[PULL v2 01/50] target/riscv: rvv: fix typo in vext continuous ldst function names
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Craig Blackmore <craig.blackmore@embecosm.com>
-Expose all profile flags for all CPUs when executing
+Replace `continus` with `continuous`.
 query-cpu-model-expansion. This will allow callers to quickly determine
 if a certain profile is implemented by a given CPU. This includes vendor
 CPUs - the fact that they don't have profile user flags doesn't mean
 that they don't implement the profile.
-After this change it's possible to quickly determine if our stock CPUs
+Signed-off-by: Craig Blackmore <craig.blackmore@embecosm.com>
-implement the existing rva22u64 profile. Here's a few examples:
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
- $ ./build/qemu-system-riscv64 -S -M virt -display none
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
--qmp tcp:localhost:1234,server,wait=off
+Message-ID: <20241218142353.1027938-2-craig.blackmore@embecosm.com>
  $ ./scripts/qmp/qmp-shell localhost:1234
 Welcome to the QMP low-level shell!
 Connected to QEMU 8.1.50
 - As expected, the 'max' CPU implements the rva22u64 profile.
 (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
     {"return": {"model":
         {"name": "rv64", "props": {... "rva22u64": true, ...}}}}
 - rv64 is missing "zba", "zbb", "zbs", "zkt" and "zfhmin":
 query-cpu-model-expansion type=full model={"name":"rv64"}
     {"return": {"model":
         {"name": "rv64", "props": {... "rva22u64": false, ...}}}}
 query-cpu-model-expansion type=full model={"name":"rv64",
     "props":{"zba":true,"zbb":true,"zbs":true,"zkt":true,"zfhmin":true}}
     {"return": {"model":
         {"name": "rv64", "props": {... "rva22u64": true, ...}}}}
 We have no vendor CPUs that supports rva22u64 (veyron-v1 is the closest
 - it is missing just 'zkt').
 In short, aside from the 'max' CPU, we have no CPUs that supports
 rva22u64 by default.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-18-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/riscv-qmp-cmds.c | 14 ++++++++++++++
+ target/riscv/vector_helper.c | 10 +++++-----
-file changed, 14 insertions(+)
+file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/riscv-qmp-cmds.c
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/riscv-qmp-cmds.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_ELEM(ste_w, uint32_t, H4, stl)
-     }
+ GEN_VEXT_ST_ELEM(ste_d, uint64_t, H8, stq)
  static inline QEMU_ALWAYS_INLINE void
 -vext_continus_ldst_tlb(CPURISCVState *env, vext_ldst_elem_fn_tlb *ldst_tlb,
 +vext_continuous_ldst_tlb(CPURISCVState *env, vext_ldst_elem_fn_tlb *ldst_tlb,
                         void *vd, uint32_t evl, target_ulong addr,
                         uint32_t reg_start, uintptr_t ra, uint32_t esz,
                         bool is_load)
@@ -XXX,XX +XXX,XX @@ vext_continus_ldst_tlb(CPURISCVState *env, vext_ldst_elem_fn_tlb *ldst_tlb,
  }
-+static void riscv_obj_add_profiles_qdict(Object *obj, QDict *qdict_out)
+ static inline QEMU_ALWAYS_INLINE void
-+{
+-vext_continus_ldst_host(CPURISCVState *env, vext_ldst_elem_fn_host *ldst_host,
-+    RISCVCPUProfile *profile;
++vext_continuous_ldst_host(CPURISCVState *env, vext_ldst_elem_fn_host *ldst_host,
-+    QObject *value;
+                         void *vd, uint32_t evl, uint32_t reg_start, void *host,
-+
+                         uint32_t esz, bool is_load)
-+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+ {
-+        profile = riscv_profiles[i];
+@@ -XXX,XX +XXX,XX @@ vext_page_ldst_us(CPURISCVState *env, void *vd, target_ulong addr,
-+        value = QOBJECT(qbool_from_bool(profile->enabled));
-+
+     if (flags == 0) {
-+        qdict_put_obj(qdict_out, profile->name, value);
+         if (nf == 1) {
-+    }
+-            vext_continus_ldst_host(env, ldst_host, vd, evl, env->vstart, host,
-+}
+-                                    esz, is_load);
-+
++            vext_continuous_ldst_host(env, ldst_host, vd, evl, env->vstart,
- static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
++                                      host, esz, is_load);
-                                            const QDict *qdict_in,
+         } else {
-                                            Error **errp)
+             for (i = env->vstart; i < evl; ++i) {
-@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                 k = 0;
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
+@@ -XXX,XX +XXX,XX @@ vext_page_ldst_us(CPURISCVState *env, void *vd, target_ulong addr,
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
+         env->vstart += elems;
-     riscv_obj_add_named_feats_qdict(obj, qdict_out);
+     } else {
-+    riscv_obj_add_profiles_qdict(obj, qdict_out);
+         if (nf == 1) {
+-            vext_continus_ldst_tlb(env, ldst_tlb, vd, evl, addr, env->vstart,
-     /* Add our CPU boolean options too */
++            vext_continuous_ldst_tlb(env, ldst_tlb, vd, evl, addr, env->vstart,
-     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
+                                    ra, esz, is_load);
          } else {
              /* load bytes from guest memory */
 --
-.43.0
+.48.1

-[PULL 30/65] target/riscv/tcg: do not use "!generic" CPU checks
+[PULL v2 02/50] target/riscv: rvv: speed up small unit-stride loads and stores
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Craig Blackmore <craig.blackmore@embecosm.com>
-Our current logic in get/setters of MISA and multi-letter extensions
+Calling `vext_continuous_ldst_tlb` for load/stores up to 6 bytes
-works because we have only 2 CPU types, generic and vendor, and by using
+significantly improves performance.
 "!generic" we're implying that we're talking about vendor CPUs. When adding
 a third CPU type this logic will break so let's handle it beforehand.
-In set_misa_ext_cfg() and set_multi_ext_cfg(), check for "vendor" cpu instead
+Co-authored-by: Helene CHELIN <helene.chelin@embecosm.com>
-of "not generic". The "generic CPU" checks remaining are from
+Co-authored-by: Paolo Savini <paolo.savini@embecosm.com>
-riscv_cpu_add_misa_properties() and cpu_add_multi_ext_prop() before
+Co-authored-by: Craig Blackmore <craig.blackmore@embecosm.com>
 applying default values for the extensions.
-This leaves us with:
+Signed-off-by: Helene CHELIN <helene.chelin@embecosm.com>
+Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
-- vendor CPUs will not allow extension enablement, all other CPUs will;
+Signed-off-by: Craig Blackmore <craig.blackmore@embecosm.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-- generic CPUs will inherit default values for extensions, all others
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-  won't.
+Message-ID: <20241218142353.1027938-3-craig.blackmore@embecosm.com>
 And now we can add a new, third CPU type, that will allow extensions to
 be enabled and will not inherit defaults, without changing the existing
 logic.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 13 +++++++++----
+ target/riscv/vector_helper.c | 16 ++++++++++++++++
-file changed, 9 insertions(+), 4 deletions(-)
+file changed, 16 insertions(+)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_is_generic(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
      return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
  }
 +static bool riscv_cpu_is_vendor(Object *cpu_obj)
 +{
 +    return object_dynamic_cast(cpu_obj, TYPE_RISCV_VENDOR_CPU) != NULL;
 +}
 +
  /*
   * We'll get here via the following path:
   *
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
      target_ulong misa_bit = misa_ext_cfg->misa_bit;
      RISCVCPU *cpu = RISCV_CPU(obj);
      CPURISCVState *env = &cpu->env;
 -    bool generic_cpu = riscv_cpu_is_generic(obj);
 +    bool vendor_cpu = riscv_cpu_is_vendor(obj);
      bool prev_val, value;
      if (!visit_type_bool(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
      }
      if (value) {
 -        if (!generic_cpu) {
 +        if (vendor_cpu) {
              g_autofree char *cpuname = riscv_cpu_get_name(cpu);
              error_setg(errp, "'%s' CPU does not allow enabling extensions",
                         cpuname);
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
  {
      const RISCVCPUMultiExtConfig *multi_ext_cfg = opaque;
      RISCVCPU *cpu = RISCV_CPU(obj);
 -    bool generic_cpu = riscv_cpu_is_generic(obj);
 +    bool vendor_cpu = riscv_cpu_is_vendor(obj);
      bool prev_val, value;
      if (!visit_type_bool(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
          return;
      }
--    if (value && !generic_cpu) {
++#if defined(CONFIG_USER_ONLY)
-+    if (value && vendor_cpu) {
++    /*
-         g_autofree char *cpuname = riscv_cpu_get_name(cpu);
++     * For data sizes <= 6 bytes we get better performance by simply calling
-         error_setg(errp, "'%s' CPU does not allow enabling extensions",
++     * vext_continuous_ldst_tlb
-                    cpuname);
++     */
 +    if (nf == 1 && (evl << log2_esz) <= 6) {
 +        addr = base + (env->vstart << log2_esz);
 +        vext_continuous_ldst_tlb(env, ldst_tlb, vd, evl, addr, env->vstart, ra,
 +                                 esz, is_load);
 +
 +        env->vstart = 0;
 +        vext_set_tail_elems_1s(evl, vd, desc, nf, esz, max_elems);
 +        return;
 +    }
 +#endif
 +
      /* Calculate the page range of first page */
      addr = base + ((env->vstart * nf) << log2_esz);
      page_split = -(addr | TARGET_PAGE_MASK);
 --
-.43.0
+.48.1

-[PULL 41/65] target/riscv/tcg: handle profile MISA bits
+[PULL v2 03/50] riscv/gdbstub: add V bit to priv reg
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yanfeng Liu <yfliu2008@qq.com>
-The profile support is handling multi-letter extensions only. Let's add
+This adds virtualization mode (V bit) as bit(2) of register `priv`
-support for MISA bits as well.
+per RiscV debug spec v1.0.0-rc4. Checked with gdb-multiarch v12.1.
-We'll go through every known MISA bit. If the profile doesn't declare
+Note that GDB may display `INVALID` tag for `priv` reg when V bit
-the bit as mandatory, ignore it. Otherwise, set the bit in env->misa_ext
+is set, this doesn't affect actual access to the bit though.
 and env->misa_ext_mask.
-Now that we're setting profile MISA bits, one can use the rv64i CPU to boot
+Signed-off-by: Yanfeng Liu <yfliu2008@qq.com>
 Linux using the following options:
 -cpu rv64i,rva22u64=true,rv39=true,s=true,zifencei=true
 In the near future, when rva22s64 (where, 's', 'zifencei' and sv39 are
 mandatory), is implemented, rv64i will be able to boot Linux loading
 rva22s64 and no additional flags.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-14-dbarboza@ventanamicro.com>
+Message-ID: <tencent_1993B55C24DE7979BF34B200F78287002907@qq.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 21 +++++++++++++++++++++
+ target/riscv/gdbstub.c | 23 +++++++++++++++++++----
-file changed, 21 insertions(+)
+file changed, 19 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/gdbstub.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_virtual(CPUState *cs, GByteArray *buf, int n)
-     profile->user_set = true;
+         RISCVCPU *cpu = RISCV_CPU(cs);
-     profile->enabled = value;
+         CPURISCVState *env = &cpu->env;
-+    for (i = 0; misa_bits[i] != 0; i++) {
+-        return gdb_get_regl(buf, env->priv);
-+        uint32_t bit = misa_bits[i];
++        /* Per RiscV debug spec v1.0.0 rc4 */
 +        target_ulong vbit = (env->virt_enabled) ? BIT(2) : 0;
 +
-+        if  (!(profile->misa_ext & bit)) {
++        return gdb_get_regl(buf, env->priv | vbit);
-+            continue;
+ #endif
      }
      return 0;
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_virtual(CPUState *cs, uint8_t *mem_buf, int n)
          RISCVCPU *cpu = RISCV_CPU(cs);
          CPURISCVState *env = &cpu->env;
 -        env->priv = ldtul_p(mem_buf) & 0x3;
 -        if (env->priv == PRV_RESERVED) {
 -            env->priv = PRV_S;
 +        target_ulong new_priv = ldtul_p(mem_buf) & 0x3;
 +        bool new_virt = 0;
 +
 +        if (new_priv == PRV_RESERVED) {
 +            new_priv = PRV_S;
 +        }
 +
-+        if (bit == RVI && !profile->enabled) {
++        if (new_priv != PRV_M) {
-+            /*
++            new_virt = (ldtul_p(mem_buf) & BIT(2)) >> 2;
-+             * Disabling profiles will not disable the base
+         }
-+             * ISA RV64I.
++
-+             */
++        if (riscv_has_ext(env, RVH) && new_virt != env->virt_enabled) {
-+            continue;
++            riscv_cpu_swap_hypervisor_regs(env);
 +        }
 +
-+        g_hash_table_insert(misa_ext_user_opts,
++        riscv_cpu_set_mode(env, new_priv, new_virt);
-+                            GUINT_TO_POINTER(bit),
+ #endif
-+                            (gpointer)value);
+         return sizeof(target_ulong);
-+        riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
+     }
 +    }
 +
      for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
          ext_offset = profile->ext_offsets[i];
 --
-.43.0
+.48.1

-[PULL 29/65] target/riscv: create TYPE_RISCV_VENDOR_CPU
+[PULL v2 04/50] target/riscv: add shcounterenw
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We want to add a new CPU type for bare CPUs that will inherit specific
+shcounterenw is defined in RVA22 as:
 traits of the 2 existing types:
-- it will allow for extensions to be enabled/disabled, like generic
+"For any hpmcounter that is not read-only zero, the corresponding bit in
-  CPUs;
+hcounteren must be writable."
-- it will NOT inherit defaults, like vendor CPUs.
+This is always true in TCG so let's claim support for it.
 We can make this conditions met by adding an explicit type for the
 existing vendor CPUs and change the existing logic to not imply that
 "not generic" means vendor CPUs.
 Let's add the "vendor" CPU type first.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-2-dbarboza@ventanamicro.com>
+Message-ID: <20241218114026.1652352-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h |  1 +
+ target/riscv/cpu.c                |   1 +
- target/riscv/cpu.c     | 30 +++++++++++++++++++++---------
+ tests/data/acpi/riscv64/virt/RHCT | Bin 332 -> 346 bytes
-files changed, 22 insertions(+), 9 deletions(-)
+files changed, 1 insertion(+)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
-+++ b/target/riscv/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU "riscv-cpu"
- #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
-+#define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
- #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
- #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-         .instance_init = initfn               \
+     ISA_EXT_DATA_ENTRY(zvkt, PRIV_VERSION_1_12_0, ext_zvkt),
-     }
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-+#define DEFINE_VENDOR_CPU(type_name, initfn) \
++    ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
-+    {                                        \
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+        .name = type_name,                   \
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-+        .parent = TYPE_RISCV_VENDOR_CPU,     \
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-+        .instance_init = initfn              \
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
-+    }
+index XXXXXXX..XXXXXXX 100644
-+
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
  static const TypeInfo riscv_cpu_type_infos[] = {
      {
          .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
          .parent = TYPE_RISCV_CPU,
          .abstract = true,
      },
 +    {
 +        .name = TYPE_RISCV_VENDOR_CPU,
 +        .parent = TYPE_RISCV_CPU,
 +        .abstract = true,
 +    },
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
  #if defined(TARGET_RISCV32)
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,   rv32_base_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,       rv32_sifive_e_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,       rv32_imafcu_nommu_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,       rv32_sifive_u_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,        rv32_ibex_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31,  rv32_sifive_e_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34,  rv32_imafcu_nommu_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34,  rv32_sifive_u_cpu_init),
  #elif defined(TARGET_RISCV64)
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,       rv64_sifive_e_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_VEYRON_V1,        rv64_veyron_v1_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51,  rv64_sifive_e_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54,  rv64_sifive_u_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,    rv64_sifive_u_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
  #endif
  };
 --
-.43.0
+.48.1

-[PULL 54/65] target/riscv: add rva22s64 cpu
+[PULL v2 05/50] target/riscv: add shvstvala
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Add a new profile CPU 'rva22s64' to work as an alias of
+shvstvala is defined in RVA22 as:
--cpu rv64i,rva22s64
+"vstval must be written in all cases described above for stval."
-Like the existing rva22u64 CPU already does with the RVA22U64 profile.
+By "cases describe above" the doc refer to the description of sstvala:
 "stval must be written with the faulting virtual address for load,
 store, and instruction page-fault, access-fault, and misaligned
 exceptions, and for breakpoint exceptions other than those caused by
 execution of the EBREAK or C.EBREAK instructions. For
 virtual-instruction and illegal-instruction exceptions, stval must be
 written with the faulting instruction."
 We already have sstvala, and our vstval follows the same rules as stval,
 so we can claim to support shvstvala too.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-27-dbarboza@ventanamicro.com>
+Message-ID: <20241218114026.1652352-5-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h | 1 +
+ target/riscv/cpu.c                |   1 +
- target/riscv/cpu.c     | 8 ++++++++
+ tests/data/acpi/riscv64/virt/RHCT | Bin 346 -> 356 bytes
-files changed, 9 insertions(+)
+files changed, 1 insertion(+)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
-+++ b/target/riscv/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
- #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
- #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
-+#define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
- #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
- #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
- #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rva22u64_profile_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-     RVA22U64.enabled = true;
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
- }
+     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
-+
++    ISA_EXT_DATA_ENTRY(shvstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+static void rva22s64_profile_cpu_init(Object *obj)
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+{
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-+    rv64i_bare_cpu_init(obj);
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-+
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
-+    RVA22S64.enabled = true;
+index XXXXXXX..XXXXXXX 100644
-+}
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
  #endif
  static const gchar *riscv_gdb_arch_name(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
      DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
      DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
 +    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64, rva22s64_profile_cpu_init),
  #endif
  };
 --
-.43.0
+.48.1

-[PULL 40/65] target/riscv/tcg: add riscv_cpu_write_misa_bit()
+[PULL v2 06/50] target/riscv: add shtvala
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We have two instances of the setting/clearing a MISA bit from
+shtvala is described in RVA22 as:
 env->misa_ext and env->misa_ext_mask pattern. And the next patch will
 end up adding one more.
-Create a helper to avoid code repetition.
+"htval must be written with the faulting guest physical address
 in all circumstances permitted by the ISA."
 This is the case since commit 3067553993, so claim support for shtvala.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20241218114026.1652352-6-dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-13-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++--------------
+ target/riscv/cpu.c                |   1 +
-file changed, 18 insertions(+), 14 deletions(-)
+ tests/data/acpi/riscv64/virt/RHCT | Bin 356 -> 364 bytes
 files changed, 1 insertion(+)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-                                  GUINT_TO_POINTER(ext_offset));
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
- }
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
-+static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
++    ISA_EXT_DATA_ENTRY(shtvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+                                     bool enabled)
+     ISA_EXT_DATA_ENTRY(shvstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+{
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+    CPURISCVState *env = &cpu->env;
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-+
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
-+    if (enabled) {
+index XXXXXXX..XXXXXXX 100644
-+        env->misa_ext |= bit;
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
 +        env->misa_ext_mask |= bit;
 +    } else {
 +        env->misa_ext &= ~bit;
 +        env->misa_ext_mask &= ~bit;
 +    }
 +}
 +
  static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                            const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
               */
              env->priv_ver = PRIV_VERSION_1_12_0;
          }
 -
 -        env->misa_ext |= misa_bit;
 -        env->misa_ext_mask |= misa_bit;
 -    } else {
 -        env->misa_ext &= ~misa_bit;
 -        env->misa_ext_mask &= ~misa_bit;
      }
 +
 +    riscv_cpu_write_misa_bit(cpu, misa_bit, value);
  }
  static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
   */
  static void riscv_cpu_add_misa_properties(Object *cpu_obj)
  {
 -    CPURISCVState *env = &RISCV_CPU(cpu_obj)->env;
      bool use_def_vals = riscv_cpu_is_generic(cpu_obj);
      int i;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
                              NULL, (void *)misa_cfg);
          object_property_set_description(cpu_obj, name, desc);
          if (use_def_vals) {
 -            if (misa_cfg->enabled) {
 -                env->misa_ext |= bit;
 -                env->misa_ext_mask |= bit;
 -            } else {
 -                env->misa_ext &= ~bit;
 -                env->misa_ext_mask &= ~bit;
 -            }
 +            riscv_cpu_write_misa_bit(RISCV_CPU(cpu_obj), bit,
 +                                     misa_cfg->enabled);
          }
      }
  }
 --
-.43.0
+.48.1

-[PULL 49/65] target/riscv/cpu.c: finalize satp_mode earlier
+[PULL v2 07/50] target/riscv: add shvstvecd
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Profiles will need to validate satp_mode during their own finalize
+shvstvecd is defined in RVA22 as:
-methods. This will occur inside riscv_tcg_cpu_finalize_features() for
-TCG. Given that satp_mode does not have any pre-req from the accelerator
+"vstvec.MODE must be capable of holding the value 0 (Direct).
-finalize() method, it's safe to finalize it earlier.
+When vstvec.MODE=Direct, vstvec.BASE must be capable of holding any
 valid four-byte-aligned address."
 This is always true for TCG so let's claim support for it.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-22-dbarboza@ventanamicro.com>
+Message-ID: <20241218114026.1652352-7-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 16 ++++++++--------
+ target/riscv/cpu.c                |   1 +
-file changed, 8 insertions(+), 8 deletions(-)
+ tests/data/acpi/riscv64/virt/RHCT | Bin 364 -> 374 bytes
 files changed, 1 insertion(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
- {
+     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
-     Error *local_err = NULL;
+     ISA_EXT_DATA_ENTRY(shtvala, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(shvstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+#ifndef CONFIG_USER_ONLY
++    ISA_EXT_DATA_ENTRY(shvstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
-+    riscv_cpu_satp_mode_finalize(cpu, &local_err);
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+    if (local_err != NULL) {
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-+        error_propagate(errp, local_err);
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-+        return;
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
-+    }
+index XXXXXXX..XXXXXXX 100644
-+#endif
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
 +
      /*
       * KVM accel does not have a specialized finalize()
       * callback because its extensions are validated
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
              return;
          }
      }
 -
 -#ifndef CONFIG_USER_ONLY
 -    riscv_cpu_satp_mode_finalize(cpu, &local_err);
 -    if (local_err != NULL) {
 -        error_propagate(errp, local_err);
 -        return;
 -    }
 -#endif
  }
  static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 --
-.43.0
+.48.1

-[PULL 39/65] target/riscv/tcg: add MISA user options hash
+[PULL v2 08/50] target/riscv: add shvsatpa
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We already track user choice for multi-letter extensions because we
+shvsatpa is defined in RVA22 as:
 needed to honor user choice when enabling/disabling extensions during
 realize(). We refrained from adding the same mechanism for MISA
 extensions since we didn't need it.
-Profile support requires tne need to check for user choice for MISA
+"All translation modes supported in satp must be supported in vsatp."
 extensions, so let's add the corresponding hash now. It works like the
 existing multi-letter hash (multi_ext_user_opts) but tracking MISA bits
 options in the cpu_set_misa_ext_cfg() callback.
-Note that we can't re-use the same hash from multi-letter extensions
+This is always true in TCG so let's claim support for it.
 because that hash uses cpu->cfg offsets as keys, while for MISA
 extensions we're using MISA bits as keys.
 After adding the user hash in cpu_set_misa_ext_cfg(), setting default
 values with object_property_set_bool() in add_misa_properties() will end
 up marking the user choice hash with them. Set the default value
 manually to avoid it.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20241218114026.1652352-8-dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-12-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 15 ++++++++++++++-
+ target/riscv/cpu.c                |   1 +
-file changed, 14 insertions(+), 1 deletion(-)
+ tests/data/acpi/riscv64/virt/RHCT | Bin 374 -> 382 bytes
 files changed, 1 insertion(+)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
- /* Hash that stores user set extensions */
+     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
- static GHashTable *multi_ext_user_opts;
+     ISA_EXT_DATA_ENTRY(shtvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+static GHashTable *misa_ext_user_opts;
++    ISA_EXT_DATA_ENTRY(shvsatpa, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(shvstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
- static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+     ISA_EXT_DATA_ENTRY(shvstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
- {
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
-         return;
+index XXXXXXX..XXXXXXX 100644
-     }
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
 +    g_hash_table_insert(misa_ext_user_opts,
 +                        GUINT_TO_POINTER(misa_bit),
 +                        (gpointer)value);
 +
      prev_val = env->misa_ext & misa_bit;
      if (value == prev_val) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
   */
  static void riscv_cpu_add_misa_properties(Object *cpu_obj)
  {
 +    CPURISCVState *env = &RISCV_CPU(cpu_obj)->env;
      bool use_def_vals = riscv_cpu_is_generic(cpu_obj);
      int i;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
                              NULL, (void *)misa_cfg);
          object_property_set_description(cpu_obj, name, desc);
          if (use_def_vals) {
 -            object_property_set_bool(cpu_obj, name, misa_cfg->enabled, NULL);
 +            if (misa_cfg->enabled) {
 +                env->misa_ext |= bit;
 +                env->misa_ext_mask |= bit;
 +            } else {
 +                env->misa_ext &= ~bit;
 +                env->misa_ext_mask &= ~bit;
 +            }
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_cpu_instance_init(CPUState *cs)
      RISCVCPU *cpu = RISCV_CPU(cs);
      Object *obj = OBJECT(cpu);
 +    misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
      multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
      riscv_cpu_add_user_properties(obj);
 --
-.43.0
+.48.1

-[PULL 32/65] target/riscv: add rv64i CPU
+[PULL v2 09/50] target/riscv: add shgatpa
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We don't have any form of a 'bare bones' CPU. rv64, our default CPUs,
+shgatpa is defined in RVA22 as:
 comes with a lot of defaults. This is fine for most regular uses but
 it's not suitable when more control of what is actually loaded in the
 CPU is required.
-A bare-bones CPU would be annoying to deal with if not by profile
+"For each supported virtual memory scheme SvNN supported in satp, the
-support, a way to load a multitude of extensions with a single flag.
+corresponding hgatp SvNNx4 mode must be supported. The hgatp mode Bare
-Profile support is going to be implemented shortly, so let's add a CPU
+must also be supported."
 for it.
-The new 'rv64i' CPU will have only RVI loaded. It is inspired in the
+Claim support for shgatpa since this is always true for TCG.
 profile specification that dictates, for RVA22U64 [1]:
 "RVA22U64 Mandatory Base
  RV64I is the mandatory base ISA for RVA22U64"
 And so it seems that RV64I is the mandatory base ISA for all profiles
 listed in [1], making it an ideal CPU to use with profile support.
 rv64i is a CPU of type TYPE_RISCV_BARE_CPU. It has a mix of features
 from pre-existent CPUs:
 - it allows extensions to be enabled, like generic CPUs;
 - it will not inherit extension defaults, like vendor CPUs.
 This is the minimum extension set to boot OpenSBI and buildroot using
 rv64i:
 ./build/qemu-system-riscv64 -nographic -M virt \
     -cpu rv64i,sv39=true,g=true,c=true,s=true,u=true
 Our minimal riscv,isa in this case will be:
  # cat /proc/device-tree/cpus/cpu@0/riscv,isa
 rv64imafdc_zicntr_zicsr_zifencei_zihpm_zca_zcd#
 [1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-5-dbarboza@ventanamicro.com>
+Message-ID: <20241218114026.1652352-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h |  2 ++
+ target/riscv/cpu.c                |   1 +
- target/riscv/cpu.c     | 46 ++++++++++++++++++++++++++++++++++++++++++
+ tests/data/acpi/riscv64/virt/RHCT | Bin 382 -> 390 bytes
-files changed, 48 insertions(+)
+files changed, 1 insertion(+)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
-+++ b/target/riscv/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU "riscv-cpu"
- #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
- #define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
-+#define TYPE_RISCV_BARE_CPU "riscv-bare-cpu"
- #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
- #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
- #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
- #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
-+#define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
- #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
- #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
- #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
- /* Set the satp mode to the max supported */
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
- static void set_satp_mode_default_map(RISCVCPU *cpu)
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
- {
+     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
-+    /*
++    ISA_EXT_DATA_ENTRY(shgatpa, PRIV_VERSION_1_12_0, has_priv_1_12),
-+     * Bare CPUs do not default to the max available.
+     ISA_EXT_DATA_ENTRY(shtvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+     * Users must set a valid satp_mode in the command
+     ISA_EXT_DATA_ENTRY(shvsatpa, PRIV_VERSION_1_12_0, has_priv_1_12),
-+     * line.
+     ISA_EXT_DATA_ENTRY(shvstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-+     */
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
-+    if (object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_BARE_CPU) != NULL) {
+index XXXXXXX..XXXXXXX 100644
-+        warn_report("No satp mode set. Defaulting to 'bare'");
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
 +        cpu->cfg.satp_mode.map = (1 << VM_1_10_MBARE);
 +        return;
 +    }
 +
      cpu->cfg.satp_mode.map = cpu->cfg.satp_mode.supported;
  }
  #endif
@@ -XXX,XX +XXX,XX @@ static void rv128_base_cpu_init(Object *obj)
      set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
  #endif
  }
 +
 +static void rv64i_bare_cpu_init(Object *obj)
 +{
 +    CPURISCVState *env = &RISCV_CPU(obj)->env;
 +    riscv_cpu_set_misa(env, MXL_RV64, RVI);
 +
 +    /* Remove the defaults from the parent class */
 +    RISCV_CPU(obj)->cfg.ext_zicntr = false;
 +    RISCV_CPU(obj)->cfg.ext_zihpm = false;
 +
 +    /* Set to QEMU's first supported priv version */
 +    env->priv_ver = PRIV_VERSION_1_10_0;
 +
 +    /*
 +     * Support all available satp_mode settings. The default
 +     * value will be set to MBARE if the user doesn't set
 +     * satp_mode manually (see set_satp_mode_default()).
 +     */
 +#ifndef CONFIG_USER_ONLY
 +    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV64);
 +#endif
 +}
  #else
  static void rv32_base_cpu_init(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
          .instance_init = initfn              \
      }
 +#define DEFINE_BARE_CPU(type_name, initfn) \
 +    {                                      \
 +        .name = type_name,                 \
 +        .parent = TYPE_RISCV_BARE_CPU,     \
 +        .instance_init = initfn            \
 +    }
 +
  static const TypeInfo riscv_cpu_type_infos[] = {
      {
          .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
          .parent = TYPE_RISCV_CPU,
          .abstract = true,
      },
 +    {
 +        .name = TYPE_RISCV_BARE_CPU,
 +        .parent = TYPE_RISCV_CPU,
 +        .abstract = true,
 +    },
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
  #if defined(TARGET_RISCV32)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
      DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
      DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
 +    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
  #endif
  };
 --
-.43.0
+.48.1

-[PULL 47/65] target/riscv: implement svade
+[PULL v2 10/50] target/riscv/tcg: add sha
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-'svade' is a RVA22S64 profile requirement, a profile we're going to add
+'sha' is the augmented hypervisor extension, defined in RVA22 as a set of
-shortly. It is a named feature (i.e. not a formal extension, not defined
+the following extensions:
 in riscv,isa DT at this moment) defined in [1] as:
-"Page-fault exceptions are raised when a page is accessed when A bit is
+- RVH
-clear, or written when D bit is clear.".
+- Ssstateen
 - Shcounterenw (always present)
 - Shvstvala (always present)
 - Shtvala (always present)
 - Shvstvecd (always present)
 - Shvsatpa (always present)
 - Shgatpa (always present)
-As far as the spec goes, 'svade' is one of the two distinct modes of
+We can claim support for 'sha' by checking if we have RVH and ssstateen.
 handling PTE_A and PTE_D. The other way, i.e. update PTE_A/PTE_D when
 they're cleared, is defined by the 'svadu' extension. Checking
 cpu_helper.c, get_physical_address(), we can verify that QEMU is
 compliant with that: we will update PTE_A/PTE_D if 'svadu' is enabled,
 or throw a page-fault exception if 'svadu' isn't enabled.
 So, as far as we're concerned, 'svade' translates to 'svadu must be
 disabled'.
 We'll implement it like 'zic64b': an internal flag that profiles can
 enable. The flag will not be exposed to users.
 [1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-20-dbarboza@ventanamicro.com>
+Message-ID: <20241218114026.1652352-10-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h     | 1 +
- target/riscv/cpu.c         | 1 +
+ target/riscv/cpu.c         | 2 ++
- target/riscv/tcg/tcg-cpu.c | 5 +++++
+ target/riscv/tcg/tcg-cpu.c | 8 ++++++++
-files changed, 7 insertions(+)
+files changed, 11 insertions(+)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_smepmp;
+     bool ext_svade;
-     bool rvv_ta_all_1s;
+     bool ext_zic64b;
-     bool rvv_ma_all_1s;
+     bool ext_ssstateen;
-+    bool svade;
++    bool ext_sha;
-     bool zic64b;
+     /*
-     uint32_t mvendorid;
+      * Always 'true' booleans for named features
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
++    ISA_EXT_DATA_ENTRY(sha, PRIV_VERSION_1_12_0, ext_sha),
+     ISA_EXT_DATA_ENTRY(shgatpa, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(shtvala, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(shvsatpa, PRIV_VERSION_1_12_0, has_priv_1_12),
 @@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
+     MULTI_EXT_CFG_BOOL("ssstateen", ext_ssstateen, true),
++    MULTI_EXT_CFG_BOOL("sha", ext_sha, true),
+     { },
  };
- const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
-+    MULTI_EXT_CFG_BOOL("svade", svade, true),
-     MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
-     DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
          cpu->cfg.cbop_blocksize = 64;
          cpu->cfg.cboz_blocksize = 64;
          break;
-+    case CPU_CFG_OFFSET(svade):
++    case CPU_CFG_OFFSET(ext_sha):
-+        cpu->cfg.ext_svadu = false;
++        if (!cpu_misa_ext_is_user_set(RVH)) {
-+        break;
++            riscv_cpu_write_misa_bit(cpu, RVH, true);
-     default:
++        }
-         g_assert_not_reached();
++        /* fallthrough */
-     }
+     case CPU_CFG_OFFSET(ext_ssstateen):
          cpu->cfg.ext_smstateen = true;
          break;
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
-     cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
+                           cpu->cfg.cboz_blocksize == 64;
-                       cpu->cfg.cbop_blocksize == 64 &&
-                       cpu->cfg.cboz_blocksize == 64;
+     cpu->cfg.ext_ssstateen = cpu->cfg.ext_smstateen;
 +
-+    cpu->cfg.svade = !cpu->cfg.ext_svadu;
++    cpu->cfg.ext_sha = riscv_has_ext(&cpu->env, RVH) &&
 +                       cpu->cfg.ext_ssstateen;
  }
  static void riscv_cpu_validate_g(RISCVCPU *cpu)
 --
-.43.0
+.48.1

-[PULL 50/65] target/riscv/cpu.c: add riscv_cpu_is_32bit()
+[PULL v2 11/50] target/riscv: use RISCVException enum in exception helpers
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Next patch will need to retrieve if a given RISCVCPU is 32 or 64 bit.
+Do a cosmetic change in riscv_raise_exception() to change 'exception'
-The existing helper riscv_is_32bit() (hw/riscv/boot.c) will always check
+type from uint32_t to RISCVException, making it a bit clear that the
-the first CPU of a given hart array, not any given CPU.
+arg is directly correlated to the RISCVException enum.
-Create a helper to retrieve the info for any given CPU, not the first
+As a side effect, change 'excp' type from int to RISCVException in
-CPU of the hart array. The helper is using the same 32 bit check that
+generate_exception() to guarantee that all callers of
-riscv_cpu_satp_mode_finalize() was doing.
+riscv_raise_exception() will use the enum.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250106173734.412353-2-dbarboza@ventanamicro.com>
 Message-ID: <20231218125334.37184-23-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 1 +
+ target/riscv/cpu.h       | 3 ++-
- target/riscv/cpu.c | 7 ++++++-
+ target/riscv/op_helper.c | 3 ++-
-files changed, 7 insertions(+), 1 deletion(-)
+ target/riscv/translate.c | 2 +-
 files changed, 5 insertions(+), 3 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+@@ -XXX,XX +XXX,XX @@ void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
-                           uint64_t *cs_base, uint32_t *pflags);
+                           int *max_insns, vaddr pc, void *host_pc);
- void riscv_cpu_update_mask(CPURISCVState *env);
+ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
-+bool riscv_cpu_is_32bit(RISCVCPU *cpu);
+-                                      uint32_t exception, uintptr_t pc);
++                                      RISCVException exception,
- RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
++                                      uintptr_t pc);
-                            target_ulong *ret_value,
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+ target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
  void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/op_helper.c
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
+@@ -XXX,XX +XXX,XX @@
- #define BYTE(x)   (x)
- #endif
+ /* Exceptions processing helpers */
+ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
-+bool riscv_cpu_is_32bit(RISCVCPU *cpu)
+-                                      uint32_t exception, uintptr_t pc)
-+{
++                                      RISCVException exception,
-+    return riscv_cpu_mxl(&cpu->env) == MXL_RV32;
++                                      uintptr_t pc)
 +}
 +
  #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
      {#_name, _min_ver, CPU_CFG_OFFSET(_prop)}
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
  #ifndef CONFIG_USER_ONLY
  static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
  {
--    bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
+     CPUState *cs = env_cpu(env);
-+    bool rv32 = riscv_cpu_is_32bit(cpu);
+     cs->exception_index = exception;
-     uint8_t satp_mode_map_max, satp_mode_supported_max;
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
-     /* The CPU wants the OS to decide which satp mode to use */
+--- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_update_pc(DisasContext *ctx, target_long diff)
      ctx->pc_save = ctx->base.pc_next + diff;
  }
 -static void generate_exception(DisasContext *ctx, int excp)
 +static void generate_exception(DisasContext *ctx, RISCVException excp)
  {
      gen_update_pc(ctx, 0);
      gen_helper_raise_exception(tcg_env, tcg_constant_i32(excp));
 --
-.43.0
+.48.1

-[PULL 37/65] target/riscv/kvm: add 'rva22u64' flag as unavailable
+[PULL v2 12/50] target/riscv: add trace in riscv_raise_exception()
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM does not have the means to support enabling the rva22u64 profile.
+When using system mode we can get the CPU traps being taken via the
-The main reasons are:
+'riscv_trap' trace or the "-d int" qemu log. User mode does not a way of
 logging/showing exceptions to users.
-- we're missing support for some mandatory rva22u64 extensions in the
+Add a trace in riscv_raise_exception() to allow qemu-riscv(32/64) users
-  KVM module;
+to check all exceptions being thrown. This is particularly useful to
 help identifying insns that are throwing SIGILLs.
-- we can't make promises about enabling a profile since it all depends
+As it is today we need to debug their binaries to identify where the
-  on host support in the end.
+illegal insns are:
-We'll revisit this decision in the future if needed. For now mark the
+$ ~/work/qemu/build/qemu-riscv64 -cpu rv64 ./foo.out
-'rva22u64' profile as unavailable when running a KVM CPU:
+Illegal instruction (core dumped)
-$ qemu-system-riscv64 -machine virt,accel=kvm -cpu rv64,rva22u64=true
+After this change users can capture the trace and use EPC to pinpoint
-qemu-system-riscv64: can't apply global rv64-riscv-cpu.rva22u64=true:
+the insn:
-    'rva22u64' is not available with KVM
 $ ~/work/qemu/build/qemu-riscv64 -cpu rv64 -trace riscv_exception ./foo.out
 riscv_exception 8 (user_ecall) on epc 0x17cd2
 riscv_exception 8 (user_ecall) on epc 0x17cda
 riscv_exception 8 (user_ecall) on epc 0x17622
 (...)
 riscv_exception 2 (illegal_instruction) on epc 0x1053a
 Illegal instruction (core dumped)
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20250106173734.412353-3-dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-10-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 7 ++++++-
+ target/riscv/op_helper.c  | 6 ++++++
-file changed, 6 insertions(+), 1 deletion(-)
+ target/riscv/trace-events | 3 +++
 files changed, 9 insertions(+)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/target/riscv/op_helper.c
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@
-     }
+ #include "exec/exec-all.h"
+ #include "exec/cpu_ldst.h"
-     if (value) {
+ #include "exec/helper-proto.h"
--        error_setg(errp, "extension %s is not available with KVM",
++#include "trace.h"
-+        error_setg(errp, "'%s' is not available with KVM",
-                    propname);
+ /* Exceptions processing helpers */
-     }
+ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
@@ -XXX,XX +XXX,XX @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
                                        uintptr_t pc)
  {
      CPUState *cs = env_cpu(env);
 +
 +    trace_riscv_exception(exception,
 +                          riscv_cpu_get_trap_name(exception, false),
 +                          env->pc);
 +
      cs->exception_index = exception;
      cpu_loop_exit_restore(cs, pc);
  }
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+diff --git a/target/riscv/trace-events b/target/riscv/trace-events
-     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_extensions);
+index XXXXXXX..XXXXXXX 100644
-     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_vendor_exts);
+--- a/target/riscv/trace-events
-     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_experimental_exts);
++++ b/target/riscv/trace-events
@@ -XXX,XX +XXX,XX @@ pmpaddr_csr_write(uint64_t mhartid, uint32_t addr_index, uint64_t val) "hart %"
  mseccfg_csr_read(uint64_t mhartid, uint64_t val) "hart %" PRIu64 ": read mseccfg, val: 0x%" PRIx64
  mseccfg_csr_write(uint64_t mhartid, uint64_t val) "hart %" PRIu64 ": write mseccfg, val: 0x%" PRIx64
 +
-+   /* We don't have the needed KVM support for profiles */
++# op_helper.c
-+    for (i = 0; riscv_profiles[i] != NULL; i++) {
++riscv_exception(uint32_t exception, const char *desc, uint64_t epc) "%u (%s) on epc 0x%"PRIx64""
 +        riscv_cpu_add_kvm_unavail_prop(cpu_obj, riscv_profiles[i]->name);
 +    }
  }
  static int kvm_riscv_get_regs_core(CPUState *cs)
 --
-.43.0
+.48.1

-[PULL 51/65] target/riscv: add satp_mode profile support
+[PULL v2 13/50] target/riscv: Remove obsolete pointer masking extension code.
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-'satp_mode' is a requirement for supervisor profiles like RVA22S64.
+Zjpm extension is finally ratified. And it's much simplier compared to the experimental one.
-User-mode/application profiles like RVA22U64 doesn't care.
+The newer version doesn't allow to specify custom mask or base for pointer masking.
 Instead it allows only certain options for masking top bits.
-Add 'satp_mode' to the profile description. If a profile requires it,
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
 set it during cpu_set_profile(). We'll also check it during finalize()
 to validate if the running config implements the profile.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-24-dbarboza@ventanamicro.com>
+Message-ID: <20250106102346.1100149-2-baturo.alexey@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  1 +
+ target/riscv/cpu.h           |  33 +---
- target/riscv/cpu.c         |  1 +
+ target/riscv/cpu_bits.h      |  87 ----------
- target/riscv/tcg/tcg-cpu.c | 40 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/cpu.c           |  13 +-
-files changed, 42 insertions(+)
+ target/riscv/cpu_helper.c    |  52 ------
  target/riscv/csr.c           | 326 -----------------------------------
  target/riscv/machine.c       |  17 +-
  target/riscv/tcg/tcg-cpu.c   |   5 +-
  target/riscv/translate.c     |  28 +--
  target/riscv/vector_helper.c |   2 +-
 files changed, 19 insertions(+), 544 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState CPURISCVState;
-     bool enabled;
+ #define RVS RV('S')
-     bool user_set;
+ #define RVU RV('U')
-     int priv_spec;
+ #define RVH RV('H')
-+    int satp_mode;
+-#define RVJ RV('J')
-     const int32_t ext_offsets[];
+ #define RVG RV('G')
- } RISCVCPUProfile;
+ #define RVB RV('B')
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      /* True if in debugger mode.  */
      bool debugger;
 -    /*
 -     * CSRs for PointerMasking extension
 -     */
 -    target_ulong mmte;
 -    target_ulong mpmmask;
 -    target_ulong mpmbase;
 -    target_ulong spmmask;
 -    target_ulong spmbase;
 -    target_ulong upmmask;
 -    target_ulong upmbase;
 -
      uint64_t mstateen[SMSTATEEN_MAX_COUNT];
      uint64_t hstateen[SMSTATEEN_MAX_COUNT];
      uint64_t sstateen[SMSTATEEN_MAX_COUNT];
      uint64_t henvcfg;
  #endif
 -    target_ulong cur_pmmask;
 -    target_ulong cur_pmbase;
      /* Fields from here on are preserved across CPU reset. */
      QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, XL, 16, 2)
  /* If PointerMasking should be applied */
  FIELD(TB_FLAGS, PM_MASK_ENABLED, 18, 1)
  FIELD(TB_FLAGS, PM_BASE_ENABLED, 19, 1)
 -FIELD(TB_FLAGS, VTA, 20, 1)
 -FIELD(TB_FLAGS, VMA, 21, 1)
 +FIELD(TB_FLAGS, VTA, 18, 1)
 +FIELD(TB_FLAGS, VMA, 19, 1)
  /* Native debug itrigger */
 -FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 +FIELD(TB_FLAGS, ITRIGGER, 20, 1)
  /* Virtual mode enabled */
 -FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 -FIELD(TB_FLAGS, PRIV, 24, 2)
 -FIELD(TB_FLAGS, AXL, 26, 2)
 +FIELD(TB_FLAGS, VIRT_ENABLED, 21, 1)
 +FIELD(TB_FLAGS, PRIV, 22, 2)
 +FIELD(TB_FLAGS, AXL, 24, 2)
  /* zicfilp needs a TB flag to track indirect branches */
 -FIELD(TB_FLAGS, FCFI_ENABLED, 28, 1)
 -FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 29, 1)
 +FIELD(TB_FLAGS, FCFI_ENABLED, 26, 1)
 +FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 27, 1)
  /* zicfiss needs a TB flag so that correct TB is located based on tb flags */
 -FIELD(TB_FLAGS, BCFI_ENABLED, 30, 1)
 +FIELD(TB_FLAGS, BCFI_ENABLED, 28, 1)
  #ifdef TARGET_RISCV32
  #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_get_vlmax(uint32_t vlenb, uint32_t vsew,
  void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
                            uint64_t *cs_base, uint32_t *pflags);
 -void riscv_cpu_update_mask(CPURISCVState *env);
  bool riscv_cpu_is_32bit(RISCVCPU *cpu);
  RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define CSR_MHPMCOUNTER30H  0xb9e
  #define CSR_MHPMCOUNTER31H  0xb9f
 -/*
 - * User PointerMasking registers
 - * NB: actual CSR numbers might be changed in future
 - */
 -#define CSR_UMTE            0x4c0
 -#define CSR_UPMMASK         0x4c1
 -#define CSR_UPMBASE         0x4c2
 -
 -/*
 - * Machine PointerMasking registers
 - * NB: actual CSR numbers might be changed in future
 - */
 -#define CSR_MMTE            0x3c0
 -#define CSR_MPMMASK         0x3c1
 -#define CSR_MPMBASE         0x3c2
 -
 -/*
 - * Supervisor PointerMaster registers
 - * NB: actual CSR numbers might be changed in future
 - */
 -#define CSR_SMTE            0x1c0
 -#define CSR_SPMMASK         0x1c1
 -#define CSR_SPMBASE         0x1c2
 -
 -/*
 - * Hypervisor PointerMaster registers
 - * NB: actual CSR numbers might be changed in future
 - */
 -#define CSR_VSMTE           0x2c0
 -#define CSR_VSPMMASK        0x2c1
 -#define CSR_VSPMBASE        0x2c2
  #define CSR_SCOUNTOVF       0xda0
  /* Crypto Extension */
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
  #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
 -/* General PointerMasking CSR bits */
 -#define PM_ENABLE       0x00000001ULL
 -#define PM_CURRENT      0x00000002ULL
 -#define PM_INSN         0x00000004ULL
 -
  /* Execution environment configuration bits */
  #define MENVCFG_FIOM                       BIT(0)
  #define MENVCFG_LPE                        BIT(2) /* zicfilp */
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
  #define HENVCFGH_STCE                       MENVCFGH_STCE
 -/* Offsets for every pair of control bits per each priv level */
 -#define XS_OFFSET    0ULL
 -#define U_OFFSET     2ULL
 -#define S_OFFSET     5ULL
 -#define M_OFFSET     8ULL
 -
 -#define PM_XS_BITS   (EXT_STATUS_MASK << XS_OFFSET)
 -#define U_PM_ENABLE  (PM_ENABLE  << U_OFFSET)
 -#define U_PM_CURRENT (PM_CURRENT << U_OFFSET)
 -#define U_PM_INSN    (PM_INSN    << U_OFFSET)
 -#define S_PM_ENABLE  (PM_ENABLE  << S_OFFSET)
 -#define S_PM_CURRENT (PM_CURRENT << S_OFFSET)
 -#define S_PM_INSN    (PM_INSN    << S_OFFSET)
 -#define M_PM_ENABLE  (PM_ENABLE  << M_OFFSET)
 -#define M_PM_CURRENT (PM_CURRENT << M_OFFSET)
 -#define M_PM_INSN    (PM_INSN    << M_OFFSET)
 -
 -/* mmte CSR bits */
 -#define MMTE_PM_XS_BITS     PM_XS_BITS
 -#define MMTE_U_PM_ENABLE    U_PM_ENABLE
 -#define MMTE_U_PM_CURRENT   U_PM_CURRENT
 -#define MMTE_U_PM_INSN      U_PM_INSN
 -#define MMTE_S_PM_ENABLE    S_PM_ENABLE
 -#define MMTE_S_PM_CURRENT   S_PM_CURRENT
 -#define MMTE_S_PM_INSN      S_PM_INSN
 -#define MMTE_M_PM_ENABLE    M_PM_ENABLE
 -#define MMTE_M_PM_CURRENT   M_PM_CURRENT
 -#define MMTE_M_PM_INSN      M_PM_INSN
 -#define MMTE_MASK    (MMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | MMTE_U_PM_INSN | \
 -                      MMTE_S_PM_ENABLE | MMTE_S_PM_CURRENT | MMTE_S_PM_INSN | \
 -                      MMTE_M_PM_ENABLE | MMTE_M_PM_CURRENT | MMTE_M_PM_INSN | \
 -                      MMTE_PM_XS_BITS)
 -
 -/* (v)smte CSR bits */
 -#define SMTE_PM_XS_BITS     PM_XS_BITS
 -#define SMTE_U_PM_ENABLE    U_PM_ENABLE
 -#define SMTE_U_PM_CURRENT   U_PM_CURRENT
 -#define SMTE_U_PM_INSN      U_PM_INSN
 -#define SMTE_S_PM_ENABLE    S_PM_ENABLE
 -#define SMTE_S_PM_CURRENT   S_PM_CURRENT
 -#define SMTE_S_PM_INSN      S_PM_INSN
 -#define SMTE_MASK    (SMTE_U_PM_ENABLE | SMTE_U_PM_CURRENT | SMTE_U_PM_INSN | \
 -                      SMTE_S_PM_ENABLE | SMTE_S_PM_CURRENT | SMTE_S_PM_INSN | \
 -                      SMTE_PM_XS_BITS)
 -
 -/* umte CSR bits */
 -#define UMTE_U_PM_ENABLE    U_PM_ENABLE
 -#define UMTE_U_PM_CURRENT   U_PM_CURRENT
 -#define UMTE_U_PM_INSN      U_PM_INSN
 -#define UMTE_MASK     (UMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | UMTE_U_PM_INSN)
 -
  /* MISELECT, SISELECT, and VSISELECT bits (AIA) */
  #define ISELECT_IPRIO0                     0x30
  #define ISELECT_IPRIO15                    0x3f
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
+@@ -XXX,XX +XXX,XX @@
-     .name = "rva22u64",
+ /* RISC-V CPU definitions */
-     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+ static const char riscv_single_letter_exts[] = "IEMAFDQCBPVH";
-     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
-+    .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
+-                              RVC, RVS, RVU, RVH, RVJ, RVG, RVB, 0};
-     .ext_offsets = {
++                              RVC, RVS, RVU, RVH, RVG, RVB, 0};
-         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
-         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
+ /*
   * From vector_helper.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
              CSR_MSCRATCH,
              CSR_SSCRATCH,
              CSR_SATP,
 -            CSR_MMTE,
 -            CSR_UPMBASE,
 -            CSR_UPMMASK,
 -            CSR_SPMBASE,
 -            CSR_SPMMASK,
 -            CSR_MPMBASE,
 -            CSR_MPMMASK,
          };
          for (i = 0; i < ARRAY_SIZE(dump_csrs); ++i) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
          }
          i++;
      }
 -    /* mmte is supposed to have pm.current hardwired to 1 */
 -    env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
      /*
       * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
      env->ssp = 0;
      env->xl = riscv_cpu_mxl(env);
 -    riscv_cpu_update_mask(env);
      cs->exception_index = RISCV_EXCP_NONE;
      env->load_res = -1;
      set_default_nan_mode(1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
      MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
      MISA_EXT_INFO(RVU, "u", "User-level instructions"),
      MISA_EXT_INFO(RVH, "h", "Hypervisor"),
 -    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
      MISA_EXT_INFO(RVV, "v", "Vector operations"),
      MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
      MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
      flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
      flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
      flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
 -    if (env->cur_pmmask != 0) {
 -        flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
 -    }
 -    if (env->cur_pmbase != 0) {
 -        flags = FIELD_DP32(flags, TB_FLAGS, PM_BASE_ENABLED, 1);
 -    }
      *pflags = flags;
  }
 -void riscv_cpu_update_mask(CPURISCVState *env)
 -{
 -    target_ulong mask = 0, base = 0;
 -    RISCVMXL xl = env->xl;
 -    /*
 -     * TODO: Current RVJ spec does not specify
 -     * how the extension interacts with XLEN.
 -     */
 -#ifndef CONFIG_USER_ONLY
 -    int mode = cpu_address_mode(env);
 -    xl = cpu_get_xl(env, mode);
 -    if (riscv_has_ext(env, RVJ)) {
 -        switch (mode) {
 -        case PRV_M:
 -            if (env->mmte & M_PM_ENABLE) {
 -                mask = env->mpmmask;
 -                base = env->mpmbase;
 -            }
 -            break;
 -        case PRV_S:
 -            if (env->mmte & S_PM_ENABLE) {
 -                mask = env->spmmask;
 -                base = env->spmbase;
 -            }
 -            break;
 -        case PRV_U:
 -            if (env->mmte & U_PM_ENABLE) {
 -                mask = env->upmmask;
 -                base = env->upmbase;
 -            }
 -            break;
 -        default:
 -            g_assert_not_reached();
 -        }
 -    }
 -#endif
 -    if (xl == MXL_RV32) {
 -        env->cur_pmmask = mask & UINT32_MAX;
 -        env->cur_pmbase = base & UINT32_MAX;
 -    } else {
 -        env->cur_pmmask = mask;
 -        env->cur_pmbase = base;
 -    }
 -}
 -
  #ifndef CONFIG_USER_ONLY
  /*
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en)
      /* tlb_flush is unnecessary as mode is contained in mmu_idx */
      env->priv = newpriv;
      env->xl = cpu_recompute_xl(env);
 -    riscv_cpu_update_mask(env);
      /*
       * Clear the load reservation - otherwise a reservation placed in one
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException hgatp(CPURISCVState *env, int csrno)
      return hmode(env, csrno);
  }
 -/* Checks if PointerMasking registers could be accessed */
 -static RISCVException pointer_masking(CPURISCVState *env, int csrno)
 -{
 -    /* Check if j-ext is present */
 -    if (riscv_has_ext(env, RVJ)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -    return RISCV_EXCP_ILLEGAL_INST;
 -}
 -
  static RISCVException aia_hmode(CPURISCVState *env, int csrno)
  {
      if (!riscv_cpu_cfg(env)->ext_ssaia) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
          env->xl = cpu_recompute_xl(env);
      }
 -    riscv_cpu_update_mask(env);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcontext(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 -/*
 - * Functions to access Pointer Masking feature registers
 - * We have to check if current priv lvl could modify
 - * csr in given mode
 - */
 -static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
 -{
 -    int csr_priv = get_field(csrno, 0x300);
 -    int pm_current;
 -
 -    if (env->debugger) {
 -        return false;
 -    }
 -    /*
 -     * If priv lvls differ that means we're accessing csr from higher priv lvl,
 -     * so allow the access
 -     */
 -    if (env->priv != csr_priv) {
 -        return false;
 -    }
 -    switch (env->priv) {
 -    case PRV_M:
 -        pm_current = get_field(env->mmte, M_PM_CURRENT);
 -        break;
 -    case PRV_S:
 -        pm_current = get_field(env->mmte, S_PM_CURRENT);
 -        break;
 -    case PRV_U:
 -        pm_current = get_field(env->mmte, U_PM_CURRENT);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 -    /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
 -    return !pm_current;
 -}
 -
 -static RISCVException read_mmte(CPURISCVState *env, int csrno,
 -                                target_ulong *val)
 -{
 -    *val = env->mmte & MMTE_MASK;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_mmte(CPURISCVState *env, int csrno,
 -                                 target_ulong val)
 -{
 -    uint64_t mstatus;
 -    target_ulong wpri_val = val & MMTE_MASK;
 -
 -    if (val != wpri_val) {
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
 -                      TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
 -                      val, "vs expected 0x", wpri_val);
 -    }
 -    /* for machine mode pm.current is hardwired to 1 */
 -    wpri_val |= MMTE_M_PM_CURRENT;
 -
 -    /* hardwiring pm.instruction bit to 0, since it's not supported yet */
 -    wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
 -    env->mmte = wpri_val | EXT_STATUS_DIRTY;
 -    riscv_cpu_update_mask(env);
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_smte(CPURISCVState *env, int csrno,
 -                                target_ulong *val)
 -{
 -    *val = env->mmte & SMTE_MASK;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_smte(CPURISCVState *env, int csrno,
 -                                 target_ulong val)
 -{
 -    target_ulong wpri_val = val & SMTE_MASK;
 -
 -    if (val != wpri_val) {
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
 -                      TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
 -                      val, "vs expected 0x", wpri_val);
 -    }
 -
 -    /* if pm.current==0 we can't modify current PM CSRs */
 -    if (check_pm_current_disabled(env, csrno)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -
 -    wpri_val |= (env->mmte & ~SMTE_MASK);
 -    write_mmte(env, csrno, wpri_val);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_umte(CPURISCVState *env, int csrno,
 -                                target_ulong *val)
 -{
 -    *val = env->mmte & UMTE_MASK;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_umte(CPURISCVState *env, int csrno,
 -                                 target_ulong val)
 -{
 -    target_ulong wpri_val = val & UMTE_MASK;
 -
 -    if (val != wpri_val) {
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
 -                      TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
 -                      val, "vs expected 0x", wpri_val);
 -    }
 -
 -    if (check_pm_current_disabled(env, csrno)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -
 -    wpri_val |= (env->mmte & ~UMTE_MASK);
 -    write_mmte(env, csrno, wpri_val);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
 -                                   target_ulong *val)
 -{
 -    *val = env->mpmmask;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
 -                                    target_ulong val)
 -{
 -    uint64_t mstatus;
 -
 -    env->mpmmask = val;
 -    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 -        env->cur_pmmask = val;
 -    }
 -    env->mmte |= EXT_STATUS_DIRTY;
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_spmmask(CPURISCVState *env, int csrno,
 -                                   target_ulong *val)
 -{
 -    *val = env->spmmask;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_spmmask(CPURISCVState *env, int csrno,
 -                                    target_ulong val)
 -{
 -    uint64_t mstatus;
 -
 -    /* if pm.current==0 we can't modify current PM CSRs */
 -    if (check_pm_current_disabled(env, csrno)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -    env->spmmask = val;
 -    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 -        env->cur_pmmask = val;
 -        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 -            env->cur_pmmask &= UINT32_MAX;
 -        }
 -    }
 -    env->mmte |= EXT_STATUS_DIRTY;
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_upmmask(CPURISCVState *env, int csrno,
 -                                   target_ulong *val)
 -{
 -    *val = env->upmmask;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_upmmask(CPURISCVState *env, int csrno,
 -                                    target_ulong val)
 -{
 -    uint64_t mstatus;
 -
 -    /* if pm.current==0 we can't modify current PM CSRs */
 -    if (check_pm_current_disabled(env, csrno)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -    env->upmmask = val;
 -    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 -        env->cur_pmmask = val;
 -        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 -            env->cur_pmmask &= UINT32_MAX;
 -        }
 -    }
 -    env->mmte |= EXT_STATUS_DIRTY;
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
 -                                   target_ulong *val)
 -{
 -    *val = env->mpmbase;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
 -                                    target_ulong val)
 -{
 -    uint64_t mstatus;
 -
 -    env->mpmbase = val;
 -    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 -        env->cur_pmbase = val;
 -    }
 -    env->mmte |= EXT_STATUS_DIRTY;
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_spmbase(CPURISCVState *env, int csrno,
 -                                   target_ulong *val)
 -{
 -    *val = env->spmbase;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_spmbase(CPURISCVState *env, int csrno,
 -                                    target_ulong val)
 -{
 -    uint64_t mstatus;
 -
 -    /* if pm.current==0 we can't modify current PM CSRs */
 -    if (check_pm_current_disabled(env, csrno)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -    env->spmbase = val;
 -    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 -        env->cur_pmbase = val;
 -        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 -            env->cur_pmbase &= UINT32_MAX;
 -        }
 -    }
 -    env->mmte |= EXT_STATUS_DIRTY;
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException read_upmbase(CPURISCVState *env, int csrno,
 -                                   target_ulong *val)
 -{
 -    *val = env->upmbase;
 -    return RISCV_EXCP_NONE;
 -}
 -
 -static RISCVException write_upmbase(CPURISCVState *env, int csrno,
 -                                    target_ulong val)
 -{
 -    uint64_t mstatus;
 -
 -    /* if pm.current==0 we can't modify current PM CSRs */
 -    if (check_pm_current_disabled(env, csrno)) {
 -        return RISCV_EXCP_NONE;
 -    }
 -    env->upmbase = val;
 -    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 -        env->cur_pmbase = val;
 -        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 -            env->cur_pmbase &= UINT32_MAX;
 -        }
 -    }
 -    env->mmte |= EXT_STATUS_DIRTY;
 -
 -    /* Set XS and SD bits, since PM CSRs are dirty */
 -    mstatus = env->mstatus | MSTATUS_XS;
 -    write_mstatus(env, csrno, mstatus);
 -    return RISCV_EXCP_NONE;
 -}
 -
  #endif
  /* Crypto Extension */
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_TINFO]     =  { "tinfo",    debug, read_tinfo,    write_ignore   },
      [CSR_MCONTEXT]  =  { "mcontext", debug, read_mcontext, write_mcontext },
 -    /* User Pointer Masking */
 -    [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
 -    [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
 -                         write_upmmask                                      },
 -    [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
 -                         write_upmbase                                      },
 -    /* Machine Pointer Masking */
 -    [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
 -    [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
 -                         write_mpmmask                                      },
 -    [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
 -                         write_mpmbase                                      },
 -    /* Supervisor Pointer Masking */
 -    [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
 -    [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
 -                         write_spmmask                                      },
 -    [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
 -                         write_spmbase                                      },
 -
      /* Performance Counters */
      [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
      [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vector = {
  static bool pointermasking_needed(void *opaque)
  {
 -    RISCVCPU *cpu = opaque;
 -    CPURISCVState *env = &cpu->env;
 -
 -    return riscv_has_ext(env, RVJ);
 +    return false;
  }
  static const VMStateDescription vmstate_pointermasking = {
      .name = "cpu/pointer_masking",
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .needed = pointermasking_needed,
      .fields = (const VMStateField[]) {
 -        VMSTATE_UINTTL(env.mmte, RISCVCPU),
 -        VMSTATE_UINTTL(env.mpmmask, RISCVCPU),
 -        VMSTATE_UINTTL(env.mpmbase, RISCVCPU),
 -        VMSTATE_UINTTL(env.spmmask, RISCVCPU),
 -        VMSTATE_UINTTL(env.spmbase, RISCVCPU),
 -        VMSTATE_UINTTL(env.upmmask, RISCVCPU),
 -        VMSTATE_UINTTL(env.upmbase, RISCVCPU),
          VMSTATE_END_OF_LIST()
      }
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_post_load(void *opaque, int version_id)
      CPURISCVState *env = &cpu->env;
      env->xl = cpu_recompute_xl(env);
 -    riscv_cpu_update_mask(env);
      return 0;
  }
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-     riscv_cpu_disable_priv_spec_isa_exts(cpu);
+     MISA_CFG(RVS, true),
- }
+     MISA_CFG(RVU, true),
+     MISA_CFG(RVH, true),
-+#ifndef CONFIG_USER_ONLY
+-    MISA_CFG(RVJ, false),
-+static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
+     MISA_CFG(RVV, false),
-+                                            RISCVCPUProfile *profile,
+     MISA_CFG(RVG, false),
-+                                            bool send_warn)
+     MISA_CFG(RVB, false),
-+{
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
-+    int satp_max = satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+     CPURISCVState *env = &cpu->env;
      const RISCVCPUMultiExtConfig *prop;
 -    /* Enable RVG, RVJ and RVV that are disabled by default */
 -    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
 +    /* Enable RVG and RVV that are disabled by default */
 +    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVV);
      for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
          isa_ext_update_enabled(cpu, prop->offset, true);
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
  static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
  static TCGv load_res;
  static TCGv load_val;
 -/* globals for PM CSRs */
 -static TCGv pm_mask;
 -static TCGv pm_base;
  /*
   * If an operation is being performed on less than TARGET_LONG_BITS,
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool vl_eq_vlmax;
      CPUState *cs;
      TCGv zero;
 -    /* PointerMasking extension */
 -    bool pm_mask_enabled;
 -    bool pm_base_enabled;
      /* Ztso */
      bool ztso;
      /* Use icount trigger for native debug */
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
      TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
      tcg_gen_addi_tl(addr, src1, imm);
 -    if (ctx->pm_mask_enabled) {
 -        tcg_gen_andc_tl(addr, addr, pm_mask);
 -    } else if (get_address_xl(ctx) == MXL_RV32) {
 +    if (get_address_xl(ctx) == MXL_RV32) {
          tcg_gen_ext32u_tl(addr, addr);
      }
 -    if (ctx->pm_base_enabled) {
 -        tcg_gen_or_tl(addr, addr, pm_base);
 -    }
      return addr;
  }
@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
      TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
      tcg_gen_add_tl(addr, src1, offs);
 -    if (ctx->pm_mask_enabled) {
 -        tcg_gen_andc_tl(addr, addr, pm_mask);
 -    } else if (get_xl(ctx) == MXL_RV32) {
 +    if (get_xl(ctx) == MXL_RV32) {
          tcg_gen_ext32u_tl(addr, addr);
      }
 -    if (ctx->pm_base_enabled) {
 -        tcg_gen_or_tl(addr, addr, pm_base);
 -    }
 +
-+    if (profile->satp_mode > satp_max) {
+     return addr;
-+        if (send_warn) {
+ }
-+            bool is_32bit = riscv_cpu_is_32bit(cpu);
-+            const char *req_satp = satp_mode_str(profile->satp_mode, is_32bit);
+@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-+            const char *cur_satp = satp_mode_str(satp_max, is_32bit);
+     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
-+
+     ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
-+            warn_report("Profile %s requires satp mode %s, "
+     ctx->cs = cs;
-+                        "but satp mode %s was set", profile->name,
+-    ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
-+                        req_satp, cur_satp);
+-    ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
-+        }
+     ctx->ztso = cpu->cfg.ext_ztso;
-+
+     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
-+        return false;
+     ctx->bcfi_enabled = FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED);
-+    }
+@@ -XXX,XX +XXX,XX @@ void riscv_translate_init(void)
-+
+                              "load_res");
-+    return true;
+     load_val = tcg_global_mem_new(tcg_env, offsetof(CPURISCVState, load_val),
-+}
+                              "load_val");
-+#endif
+-    /* Assign PM CSRs to tcg globals */
-+
+-    pm_mask = tcg_global_mem_new(tcg_env, offsetof(CPURISCVState, cur_pmmask),
- static void riscv_cpu_validate_profile(RISCVCPU *cpu,
+-                                 "pmmask");
-                                        RISCVCPUProfile *profile)
+-    pm_base = tcg_global_mem_new(tcg_env, offsetof(CPURISCVState, cur_pmbase),
 -                                 "pmbase");
  }
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
  static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
  {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
+-    return (addr & ~env->cur_pmmask) | env->cur_pmbase;
-     bool profile_impl = true;
++    return addr;
-     int i;
+ }
-+#ifndef CONFIG_USER_ONLY
+ /*
 +    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
 +        profile_impl = riscv_cpu_validate_profile_satp(cpu, profile,
 +                                                       send_warn);
 +    }
 +#endif
 +
      if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
          profile->priv_spec != env->priv_ver) {
          profile_impl = false;
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
          cpu->env.priv_ver = profile->priv_spec;
      }
 +#ifndef CONFIG_USER_ONLY
 +    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
 +        const char *satp_prop = satp_mode_str(profile->satp_mode,
 +                                              riscv_cpu_is_32bit(cpu));
 +        object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
 +    }
 +#endif
 +
      for (i = 0; misa_bits[i] != 0; i++) {
          uint32_t bit = misa_bits[i];
 --
-.43.0
+.48.1

-[PULL 05/65] target/riscv/pmp: Use hwaddr instead of target_ulong for RV32
+[PULL v2 14/50] target/riscv: Add new CSR fields for S{sn, mn, m}pm extensions as part of Zjpm v1.0
-From: Ivan Klokov <ivan.klokov@syntacore.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-The Sv32 page-based virtual-memory scheme described in RISCV privileged
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
-spec Section 5.3 supports 34-bit physical addresses for RV32, so the
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 PMP scheme must support addresses wider than XLEN for RV32. However,
 PMP address register format is still 32 bit wide.
 Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231123091214.20312-1-ivan.klokov@syntacore.com>
+Message-ID: <20250106102346.1100149-3-baturo.alexey@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.h |  8 ++++----
+ target/riscv/cpu.h      |  8 ++++++++
- target/riscv/pmp.c | 26 ++++++++++++--------------
+ target/riscv/cpu_bits.h |  4 ++++
-files changed, 16 insertions(+), 18 deletions(-)
+ target/riscv/cpu_cfg.h  |  3 +++
  target/riscv/pmp.h      |  1 +
  target/riscv/csr.c      | 33 +++++++++++++++++++++++++++++++--
  target/riscv/pmp.c      | 14 +++++++++++---
 files changed, 58 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     EXT_STATUS_DIRTY,
+ } RISCVExtStatus;
++/* Enum holds PMM field values for Zjpm v1.0 extension */
++typedef enum {
++    PMM_FIELD_DISABLED = 0,
++    PMM_FIELD_RESERVED = 1,
++    PMM_FIELD_PMLEN7   = 2,
++    PMM_FIELD_PMLEN16  = 3,
++} RISCVPmPmm;
++
+ typedef struct riscv_cpu_implied_exts_rule {
+ #ifndef CONFIG_USER_ONLY
+     /*
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+ #define HSTATUS_VTSR         0x00400000
+ #define HSTATUS_HUKTE        0x01000000
+ #define HSTATUS_VSXL         0x300000000
++#define HSTATUS_HUPMM        0x3000000000000
+ #define HSTATUS32_WPRI       0xFF8FF87E
+ #define HSTATUS64_WPRI       0xFFFFFFFFFF8FF87EULL
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define MENVCFG_CBIE                       (3UL << 4)
+ #define MENVCFG_CBCFE                      BIT(6)
+ #define MENVCFG_CBZE                       BIT(7)
++#define MENVCFG_PMM                        (3ULL << 32)
+ #define MENVCFG_ADUE                       (1ULL << 61)
+ #define MENVCFG_PBMTE                      (1ULL << 62)
+ #define MENVCFG_STCE                       (1ULL << 63)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define SENVCFG_CBCFE                      MENVCFG_CBCFE
+ #define SENVCFG_CBZE                       MENVCFG_CBZE
+ #define SENVCFG_UKTE                       BIT(8)
++#define SENVCFG_PMM                        MENVCFG_PMM
+ #define HENVCFG_FIOM                       MENVCFG_FIOM
+ #define HENVCFG_LPE                        MENVCFG_LPE
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define HENVCFG_CBIE                       MENVCFG_CBIE
+ #define HENVCFG_CBCFE                      MENVCFG_CBCFE
+ #define HENVCFG_CBZE                       MENVCFG_CBZE
++#define HENVCFG_PMM                        MENVCFG_PMM
+ #define HENVCFG_ADUE                       MENVCFG_ADUE
+ #define HENVCFG_PBMTE                      MENVCFG_PBMTE
+ #define HENVCFG_STCE                       MENVCFG_STCE
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_ssaia;
+     bool ext_sscofpmf;
+     bool ext_smepmp;
++    bool ext_ssnpm;
++    bool ext_smnpm;
++    bool ext_smmpm;
+     bool rvv_ta_all_1s;
+     bool rvv_ma_all_1s;
+     bool rvv_vl_half_avl;
 diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.h
 +++ b/target/riscv/pmp.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ typedef enum {
- } pmp_entry_t;
+     MSECCFG_USEED = 1 << 8,
      MSECCFG_SSEED = 1 << 9,
      MSECCFG_MLPE =  1 << 10,
 +    MSECCFG_PMM = 3ULL << 32,
  } mseccfg_field_t;
  typedef struct {
--    target_ulong sa;
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
--    target_ulong ea;
+index XXXXXXX..XXXXXXX 100644
-+    hwaddr sa;
+--- a/target/riscv/csr.c
-+    hwaddr ea;
++++ b/target/riscv/csr.c
- } pmp_addr_t;
+@@ -XXX,XX +XXX,XX @@ static RISCVException have_mseccfg(CPURISCVState *env, int csrno)
+     if (riscv_cpu_cfg(env)->ext_zkr) {
- typedef struct {
+         return RISCV_EXCP_NONE;
-@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env);
+     }
- void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
++    if (riscv_cpu_cfg(env)->ext_smmpm) {
-                        target_ulong val);
++        return RISCV_EXCP_NONE;
- target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
++    }
--bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
+     return RISCV_EXCP_ILLEGAL_INST;
-                         target_ulong size, pmp_priv_t privs,
+ }
-                         pmp_priv_t *allowed_privs,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-                         target_ulong mode);
+         if (env_archcpu(env)->cfg.ext_zicfiss) {
--target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr);
+             mask |= MENVCFG_SSE;
-+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr);
+         }
- void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
++
- void pmp_update_rule_nums(CPURISCVState *env);
++        /* Update PMM field only if the value is valid according to Zjpm v1.0 */
- uint32_t pmp_get_num_rules(CPURISCVState *env);
++        if (env_archcpu(env)->cfg.ext_smnpm &&
 +            get_field(val, MENVCFG_PMM) != PMM_FIELD_RESERVED) {
 +            mask |= MENVCFG_PMM;
 +        }
      }
      env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
  {
      uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
      RISCVException ret;
 +    /* Update PMM field only if the value is valid according to Zjpm v1.0 */
 +    if (env_archcpu(env)->cfg.ext_ssnpm &&
 +        riscv_cpu_mxl(env) == MXL_RV64 &&
 +        get_field(val, SENVCFG_PMM) != PMM_FIELD_RESERVED) {
 +        mask |= SENVCFG_PMM;
 +    }
      ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
      if (ret != RISCV_EXCP_NONE) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
              get_field(env->menvcfg, MENVCFG_SSE)) {
              mask |= HENVCFG_SSE;
          }
 +
 +        /* Update PMM field only if the value is valid according to Zjpm v1.0 */
 +        if (env_archcpu(env)->cfg.ext_ssnpm &&
 +            get_field(val, HENVCFG_PMM) != PMM_FIELD_RESERVED) {
 +            mask |= HENVCFG_PMM;
 +        }
      }
      env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
  static RISCVException write_hstatus(CPURISCVState *env, int csrno,
                                      target_ulong val)
  {
 +    uint64_t mask = (target_ulong)-1;
      if (!env_archcpu(env)->cfg.ext_svukte) {
 -        val = val & (~HSTATUS_HUKTE);
 +        mask &= ~HSTATUS_HUKTE;
      }
 -    env->hstatus = val;
 +    /* Update PMM field only if the value is valid according to Zjpm v1.0 */
 +    if (!env_archcpu(env)->cfg.ext_ssnpm ||
 +        riscv_cpu_mxl(env) != MXL_RV64 ||
 +        get_field(val, HSTATUS_HUPMM) == PMM_FIELD_RESERVED) {
 +        mask &= ~HSTATUS_HUPMM;
 +    }
 +    env->hstatus = (env->hstatus & ~mask) | (val & mask);
 +
      if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
          qemu_log_mask(LOG_UNIMP,
                        "QEMU does not support mixed HSXLEN options.");
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ void pmp_unlock_entries(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
-     }
+ void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
  }
 -static void pmp_decode_napot(target_ulong a, target_ulong *sa,
 -                             target_ulong *ea)
 +static void pmp_decode_napot(hwaddr a, hwaddr *sa, hwaddr *ea)
  {
-     /*
-      * aaaa...aaa0   8-byte NAPOT range
-@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
-     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
-     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
-     target_ulong prev_addr = 0u;
--    target_ulong sa = 0u;
--    target_ulong ea = 0u;
-+    hwaddr sa = 0u;
-+    hwaddr ea = 0u;
-     if (pmp_index >= 1u) {
-         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
-@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_nums(CPURISCVState *env)
-     }
- }
--static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
--                           target_ulong addr)
-+static int pmp_is_in_range(CPURISCVState *env, int pmp_index, hwaddr addr)
- {
-     int result = 0;
-@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, pmp_priv_t privs,
-  * Return true if a pmp rule match or default match
-  * Return false if no match
-  */
--bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
-                         target_ulong size, pmp_priv_t privs,
-                         pmp_priv_t *allowed_privs, target_ulong mode)
- {
-     int i = 0;
-     int pmp_size = 0;
--    target_ulong s = 0;
--    target_ulong e = 0;
-+    hwaddr s = 0;
-+    hwaddr e = 0;
-     /* Short cut if no rules */
-     if (0 == pmp_get_num_rules(env)) {
-@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env)
-  * To avoid this we return a size of 1 (which means no caching) if the PMP
-  * region only covers partial of the TLB page.
-  */
--target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr)
-+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr)
- {
--    target_ulong pmp_sa;
--    target_ulong pmp_ea;
--    target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
--    target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
-+    hwaddr pmp_sa;
-+    hwaddr pmp_ea;
-+    hwaddr tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
-+    hwaddr tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
      int i;
++    uint64_t mask = MSECCFG_MMWP | MSECCFG_MML;
-     /*
++    /* Update PMM field only if the value is valid according to Zjpm v1.0 */
 +    if (riscv_cpu_cfg(env)->ext_smmpm &&
 +        riscv_cpu_mxl(env) == MXL_RV64 &&
 +        get_field(val, MSECCFG_PMM) != PMM_FIELD_RESERVED) {
 +        mask |= MSECCFG_PMM;
 +    }
      trace_mseccfg_csr_write(env->mhartid, val);
@@ -XXX,XX +XXX,XX @@ void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
      if (riscv_cpu_cfg(env)->ext_smepmp) {
          /* Sticky bits */
 -        val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
 -        if ((val ^ env->mseccfg) & (MSECCFG_MMWP | MSECCFG_MML)) {
 +        val |= (env->mseccfg & mask);
 +        if ((val ^ env->mseccfg) & mask) {
              tlb_flush(env_cpu(env));
          }
      } else {
 -        val &= ~(MSECCFG_MMWP | MSECCFG_MML | MSECCFG_RLB);
 +        mask |= MSECCFG_RLB;
 +        val &= ~(mask);
      }
      /* M-mode forward cfi to be enabled if cfi extension is implemented */
 --
-.43.0
+.48.1

-[PULL 44/65] target/riscv/tcg: validate profiles during finalize
+[PULL v2 15/50] target/riscv: Add helper functions to calculate current number of masked bits for pointer masking
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-Enabling a profile and then disabling some of its mandatory extensions
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
-is a valid use. It can be useful for debugging and testing. But the
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 common expected use of enabling a profile is to enable all its mandatory
 extensions.
 Add an user warning when mandatory extensions from an enabled profile
 are disabled in the command line. We're also going to disable the
 profile flag in this case since the profile must include all the
 mandatory extensions. This flag can be exposed by QMP to indicate the
 actual profile state after the CPU is realized.
 After this patch, this will throw warnings:
 -cpu rv64,rva22u64=true,zihintpause=false,zicbom=false,zicboz=false
 qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zihintpause
 qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicbom
 qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicboz
 Note that the following will NOT throw warnings because the profile is
 being enabled last, hence all its mandatory extensions will be enabled:
 -cpu rv64,zihintpause=false,zicbom=false,zicboz=false,rva22u64=true
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-17-dbarboza@ventanamicro.com>
+Message-ID: <20250106102346.1100149-4-baturo.alexey@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 69 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/cpu.h        |  5 +++
-file changed, 69 insertions(+)
+ target/riscv/cpu_helper.c | 78 +++++++++++++++++++++++++++++++++++++++
 files changed, 83 insertions(+)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/cpu.h
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-     g_assert_not_reached();
  bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 +bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
 +RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
 +uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
 +
  RISCVException riscv_csrr(CPURISCVState *env, int csrno,
                            target_ulong *ret_value);
 +
  RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                             target_ulong *ret_value,
                             target_ulong new_value, target_ulong write_mask);
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
      *pflags = flags;
  }
-+static const char *cpu_cfg_ext_get_name(uint32_t ext_offset)
++RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 +{
-+    const RISCVCPUMultiExtConfig *feat;
++#ifndef CONFIG_USER_ONLY
-+    const RISCVIsaExtData *edata;
++    int priv_mode = cpu_address_mode(env);
 +
-+    for (edata = isa_edata_arr; edata->name != NULL; edata++) {
++    if (get_field(env->mstatus, MSTATUS_MPRV) &&
-+        if (edata->ext_enable_offset == ext_offset) {
++        get_field(env->mstatus, MSTATUS_MXR)) {
-+            return edata->name;
++        return PMM_FIELD_DISABLED;
 +        }
 +    }
 +
-+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
++    /* Get current PMM field */
-+        if (feat->offset == ext_offset) {
++    switch (priv_mode) {
-+            return feat->name;
++    case PRV_M:
 +        if (riscv_cpu_cfg(env)->ext_smmpm) {
 +            return get_field(env->mseccfg, MSECCFG_PMM);
 +        }
++        break;
++    case PRV_S:
++        if (riscv_cpu_cfg(env)->ext_smnpm) {
++            if (get_field(env->mstatus, MSTATUS_MPV)) {
++                return get_field(env->henvcfg, HENVCFG_PMM);
++            } else {
++                return get_field(env->menvcfg, MENVCFG_PMM);
++            }
++        }
++        break;
++    case PRV_U:
++        if (riscv_has_ext(env, RVS)) {
++            if (riscv_cpu_cfg(env)->ext_ssnpm) {
++                return get_field(env->senvcfg, SENVCFG_PMM);
++            }
++        } else {
++            if (riscv_cpu_cfg(env)->ext_smnpm) {
++                return get_field(env->menvcfg, MENVCFG_PMM);
++            }
++        }
++        break;
++    default:
++        g_assert_not_reached();
++    }
++    return PMM_FIELD_DISABLED;
++#else
++    return PMM_FIELD_DISABLED;
++#endif
++}
++
++bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
++{
++#ifndef CONFIG_USER_ONLY
++    int satp_mode = 0;
++    int priv_mode = cpu_address_mode(env);
++
++    if (riscv_cpu_mxl(env) == MXL_RV32) {
++        satp_mode = get_field(env->satp, SATP32_MODE);
++    } else {
++        satp_mode = get_field(env->satp, SATP64_MODE);
 +    }
 +
-+    g_assert_not_reached();
++    return ((satp_mode != VM_1_10_MBARE) && (priv_mode != PRV_M));
 +#else
 +    return false;
 +#endif
 +}
 +
- static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
++uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm)
  {
      const RISCVCPUMultiExtConfig *feat;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      riscv_cpu_disable_priv_spec_isa_exts(cpu);
  }
 +static void riscv_cpu_validate_profile(RISCVCPU *cpu,
 +                                       RISCVCPUProfile *profile)
 +{
-+    const char *warn_msg = "Profile %s mandates disabled extension %s";
++    switch (pmm) {
-+    bool send_warn = profile->user_set && profile->enabled;
++    case PMM_FIELD_DISABLED:
-+    bool profile_impl = true;
++        return 0;
-+    int i;
++    case PMM_FIELD_PMLEN7:
-+
++        return 7;
-+    for (i = 0; misa_bits[i] != 0; i++) {
++    case PMM_FIELD_PMLEN16:
-+        uint32_t bit = misa_bits[i];
++        return 16;
-+
++    default:
-+        if (!(profile->misa_ext & bit)) {
++        g_assert_not_reached();
 +            continue;
 +        }
 +
 +        if (!riscv_has_ext(&cpu->env, bit)) {
 +            profile_impl = false;
 +
 +            if (send_warn) {
 +                warn_report(warn_msg, profile->name,
 +                            riscv_get_misa_ext_name(bit));
 +            }
 +        }
 +    }
 +
 +    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
 +        int ext_offset = profile->ext_offsets[i];
 +
 +        if (!isa_ext_is_enabled(cpu, ext_offset)) {
 +            profile_impl = false;
 +
 +            if (send_warn) {
 +                warn_report(warn_msg, profile->name,
 +                            cpu_cfg_ext_get_name(ext_offset));
 +            }
 +        }
 +    }
 +
 +    profile->enabled = profile_impl;
 +}
 +
 +static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
 +{
 +    for (int i = 0; riscv_profiles[i] != NULL; i++) {
 +        riscv_cpu_validate_profile(cpu, riscv_profiles[i]);
 +    }
 +}
 +
- void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
+ #ifndef CONFIG_USER_ONLY
- {
-     CPURISCVState *env = &cpu->env;
+ /*
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
      }
      riscv_cpu_update_named_features(cpu);
 +    riscv_cpu_validate_profiles(cpu);
      if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
          /*
 --
-.43.0
+.48.1

-[PULL 64/65] target/riscv: Don't adjust vscause for exceptions
+[PULL v2 16/50] target/riscv: Add pointer masking tb flags
-From: Alistair Francis <alistair23@gmail.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-We have been incorrectly adjusting both the interrupt and exception
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
-cause when using the hypervisor extension and trapping to VS-mode. This
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-patch changes the conditional to ensure we only adjust the cause for
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-interrupts and not exceptions.
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20250106102346.1100149-5-baturo.alexey@gmail.com>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1708
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20240108001328.280222-3-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 4 ++--
+ target/riscv/cpu.h        | 3 +++
-file changed, 2 insertions(+), 2 deletions(-)
+ target/riscv/cpu_helper.c | 3 +++
  target/riscv/translate.c  | 5 +++++
 files changed, 11 insertions(+)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, FCFI_ENABLED, 26, 1)
+ FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 27, 1)
+ /* zicfiss needs a TB flag so that correct TB is located based on tb flags */
+ FIELD(TB_FLAGS, BCFI_ENABLED, 28, 1)
++/* If pointer masking should be applied and address sign extended */
++FIELD(TB_FLAGS, PM_PMM, 29, 2)
++FIELD(TB_FLAGS, PM_SIGNEXTEND, 31, 1)
+ #ifdef TARGET_RISCV32
+ #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                  * See if we need to adjust cause. Yes if its VS mode interrupt
+     RISCVCPU *cpu = env_archcpu(env);
-                  * no if hypervisor has delegated one of hs mode's interrupt
+     RISCVExtStatus fs, vs;
-                  */
+     uint32_t flags = 0;
--                if (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
++    bool pm_signext = riscv_cpu_virt_mem_enabled(env);
--                    cause == IRQ_VS_EXT) {
-+                if (async && (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
+     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
-+                              cause == IRQ_VS_EXT)) {
+     *cs_base = 0;
-                     cause = cause - 1;
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                 }
+     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
-                 write_gva = false;
+     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
      flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
 +    flags = FIELD_DP32(flags, TB_FLAGS, PM_PMM, riscv_pm_get_pmm(env));
 +    flags = FIELD_DP32(flags, TB_FLAGS, PM_SIGNEXTEND, pm_signext);
      *pflags = flags;
  }
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool vl_eq_vlmax;
      CPUState *cs;
      TCGv zero;
 +    /* actual address width */
 +    uint8_t addr_xl;
 +    bool addr_signed;
      /* Ztso */
      bool ztso;
      /* Use icount trigger for native debug */
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
      ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
      ctx->cs = cs;
 +    ctx->addr_xl = 0;
 +    ctx->addr_signed = false;
      ctx->ztso = cpu->cfg.ext_ztso;
      ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
      ctx->bcfi_enabled = FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED);
 --
-.43.0
+.48.1

-[PULL 18/65] hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
+[PULL v2 17/50] target/riscv: Update address modify functions to take into account pointer masking
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-Add APLIC structures for each socket in the MADT when system is configured
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
-with APLIC as the external wired interrupt controller.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Message-ID: <20250106102346.1100149-6-baturo.alexey@gmail.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-8-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 34 ++++++++++++++++++++++++++++++++++
+ target/riscv/translate.c     | 22 ++++++++++++++++------
-file changed, 34 insertions(+)
+ target/riscv/vector_helper.c | 16 ++++++++++++++++
 files changed, 32 insertions(+), 6 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/translate.c
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
-     uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
+     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
-     uint16_t imsic_max_hart_per_socket = 0;
-     uint8_t  hart_index_bits;
+     tcg_gen_addi_tl(addr, src1, imm);
-+    uint64_t aplic_addr;
+-    if (get_address_xl(ctx) == MXL_RV32) {
-+    uint32_t gsi_base;
+-        tcg_gen_ext32u_tl(addr, addr);
-     uint8_t  socket;
++    if (ctx->addr_signed) {
++        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
-     for (socket = 0; socket < riscv_socket_count(ms); socket++) {
++    } else {
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
++        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
          build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
      }
-+    if (s->aia_type != VIRT_AIA_TYPE_NONE) {
+     return addr;
-+        /* APLICs */
+@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
-+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
-+            aplic_addr = s->memmap[VIRT_APLIC_S].base +
-+                             s->memmap[VIRT_APLIC_S].size * socket;
+     tcg_gen_add_tl(addr, src1, offs);
-+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
+-    if (get_xl(ctx) == MXL_RV32) {
-+            build_append_int_noprefix(table_data, 0x1A, 1);    /* Type */
+-        tcg_gen_ext32u_tl(addr, addr);
-+            build_append_int_noprefix(table_data, 36, 1);      /* Length */
++    if (ctx->addr_signed) {
-+            build_append_int_noprefix(table_data, 1, 1);       /* Version */
++        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
-+            build_append_int_noprefix(table_data, socket, 1);  /* APLIC ID */
++    } else {
-+            build_append_int_noprefix(table_data, 0, 4);       /* Flags */
++        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
-+            build_append_int_noprefix(table_data, 0, 8);       /* Hardware ID */
+     }
-+            /* Number of IDCs */
-+            if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+     return addr;
-+                build_append_int_noprefix(table_data,
+@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-+                                          s->soc[socket].num_harts,
+     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
-+                                          2);
+     ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
-+            } else {
+     ctx->cs = cs;
-+                build_append_int_noprefix(table_data, 0, 2);
+-    ctx->addr_xl = 0;
-+            }
+-    ctx->addr_signed = false;
-+            /* Total External Interrupt Sources Supported */
++    if (get_xl(ctx) == MXL_RV32) {
-+            build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_SOURCES, 2);
++        ctx->addr_xl = 32;
-+            /* Global System Interrupt Base */
++        ctx->addr_signed = false;
-+            build_append_int_noprefix(table_data, gsi_base, 4);
++    } else {
-+            /* APLIC Address */
++        int pm_pmm = FIELD_EX32(tb_flags, TB_FLAGS, PM_PMM);
-+            build_append_int_noprefix(table_data, aplic_addr, 8);
++        ctx->addr_xl = 64 - riscv_pm_get_pmlen(pm_pmm);
-+            /* APLIC size */
++        ctx->addr_signed = FIELD_EX32(tb_flags, TB_FLAGS, PM_SIGNEXTEND);
 +            build_append_int_noprefix(table_data,
 +                                      s->memmap[VIRT_APLIC_S].size, 4);
 +        }
 +    }
-+
+     ctx->ztso = cpu->cfg.ext_ztso;
-     acpi_table_end(linker, &table);
+     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
      ctx->bcfi_enabled = FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED);
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
  static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
  {
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        return addr;
 +    }
 +    RISCVPmPmm pmm = riscv_pm_get_pmm(env);
 +    if (pmm == PMM_FIELD_DISABLED) {
 +        return addr;
 +    }
 +    int pmlen = riscv_pm_get_pmlen(pmm);
 +    bool signext = riscv_cpu_virt_mem_enabled(env);
 +    addr = addr << pmlen;
 +    /* sign/zero extend masked address by N-1 bit */
 +    if (signext) {
 +        addr = (target_long)addr >> pmlen;
 +    } else {
 +        addr = addr >> pmlen;
 +    }
      return addr;
  }
 --
-.43.0
+.48.1

-[PULL 12/65] hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
+[PULL v2 18/50] target/riscv: Apply pointer masking for virtualized memory accesses
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-RISC-V also needs to use the same code to create fw_cfg in DSDT. So,
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
 avoid code duplication by moving the code in arm and riscv to a device
 specific file.
 Suggested-by: Igor Mammedov <imammedo@redhat.com>
 Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250106102346.1100149-7-baturo.alexey@gmail.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-2-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/nvram/fw_cfg_acpi.h | 15 +++++++++++++++
+ target/riscv/cpu.h           |  1 +
- hw/arm/virt-acpi-build.c       | 19 ++-----------------
+ target/riscv/internals.h     | 54 ++++++++++++++++++++++++++++++++++++
- hw/nvram/fw_cfg-acpi.c         | 23 +++++++++++++++++++++++
+ target/riscv/cpu_helper.c    | 19 +++++++++++++
- hw/riscv/virt-acpi-build.c     | 19 ++-----------------
+ target/riscv/op_helper.c     | 16 +++++------
- hw/nvram/meson.build           |  1 +
+ target/riscv/vector_helper.c | 21 --------------
-files changed, 43 insertions(+), 34 deletions(-)
+files changed, 82 insertions(+), 29 deletions(-)
  create mode 100644 include/hw/nvram/fw_cfg_acpi.h
  create mode 100644 hw/nvram/fw_cfg-acpi.c
-diff --git a/include/hw/nvram/fw_cfg_acpi.h b/include/hw/nvram/fw_cfg_acpi.h
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/riscv/cpu.h
---- /dev/null
++++ b/target/riscv/cpu.h
-+++ b/include/hw/nvram/fw_cfg_acpi.h
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_is_32bit(RISCVCPU *cpu);
-@@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0+ */
+ bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
-+/*
+ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
-+ * ACPI support for fw_cfg
++RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env);
-+ *
+ uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
-+ */
-+
+ RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-+#ifndef FW_CFG_ACPI_H
+diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-+#define FW_CFG_ACPI_H
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/riscv/internals.h
-+#include "qemu/osdep.h"
++++ b/target/riscv/internals.h
-+#include "exec/hwaddr.h"
+@@ -XXX,XX +XXX,XX @@ static inline float16 check_nanbox_h(CPURISCVState *env, uint64_t f)
-+
+ /* Our implementation of CPUClass::has_work */
-+void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap);
+ bool riscv_cpu_has_work(CPUState *cs);
-+
 +/* Zjpm addr masking routine */
 +static inline target_ulong adjust_addr_body(CPURISCVState *env,
 +                                            target_ulong addr,
 +                                            bool is_virt_addr)
 +{
 +    RISCVPmPmm pmm = PMM_FIELD_DISABLED;
 +    uint32_t pmlen = 0;
 +    bool signext = false;
 +
 +    /* do nothing for rv32 mode */
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        return addr;
 +    }
 +
 +    /* get pmm field depending on whether addr is */
 +    if (is_virt_addr) {
 +        pmm = riscv_pm_get_virt_pmm(env);
 +    } else {
 +        pmm = riscv_pm_get_pmm(env);
 +    }
 +
 +    /* if pointer masking is disabled, return original addr */
 +    if (pmm == PMM_FIELD_DISABLED) {
 +        return addr;
 +    }
 +
 +    if (!is_virt_addr) {
 +        signext = riscv_cpu_virt_mem_enabled(env);
 +    }
 +    addr = addr << pmlen;
 +    pmlen = riscv_pm_get_pmlen(pmm);
 +
 +    /* sign/zero extend masked address by N-1 bit */
 +    if (signext) {
 +        addr = (target_long)addr >> pmlen;
 +    } else {
 +        addr = addr >> pmlen;
 +    }
 +
 +    return addr;
 +}
 +
 +static inline target_ulong adjust_addr(CPURISCVState *env,
 +                                       target_ulong addr)
 +{
 +    return adjust_addr_body(env, addr, false);
 +}
 +
 +static inline target_ulong adjust_addr_virt(CPURISCVState *env,
 +                                            target_ulong addr)
 +{
 +    return adjust_addr_body(env, addr, true);
 +}
 +
  #endif
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
  #endif
  }
 +RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
 +{
 +#ifndef CONFIG_USER_ONLY
 +    int priv_mode = cpu_address_mode(env);
 +
 +    if (priv_mode == PRV_U) {
 +        return get_field(env->hstatus, HSTATUS_HUPMM);
 +    } else {
 +        if (get_field(env->hstatus, HSTATUS_SPVP)) {
 +            return get_field(env->henvcfg, HENVCFG_PMM);
 +        } else {
 +            return get_field(env->senvcfg, SENVCFG_PMM);
 +        }
 +    }
 +#else
 +    return PMM_FIELD_DISABLED;
 +#endif
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
++}
-index XXXXXXX..XXXXXXX 100644
++
---- a/hw/arm/virt-acpi-build.c
+ bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
-+++ b/hw/arm/virt-acpi-build.c
+ {
-@@ -XXX,XX +XXX,XX @@
+ #ifndef CONFIG_USER_ONLY
- #include "target/arm/cpu.h"
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
- #include "hw/acpi/acpi-defs.h"
+index XXXXXXX..XXXXXXX 100644
- #include "hw/acpi/acpi.h"
+--- a/target/riscv/op_helper.c
--#include "hw/nvram/fw_cfg.h"
++++ b/target/riscv/op_helper.c
-+#include "hw/nvram/fw_cfg_acpi.h"
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
- #include "hw/acpi/bios-linker-loader.h"
+     int mmu_idx = check_access_hlsv(env, false, ra);
- #include "hw/acpi/aml-build.h"
+     MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
- #include "hw/acpi/utils.h"
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
+-    return cpu_ldb_mmu(env, addr, oi, ra);
-     aml_append(scope, dev);
++    return cpu_ldb_mmu(env, adjust_addr_virt(env, addr), oi, ra);
  }
--static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
+ target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 -    return cpu_ldw_mmu(env, addr, oi, ra);
 +    return cpu_ldw_mmu(env, adjust_addr_virt(env, addr), oi, ra);
  }
  target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 -    return cpu_ldl_mmu(env, addr, oi, ra);
 +    return cpu_ldl_mmu(env, adjust_addr_virt(env, addr), oi, ra);
  }
  target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
 -    return cpu_ldq_mmu(env, addr, oi, ra);
 +    return cpu_ldq_mmu(env, adjust_addr_virt(env, addr), oi, ra);
  }
  void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 -    cpu_stb_mmu(env, addr, val, oi, ra);
 +    cpu_stb_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
  }
  void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 -    cpu_stw_mmu(env, addr, val, oi, ra);
 +    cpu_stw_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
  }
  void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 -    cpu_stl_mmu(env, addr, val, oi, ra);
 +    cpu_stl_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
  }
  void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
      int mmu_idx = check_access_hlsv(env, false, ra);
      MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
 -    cpu_stq_mmu(env, addr, val, oi, ra);
 +    cpu_stq_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
  }
  /*
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
      return scale < 0 ? vlenb >> -scale : vlenb << scale;
  }
 -static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 -{
--    Aml *dev = aml_device("FWCF");
+-    if (riscv_cpu_mxl(env) == MXL_RV32) {
--    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
+-        return addr;
--    /* device present, functioning, decoding, not shown in UI */
+-    }
--    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+-    RISCVPmPmm pmm = riscv_pm_get_pmm(env);
--    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+-    if (pmm == PMM_FIELD_DISABLED) {
--
+-        return addr;
--    Aml *crs = aml_resource_template();
+-    }
--    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
+-    int pmlen = riscv_pm_get_pmlen(pmm);
--                                       fw_cfg_memmap->size, AML_READ_WRITE));
+-    bool signext = riscv_cpu_virt_mem_enabled(env);
--    aml_append(dev, aml_name_decl("_CRS", crs));
+-    addr = addr << pmlen;
--    aml_append(scope, dev);
+-    /* sign/zero extend masked address by N-1 bit */
 -    if (signext) {
 -        addr = (target_long)addr >> pmlen;
 -    } else {
 -        addr = addr >> pmlen;
 -    }
 -    return addr;
 -}
 -
- static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
+ /*
- {
+  * This function checks watchpoint before real load operation.
-     Aml *dev, *crs;
+  *
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
      if (vmc->acpi_expose_flash) {
          acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
      }
 -    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
 +    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
      acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
                      (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
      acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
 diff --git a/hw/nvram/fw_cfg-acpi.c b/hw/nvram/fw_cfg-acpi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/nvram/fw_cfg-acpi.c
@@ -XXX,XX +XXX,XX @@
 +// SPDX-License-Identifier: GPL-2.0+
 +/*
 + * Add fw_cfg device in DSDT
 + *
 + */
 +
 +#include "hw/nvram/fw_cfg_acpi.h"
 +#include "hw/acpi/aml-build.h"
 +
 +void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap)
 +{
 +    Aml *dev = aml_device("FWCF");
 +    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
 +    /* device present, functioning, decoding, not shown in UI */
 +    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
 +    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
 +
 +    Aml *crs = aml_resource_template();
 +    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
 +                                       fw_cfg_memmap->size, AML_READ_WRITE));
 +    aml_append(dev, aml_name_decl("_CRS", crs));
 +    aml_append(scope, dev);
 +}
 diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt-acpi-build.c
 +++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/acpi/acpi.h"
  #include "hw/acpi/aml-build.h"
  #include "hw/acpi/utils.h"
 +#include "hw/nvram/fw_cfg_acpi.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "sysemu/reset.h"
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
      }
  }
 -static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
 -{
 -    Aml *dev = aml_device("FWCF");
 -    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
 -
 -    /* device present, functioning, decoding, not shown in UI */
 -    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
 -    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
 -
 -    Aml *crs = aml_resource_template();
 -    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
 -                                       fw_cfg_memmap->size, AML_READ_WRITE));
 -    aml_append(dev, aml_name_decl("_CRS", crs));
 -    aml_append(scope, dev);
 -}
 -
  /* RHCT Node[N] starts at offset 56 */
  #define RHCT_NODE_ARRAY_OFFSET 56
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
      scope = aml_scope("\\_SB");
      acpi_dsdt_add_cpus(scope, s);
 -    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
 +    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
      aml_append(dsdt, scope);
 diff --git a/hw/nvram/meson.build b/hw/nvram/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/nvram/meson.build
 +++ b/hw/nvram/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_XLNX_EFUSE_ZYNQMP', if_true: files(
  system_ss.add(when: 'CONFIG_XLNX_BBRAM', if_true: files('xlnx-bbram.c'))
  specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_nvram.c'))
 +specific_ss.add(when: 'CONFIG_ACPI', if_true: files('fw_cfg-acpi.c'))
 --
-.43.0
+.48.1

-[PULL 62/65] target/riscv: pmp: Ignore writes when RW=01 and MML=0
+[PULL v2 19/50] target/riscv: Enable updates for pointer masking variables and thus enable pointer masking extension
-From: Ivan Klokov <ivan.klokov@syntacore.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-This patch changes behavior on writing RW=01 to pmpcfg with MML=0.
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
 RWX filed is form of collective WARL with the combination of
 pmpcfg.RW=01 remains reserved for future standard use.
 According to definition of WARL writing the CSR has no other side
 effect. But current implementation change architectural state and
 change system behavior. After writing we will get unreadable-unwriteble
 region regardless on the previous state.
 On the other side WARL said that we should read legal value and nothing
 says about what we should write. Current behavior change system state
 regardless of whether we read this register or not.
 Fixes: ac66f2f0 ("target/riscv: pmp: Ignore writes when RW=01")
 Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231220153205.11072-1-ivan.klokov@syntacore.com>
+Message-ID: <20250106102346.1100149-8-baturo.alexey@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.c | 2 +-
+ target/riscv/cpu.c | 6 ++++++
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 6 insertions(+)
-diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/pmp.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-             /* If !mseccfg.MML then ignore writes with encoding RW=01 */
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-             if ((val & PMP_WRITE) && !(val & PMP_READ) &&
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-                 !MSECCFG_MML_ISSET(env)) {
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
--                val &= ~(PMP_WRITE | PMP_READ);
++    ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
-+                return false;
++    ISA_EXT_DATA_ENTRY(smnpm, PRIV_VERSION_1_13_0, ext_smnpm),
-             }
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-             env->pmp_state.pmp[pmp_index].cfg_reg = val;
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
-             pmp_update_rule_addr(env, pmp_index);
+     ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, has_priv_1_11),
      ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
      ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
 +    ISA_EXT_DATA_ENTRY(ssnpm, PRIV_VERSION_1_13_0, ext_ssnpm),
      ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
      ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
      ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
      MULTI_EXT_CFG_BOOL("zvfhmin", ext_zvfhmin, false),
      MULTI_EXT_CFG_BOOL("sstc", ext_sstc, true),
 +    MULTI_EXT_CFG_BOOL("ssnpm", ext_ssnpm, false),
      MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
      MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
 +    MULTI_EXT_CFG_BOOL("smmpm", ext_smmpm, false),
 +    MULTI_EXT_CFG_BOOL("smnpm", ext_smnpm, false),
      MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
      MULTI_EXT_CFG_BOOL("ssaia", ext_ssaia, false),
      MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
 --
-.43.0
+.48.1

-[PULL 61/65] roms/opensbi: Upgrade from v1.3.1 to v1.4
+[PULL v2 20/50] target/riscv: Add 'ext_smrnmi' in the RISCVCPUConfig
-From: Bin Meng <bmeng@tinylab.org>
+From: Tommy Wu <tommy.wu@sifive.com>
-Upgrade OpenSBI from v1.3.1 to v1.4 and the pre-built bios images.
+The boolean variable 'ext_smrnmi' is used to determine whether the
 Smrnmi extension exists.
-The v1.4 release includes the following commits:
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 a398d9 lib: sbi: Add Zicntr as a HART ISA extension
 c lib: sbi: Add Zihpm as a HART ISA extension
 b9c8f lib: sbi: Alphabetically sort HART ISA extensions
 fc6 lib: sbi: Rename hart_pmu_get_allowed_bits() function
 c lib: sbi: Fix Priv spec version for [m|s]counteren and mcountinhibit CSRs
 6053917 lib: sbi: Fix how print gets flags
 ef182 lib: sbi: print not fill '0' when left-aligned
 dac06 lib: sbi: Add '+' flags for print
 fa74 lib: sbi: Add ' ' '\'' flags for print
 cbb6e lib: sbi: implifying the parameters of printi
 fe08281 lib: sbi: print add 'o' type
 c6ee5ae lib: sbi: Fix printi
 b6fcdd lib: sbi: Simplify prints
 cc89fa7 lib: sbi: Fix printc
 ff43168 lib: sbi: Fix timing of clearing tbuf
 a73982d lib: sbi: Fix missing '\0' when buffer szie equal 1
 ea6533a lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
 c3b98c6 include: sbi: Add macro definitions for mseccfg CSR
 c099c4 lib: sbi: Add functions to manipulate PMP entries
 c202c5 include: sbi: Add Smepmp specific access flags for PMP entries
 cbcfc7b lib: sbi: Add smepmp in hart extensions
 d72f5f1 lib: utils: Add detection of Smepmp from ISA string in FDT
 a42a23 lib: sbi: Grant SU R/W/X permissions to whole memory
 f3fdd04 lib: sbi: Change the order of PMP initialization
 dd8db5 lib: sbi: Add support for Smepmp
 e44ef6 lib: sbi: Add functions to map/unmap shared memory
 ad8660 lib: sbi: Map/Unmap debug console shared memory buffers
 eb10 lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
 e2111e libfdt: fix SPDX license identifiers
 e05a9cf lib: sbi: Update system suspend to spec
 e20d25 include: sbi: fix CSR define of mseccfg
 c5151 include: sbi_utils: Remove driver pointer from struct i2c_adapter
 a35b0 lib: utils/regmap: Add generic regmap access library
 e97275 lib: utils/regmap: Add simple FDT based regmap framework
 f21d8f7 lib: utils/regmap: Add simple FDT based syscon regmap driver
 a344a9 lib: utils/reset: Add syscon based reboot and poweroff
 c2e6027 lib: utils/reset: Remove SiFive Test reset driver
 f536e0b gitignore: allow gitignore to ignore most dot file
 c744ed7 lib: sbi_pmu: Enable noncontigous hpm event and counters
 b2e lib: utils/fdt: Fix fdt_parse_isa_extensions() implementation
 f46a564 lib: sbi: Fix typo for finding fixed event counter
 a8 fw_base.S: Fix assembler error with clang 16+
 c104c60 lib: sbi: Add support for smcntrpmf
 aabeee Makefile: Fix grep warning
 e7e73aa platform: generic: allwinner: correct mhpmevent count
 ee1f83c lib: sbi_pmu: remove mhpm_count field in hart feature
 a9cffd6 firmware: payload: test: Change to SBI v2.0 DBCN ecalls
 b20bd47 lib: sbi: improve the definition of SBI_IPI_EVENT_MAX
 f lib: sbi_pmu: ensure update hpm counter before starting counting
 c9a296d platform: generic: allwinner: fix OF process for T-HEAD c9xx pmu
 d3d7 lib: sbi_pmu: keep overflow interrupt of stopped hpm counter disabled
 cacfba3 platform: Allow platforms to specify the size of tlb fifo
 bd9694 lib: sbi: alloc tlb fifo by sbi_malloc
 e65d lib: sbi: Implement SET_FS_DIRTY() to make sure the mstatus FS dirty is set
 d1e4dff lib: sbi: Introduce HART index in sbi_scratch
 e6125c3 lib: sbi: Remove sbi_platform_hart_index/invalid() functions
 e70d lib: sbi: Extend sbi_hartmask to support both hartid and hartindex
 e632cd7 lib: sbi: Use sbi_scratch_last_hartindex() in remote TLB managment
 c667b lib: sbi: Prefer hartindex over hartid in IPI framework
 d6ff8 lib: sbi: Remove sbi_scratch_last_hartid() macro
 daa2 lib: sbi: Maximize the use of HART index in sbi_domain
 fb3 include: sbi: Remove sbi_hartmask_for_each_hart() macro
 b8fb96e include: sbi_domain: Fix permission test macros
 bff27c1 lib: sbi: Factor-out Smepmp configuration as separate function
 d31 lib: sbi: Don't clear mseccfg.MML bit in sbi_hart_smepmp_configure()
 b51a9d lib: sbi: Fix pmp_flags for Smepmp read-only shared region
 aea28 lib: sbi: Populate M-only Smepmp entries before setting mseccfg.MML
 e8bc162 lib: utils/serial: Add shared regions for serial drivers
 b7e9d34 lib: utils/regmap: Mark syscon region as shared read-write
 3669153 platform: generic: thead: fix stale TLB entries for th1520/sg2042
 de525ac firmware: Remove ALIGN in .rela.dyn in linker script
 a6d725 firmware: Remove handling of R_RISCV_{32,64}
 ed125a Makefile: Add --exclude-libs ALL to avoid .dynsym
 e21901d doc: Fix fw_payload.md
 a125423 lib: utils/serial: Ensure proper allocation of PMP entries for uart8250
 d36709f lib: utils: timer/ipi: Update memregion flags for PLMT and PLICSW
 c2f lib: sbi: fix sbi_domain_get_assigned_hartmask()
 da30f6 lib: utils/fdt: simplify dt_parse_isa_extensions
 aca2 lib: utils: Simplify SET_ISA_EXT_MAP()
 f831b93 lib: sbi_pmu: check for index overflows
 d891cae gpio/starfive: redundant readl() call
 e8114c6 docs: platform: update platform_requirements.md
 f2b lib: sbi: Add support for mconfigptr
 ec0559e lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP
 cbdd869 include: sbi: Change spec version to 2.0
 d0ed1b lib: sbi: simplify sanitize_domain()
 c1a6987 platform: generic: thead: move to thead c9xx header to vendor specific postion
 e941e7 platform: generic: thead: separate implement of T-HEAD c9xx pmu
 d9b1 platform: generic: thead: separate implement of T-HEAD c9xx errata
 e21b96 platform: generic: thead: initialize PMU by default in thead generic platform
 a140a4e lib: sbi: Correctly limit flushes to a single ASID/VMID
 ae718 platform: generic: thead: improve tlb flush errata
 fd64b platform: Uses hart count as the default size of tlb info
 f2ccd lib: utils/serial: Optimize semihosting_putc implementation
 fccdf41 firmware: fw_base.S: Fix boot hart status synchronization
 d1e0f7f utils/reset: Remove fdt_reset_thead
 d2c9 lib: utils/timer: Allow ACLINT MTIMER driver to setup quirks
 accafb1 lib: utils/timer: mtimer: add separate T-Head C9xx CLINT mtimer compatible
 bc25f lib: utils/ipi: mswi: add separate T-Head C9xx CLINT mswi compatible
 b2f55d lib: sbi: separate the swap operation of domain region
 b03cdd lib: sbi: Add regions merging when sanitizing domain region
 bfdb9e platform: generic: Add Sophgo sg2042 platform support
 f7ae include: sbi: macros for mseccfg.sseed and .useed
 efcac33 lib: sbi: Add Zkr in hart extensions
 e5b0cf lib: sbi: enable seed access in S-mode
 e11 lib: sbi: change sbi_hart_features.extensions as an array
 aaed4f lib: sbi: Make console_puts/console_putc interchangeable
 dc0bb19 lib: utils/serial: remove semihosting_putc
 bb930 lib: sbi: Fix PMP granularity handling in sbi_hart_map_saddr()
 b9c8 lib: sbi_pmu: avoid buffer overflow
 c lib: utils/irqchip: Avoid redundant writes to APLIC CLRIE register
 f520256 lib: sbi: Allow relaxed MMIO writes in device ipi_send() callback
 b70d628 lib: sbi: Allow relaxed MMIO writes in device ipi_clear() callback
 bd74931 lib: ipi: Adjust Andes PLICSW to single-bit-per-hart scheme
 f sbi: sbi_pmu: Improve sbi_pmu_init() error handling
 fa99 lib: sbi: Add XAndesPMU in hart extensions
 a48f2cf sbi: sbi_pmu: Add hw_counter_filter_mode() to pmu device
 ec60c platform: include: andes45: Add PMU related CSR defines
 effd89a platform: generic: Introduce pmu_init() platform override
 b9e743 platform: andes: Add Andes custom PMU support
 e50c24 platform: andes: Enable Andes PMU for AE350
 c661 platform: rzfive: Enable Andes PMU for RZ/Five
 b3262e lib: utils: fdt_fixup: Allow preserving PMU properties
 ae4e platform: andes: Factor out is_andes() helper
 f93 lib: utils: fdt_pmu: Make the fdt_pmu_evt_select table global variable
 e19d419 lib: utils: fdt_pmu: Do not iterate over the fdt_pmu_evt_select table
 d162009 docs: pmu: Add Andes PMU node example
 b9a849 lib: sbi: Remove xchg/cmpxchg implemented via lr/sc
 bf49b lib: sbi: Fix __atomic_op_bit_ord and comments
 8839869 lib: sbi: Replace __atomic_op_bit_ord with __atomic intrinsics
 ec lib: sbi: Prevent redundant sbi_ipi_process
 da66b lib: sbi_hart: Store PMP granularity as log base 2
 ee72517 lib: sbi_pmu: Add PMU snapshot definitions
 a0ba5 lib: sbi_pmu: Fix the counter info function
 0696810 firmware: fix section types
 a25fc74 lib: sbi_hsm: Put the resume_pending hart in the interruptible hart mask
 aa306 platform: recalculate heap size to support new tlb entry number
 a2e254e lib: sbi: skip wait_for_coldboot when coolboot done
 d58 lib: utils/fdt: Allow to use reg-names when parsing ACLINT
 cba92 lib: sbi_tlb: Check tlb_range_flush_limit only once per request
 a894187 lib: sbi_ipi: Do not ignore errors from sbi_ipi_send()
 fa65 lib: sbi_ipi: Process self-IPIs in sbi_ipi_send()
 2707250 lib: sbi_ipi: Drop unnecessary ipi_process check
 ce14 lib: sbi: Simplify the initialization of root_hmask in sbi_domain_init
 c8be56 lib: sbi: Improve the code of privilege mode and extensions detection
 fe6f lib: sbi: Refactor the code for enable extensions in menvfg CSR
 d lib: sbi: Using one array to define the name of extensions
 daac8f lib: sbi: Detect extensions from the ISA string in DT
 ceb3 lib: sbi_tlb: Reduce size of struct sbi_tlb_info
 b2 platform: generic: Fine tune fw_platform_calculate_heap_size()
 cdebae2 lib: utils/irqchip: Add shared MMIO region for PLIC in root domain
 bea lib: sbi: Allow ecall handlers to directly update register state
 a57e8c lib: sbi: Remove the SBI_ETRAP error code
 b80b92 lib: sbi: Do not enter OpenSBI with mseccfg.MML == 1
 e09ad lib: sbi: Fix shift bug in sbi_system_reset
 ba29293 lib: utils/timer: mtimer: only use regname for aclint
 bbd065d lib: sbi: Detect Zicntr extension only based on traps
 a2b255b include: Bump-up version to 1.4
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20240102151153.133896-1-bmeng@tinylab.org>
+Message-ID: <20250106054336.1878291-2-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 135376 -> 267416 bytes
+ target/riscv/cpu_cfg.h | 1 +
- .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 138368 -> 270808 bytes
+file changed, 1 insertion(+)
  roms/opensbi                                  |   2 +-
 files changed, 1 insertion(+), 1 deletion(-)
-diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
+--- a/target/riscv/cpu_cfg.h
-diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
++++ b/target/riscv/cpu_cfg.h
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
+     bool ext_ssaia;
-diff --git a/roms/opensbi b/roms/opensbi
+     bool ext_sscofpmf;
-index XXXXXXX..XXXXXXX 160000
+     bool ext_smepmp;
---- a/roms/opensbi
++    bool ext_smrnmi;
-+++ b/roms/opensbi
+     bool ext_ssnpm;
-@@ -1 +1 @@
+     bool ext_smnpm;
--Subproject commit 057eb10b6d523540012e6947d5c9f63e95244e94
+     bool ext_smmpm;
 +Subproject commit a2b255b88918715173942f2c5e1f97ac9e90c877
 --
-.43.0
+.48.1

-[PULL 48/65] target/riscv: add priv ver restriction to profiles
+[PULL v2 21/50] target/riscv: Add Smrnmi CSRs
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-Some profiles, like RVA22S64, has a priv_spec requirement.
+The Smrnmi extension adds the 'mnscratch', 'mnepc', 'mncause',
 'mnstatus' CSRs.
-Make this requirement explicit for all profiles. We'll validate this
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-requirement finalize() time and, in case the user chooses an
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 incompatible priv_spec while activating a profile, a warning will be
 shown.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-21-dbarboza@ventanamicro.com>
+Message-ID: <20250106054336.1878291-3-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  2 ++
+ target/riscv/cpu.h      |  7 ++++
- target/riscv/cpu.c         |  1 +
+ target/riscv/cpu_bits.h | 11 ++++++
- target/riscv/tcg/tcg-cpu.c | 31 +++++++++++++++++++++++++++++++
+ target/riscv/cpu.c      |  5 +++
-files changed, 34 insertions(+)
+ target/riscv/csr.c      | 82 +++++++++++++++++++++++++++++++++++++++++
 files changed, 105 insertions(+)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-     uint32_t misa_ext;
+     uint64_t kvm_timer_state;
-     bool enabled;
+     uint64_t kvm_timer_frequency;
-     bool user_set;
+ #endif /* CONFIG_KVM */
-+    int priv_spec;
++
-     const int32_t ext_offsets[];
++    /* RNMI */
- } RISCVCPUProfile;
++    target_ulong mnscratch;
++    target_ulong mnepc;
- #define RISCV_PROFILE_EXT_LIST_END -1
++    target_ulong mncause; /* mncause without bit XLEN-1 set to 1 */
-+#define RISCV_PROFILE_ATTR_UNUSED -1
++    target_ulong mnstatus;
++    target_ulong rnmip;
- extern RISCVCPUProfile *riscv_profiles[];
+ };
  /*
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define CSR_PMPADDR14       0x3be
  #define CSR_PMPADDR15       0x3bf
 +/* RNMI */
 +#define CSR_MNSCRATCH       0x740
 +#define CSR_MNEPC           0x741
 +#define CSR_MNCAUSE         0x742
 +#define CSR_MNSTATUS        0x744
 +
  /* Debug/Trace Registers (shared with Debug Mode) */
  #define CSR_TSELECT         0x7a0
  #define CSR_TDATA1          0x7a1
@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define SATP64_ASID         0x0FFFF00000000000ULL
  #define SATP64_PPN          0x00000FFFFFFFFFFFULL
 +/* RNMI mnstatus CSR mask */
 +#define MNSTATUS_NMIE       0x00000008
 +#define MNSTATUS_MNPV       0x00000080
 +#define MNSTATUS_MNPP       0x00001800
 +
  /* VM modes (satp.mode) privileged ISA 1.10 */
  #define VM_1_10_MBARE       0
  #define VM_1_10_SV32        1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
- static RISCVCPUProfile RVA22U64 = {
+         riscv_trigger_reset_hold(env);
      .name = "rva22u64",
      .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
 +    .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
      .ext_offsets = {
          CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
          CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
      }
- }
++    if (cpu->cfg.ext_smrnmi) {
-+static const char *cpu_priv_ver_to_str(int priv_ver)
++        env->rnmip = 0;
-+{
++        env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
 +    switch (priv_ver) {
 +    case PRIV_VERSION_1_10_0:
 +        return "v1.10.0";
 +    case PRIV_VERSION_1_11_0:
 +        return "v1.11.0";
 +    case PRIV_VERSION_1_12_0:
 +        return "v1.12.0";
 +    }
 +
-+    g_assert_not_reached();
+     if (kvm_enabled()) {
          kvm_riscv_reset_vcpu(cpu);
      }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException debug(CPURISCVState *env, int csrno)
      return RISCV_EXCP_ILLEGAL_INST;
  }
 +
 +static RISCVException rnmi(CPURISCVState *env, int csrno)
 +{
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    if (cpu->cfg.ext_smrnmi) {
 +        return RISCV_EXCP_NONE;
 +    }
 +
 +    return RISCV_EXCP_ILLEGAL_INST;
 +}
  #endif
  static RISCVException seed(CPURISCVState *env, int csrno)
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcontext(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +static RISCVException read_mnscratch(CPURISCVState *env, int csrno,
 +                                     target_ulong *val)
 +{
 +    *val = env->mnscratch;
 +    return RISCV_EXCP_NONE;
 +}
 +
- static void riscv_cpu_synchronize_from_tb(CPUState *cs,
++static int write_mnscratch(CPURISCVState *env, int csrno, target_ulong val)
-                                           const TranslationBlock *tb)
++{
- {
++    env->mnscratch = val;
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
++    return RISCV_EXCP_NONE;
- static void riscv_cpu_validate_profile(RISCVCPU *cpu,
++}
                                         RISCVCPUProfile *profile)
  {
 +    CPURISCVState *env = &cpu->env;
      const char *warn_msg = "Profile %s mandates disabled extension %s";
      bool send_warn = profile->user_set && profile->enabled;
      bool profile_impl = true;
      int i;
 +    if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
 +        profile->priv_spec != env->priv_ver) {
 +        profile_impl = false;
 +
-+        if (send_warn) {
++static int read_mnepc(CPURISCVState *env, int csrno, target_ulong *val)
-+            warn_report("Profile %s requires priv spec %s, "
++{
-+                        "but priv ver %s was set", profile->name,
++    *val = env->mnepc;
-+                        cpu_priv_ver_to_str(profile->priv_spec),
++    return RISCV_EXCP_NONE;
-+                        cpu_priv_ver_to_str(env->priv_ver));
++}
 +
 +static int write_mnepc(CPURISCVState *env, int csrno, target_ulong val)
 +{
 +    env->mnepc = val;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static int read_mncause(CPURISCVState *env, int csrno, target_ulong *val)
 +{
 +    *val = env->mncause;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static int write_mncause(CPURISCVState *env, int csrno, target_ulong val)
 +{
 +    env->mncause = val;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static int read_mnstatus(CPURISCVState *env, int csrno, target_ulong *val)
 +{
 +    *val = env->mnstatus;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static int write_mnstatus(CPURISCVState *env, int csrno, target_ulong val)
 +{
 +    target_ulong mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
 +
 +    if (riscv_has_ext(env, RVH)) {
 +        /* Flush tlb on mnstatus fields that affect VM. */
 +        if ((val ^ env->mnstatus) & MNSTATUS_MNPV) {
 +            tlb_flush(env_cpu(env));
 +        }
++
++        mask |= MNSTATUS_MNPV;
 +    }
 +
-     for (i = 0; misa_bits[i] != 0; i++) {
++    /* mnstatus.mnie can only be cleared by hardware. */
-         uint32_t bit = misa_bits[i];
++    env->mnstatus = (env->mnstatus & MNSTATUS_NMIE) | (val & mask);
++    return RISCV_EXCP_NONE;
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
++}
      profile->user_set = true;
      profile->enabled = value;
 +    if (profile->enabled) {
 +        cpu->env.priv_ver = profile->priv_spec;
 +    }
 +
-     for (i = 0; misa_bits[i] != 0; i++) {
+ #endif
-         uint32_t bit = misa_bits[i];
+ /* Crypto Extension */
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                          write_sstateen_1_3,
                          .min_priv_ver = PRIV_VERSION_1_12_0 },
 +    /* RNMI */
 +    [CSR_MNSCRATCH] = { "mnscratch", rnmi, read_mnscratch, write_mnscratch,
 +                        .min_priv_ver = PRIV_VERSION_1_12_0               },
 +    [CSR_MNEPC]     = { "mnepc",     rnmi, read_mnepc,     write_mnepc,
 +                        .min_priv_ver = PRIV_VERSION_1_12_0               },
 +    [CSR_MNCAUSE]   = { "mncause",   rnmi, read_mncause,   write_mncause,
 +                        .min_priv_ver = PRIV_VERSION_1_12_0               },
 +    [CSR_MNSTATUS]  = { "mnstatus",  rnmi, read_mnstatus,  write_mnstatus,
 +                        .min_priv_ver = PRIV_VERSION_1_12_0               },
 +
      /* Supervisor Trap Setup */
      [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
                           NULL,                read_sstatus_i128              },
 --
-.43.0
+.48.1

-[PULL 21/65] hw/pci-host/gpex: Define properties for MMIO ranges
+[PULL v2 22/50] target/riscv: Handle Smrnmi interrupt and exception
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-ACPI DSDT generator needs information like ECAM range, PIO range, 32-bit
+Because the RNMI interrupt trap handler address is implementation defined.
-and 64-bit PCI MMIO range etc related to the PCI host bridge. Instead of
+We add the 'rnmi-interrupt-vector' and 'rnmi-exception-vector' as the property
-making these values machine specific, create properties for the GPEX
+of the harts. It’s very easy for users to set the address based on their
-host bridge with default value 0. During initialization, the firmware
+expectation. This patch also adds the functionality to handle the RNMI signals.
-can initialize these properties with correct values for the platform.
-This basically allows DSDT generator code independent of the machine
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-specific memory map accesses.
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Suggested-by: Igor Mammedov <imammedo@redhat.com>
 Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231218150247.466427-11-sunilvl@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250106054336.1878291-4-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/pci-host/gpex.h | 28 ++++++++++++++++++++--------
+ include/hw/riscv/riscv_hart.h |  4 ++
- hw/pci-host/gpex-acpi.c    | 13 +++++++++++++
+ target/riscv/cpu.h            |  3 ++
- hw/pci-host/gpex.c         | 12 ++++++++++++
+ target/riscv/cpu_bits.h       | 12 +++++
-files changed, 45 insertions(+), 8 deletions(-)
+ hw/riscv/riscv_hart.c         | 41 ++++++++++++++++
+ target/riscv/cpu.c            | 11 +++++
-diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
+ target/riscv/cpu_helper.c     | 88 ++++++++++++++++++++++++++++++++---
-index XXXXXXX..XXXXXXX 100644
+files changed, 152 insertions(+), 7 deletions(-)
---- a/include/hw/pci-host/gpex.h
-+++ b/include/hw/pci-host/gpex.h
+diff --git a/include/hw/riscv/riscv_hart.h b/include/hw/riscv/riscv_hart.h
-@@ -XXX,XX +XXX,XX @@ struct GPEXRootState {
+index XXXXXXX..XXXXXXX 100644
-     /*< public >*/
+--- a/include/hw/riscv/riscv_hart.h
 +++ b/include/hw/riscv/riscv_hart.h
@@ -XXX,XX +XXX,XX @@ struct RISCVHartArrayState {
      uint32_t hartid_base;
      char *cpu_type;
      uint64_t resetvec;
 +    uint32_t num_rnmi_irqvec;
 +    uint64_t *rnmi_irqvec;
 +    uint32_t num_rnmi_excpvec;
 +    uint64_t *rnmi_excpvec;
      RISCVCPU *harts;
  };
-+struct GPEXConfig {
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-+    MemMapEntry ecam;
+index XXXXXXX..XXXXXXX 100644
-+    MemMapEntry mmio32;
+--- a/target/riscv/cpu.h
-+    MemMapEntry mmio64;
++++ b/target/riscv/cpu.h
-+    MemMapEntry pio;
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-+    int         irq;
+     target_ulong mncause; /* mncause without bit XLEN-1 set to 1 */
-+    PCIBus      *bus;
+     target_ulong mnstatus;
-+};
+     target_ulong rnmip;
-+
++    uint64_t rnmi_irqvec;
- struct GPEXHost {
++    uint64_t rnmi_excpvec;
      /*< private >*/
      PCIExpressHost parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GPEXHost {
      int irq_num[GPEX_NUM_IRQS];
      bool allow_unmapped_accesses;
 -};
 -struct GPEXConfig {
 -    MemMapEntry ecam;
 -    MemMapEntry mmio32;
 -    MemMapEntry mmio64;
 -    MemMapEntry pio;
 -    int         irq;
 -    PCIBus      *bus;
 +    struct GPEXConfig gpex_cfg;
  };
- int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
+ /*
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
- void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg);
+ int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
-+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq);
+ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
-+
+                               uint64_t value);
-+#define PCI_HOST_PIO_BASE               "x-pio-base"
++void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level);
-+#define PCI_HOST_PIO_SIZE               "x-pio-size"
+ void riscv_cpu_interrupt(CPURISCVState *env);
-+#define PCI_HOST_ECAM_BASE              "x-ecam-base"
+ #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
-+#define PCI_HOST_ECAM_SIZE              "x-ecam-size"
+ void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
-+#define PCI_HOST_BELOW_4G_MMIO_BASE     "x-below-4g-mmio-base"
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-+#define PCI_HOST_BELOW_4G_MMIO_SIZE     "x-below-4g-mmio-size"
+index XXXXXXX..XXXXXXX 100644
-+#define PCI_HOST_ABOVE_4G_MMIO_BASE     "x-above-4g-mmio-base"
+--- a/target/riscv/cpu_bits.h
-+#define PCI_HOST_ABOVE_4G_MMIO_SIZE     "x-above-4g-mmio-size"
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum {
- #endif /* HW_GPEX_H */
+ /* Default Reset Vector address */
-diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
+ #define DEFAULT_RSTVEC      0x1000
-index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex-acpi.c
++/* Default RNMI Interrupt Vector address */
-+++ b/hw/pci-host/gpex-acpi.c
++#define DEFAULT_RNMI_IRQVEC     0x0
-@@ -XXX,XX +XXX,XX @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
++
++/* Default RNMI Exception Vector address */
-     crs_range_set_free(&crs_range_set);
++#define DEFAULT_RNMI_EXCPVEC    0x0
 +
  /* Exception causes */
  typedef enum RISCVException {
      RISCV_EXCP_NONE = -1, /* sentinel value */
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  /* -1 is due to bit zero of hgeip and hgeie being ROZ. */
  #define IRQ_LOCAL_GUEST_MAX                (TARGET_LONG_BITS - 1)
 +/* RNMI causes */
 +#define RNMI_MAX                           16
 +
  /* mip masks */
  #define MIP_USIP                           (1 << IRQ_U_SOFT)
  #define MIP_SSIP                           (1 << IRQ_S_SOFT)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define MHPMEVENT_IDX_MASK                 0xFFFFF
  #define MHPMEVENT_SSCOF_RESVD              16
 +/* RISC-V-specific interrupt pending bits. */
 +#define CPU_INTERRUPT_RNMI                 CPU_INTERRUPT_TGT_EXT_0
 +
  /* JVT CSR bits */
  #define JVT_MODE                           0x3F
  #define JVT_BASE                           (~0x3F)
 diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv_hart.c
 +++ b/hw/riscv/riscv_hart.c
@@ -XXX,XX +XXX,XX @@
  #include "target/riscv/cpu.h"
  #include "hw/qdev-properties.h"
  #include "hw/riscv/riscv_hart.h"
 +#include "qemu/error-report.h"
  static const Property riscv_harts_props[] = {
      DEFINE_PROP_UINT32("num-harts", RISCVHartArrayState, num_harts, 1),
@@ -XXX,XX +XXX,XX @@ static const Property riscv_harts_props[] = {
      DEFINE_PROP_STRING("cpu-type", RISCVHartArrayState, cpu_type),
      DEFINE_PROP_UINT64("resetvec", RISCVHartArrayState, resetvec,
                         DEFAULT_RSTVEC),
 +
 +    /*
 +     * Smrnmi implementation-defined interrupt and exception trap handlers.
 +     *
 +     * When an RNMI interrupt is detected, the hart then enters M-mode and
 +     * jumps to the address defined by "rnmi-interrupt-vector".
 +     *
 +     * When the hart encounters an exception while executing in M-mode with
 +     * the mnstatus.NMIE bit clear, the hart then jumps to the address
 +     * defined by "rnmi-exception-vector".
 +     */
 +    DEFINE_PROP_ARRAY("rnmi-interrupt-vector", RISCVHartArrayState,
 +                      num_rnmi_irqvec, rnmi_irqvec, qdev_prop_uint64,
 +                      uint64_t),
 +    DEFINE_PROP_ARRAY("rnmi-exception-vector", RISCVHartArrayState,
 +                      num_rnmi_excpvec, rnmi_excpvec, qdev_prop_uint64,
 +                      uint64_t),
  };
  static void riscv_harts_cpu_reset(void *opaque)
@@ -XXX,XX +XXX,XX @@ static bool riscv_hart_realize(RISCVHartArrayState *s, int idx,
  {
      object_initialize_child(OBJECT(s), "harts[*]", &s->harts[idx], cpu_type);
      qdev_prop_set_uint64(DEVICE(&s->harts[idx]), "resetvec", s->resetvec);
 +
 +    if (s->harts[idx].cfg.ext_smrnmi) {
 +        if (idx < s->num_rnmi_irqvec) {
 +            qdev_prop_set_uint64(DEVICE(&s->harts[idx]),
 +                                 "rnmi-interrupt-vector", s->rnmi_irqvec[idx]);
 +        }
 +
 +        if (idx < s->num_rnmi_excpvec) {
 +            qdev_prop_set_uint64(DEVICE(&s->harts[idx]),
 +                                 "rnmi-exception-vector", s->rnmi_excpvec[idx]);
 +        }
 +    } else {
 +        if (s->num_rnmi_irqvec > 0) {
 +            warn_report_once("rnmi-interrupt-vector property is ignored "
 +                             "because Smrnmi extension is not enabled.");
 +        }
 +
 +        if (s->num_rnmi_excpvec > 0) {
 +            warn_report_once("rnmi-exception-vector property is ignored "
 +                             "because Smrnmi extension is not enabled.");
 +        }
 +    }
 +
      s->harts[idx].env.mhartid = s->hartid_base + idx;
      qemu_register_reset(riscv_harts_cpu_reset, &s->harts[idx]);
      return qdev_realize(DEVICE(&s->harts[idx]), NULL, errp);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
          g_assert_not_reached();
      }
  }
 +
-+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq)
++static void riscv_cpu_set_nmi(void *opaque, int irq, int level)
 +{
-+    bool ambig;
++    riscv_cpu_set_rnmi(RISCV_CPU(opaque), irq, level);
-+    Object *obj = object_resolve_path_type("", TYPE_GPEX_HOST, &ambig);
++}
-+
+ #endif /* CONFIG_USER_ONLY */
-+    if (!obj || ambig) {
  static bool riscv_cpu_is_dynamic(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_init(Object *obj)
  #ifndef CONFIG_USER_ONLY
      qdev_init_gpio_in(DEVICE(obj), riscv_cpu_set_irq,
                        IRQ_LOCAL_MAX + IRQ_LOCAL_GUEST_MAX);
 +    qdev_init_gpio_in_named(DEVICE(cpu), riscv_cpu_set_nmi,
 +                            "riscv.cpu.rnmi", RNMI_MAX);
  #endif /* CONFIG_USER_ONLY */
      general_user_opts = g_hash_table_new(g_str_hash, g_str_equal);
@@ -XXX,XX +XXX,XX @@ static const Property riscv_cpu_properties[] = {
  #ifndef CONFIG_USER_ONLY
      DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
 +    DEFINE_PROP_UINT64("rnmi-interrupt-vector", RISCVCPU, env.rnmi_irqvec,
 +                       DEFAULT_RNMI_IRQVEC),
 +    DEFINE_PROP_UINT64("rnmi-exception-vector", RISCVCPU, env.rnmi_excpvec,
 +                       DEFAULT_RNMI_EXCPVEC),
  #endif
      DEFINE_PROP_BOOL("short-isa-string", RISCVCPU, cfg.short_isa_string, false),
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
      uint64_t vsbits, irq_delegated;
      int virq;
 +    /* Priority: RNMI > Other interrupt. */
 +    if (riscv_cpu_cfg(env)->ext_smrnmi) {
 +        /* If mnstatus.NMIE == 0, all interrupts are disabled. */
 +        if (!get_field(env->mnstatus, MNSTATUS_NMIE)) {
 +            return RISCV_EXCP_NONE;
 +        }
 +
 +        if (env->rnmip) {
 +            return ctz64(env->rnmip); /* since non-zero */
 +        }
 +    }
 +
      /* Determine interrupt enable state of all privilege modes */
      if (env->virt_enabled) {
          mie = 1;
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
  bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  {
 -    if (interrupt_request & CPU_INTERRUPT_HARD) {
 +    uint32_t mask = CPU_INTERRUPT_HARD | CPU_INTERRUPT_RNMI;
 +
 +    if (interrupt_request & mask) {
          RISCVCPU *cpu = RISCV_CPU(cs);
          CPURISCVState *env = &cpu->env;
          int interruptno = riscv_cpu_local_irq_pending(env);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
      env->geilen = geilen;
  }
 +void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    CPUState *cs = CPU(cpu);
 +    bool release_lock = false;
 +
 +    if (!bql_locked()) {
 +        release_lock = true;
 +        bql_lock();
 +    }
 +
 +    if (level) {
 +        env->rnmip |= 1 << irq;
 +        cpu_interrupt(cs, CPU_INTERRUPT_RNMI);
 +    } else {
 +        env->rnmip &= ~(1 << irq);
 +        cpu_reset_interrupt(cs, CPU_INTERRUPT_RNMI);
 +    }
 +
 +    if (release_lock) {
 +        bql_unlock();
 +    }
 +}
 +
  int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
  {
      CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      bool write_gva = false;
      bool always_storeamo = (env->excp_uw2 & RISCV_UW2_ALWAYS_STORE_AMO);
      uint64_t s;
 +    int mode;
      /*
       * cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      target_ulong htval = 0;
      target_ulong mtval2 = 0;
      int sxlen = 0;
 -    int mxlen = 0;
 +    int mxlen = 16 << riscv_cpu_mxl(env);
 +    bool nnmi_excep = false;
 +
 +    if (cpu->cfg.ext_smrnmi && env->rnmip && async) {
 +        env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
 +        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV,
 +                                  env->virt_enabled);
 +        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPP,
 +                                  env->priv);
 +        env->mncause = cause | ((target_ulong)1U << (mxlen - 1));
 +        env->mnepc = env->pc;
 +        env->pc = env->rnmi_irqvec;
 +
 +        /* Trapping to M mode, virt is disabled */
 +        riscv_cpu_set_mode(env, PRV_M, false);
 +
 +        return;
 +    }
-+
-+    GPEX_HOST(obj)->gpex_cfg.irq = irq;
+     if (!async) {
-+    acpi_dsdt_add_gpex(scope, &GPEX_HOST(obj)->gpex_cfg);
+         /* set tval to badaddr for traps with address information */
-+}
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
+                   __func__, env->mhartid, async, cause, env->pc, tval,
-index XXXXXXX..XXXXXXX 100644
+                   riscv_cpu_get_trap_name(cause, async));
---- a/hw/pci-host/gpex.c
-+++ b/hw/pci-host/gpex.c
+-    if (env->priv <= PRV_S && cause < 64 &&
-@@ -XXX,XX +XXX,XX @@ static Property gpex_host_properties[] = {
+-        (((deleg >> cause) & 1) || s_injected || vs_injected)) {
-      */
++    mode = env->priv <= PRV_S && cause < 64 &&
-     DEFINE_PROP_BOOL("allow-unmapped-accesses", GPEXHost,
++        (((deleg >> cause) & 1) || s_injected || vs_injected) ? PRV_S : PRV_M;
-                      allow_unmapped_accesses, true),
++
-+    DEFINE_PROP_UINT64(PCI_HOST_ECAM_BASE, GPEXHost, gpex_cfg.ecam.base, 0),
++    if (mode == PRV_S) {
-+    DEFINE_PROP_SIZE(PCI_HOST_ECAM_SIZE, GPEXHost, gpex_cfg.ecam.size, 0),
+         /* handle the trap in S-mode */
-+    DEFINE_PROP_UINT64(PCI_HOST_PIO_BASE, GPEXHost, gpex_cfg.pio.base, 0),
+         /* save elp status */
-+    DEFINE_PROP_SIZE(PCI_HOST_PIO_SIZE, GPEXHost, gpex_cfg.pio.size, 0),
+         if (cpu_get_fcfien(env)) {
-+    DEFINE_PROP_UINT64(PCI_HOST_BELOW_4G_MMIO_BASE, GPEXHost,
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-+                       gpex_cfg.mmio32.base, 0),
+                   ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
-+    DEFINE_PROP_SIZE(PCI_HOST_BELOW_4G_MMIO_SIZE, GPEXHost,
+         riscv_cpu_set_mode(env, PRV_S, virt);
-+                     gpex_cfg.mmio32.size, 0),
+     } else {
-+    DEFINE_PROP_UINT64(PCI_HOST_ABOVE_4G_MMIO_BASE, GPEXHost,
++        /*
-+                       gpex_cfg.mmio64.base, 0),
++         * If the hart encounters an exception while executing in M-mode
-+    DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MMIO_SIZE, GPEXHost,
++         * with the mnstatus.NMIE bit clear, the exception is an RNMI exception.
-+                     gpex_cfg.mmio64.size, 0),
++         */
-     DEFINE_PROP_END_OF_LIST(),
++        nnmi_excep = cpu->cfg.ext_smrnmi &&
- };
++                     !get_field(env->mnstatus, MNSTATUS_NMIE) &&
 +                     !async;
 +
          /* handle the trap in M-mode */
          /* save elp status */
          if (cpu_get_fcfien(env)) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          s = set_field(s, MSTATUS_MPP, env->priv);
          s = set_field(s, MSTATUS_MIE, 0);
          env->mstatus = s;
 -        mxlen = 16 << riscv_cpu_mxl(env);
          env->mcause = cause | ((target_ulong)async << (mxlen - 1));
          env->mepc = env->pc;
          env->mtval = tval;
          env->mtval2 = mtval2;
          env->mtinst = tinst;
 -        env->pc = (env->mtvec >> 2 << 2) +
 -                  ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
 +
 +        /*
 +         * For RNMI exception, program counter is set to the RNMI exception
 +         * trap handler address.
 +         */
 +        if (nnmi_excep) {
 +            env->pc = env->rnmi_excpvec;
 +        } else {
 +            env->pc = (env->mtvec >> 2 << 2) +
 +                      ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
 +        }
          riscv_cpu_set_mode(env, PRV_M, virt);
      }
 --
-.43.0
+.48.1

-[PULL 38/65] target/riscv/tcg: add user flag for profile support
+[PULL v2 23/50] target/riscv: Add Smrnmi mnret instruction
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-The TCG emulation implements all the extensions described in the
+This patch adds a new instruction 'mnret'. 'mnret' is an M-mode-only
-RVA22U64 profile, both mandatory and optional. The mandatory extensions
+instruction that uses the values in `mnepc` and `mnstatus` to return to the
-will be enabled via the profile flag. We'll leave the optional
+program counter, privilege mode, and virtualization mode of the
-extensions to be enabled by hand.
+interrupted context.
-Given that this is the first profile we're implementing in TCG we'll
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-need some ground work first:
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 - all profiles declared in riscv_profiles[] will be exposed to users.
 TCG is the main accelerator we're considering when adding profile
 support in QEMU, so for now it's safe to assume that all profiles in
 riscv_profiles[] will be relevant to TCG;
 - we'll not support user profile settings for vendor CPUs. The flags
 will still be exposed but users won't be able to change them;
 - profile support, albeit available for all non-vendor CPUs, will be
 based on top of the new 'rv64i' CPU. Setting a profile to 'true' means
 enable all mandatory extensions of this profile, setting it to 'false'
 will disable all mandatory profile extensions of the CPU, which will
 obliterate preset defaults. This is not a problem for a bare CPU like
 rv64i but it can allow for silly scenarios when using other CPUs. E.g.
 an user can do "-cpu rv64,rva22u64=false" and have a bunch of default
 rv64 extensions disabled. The recommended way of using profiles is the
 rv64i CPU, but users are free to experiment.
 For now we'll handle multi-letter extensions only. MISA extensions need
 additional steps that we'll take care later. At this point we can boot a
 Linux buildroot using rva22u64 using the following options:
 -cpu rv64i,rva22u64=true,sv39=true,g=true,c=true,s=true
 Note that being an usermode/application profile we still need to
 explicitly set 's=true' to enable Supervisor mode to boot Linux.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-11-dbarboza@ventanamicro.com>
+Message-ID: <20250106054336.1878291-5-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 80 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/helper.h                         |  1 +
-file changed, 80 insertions(+)
+ target/riscv/insn32.decode                    |  3 ++
  target/riscv/op_helper.c                      | 45 ++++++++++++++++---
  .../riscv/insn_trans/trans_privileged.c.inc   | 20 +++++++++
 files changed, 64 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/helper.h
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
-     return false;
+ #ifndef CONFIG_USER_ONLY
  DEF_HELPER_1(sret, tl, env)
  DEF_HELPER_1(mret, tl, env)
 +DEF_HELPER_1(mnret, tl, env)
  DEF_HELPER_1(wfi, void, env)
  DEF_HELPER_1(wrs_nto, void, env)
  DEF_HELPER_1(tlb_flush, void, env)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ wfi         0001000    00101 00000 000 00000 1110011
  sfence_vma  0001001    ..... ..... 000 00000 1110011 @sfence_vma
  sfence_vm   0001000    00100 ..... 000 00000 1110011 @sfence_vm
 +# *** NMI ***
 +mnret       0111000    00010 00000 000 00000 1110011
 +
  # *** RV32I Base Instruction Set ***
  lui      ....................       ..... 0110111 @u
  {
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
      return retpc;
  }
-+static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
+-target_ulong helper_mret(CPURISCVState *env)
-+{
++static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
-+    switch (feat_offset) {
++                                  target_ulong prev_priv)
-+    case CPU_CFG_OFFSET(zic64b):
+ {
-+        cpu->cfg.cbom_blocksize = 64;
+     if (!(env->priv >= PRV_M)) {
-+        cpu->cfg.cbop_blocksize = 64;
+         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-+        cpu->cfg.cboz_blocksize = 64;
+     }
-+        break;
-+    default:
+-    target_ulong retpc = env->mepc;
-+        g_assert_not_reached();
+     if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) {
-+    }
+         riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
      }
 -    uint64_t mstatus = env->mstatus;
 -    target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
 -
      if (riscv_cpu_cfg(env)->pmp &&
          !pmp_get_num_rules(env) && (prev_priv != PRV_M)) {
          riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
      }
 +}
 +
- static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
++target_ulong helper_mret(CPURISCVState *env)
-                                         uint32_t ext_offset)
++{
- {
++    target_ulong retpc = env->mepc;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
++    uint64_t mstatus = env->mstatus;
-     }
++    target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
 +
 +    check_ret_from_m_mode(env, retpc, prev_priv);
      target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
                               (prev_priv != PRV_M);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
      return retpc;
  }
-+static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
++target_ulong helper_mnret(CPURISCVState *env)
 +                            void *opaque, Error **errp)
 +{
-+    RISCVCPUProfile *profile = opaque;
++    target_ulong retpc = env->mnepc;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    target_ulong prev_priv = get_field(env->mnstatus, MNSTATUS_MNPP);
-+    bool value;
++    target_ulong prev_virt;
 +    int i, ext_offset;
 +
-+    if (riscv_cpu_is_vendor(obj)) {
++    check_ret_from_m_mode(env, retpc, prev_priv);
-+        error_setg(errp, "Profile %s is not available for vendor CPUs",
++
-+                   profile->name);
++    prev_virt = get_field(env->mnstatus, MNSTATUS_MNPV) &&
-+        return;
++                (prev_priv != PRV_M);
 +    env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, true);
 +
 +    /*
 +     * If MNRET changes the privilege mode to a mode
 +     * less privileged than M, it also sets mstatus.MPRV to 0.
 +     */
 +    if (prev_priv < PRV_M) {
 +        env->mstatus = set_field(env->mstatus, MSTATUS_MPRV, false);
 +    }
 +
-+    if (cpu->env.misa_mxl != MXL_RV64) {
++    if (riscv_has_ext(env, RVH) && prev_virt) {
-+        error_setg(errp, "Profile %s only available for 64 bit CPUs",
++        riscv_cpu_swap_hypervisor_regs(env);
 +                   profile->name);
 +        return;
 +    }
 +
-+    if (!visit_type_bool(v, name, &value, errp)) {
++    riscv_cpu_set_mode(env, prev_priv, prev_virt);
 +        return;
 +    }
 +
-+    profile->user_set = true;
++    return retpc;
 +    profile->enabled = value;
 +
 +    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
 +        ext_offset = profile->ext_offsets[i];
 +
 +        if (profile->enabled) {
 +            if (cpu_cfg_offset_is_named_feat(ext_offset)) {
 +                riscv_cpu_enable_named_feat(cpu, ext_offset);
 +            }
 +
 +            cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
 +        }
 +
 +        g_hash_table_insert(multi_ext_user_opts,
 +                            GUINT_TO_POINTER(ext_offset),
 +                            (gpointer)profile->enabled);
 +        isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
 +    }
 +}
 +
-+static void cpu_get_profile(Object *obj, Visitor *v, const char *name,
+ void helper_wfi(CPURISCVState *env)
-+                            void *opaque, Error **errp)
+ {
      CPUState *cs = env_cpu(env);
 diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_privileged.c.inc
 +++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@
   * this program.  If not, see <http://www.gnu.org/licenses/>.
   */
 +#define REQUIRE_SMRNMI(ctx) do {     \
 +    if (!ctx->cfg_ptr->ext_smrnmi) { \
 +        return false;                \
 +    }                                \
 +} while (0)
 +
  static bool trans_ecall(DisasContext *ctx, arg_ecall *a)
  {
      /* always generates U-level ECALL, fixed in do_interrupt handler */
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
  #endif
  }
 +static bool trans_mnret(DisasContext *ctx, arg_mnret *a)
 +{
-+    RISCVCPUProfile *profile = opaque;
++#ifndef CONFIG_USER_ONLY
-+    bool value = profile->enabled;
++    REQUIRE_SMRNMI(ctx);
-+
++    decode_save_opc(ctx, 0);
-+    visit_type_bool(v, name, &value, errp);
++    gen_helper_mnret(cpu_pc, tcg_env);
 +    tcg_gen_exit_tb(NULL, 0); /* no chaining */
 +    ctx->base.is_jmp = DISAS_NORETURN;
 +    return true;
 +#else
 +    return false;
 +#endif
 +}
 +
-+static void riscv_cpu_add_profiles(Object *cpu_obj)
+ static bool trans_wfi(DisasContext *ctx, arg_wfi *a)
 +{
 +    for (int i = 0; riscv_profiles[i] != NULL; i++) {
 +        const RISCVCPUProfile *profile = riscv_profiles[i];
 +
 +        object_property_add(cpu_obj, profile->name, "bool",
 +                            cpu_get_profile, cpu_set_profile,
 +                            NULL, (void *)profile);
 +    }
 +}
 +
  static bool cpu_ext_is_deprecated(const char *ext_name)
  {
-     return isupper(ext_name[0]);
+ #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
      riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_deprecated_exts);
 +    riscv_cpu_add_profiles(obj);
 +
      for (Property *prop = riscv_cpu_options; prop && prop->name; prop++) {
          qdev_property_add_static(DEVICE(obj), prop);
      }
 --
-.43.0
+.48.1

-[PULL 46/65] target/riscv: add 'rva22u64' CPU
+[PULL v2 24/50] target/riscv: Add Smrnmi cpu extension
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-This CPU was suggested by Alistair [1] and others during the profile
+This adds the properties for ISA extension Smrnmi.
 design discussions. It consists of the bare 'rv64i' CPU with rva22u64
 enabled by default, like an alias of '-cpu rv64i,rva22u64=true'.
-Users now have an even easier way of consuming this user-mode profile by
+Also, when Smrnmi is present, the firmware (e.g., OpenSBI) must set
-doing '-cpu rva22u64'. Extensions can be enabled/disabled at will on top
+mnstatus.NMIE to 1 before enabling any interrupts. Otherwise, all
-of it.
+interrupts will be disabled. Since our current OpenSBI does not
 support Smrnmi yet, let's disable Smrnmi for the 'max' type CPU for
 now. We can re-enable it once OpenSBI includes proper support for it.
-We can boot Linux with this "user-mode" CPU by doing:
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 -cpu rva22u64,sv39=true,s=true,zifencei=true
 [1] https://lore.kernel.org/qemu-riscv/CAKmqyKP7xzZ9Sx=-Lbx2Ob0qCfB7Z+JO944FQ2TQ+49mqo0q_Q@mail.gmail.com/
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-19-dbarboza@ventanamicro.com>
+Message-ID: <20250106054336.1878291-6-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h     |  1 +
+ target/riscv/cpu.c         | 2 ++
- target/riscv/cpu.c         | 17 +++++++++++++++++
+ target/riscv/tcg/tcg-cpu.c | 9 +++++++++
- target/riscv/tcg/tcg-cpu.c |  9 +++++++++
+files changed, 11 insertions(+)
 files changed, 27 insertions(+)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
-+++ b/target/riscv/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
- #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
- #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
-+#define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
- #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
- #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
- #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     DEFINE_PROP_END_OF_LIST(),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
- };
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-+#if defined(TARGET_RISCV64)
++    ISA_EXT_DATA_ENTRY(smrnmi, PRIV_VERSION_1_12_0, ext_smrnmi),
-+static void rva22u64_profile_cpu_init(Object *obj)
+     ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
-+{
+     ISA_EXT_DATA_ENTRY(smnpm, PRIV_VERSION_1_13_0, ext_smnpm),
-+    rv64i_bare_cpu_init(obj);
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-+
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-+    RVA22U64.enabled = true;
-+}
+     MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
-+#endif
+     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
-+
++    MULTI_EXT_CFG_BOOL("smrnmi", ext_smrnmi, false),
- static const gchar *riscv_gdb_arch_name(CPUState *cs)
+     MULTI_EXT_CFG_BOOL("smmpm", ext_smmpm, false),
- {
+     MULTI_EXT_CFG_BOOL("smnpm", ext_smnpm, false),
-     RISCVCPU *cpu = RISCV_CPU(cs);
+     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
          .instance_init = initfn            \
      }
 +#define DEFINE_PROFILE_CPU(type_name, initfn) \
 +    {                                         \
 +        .name = type_name,                    \
 +        .parent = TYPE_RISCV_BARE_CPU,        \
 +        .instance_init = initfn               \
 +    }
 +
  static const TypeInfo riscv_cpu_type_infos[] = {
      {
          .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
      DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
      DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
 +    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
  #endif
  };
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_profiles(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
-         object_property_add(cpu_obj, profile->name, "bool",
+     if (env->misa_mxl != MXL_RV32) {
-                             cpu_get_profile, cpu_set_profile,
+         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_zcf), false);
-                             NULL, (void *)profile);
+     }
 +
-+        /*
++    /*
-+         * CPUs might enable a profile right from the start.
++     * ext_smrnmi requires OpenSBI changes that our current
-+         * Enable its mandatory extensions right away in this
++     * image does not have. Disable it for now.
-+         * case.
++     */
-+         */
++    if (cpu->cfg.ext_smrnmi) {
-+        if (profile->enabled) {
++        isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smrnmi), false);
-+            object_property_set_bool(cpu_obj, profile->name, true, NULL);
++        qemu_log("Smrnmi is disabled in the 'max' type CPU\n");
-+        }
++    }
      }
  }
+ static bool riscv_cpu_has_max_extensions(Object *cpu_obj)
 --
-.43.0
+.48.1

-[PULL 31/65] target/riscv/tcg: update priv_ver on user_set extensions
+[PULL v2 25/50] target/riscv: Add Zicfilp support for Smrnmi
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Frank Chang <frank.chang@sifive.com>
-We'll add a new bare CPU type that won't have any default priv_ver. This
+Zicfilp extension introduces the MNPELP (bit 9) in mnstatus.
-means that the CPU will default to priv_ver = 0, i.e. 1.10.0.
+The MNPELP field holds the previous ELP.
-At the same we'll allow these CPUs to enable extensions at will, but
+When a RNMI trap is delivered, the MNPELP is set to ELP and ELP set
-then, if the extension has a priv_ver newer than 1.10, we'll end up
+to NO_LP_EXPECTED. Upon a mnret, if the mnstatus.MNPP holds the
-disabling it. Users will then need to manually set priv_ver to something
+value y, then ELP is set to the value of MNPELP if yLPE is 1;
-other than 1.10 to enable the extensions they want, which is not ideal.
+otherwise, it is set to NO_LP_EXPECTED.
-Change the setter() of extensions to allow user enabled extensions to
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-bump the priv_ver of the CPU. This will make it convenient for users to
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 enable extensions for CPUs that doesn't set a default priv_ver.
 This change does not affect any existing CPU: vendor CPUs does not allow
 extensions to be enabled, and generic CPUs are already set to priv_ver
 LATEST.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-4-dbarboza@ventanamicro.com>
+Message-ID: <20250106054336.1878291-7-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++++++++++++++++
+ target/riscv/cpu_bits.h   |  1 +
-file changed, 32 insertions(+)
+ target/riscv/cpu_helper.c | 11 ++++++++++-
  target/riscv/op_helper.c  |  9 +++++++++
 files changed, 20 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-     g_assert_not_reached();
+ /* RNMI mnstatus CSR mask */
- }
+ #define MNSTATUS_NMIE       0x00000008
+ #define MNSTATUS_MNPV       0x00000080
-+static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
++#define MNSTATUS_MNPELP     0x00000200
-+                                        uint32_t ext_offset)
+ #define MNSTATUS_MNPP       0x00001800
-+{
-+    int ext_priv_ver;
+ /* VM modes (satp.mode) privileged ISA 1.10 */
-+
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-+    if (env->priv_ver == PRIV_VERSION_LATEST) {
+index XXXXXXX..XXXXXXX 100644
-+        return;
+--- a/target/riscv/cpu_helper.c
-+    }
++++ b/target/riscv/cpu_helper.c
-+
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-+    ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
+         env->mnepc = env->pc;
-+
+         env->pc = env->rnmi_irqvec;
-+    if (env->priv_ver < ext_priv_ver) {
-+        /*
++        if (cpu_get_fcfien(env)) {
-+         * Note: the 'priv_spec' command line option, if present,
++            env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, env->elp);
 +         * will take precedence over this priv_ver bump.
 +         */
 +        env->priv_ver = ext_priv_ver;
 +    }
 +}
 +
  static void cpu_cfg_ext_auto_update(RISCVCPU *cpu, uint32_t ext_offset,
                                      bool value)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
              return;
          }
 +        if (misa_bit == RVH && env->priv_ver < PRIV_VERSION_1_12_0) {
 +            /*
 +             * Note: the 'priv_spec' command line option, if present,
 +             * will take precedence over this priv_ver bump.
 +             */
 +            env->priv_ver = PRIV_VERSION_1_12_0;
 +        }
 +
-         env->misa_ext |= misa_bit;
+         /* Trapping to M mode, virt is disabled */
-         env->misa_ext_mask |= misa_bit;
+         riscv_cpu_set_mode(env, PRV_M, false);
-     } else {
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-         return;
+         /* handle the trap in M-mode */
-     }
+         /* save elp status */
+         if (cpu_get_fcfien(env)) {
-+    if (value) {
+-            env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, env->elp);
-+        cpu_bump_multi_ext_priv_ver(&cpu->env, multi_ext_cfg->offset);
++            if (nnmi_excep) {
 +                env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP,
 +                                          env->elp);
 +            } else {
 +                env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, env->elp);
 +            }
          }
          if (riscv_has_ext(env, RVH)) {
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
      riscv_cpu_set_mode(env, prev_priv, prev_virt);
 +    /*
 +     * If forward cfi enabled for new priv, restore elp status
 +     * and clear mnpelp in mnstatus
 +     */
 +    if (cpu_get_fcfien(env)) {
 +        env->elp = get_field(env->mnstatus, MNSTATUS_MNPELP);
 +    }
++    env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, 0);
 +
-     isa_ext_update_enabled(cpu, multi_ext_cfg->offset, value);
+     return retpc;
  }
 --
-.43.0
+.48.1

-[PULL 07/65] target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
+[PULL v2 26/50] target/riscv: Have kvm_riscv_get_timebase_frequency() take RISCVCPU cpu
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-KVM_REG_RISCV_FP_F regs have u32 size according to the API, but by using
+Keep kvm_riscv_get_timebase_frequency() prototype aligned with
-kvm_riscv_reg_id() in RISCV_FP_F_REG() we're returning u64 sizes when
+the other ones declared in "kvm_riscv.h", have it take a RISCVCPU
-running with TARGET_RISCV64. The most likely reason why no one noticed
+cpu as argument. Include "target/riscv/cpu-qom.h" which declares
-this is because we're not implementing kvm_cpu_synchronize_state() in
+the RISCVCPU typedef.
 RISC-V yet.
-Create a new helper that returns a KVM ID with u32 size and use it in
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-RISCV_FP_F_REG().
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250112231344.34632-2-philmd@linaro.org>
 Reported-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231208183835.2411523-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
+ target/riscv/kvm/kvm_riscv.h | 4 +++-
-file changed, 8 insertions(+), 3 deletions(-)
+ hw/riscv/virt.c              | 2 +-
  target/riscv/kvm/kvm-cpu.c   | 4 ++--
 files changed, 6 insertions(+), 4 deletions(-)
+diff --git a/target/riscv/kvm/kvm_riscv.h b/target/riscv/kvm/kvm_riscv.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm/kvm_riscv.h
++++ b/target/riscv/kvm/kvm_riscv.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef QEMU_KVM_RISCV_H
+ #define QEMU_KVM_RISCV_H
++#include "target/riscv/cpu-qom.h"
++
+ void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
+ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+ void riscv_kvm_aplic_request(void *opaque, int irq, int level);
+ int kvm_riscv_sync_mpstate_to_kvm(RISCVCPU *cpu, int state);
+ void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
+-uint64_t kvm_riscv_get_timebase_frequency(CPUState *cs);
++uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu);
+ #endif
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/virt.c
++++ b/hw/riscv/virt.c
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+     qemu_fdt_add_subnode(ms->fdt, "/cpus");
+     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "timebase-frequency",
+                           kvm_enabled() ?
+-                          kvm_riscv_get_timebase_frequency(first_cpu) :
++                          kvm_riscv_get_timebase_frequency(RISCV_CPU(first_cpu)) :
+                           RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
+     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
+     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-     return id;
+     env->kvm_timer_dirty = false;
  }
-+static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
+-uint64_t kvm_riscv_get_timebase_frequency(CPUState *cs)
-+{
++uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu)
-+    return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
+ {
-+}
+     uint64_t reg;
-+
- #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
+-    KVM_RISCV_GET_TIMER(cs, frequency, reg);
-                  KVM_REG_RISCV_CORE_REG(name))
++    KVM_RISCV_GET_TIMER(CPU(cpu), frequency, reg);
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+     return reg;
- #define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
+ }
                   KVM_REG_RISCV_TIMER_REG(name))
 -#define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
 +#define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
  #define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
      if (riscv_has_ext(env, RVF)) {
          uint32_t reg;
          for (i = 0; i < 32; i++) {
 -            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
 +            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(i), &reg);
              if (ret) {
                  return ret;
              }
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
          uint32_t reg;
          for (i = 0; i < 32; i++) {
              reg = env->fpr[i];
 -            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
 +            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(i), &reg);
              if (ret) {
                  return ret;
              }
 --
-.43.0
+.48.1

-[PULL 25/65] hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
+[PULL v2 27/50] hw/riscv/virt: Remove unnecessary use of &first_cpu
-From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The interrupts-extended property of PLIC only has 2 * hart number
+virt_machine_init() creates the HARTs vCPUs, then later
-fields when KVM enabled, copy 4 * hart number fields to fdt will
+virt_machine_done() calls create_fdt_sockets(), so the
-expose some uninitialized value.
+latter has access to the first vCPU via:
-In this patch, I also refactor the code about the setting of
+  RISCVVirtState {
-interrupts-extended property of PLIC for improved readability.
+    RISCVHartArrayState {
       RISCVCPU *harts;
       ...
-Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+    } soc[VIRT_SOCKETS_MAX];
-Reviewed-by: Jim Shu <jim.shu@sifive.com>
+    ...
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231218090543.22353-1-yongxuan.wang@sifive.com>
+  } s;
 Directly use that instead of the &first_cpu global.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250112231344.34632-3-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 47 +++++++++++++++++++++++++++--------------------
+ hw/riscv/virt.c | 2 +-
-file changed, 27 insertions(+), 20 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-         "sifive,plic-1.0.0", "riscv,plic0"
+     qemu_fdt_add_subnode(ms->fdt, "/cpus");
-     };
+     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "timebase-frequency",
+                           kvm_enabled() ?
--    if (kvm_enabled()) {
+-                          kvm_riscv_get_timebase_frequency(RISCV_CPU(first_cpu)) :
--        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
++                          kvm_riscv_get_timebase_frequency(&s->soc->harts[0]) :
--    } else {
+                           RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
--        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
--    }
+     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
 -
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 -        if (kvm_enabled()) {
 -            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 -        } else {
 -            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
 -            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
 -            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
 -        }
 -    }
 -
      plic_phandles[socket] = (*phandle)++;
      plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
      plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
                                    (char **)&plic_compat,
                                    ARRAY_SIZE(plic_compat));
      qemu_fdt_setprop(ms->fdt, plic_name, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
 -        plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 +
 +    if (kvm_enabled()) {
 +        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +
 +        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +        }
 +
 +        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
 +                         plic_cells,
 +                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +   } else {
 +        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 +
 +        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
 +            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
 +            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
 +        }
 +
 +        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
 +                         plic_cells,
 +                         s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 +    }
 +
      qemu_fdt_setprop_cells(ms->fdt, plic_name, "reg",
 x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
      qemu_fdt_setprop_cell(ms->fdt, plic_name, "riscv,ndev",
 --
-.43.0
+.48.1

-[PULL 33/65] target/riscv: add zicbop extension flag
+[PULL v2 28/50] target/riscv: Add properties for Indirect CSR Access extension
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Kaiwen Xue <kaiwenx@rivosinc.com>
-QEMU already implements zicbom (Cache Block Management Operations) and
+This adds the properties for sxcsrind. Definitions of new registers and
-zicboz (Cache Block Zero Operations). Commit 59cb29d6a5 ("target/riscv:
+implementations will come with future patches.
 add Zicbop cbo.prefetch{i, r, m} placeholder") added placeholders for
 what would be the instructions for zicbop (Cache Block Prefetch
 Operations), which are now no-ops.
-The RVA22U64 profile mandates zicbop, which means that applications that
+Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
-run with this profile might expect zicbop to be present in the riscv,isa
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-DT and might behave badly if it's absent.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
-Adding zicbop as an extension will make our future RVA22U64
+Message-ID: <20250110-counter_delegation-v5-1-e83d797ae294@rivosinc.com>
 implementation more in line with what userspace expects and, if/when
 cache block prefetch operations became relevant to QEMU, we already have
 the extension flag to turn then on/off as needed.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-6-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h | 2 ++
- hw/riscv/virt.c        | 5 +++++
+ target/riscv/cpu.c     | 2 ++
- target/riscv/cpu.c     | 3 +++
+files changed, 4 insertions(+)
 files changed, 10 insertions(+)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zicntr;
+     bool ext_smstateen;
-     bool ext_zicsr;
+     bool ext_sstc;
-     bool ext_zicbom;
+     bool ext_smcntrpmf;
-+    bool ext_zicbop;
++    bool ext_smcsrind;
-     bool ext_zicboz;
++    bool ext_sscsrind;
-     bool ext_zicond;
+     bool ext_svadu;
-     bool ext_zihintntl;
+     bool ext_svinval;
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_svnapot;
      uint16_t vlen;
      uint16_t elen;
      uint16_t cbom_blocksize;
 +    uint16_t cbop_blocksize;
      uint16_t cboz_blocksize;
      bool mmu;
      bool pmp;
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
                                    cpu_ptr->cfg.cboz_blocksize);
          }
 +        if (cpu_ptr->cfg.ext_zicbop) {
 +            qemu_fdt_setprop_cell(ms->fdt, cpu_name, "riscv,cbop-block-size",
 +                                  cpu_ptr->cfg.cbop_blocksize);
 +        }
 +
          qemu_fdt_setprop_string(ms->fdt, cpu_name, "compatible", "riscv");
          qemu_fdt_setprop_string(ms->fdt, cpu_name, "status", "okay");
          qemu_fdt_setprop_cell(ms->fdt, cpu_name, "reg",
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-  */
+     ISA_EXT_DATA_ENTRY(shvstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
- const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-     ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-+    ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
++    ISA_EXT_DATA_ENTRY(smcsrind, PRIV_VERSION_1_13_0, ext_smcsrind),
-     ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
+     ISA_EXT_DATA_ENTRY(smrnmi, PRIV_VERSION_1_12_0, ext_smrnmi),
-     ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr),
+     ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     MULTI_EXT_CFG_BOOL("zhinxmin", ext_zhinxmin, false),
+     ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, has_priv_1_11),
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-     MULTI_EXT_CFG_BOOL("zicbom", ext_zicbom, true),
+     ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
-+    MULTI_EXT_CFG_BOOL("zicbop", ext_zicbop, true),
++    ISA_EXT_DATA_ENTRY(sscsrind, PRIV_VERSION_1_12_0, ext_sscsrind),
-     MULTI_EXT_CFG_BOOL("zicboz", ext_zicboz, true),
+     ISA_EXT_DATA_ENTRY(ssnpm, PRIV_VERSION_1_13_0, ext_ssnpm),
+     ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
-     MULTI_EXT_CFG_BOOL("zmmul", ext_zmmul, false),
+     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
      DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
      DEFINE_PROP_UINT16("cbom_blocksize", RISCVCPU, cfg.cbom_blocksize, 64),
 +    DEFINE_PROP_UINT16("cbop_blocksize", RISCVCPU, cfg.cbop_blocksize, 64),
      DEFINE_PROP_UINT16("cboz_blocksize", RISCVCPU, cfg.cboz_blocksize, 64),
      DEFINE_PROP_END_OF_LIST(),
 --
-.43.0
+.48.1

-[PULL 63/65] target/riscv: Assert that the CSR numbers will be correct
+[PULL v2 29/50] target/riscv: Decouple AIA processing from xiselect and xireg
-From: Alistair Francis <alistair23@gmail.com>
+From: Kaiwen Xue <kaiwenx@rivosinc.com>
-The CSRs will always be between either CSR_MHPMCOUNTER3 and
+Since xiselect and xireg also will be of use in sxcsrind, AIA should
-CSR_MHPMCOUNTER31 or CSR_MHPMCOUNTER3H and CSR_MHPMCOUNTER31H.
+have its own separated interface when those CSRs are accessed.
-So although ctr_index can't be negative, Coverity doesn't know this and
+Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
-it isn't obvious to human readers either. Let's add an assert to ensure
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-that Coverity knows the values will be within range.
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Message-ID: <20250110-counter_delegation-v5-2-e83d797ae294@rivosinc.com>
 To simplify the code let's also change the RV32 adjustment.
 Fixes: Coverity CID 1523910
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20240108001328.280222-2-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 5 ++++-
+ target/riscv/csr.c | 165 ++++++++++++++++++++++++++++++++++++++-------
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 139 insertions(+), 26 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException mctr(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@
+ #include "system/cpu-timers.h"
-     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
+ #include "qemu/guest-random.h"
-         /* Offset for RV32 mhpmcounternh counters */
+ #include "qapi/error.h"
--        base_csrno += 0x80;
++#include <stdbool.h>
-+        csrno -= 0x80;
  /* CSR function table public API */
  void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_any32(CPURISCVState *env, int csrno)
      return any32(env, csrno);
  }
 +static RISCVException csrind_or_aia_any(CPURISCVState *env, int csrno)
 +{
 +    if (!riscv_cpu_cfg(env)->ext_smaia && !riscv_cpu_cfg(env)->ext_smcsrind) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return any(env, csrno);
 +}
 +
  static RISCVException smode(CPURISCVState *env, int csrno)
  {
      if (riscv_has_ext(env, RVS)) {
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_smode32(CPURISCVState *env, int csrno)
      return smode32(env, csrno);
  }
 +static bool csrind_extensions_present(CPURISCVState *env)
 +{
 +    return riscv_cpu_cfg(env)->ext_smcsrind || riscv_cpu_cfg(env)->ext_sscsrind;
 +}
 +
 +static bool aia_extensions_present(CPURISCVState *env)
 +{
 +    return riscv_cpu_cfg(env)->ext_smaia || riscv_cpu_cfg(env)->ext_ssaia;
 +}
 +
 +static bool csrind_or_aia_extensions_present(CPURISCVState *env)
 +{
 +    return csrind_extensions_present(env) || aia_extensions_present(env);
 +}
 +
 +static RISCVException csrind_or_aia_smode(CPURISCVState *env, int csrno)
 +{
 +    if (!csrind_or_aia_extensions_present(env)) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return smode(env, csrno);
 +}
 +
  static RISCVException hmode(CPURISCVState *env, int csrno)
  {
      if (riscv_has_ext(env, RVH)) {
@@ -XXX,XX +XXX,XX @@ static RISCVException hmode32(CPURISCVState *env, int csrno)
  }
 +static RISCVException csrind_or_aia_hmode(CPURISCVState *env, int csrno)
 +{
 +    if (!csrind_or_aia_extensions_present(env)) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return hmode(env, csrno);
 +}
 +
  static RISCVException umode(CPURISCVState *env, int csrno)
  {
      if (riscv_has_ext(env, RVU)) {
@@ -XXX,XX +XXX,XX @@ static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
      };
  }
 +static int csrind_xlate_vs_csrno(CPURISCVState *env, int csrno)
 +{
 +    if (!env->virt_enabled) {
 +        return csrno;
 +    }
 +
 +    switch (csrno) {
 +    case CSR_SISELECT:
 +        return CSR_VSISELECT;
 +    case CSR_SIREG:
 +        return CSR_VSIREG;
 +    default:
 +        return csrno;
 +    };
 +}
 +
  static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
                                     target_ulong *val, target_ulong new_val,
                                     target_ulong wr_mask)
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
      target_ulong *iselect;
      /* Translate CSR number for VS-mode */
 -    csrno = aia_xlate_vs_csrno(env, csrno);
 +    csrno = csrind_xlate_vs_csrno(env, csrno);
      /* Find the iselect CSR based on CSR number */
      switch (csrno) {
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +static bool xiselect_aia_range(target_ulong isel)
 +{
 +    return (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) ||
 +           (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST);
 +}
 +
  static int rmw_iprio(target_ulong xlen,
                       target_ulong iselect, uint8_t *iprio,
                       target_ulong *val, target_ulong new_val,
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
      return 0;
  }
 -static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
 -                                target_ulong *val, target_ulong new_val,
 -                                target_ulong wr_mask)
 +static RISCVException rmw_xireg_aia(CPURISCVState *env, int csrno,
 +                         target_ulong isel, target_ulong *val,
 +                         target_ulong new_val, target_ulong wr_mask)
  {
 -    bool virt, isel_reserved;
 -    uint8_t *iprio;
 +    bool virt = false, isel_reserved = false;
      int ret = -EINVAL;
 -    target_ulong priv, isel, vgein;
 -
 -    /* Translate CSR number for VS-mode */
 -    csrno = aia_xlate_vs_csrno(env, csrno);
 +    uint8_t *iprio;
 +    target_ulong priv, vgein;
 -    /* Decode register details from CSR number */
 -    virt = false;
 -    isel_reserved = false;
 +    /* VS-mode CSR number passed in has already been translated */
      switch (csrno) {
      case CSR_MIREG:
 +        if (!riscv_cpu_cfg(env)->ext_smaia) {
 +            goto done;
 +        }
          iprio = env->miprio;
 -        isel = env->miselect;
          priv = PRV_M;
          break;
      case CSR_SIREG:
 -        if (env->priv == PRV_S && env->mvien & MIP_SEIP &&
 +        if (!riscv_cpu_cfg(env)->ext_ssaia ||
 +            (env->priv == PRV_S && env->mvien & MIP_SEIP &&
              env->siselect >= ISELECT_IMSIC_EIDELIVERY &&
 -            env->siselect <= ISELECT_IMSIC_EIE63) {
 +            env->siselect <= ISELECT_IMSIC_EIE63)) {
              goto done;
          }
          iprio = env->siprio;
 -        isel = env->siselect;
          priv = PRV_S;
          break;
      case CSR_VSIREG:
 +        if (!riscv_cpu_cfg(env)->ext_ssaia) {
 +            goto done;
 +        }
          iprio = env->hviprio;
 -        isel = env->vsiselect;
          priv = PRV_S;
          virt = true;
          break;
      default:
 -         goto done;
 +        goto done;
      };
      /* Find the selected guest interrupt file */
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
      }
-+
-+    g_assert(csrno >= CSR_MHPMCOUNTER3 && csrno <= CSR_MHPMCOUNTER31);
+ done:
-+
++    /*
-     ctr_index = csrno - base_csrno;
++     * If AIA is not enabled, illegal instruction exception is always
-     if ((BIT(ctr_index) & pmu_avail_ctrs >> 3) == 0) {
++     * returned regardless of whether we are in VS-mode or not
-         /* The PMU is not enabled or counter is out of range */
++     */
      if (ret) {
          return (env->virt_enabled && virt && !isel_reserved) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
 +                                target_ulong *val, target_ulong new_val,
 +                                target_ulong wr_mask)
 +{
 +    bool virt = false;
 +    int ret = -EINVAL;
 +    target_ulong isel;
 +
 +    /* Translate CSR number for VS-mode */
 +    csrno = csrind_xlate_vs_csrno(env, csrno);
 +
 +    /* Decode register details from CSR number */
 +    switch (csrno) {
 +    case CSR_MIREG:
 +        isel = env->miselect;
 +        break;
 +    case CSR_SIREG:
 +        isel = env->siselect;
 +        break;
 +    case CSR_VSIREG:
 +        isel = env->vsiselect;
 +        virt = true;
 +        break;
 +    default:
 +         goto done;
 +    };
 +
 +    if (xiselect_aia_range(isel)) {
 +        return rmw_xireg_aia(env, csrno, isel, val, new_val, wr_mask);
 +    }
 +
 +done:
 +    if (ret) {
 +        return (env->virt_enabled && virt) ?
 +               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
 +    }
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
      /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
 -    [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
 -    [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
 +    [CSR_MISELECT] = { "miselect", csrind_or_aia_any,   NULL, NULL,
 +                       rmw_xiselect                                    },
 +    [CSR_MIREG]    = { "mireg",    csrind_or_aia_any,   NULL, NULL,
 +                       rmw_xireg                                       },
      /* Machine-Level Interrupts (AIA) */
      [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
      /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
 -    [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
 -    [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
 +    [CSR_SISELECT]   = { "siselect",   csrind_or_aia_smode, NULL, NULL,
 +                         rmw_xiselect                                       },
 +    [CSR_SIREG]      = { "sireg",      csrind_or_aia_smode, NULL, NULL,
 +                         rmw_xireg                                          },
      /* Supervisor-Level Interrupts (AIA) */
      [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      /*
       * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
       */
 -    [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
 -                          rmw_xiselect                                     },
 -    [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
 +    [CSR_VSISELECT]   = { "vsiselect",   csrind_or_aia_hmode, NULL, NULL,
 +                          rmw_xiselect                                      },
 +    [CSR_VSIREG]      = { "vsireg",      csrind_or_aia_hmode, NULL, NULL,
 +                          rmw_xireg                                         },
      /* VS-Level Interrupts (H-extension with AIA) */
      [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
 --
-.43.0
+.48.1

-[PULL 59/65] target/riscv/kvm: add RVV and Vector CSR regs
+[PULL v2 30/50] target/riscv: Enable S*stateen bits for AIA
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Atish Patra <atishp@rivosinc.com>
-Add support for RVV and Vector CSR KVM regs vstart, vl and vtype.
+As per the ratified AIA spec v1.0, three stateen bits control AIA CSR
 access.
-Support for vregs[] requires KVM side changes and an extra reg (vlenb)
+Bit 60 controls the indirect CSRs
-and will be added later.
+Bit 59 controls the most AIA CSR state
 Bit 58 controls the IMSIC state such as stopei and vstopei
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Enable the corresponding bits in [m|h]stateen and enable corresponding
 checks in the CSR accessor functions.
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-5-dbarboza@ventanamicro.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-3-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 74 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/csr.c | 85 +++++++++++++++++++++++++++++++++++++++++++++-
-file changed, 74 insertions(+)
+file changed, 84 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/target/riscv/csr.c
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
+@@ -XXX,XX +XXX,XX @@ static RISCVException smode32(CPURISCVState *env, int csrno)
- #define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
+ static RISCVException aia_smode(CPURISCVState *env, int csrno)
+ {
-+#define RISCV_VECTOR_CSR_REG(env, name) \
++    int ret;
 +    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_VECTOR, \
 +                           KVM_REG_RISCV_VECTOR_CSR_REG(name))
 +
- #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
+     if (!riscv_cpu_cfg(env)->ext_ssaia) {
-     do { \
+         return RISCV_EXCP_ILLEGAL_INST;
-         int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
+     }
-@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_misa_ext_cfgs[] = {
-     KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
++    if (csrno == CSR_STOPEI) {
-     KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
++        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_IMSIC);
-     KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
++    } else {
-+    KVM_MISA_CFG(RVV, KVM_RISCV_ISA_EXT_V),
++        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
  };
  static void kvm_cpu_get_misa_ext_cfg(Object *obj, Visitor *v,
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
      env->kvm_timer_dirty = false;
  }
 +static int kvm_riscv_get_regs_vector(CPUState *cs)
 +{
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +    target_ulong reg;
 +    int ret = 0;
 +
 +    if (!riscv_has_ext(env, RVV)) {
 +        return 0;
 +    }
 +
-+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
++    if (ret != RISCV_EXCP_NONE) {
 +    if (ret) {
 +        return ret;
 +    }
 +    env->vstart = reg;
 +
 +    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +    env->vl = reg;
 +
 +    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +    env->vtype = reg;
 +
 +    return 0;
 +}
 +
 +static int kvm_riscv_put_regs_vector(CPUState *cs)
 +{
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +    target_ulong reg;
 +    int ret = 0;
 +
 +    if (!riscv_has_ext(env, RVV)) {
 +        return 0;
 +    }
 +
 +    reg = env->vstart;
 +    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +
-+    reg = env->vl;
+     return smode(env, csrno);
-+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+ }
-+    if (ret) {
  static RISCVException aia_smode32(CPURISCVState *env, int csrno)
  {
 +    int ret;
 +
      if (!riscv_cpu_cfg(env)->ext_ssaia) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
-+    reg = env->vtype;
++    if (ret != RISCV_EXCP_NONE) {
 +    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
 +
 +    return ret;
 +}
 +
  typedef struct KVMScratchCPU {
      int kvmfd;
      int vmfd;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          return ret;
      }
 +    ret = kvm_riscv_get_regs_vector(cs);
 +    if (ret) {
 +        return ret;
 +    }
 +
-     return ret;
+     return smode32(env, csrno);
  }
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
+@@ -XXX,XX +XXX,XX @@ static RISCVException hgatp(CPURISCVState *env, int csrno)
-         return ret;
-     }
+ static RISCVException aia_hmode(CPURISCVState *env, int csrno)
+ {
-+    ret = kvm_riscv_put_regs_vector(cs);
++    int ret;
-+    if (ret) {
++
      if (!riscv_cpu_cfg(env)->ext_ssaia) {
          return RISCV_EXCP_ILLEGAL_INST;
       }
 -     return hmode(env, csrno);
 +    if (csrno == CSR_VSTOPEI) {
 +        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_IMSIC);
 +    } else {
 +        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
 +    }
 +
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
-     if (KVM_PUT_RESET_STATE == level) {
++    return hmode(env, csrno);
-         RISCVCPU *cpu = RISCV_CPU(cs);
+ }
-         if (cs->cpu_index == 0) {
  static RISCVException aia_hmode32(CPURISCVState *env, int csrno)
  {
 +    int ret;
 +
 +    if (!riscv_cpu_cfg(env)->ext_ssaia) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +     }
 +
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
      if (!riscv_cpu_cfg(env)->ext_ssaia) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
                                     target_ulong wr_mask)
  {
      target_ulong *iselect;
 +    int ret;
 +
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
      /* Translate CSR number for VS-mode */
      csrno = csrind_xlate_vs_csrno(env, csrno);
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
      int ret = -EINVAL;
      target_ulong isel;
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
      /* Translate CSR number for VS-mode */
      csrno = csrind_xlate_vs_csrno(env, csrno);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
          wr_mask |= SMSTATEEN0_P1P13;
      }
 +    if (riscv_cpu_cfg(env)->ext_smaia) {
 +        wr_mask |= SMSTATEEN0_SVSLCT;
 +    }
 +
 +    /*
 +     * As per the AIA specification, SMSTATEEN0_IMSIC is valid only if IMSIC is
 +     * implemented. However, that information is with MachineState and we can't
 +     * figure that out in csr.c. Just enable if Smaia is available.
 +     */
 +    if (riscv_cpu_cfg(env)->ext_smaia) {
 +        wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
 +    }
 +
      return write_mstateen(env, csrno, wr_mask, new_val);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
          wr_mask |= SMSTATEEN0_FCSR;
      }
 +    if (riscv_cpu_cfg(env)->ext_ssaia) {
 +        wr_mask |= SMSTATEEN0_SVSLCT;
 +    }
 +
 +    /*
 +     * As per the AIA specification, SMSTATEEN0_IMSIC is valid only if IMSIC is
 +     * implemented. However, that information is with MachineState and we can't
 +     * figure that out in csr.c. Just enable if Ssaia is available.
 +     */
 +    if (riscv_cpu_cfg(env)->ext_ssaia) {
 +        wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
 +    }
 +
      return write_hstateen(env, csrno, wr_mask, new_val);
  }
 --
-.43.0
+.48.1

-[PULL 22/65] hw/riscv/virt: Update GPEX MMIO related properties
+[PULL v2 31/50] target/riscv: Support generic CSR indirect access
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Kaiwen Xue <kaiwenx@rivosinc.com>
-Update the GPEX host bridge properties related to MMIO ranges with
+This adds the indirect access registers required by sscsrind/smcsrind
-values set for the virt machine.
+and the operations on them. Note that xiselect and xireg are used for
 both AIA and sxcsrind, and the behavior of accessing them depends on
 whether each extension is enabled and the value stored in xiselect.
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
+Co-developed-by: Atish Patra <atishp@rivosinc.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218150247.466427-12-sunilvl@ventanamicro.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-4-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  1 +
+ target/riscv/cpu_bits.h |  28 +++++++-
- hw/riscv/virt.c         | 47 ++++++++++++++++++++++++++++-------------
+ target/riscv/csr.c      | 144 ++++++++++++++++++++++++++++++++++++++--
-files changed, 33 insertions(+), 15 deletions(-)
+files changed, 166 insertions(+), 6 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/target/riscv/cpu_bits.h
-+++ b/include/hw/riscv/virt.h
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
+@@ -XXX,XX +XXX,XX @@
-     char *oem_table_id;
+ #define CSR_MISELECT        0x350
-     OnOffAuto acpi;
+ #define CSR_MIREG           0x351
-     const MemMapEntry *memmap;
-+    struct GPEXHost *gpex_host;
++/* Machine Indirect Register Alias */
- };
++#define CSR_MIREG2          0x352
++#define CSR_MIREG3          0x353
- enum {
++#define CSR_MIREG4          0x355
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
++#define CSR_MIREG5          0x356
 +#define CSR_MIREG6          0x357
 +
  /* Machine-Level Interrupts (AIA) */
  #define CSR_MTOPEI          0x35c
  #define CSR_MTOPI           0xfb0
@@ -XXX,XX +XXX,XX @@
  #define CSR_SISELECT        0x150
  #define CSR_SIREG           0x151
 +/* Supervisor Indirect Register Alias */
 +#define CSR_SIREG2          0x152
 +#define CSR_SIREG3          0x153
 +#define CSR_SIREG4          0x155
 +#define CSR_SIREG5          0x156
 +#define CSR_SIREG6          0x157
 +
  /* Supervisor-Level Interrupts (AIA) */
  #define CSR_STOPEI          0x15c
  #define CSR_STOPI           0xdb0
@@ -XXX,XX +XXX,XX @@
  #define CSR_VSISELECT       0x250
  #define CSR_VSIREG          0x251
 +/* Virtual Supervisor Indirect Alias */
 +#define CSR_VSIREG2         0x252
 +#define CSR_VSIREG3         0x253
 +#define CSR_VSIREG4         0x255
 +#define CSR_VSIREG5         0x256
 +#define CSR_VSIREG6         0x257
 +
  /* VS-Level Interrupts (H-extension with AIA) */
  #define CSR_VSTOPEI         0x25c
  #define CSR_VSTOPI          0xeb0
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define ISELECT_IMSIC_EIE63                0xff
  #define ISELECT_IMSIC_FIRST                ISELECT_IMSIC_EIDELIVERY
  #define ISELECT_IMSIC_LAST                 ISELECT_IMSIC_EIE63
 -#define ISELECT_MASK                       0x1ff
 +#define ISELECT_MASK_AIA                   0x1ff
 +
 +/* MISELECT, SISELECT, and VSISELECT bits (AIA) */
 +#define ISELECT_MASK_SXCSRIND              0xfff
  /* Dummy [M|S|VS]ISELECT value for emulating [M|S|VS]TOPEI CSRs */
 -#define ISELECT_IMSIC_TOPEI                (ISELECT_MASK + 1)
 +#define ISELECT_IMSIC_TOPEI                (ISELECT_MASK_AIA + 1)
  /* IMSIC bits (AIA) */
  #define IMSIC_TOPEI_IID_SHIFT              16
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/csr.c
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
+@@ -XXX,XX +XXX,XX @@ static RISCVException aia_any32(CPURISCVState *env, int csrno)
      return any32(env, csrno);
  }
- static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
++static RISCVException csrind_any(CPURISCVState *env, int csrno)
--                                          hwaddr ecam_base, hwaddr ecam_size,
++{
--                                          hwaddr mmio_base, hwaddr mmio_size,
++    if (!riscv_cpu_cfg(env)->ext_smcsrind) {
--                                          hwaddr high_mmio_base,
++        return RISCV_EXCP_ILLEGAL_INST;
--                                          hwaddr high_mmio_size,
++    }
--                                          hwaddr pio_base,
++
--                                          DeviceState *irqchip)
++    return RISCV_EXCP_NONE;
-+                                          DeviceState *irqchip,
++}
-+                                          RISCVVirtState *s)
++
  static RISCVException csrind_or_aia_any(CPURISCVState *env, int csrno)
  {
-     DeviceState *dev;
+     if (!riscv_cpu_cfg(env)->ext_smaia && !riscv_cpu_cfg(env)->ext_smcsrind) {
-     MemoryRegion *ecam_alias, *ecam_reg;
+@@ -XXX,XX +XXX,XX @@ static bool csrind_or_aia_extensions_present(CPURISCVState *env)
-     MemoryRegion *mmio_alias, *high_mmio_alias, *mmio_reg;
+     return csrind_extensions_present(env) || aia_extensions_present(env);
 +    hwaddr ecam_base = s->memmap[VIRT_PCIE_ECAM].base;
 +    hwaddr ecam_size = s->memmap[VIRT_PCIE_ECAM].size;
 +    hwaddr mmio_base = s->memmap[VIRT_PCIE_MMIO].base;
 +    hwaddr mmio_size = s->memmap[VIRT_PCIE_MMIO].size;
 +    hwaddr high_mmio_base = virt_high_pcie_memmap.base;
 +    hwaddr high_mmio_size = virt_high_pcie_memmap.size;
 +    hwaddr pio_base = s->memmap[VIRT_PCIE_PIO].base;
 +    hwaddr pio_size = s->memmap[VIRT_PCIE_PIO].size;
      qemu_irq irq;
      int i;
      dev = qdev_new(TYPE_GPEX_HOST);
 +    /* Set GPEX object properties for the virt machine */
 +    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_BASE,
 +                            ecam_base, NULL);
 +    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_SIZE,
 +                            ecam_size, NULL);
 +    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
 +                             PCI_HOST_BELOW_4G_MMIO_BASE,
 +                             mmio_base, NULL);
 +    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_BELOW_4G_MMIO_SIZE,
 +                            mmio_size, NULL);
 +    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
 +                             PCI_HOST_ABOVE_4G_MMIO_BASE,
 +                             high_mmio_base, NULL);
 +    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ABOVE_4G_MMIO_SIZE,
 +                            high_mmio_size, NULL);
 +    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_BASE,
 +                            pio_base, NULL);
 +    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_SIZE,
 +                            pio_size, NULL);
 +
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      ecam_alias = g_new0(MemoryRegion, 1);
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
          gpex_set_irq_num(GPEX_HOST(dev), i, PCIE_IRQ + i);
      }
 +    GPEX_HOST(dev)->gpex_cfg.bus = PCI_HOST_BRIDGE(GPEX_HOST(dev))->bus;
      return dev;
  }
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
++static RISCVException csrind_smode(CPURISCVState *env, int csrno)
-             qdev_get_gpio_in(virtio_irqchip, VIRTIO_IRQ + i));
++{
-     }
++    if (!csrind_extensions_present(env)) {
++        return RISCV_EXCP_ILLEGAL_INST;
--    gpex_pcie_init(system_memory,
++    }
--                   memmap[VIRT_PCIE_ECAM].base,
++
--                   memmap[VIRT_PCIE_ECAM].size,
++    return smode(env, csrno);
--                   memmap[VIRT_PCIE_MMIO].base,
++}
--                   memmap[VIRT_PCIE_MMIO].size,
++
--                   virt_high_pcie_memmap.base,
+ static RISCVException csrind_or_aia_smode(CPURISCVState *env, int csrno)
--                   virt_high_pcie_memmap.size,
+ {
--                   memmap[VIRT_PCIE_PIO].base,
+     if (!csrind_or_aia_extensions_present(env)) {
--                   pcie_irqchip);
+@@ -XXX,XX +XXX,XX @@ static RISCVException hmode32(CPURISCVState *env, int csrno)
-+    gpex_pcie_init(system_memory, pcie_irqchip, s);
+ }
-     create_platform_bus(s, mmio_irqchip);
++static RISCVException csrind_hmode(CPURISCVState *env, int csrno)
 +{
 +    if (!csrind_extensions_present(env)) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return hmode(env, csrno);
 +}
 +
  static RISCVException csrind_or_aia_hmode(CPURISCVState *env, int csrno)
  {
      if (!csrind_or_aia_extensions_present(env)) {
@@ -XXX,XX +XXX,XX @@ static int csrind_xlate_vs_csrno(CPURISCVState *env, int csrno)
      case CSR_SISELECT:
          return CSR_VSISELECT;
      case CSR_SIREG:
 -        return CSR_VSIREG;
 +    case CSR_SIREG2:
 +    case CSR_SIREG3:
 +    case CSR_SIREG4:
 +    case CSR_SIREG5:
 +    case CSR_SIREG6:
 +        return CSR_VSIREG + (csrno - CSR_SIREG);
      default:
          return csrno;
      };
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
          *val = *iselect;
      }
 -    wr_mask &= ISELECT_MASK;
 +    if (riscv_cpu_cfg(env)->ext_smcsrind || riscv_cpu_cfg(env)->ext_sscsrind) {
 +        wr_mask &= ISELECT_MASK_SXCSRIND;
 +    } else {
 +        wr_mask &= ISELECT_MASK_AIA;
 +    }
 +
      if (wr_mask) {
          *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
      }
@@ -XXX,XX +XXX,XX @@ done:
      return RISCV_EXCP_NONE;
  }
 +/*
 + * rmw_xireg_csrind: Perform indirect access to xireg and xireg2-xireg6
 + *
 + * Perform indirect access to xireg and xireg2-xireg6.
 + * This is a generic interface for all xireg CSRs. Apart from AIA, all other
 + * extension using csrind should be implemented here.
 + */
 +static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
 +                              target_ulong isel, target_ulong *val,
 +                              target_ulong new_val, target_ulong wr_mask)
 +{
 +    return -EINVAL;
 +}
 +
 +static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
 +                      target_ulong new_val, target_ulong wr_mask)
 +{
 +    bool virt = false;
 +    int ret = -EINVAL;
 +    target_ulong isel;
 +
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
 +    /* Translate CSR number for VS-mode */
 +    csrno = csrind_xlate_vs_csrno(env, csrno);
 +
 +    if (CSR_MIREG <= csrno && csrno <= CSR_MIREG6 &&
 +        csrno != CSR_MIREG4 - 1) {
 +        isel = env->miselect;
 +    } else if (CSR_SIREG <= csrno && csrno <= CSR_SIREG6 &&
 +               csrno != CSR_SIREG4 - 1) {
 +        isel = env->siselect;
 +    } else if (CSR_VSIREG <= csrno && csrno <= CSR_VSIREG6 &&
 +               csrno != CSR_VSIREG4 - 1) {
 +        isel = env->vsiselect;
 +        virt = true;
 +    } else {
 +        goto done;
 +    }
 +
 +    return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
 +
 +done:
 +    return (env->virt_enabled && virt) ?
 +            RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
 +}
 +
  static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
                                  target_ulong *val, target_ulong new_val,
                                  target_ulong wr_mask)
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
           goto done;
      };
 +    /*
 +     * Use the xiselect range to determine actual op on xireg.
 +     *
 +     * Since we only checked the existence of AIA or Indirect Access in the
 +     * predicate, we should check the existence of the exact extension when
 +     * we get to a specific range and return illegal instruction exception even
 +     * in VS-mode.
 +     */
      if (xiselect_aia_range(isel)) {
          return rmw_xireg_aia(env, csrno, isel, val, new_val, wr_mask);
 +    } else if (riscv_cpu_cfg(env)->ext_smcsrind ||
 +               riscv_cpu_cfg(env)->ext_sscsrind) {
 +        return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
 +    } else {
 +        return RISCV_EXCP_ILLEGAL_INST;
      }
  done:
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
          wr_mask |= SMSTATEEN0_P1P13;
      }
 -    if (riscv_cpu_cfg(env)->ext_smaia) {
 +    if (riscv_cpu_cfg(env)->ext_smaia || riscv_cpu_cfg(env)->ext_smcsrind) {
          wr_mask |= SMSTATEEN0_SVSLCT;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
          wr_mask |= SMSTATEEN0_FCSR;
      }
 -    if (riscv_cpu_cfg(env)->ext_ssaia) {
 +    if (riscv_cpu_cfg(env)->ext_ssaia || riscv_cpu_cfg(env)->ext_sscsrind) {
          wr_mask |= SMSTATEEN0_SVSLCT;
      }
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MIREG]    = { "mireg",    csrind_or_aia_any,   NULL, NULL,
                         rmw_xireg                                       },
 +    /* Machine Indirect Register Alias */
 +    [CSR_MIREG2]   = { "mireg2", csrind_any, NULL, NULL, rmw_xiregi,
 +                       .min_priv_ver = PRIV_VERSION_1_12_0          },
 +    [CSR_MIREG3]   = { "mireg3", csrind_any, NULL, NULL, rmw_xiregi,
 +                       .min_priv_ver = PRIV_VERSION_1_12_0          },
 +    [CSR_MIREG4]   = { "mireg4", csrind_any, NULL, NULL, rmw_xiregi,
 +                       .min_priv_ver = PRIV_VERSION_1_12_0          },
 +    [CSR_MIREG5]   = { "mireg5", csrind_any, NULL, NULL, rmw_xiregi,
 +                       .min_priv_ver = PRIV_VERSION_1_12_0          },
 +    [CSR_MIREG6]   = { "mireg6", csrind_any, NULL, NULL, rmw_xiregi,
 +                       .min_priv_ver = PRIV_VERSION_1_12_0          },
 +
      /* Machine-Level Interrupts (AIA) */
      [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
      [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_SIREG]      = { "sireg",      csrind_or_aia_smode, NULL, NULL,
                           rmw_xireg                                          },
 +    /* Supervisor Indirect Register Alias */
 +    [CSR_SIREG2]      = { "sireg2", csrind_smode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_SIREG3]      = { "sireg3", csrind_smode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_SIREG4]      = { "sireg4", csrind_smode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_SIREG5]      = { "sireg5", csrind_smode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_SIREG6]      = { "sireg6", csrind_smode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +
      /* Supervisor-Level Interrupts (AIA) */
      [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
      [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_VSIREG]      = { "vsireg",      csrind_or_aia_hmode, NULL, NULL,
                            rmw_xireg                                         },
 +    /* Virtual Supervisor Indirect Alias */
 +    [CSR_VSIREG2]     = { "vsireg2", csrind_hmode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_VSIREG3]     = { "vsireg3", csrind_hmode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_VSIREG4]     = { "vsireg4", csrind_hmode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_VSIREG5]     = { "vsireg5", csrind_hmode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +    [CSR_VSIREG6]     = { "vsireg6", csrind_hmode, NULL, NULL, rmw_xiregi,
 +                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 +
      /* VS-Level Interrupts (H-extension with AIA) */
      [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
      [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
 --
-.43.0
+.48.1

-[PULL 26/65] target/riscv: Add support for Zacas extension
+[PULL v2 32/50] target/riscv: Add properties for counter delegation ISA extensions
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Atish Patra <atishp@rivosinc.com>
-Add support for amocas.w/d/q instructions which are part of the ratified
+This adds the properties for counter delegation ISA extensions
-Zacas extension: https://github.com/riscv/riscv-zacas
+(Smcdeleg/Ssccfg). Definitions of new registers and and implementation
 will come in the next set of patches.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231207153842.32401-2-rbradford@rivosinc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-5-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h                      |   1 +
+ target/riscv/cpu_cfg.h | 2 ++
- target/riscv/insn32.decode                  |   6 +
+ target/riscv/cpu.c     | 2 ++
- target/riscv/cpu.c                          |   2 +
+files changed, 4 insertions(+)
  target/riscv/tcg/tcg-cpu.c                  |   5 +
  target/riscv/translate.c                    |   1 +
  target/riscv/insn_trans/trans_rvzacas.c.inc | 150 ++++++++++++++++++++
 files changed, 165 insertions(+)
  create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svnapot;
+     bool ext_ztso;
-     bool ext_svpbmt;
+     bool ext_smstateen;
-     bool ext_zdinx;
+     bool ext_sstc;
-+    bool ext_zacas;
++    bool ext_smcdeleg;
-     bool ext_zawrs;
++    bool ext_ssccfg;
-     bool ext_zfa;
+     bool ext_smcntrpmf;
-     bool ext_zfbfmin;
+     bool ext_smcsrind;
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+     bool ext_sscsrind;
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
  vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
  vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +
 +# *** RV32 Zacas Standard Extension ***
 +amocas_w    00101 . . ..... ..... 010 ..... 0101111 @atom_st
 +amocas_d    00101 . . ..... ..... 011 ..... 0101111 @atom_st
 +# *** RV64 Zacas Standard Extension ***
 +amocas_q    00101 . . ..... ..... 100 ..... 0101111 @atom_st
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+     ISA_EXT_DATA_ENTRY(shvstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
-     ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
+     ISA_EXT_DATA_ENTRY(shvstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
-     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+    ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
++    ISA_EXT_DATA_ENTRY(smcdeleg, PRIV_VERSION_1_13_0, ext_smcdeleg),
-     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
-     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
+     ISA_EXT_DATA_ENTRY(smcsrind, PRIV_VERSION_1_13_0, ext_smcsrind),
-     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true),
+     ISA_EXT_DATA_ENTRY(smnpm, PRIV_VERSION_1_13_0, ext_smnpm),
-     MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-     MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
-+    MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
++    ISA_EXT_DATA_ENTRY(ssccfg, PRIV_VERSION_1_13_0, ext_ssccfg),
-     MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
+     ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, has_priv_1_11),
-     MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
+     ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    if ((cpu->cfg.ext_zacas) && !riscv_has_ext(env, RVA)) {
 +        error_setg(errp, "Zacas extension requires A extension");
 +        return;
 +    }
 +
      if ((cpu->cfg.ext_zawrs) && !riscv_has_ext(env, RVA)) {
          error_setg(errp, "Zawrs extension requires A extension");
          return;
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
  #include "insn_trans/trans_rvv.c.inc"
  #include "insn_trans/trans_rvb.c.inc"
  #include "insn_trans/trans_rvzicond.c.inc"
 +#include "insn_trans/trans_rvzacas.c.inc"
  #include "insn_trans/trans_rvzawrs.c.inc"
  #include "insn_trans/trans_rvzicbo.c.inc"
  #include "insn_trans/trans_rvzfa.c.inc"
 diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V translation routines for the RV64 Zacas Standard Extension.
 + *
 + * Copyright (c) 2020-2023 PLCT Lab
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#define REQUIRE_ZACAS(ctx) do {          \
 +    if (!ctx->cfg_ptr->ext_zacas) {      \
 +        return false;                     \
 +    }                                     \
 +} while (0)
 +
 +static bool gen_cmpxchg(DisasContext *ctx, arg_atomic *a, MemOp mop)
 +{
 +    TCGv dest = get_gpr(ctx, a->rd, EXT_NONE);
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
 +    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 +
 +    decode_save_opc(ctx);
 +    tcg_gen_atomic_cmpxchg_tl(dest, src1, dest, src2, ctx->mem_idx, mop);
 +
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +static bool trans_amocas_w(DisasContext *ctx, arg_amocas_w *a)
 +{
 +    REQUIRE_ZACAS(ctx);
 +    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TESL);
 +}
 +
 +static TCGv_i64 get_gpr_pair(DisasContext *ctx, int reg_num)
 +{
 +    TCGv_i64 t;
 +
 +    assert(get_ol(ctx) == MXL_RV32);
 +
 +    if (reg_num == 0) {
 +        return tcg_constant_i64(0);
 +    }
 +
 +    t = tcg_temp_new_i64();
 +    tcg_gen_concat_tl_i64(t, cpu_gpr[reg_num], cpu_gpr[reg_num + 1]);
 +    return t;
 +}
 +
 +static void gen_set_gpr_pair(DisasContext *ctx, int reg_num, TCGv_i64 t)
 +{
 +    assert(get_ol(ctx) == MXL_RV32);
 +
 +    if (reg_num != 0) {
 +#ifdef TARGET_RISCV32
 +        tcg_gen_extr_i64_i32(cpu_gpr[reg_num], cpu_gpr[reg_num + 1], t);
 +#else
 +        tcg_gen_ext32s_i64(cpu_gpr[reg_num], t);
 +        tcg_gen_sari_i64(cpu_gpr[reg_num + 1], t, 32);
 +#endif
 +
 +        if (get_xl_max(ctx) == MXL_RV128) {
 +            tcg_gen_sari_tl(cpu_gprh[reg_num], cpu_gpr[reg_num], 63);
 +            tcg_gen_sari_tl(cpu_gprh[reg_num + 1], cpu_gpr[reg_num + 1], 63);
 +        }
 +    }
 +}
 +
 +static bool gen_cmpxchg64(DisasContext *ctx, arg_atomic *a, MemOp mop)
 +{
 +    /*
 +     * Encodings with odd numbered registers specified in rs2 and rd are
 +     * reserved.
 +     */
 +    if ((a->rs2 | a->rd) & 1) {
 +        return false;
 +    }
 +
 +    TCGv_i64 dest = get_gpr_pair(ctx, a->rd);
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
 +    TCGv_i64 src2 = get_gpr_pair(ctx, a->rs2);
 +
 +    decode_save_opc(ctx);
 +    tcg_gen_atomic_cmpxchg_i64(dest, src1, dest, src2, ctx->mem_idx, mop);
 +
 +    gen_set_gpr_pair(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +static bool trans_amocas_d(DisasContext *ctx, arg_amocas_d *a)
 +{
 +    REQUIRE_ZACAS(ctx);
 +    switch (get_ol(ctx)) {
 +    case MXL_RV32:
 +        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TEUQ);
 +    case MXL_RV64:
 +    case MXL_RV128:
 +        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TEUQ);
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
 +{
 +    REQUIRE_ZACAS(ctx);
 +    REQUIRE_64BIT(ctx);
 +
 +    /*
 +     * Encodings with odd numbered registers specified in rs2 and rd are
 +     * reserved.
 +     */
 +    if ((a->rs2 | a->rd) & 1) {
 +        return false;
 +    }
 +
 +#ifdef TARGET_RISCV64
 +    TCGv_i128 dest = tcg_temp_new_i128();
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
 +    TCGv_i128 src2 = tcg_temp_new_i128();
 +    TCGv_i64 src2l = get_gpr(ctx, a->rs2, EXT_NONE);
 +    TCGv_i64 src2h = get_gpr(ctx, a->rs2 == 0 ? 0 : a->rs2 + 1, EXT_NONE);
 +    TCGv_i64 destl = get_gpr(ctx, a->rd, EXT_NONE);
 +    TCGv_i64 desth = get_gpr(ctx, a->rd == 0 ? 0 : a->rd + 1, EXT_NONE);
 +
 +    tcg_gen_concat_i64_i128(src2, src2l, src2h);
 +    tcg_gen_concat_i64_i128(dest, destl, desth);
 +    decode_save_opc(ctx);
 +    tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx,
 +                                (MO_ALIGN | MO_TEUO));
 +
 +    tcg_gen_extr_i128_i64(destl, desth, dest);
 +
 +    if (a->rd != 0) {
 +        gen_set_gpr(ctx, a->rd, destl);
 +        gen_set_gpr(ctx, a->rd + 1, desth);
 +    }
 +#endif
 +
 +    return true;
 +}
 --
-.43.0
+.48.1

-[PULL 60/65] docs/system/riscv: sifive_u: Update S-mode U-Boot image build instructions
+[PULL v2 33/50] target/riscv: Add counter delegation definitions
-From: Bin Meng <bmeng@tinylab.org>
+From: Kaiwen Xue <kaiwenx@rivosinc.com>
-Currently, the documentation outlines the process for building the
+This adds definitions for counter delegation, including the new
-S-mode U-Boot image using `make menuconfig` and manual actions within
+scountinhibit register and the mstateen.CD bit.
 the menuconfig UI. However, this approach is fragile due to Kconfig
 options potentially changing across different releases. For example,
 CONFIG_OF_PRIOR_STAGE has been replaced by CONFIG_BOARD since v2022.01
 release, and CONFIG_TEXT_BASE has been moved to the 'General setup'
 menu from the 'Boot options' menu in v2024.01 release.
-This update aims to make the S-mode U-Boot image build instructions
+Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
 future-proof. It leverages the 'config' script provided in the U-Boot
 source tree to edit the .config file, followed by a `make olddefconfig`.
 Validated with U-Boot v2024.01 release.
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20240104071523.273702-1-bmeng@tinylab.org>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-6-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/sifive_u.rst | 33 ++++++++++++---------------------
+ target/riscv/cpu.h      | 1 +
-file changed, 12 insertions(+), 21 deletions(-)
+ target/riscv/cpu_bits.h | 8 +++++++-
  target/riscv/machine.c  | 1 +
 files changed, 9 insertions(+), 1 deletion(-)
-diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/sifive_u.rst
+--- a/target/riscv/cpu.h
-+++ b/docs/system/riscv/sifive_u.rst
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ command line options with ``qemu-system-riscv32``.
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
- Running U-Boot
+     uint32_t scounteren;
- --------------
+     uint32_t mcounteren;
--U-Boot mainline v2021.07 release is tested at the time of writing. To build a
++    uint32_t scountinhibit;
-+U-Boot mainline v2024.01 release is tested at the time of writing. To build a
+     uint32_t mcountinhibit;
- U-Boot mainline bootloader that can be booted by the ``sifive_u`` machine, use
- the sifive_unleashed_defconfig with similar commands as described above for
+     /* PMU cycle & instret privilege mode filtering */
- Linux:
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ configuration of U-Boot:
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
-   $ export CROSS_COMPILE=riscv64-linux-
++++ b/target/riscv/cpu_bits.h
-   $ make sifive_unleashed_defconfig
+@@ -XXX,XX +XXX,XX @@
--  $ make menuconfig
+ #define CSR_SSTATEEN2       0x10E
--
+ #define CSR_SSTATEEN3       0x10F
--then manually select the following configuration:
--
++/* Supervisor Counter Delegation */
--  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
++#define CSR_SCOUNTINHIBIT   0x120
--
++
--and unselect the following configuration:
+ /* Supervisor Trap Handling */
--
+ #define CSR_SSCRATCH        0x140
--  * Library routines ---> Allow access to binman information in the device tree
+ #define CSR_SEPC            0x141
-+  $ ./scripts/config --enable OF_BOARD
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
-+  $ ./scripts/config --disable BINMAN_FDT
+ #define MENVCFG_CBCFE                      BIT(6)
-+  $ ./scripts/config --disable SPL
+ #define MENVCFG_CBZE                       BIT(7)
-+  $ make olddefconfig
+ #define MENVCFG_PMM                        (3ULL << 32)
++#define MENVCFG_CDE                        (1ULL << 60)
- This changes U-Boot to use the QEMU generated device tree blob, and bypass
+ #define MENVCFG_ADUE                       (1ULL << 61)
- running the U-Boot SPL stage.
+ #define MENVCFG_PBMTE                      (1ULL << 62)
-@@ -XXX,XX +XXX,XX @@ It's possible to create a 32-bit U-Boot S-mode image as well.
+ #define MENVCFG_STCE                       (1ULL << 63)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
-   $ export CROSS_COMPILE=riscv64-linux-
+ #define ISELECT_IMSIC_LAST                 ISELECT_IMSIC_EIE63
-   $ make sifive_unleashed_defconfig
+ #define ISELECT_MASK_AIA                   0x1ff
--  $ make menuconfig
--
+-/* MISELECT, SISELECT, and VSISELECT bits (AIA) */
--then manually update the following configuration in U-Boot:
++/* [M|S|VS]SELCT value for Indirect CSR Access Extension */
--
++#define ISELECT_CD_FIRST                   0x40
--  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
++#define ISELECT_CD_LAST                    0x5f
--  * RISC-V architecture ---> Base ISA ---> RV32I
+ #define ISELECT_MASK_SXCSRIND              0xfff
--  * Boot options ---> Boot images ---> Text Base ---> 0x80400000
--
+ /* Dummy [M|S|VS]ISELECT value for emulating [M|S|VS]TOPEI CSRs */
--and unselect the following configuration:
+diff --git a/target/riscv/machine.c b/target/riscv/machine.c
--
+index XXXXXXX..XXXXXXX 100644
--  * Library routines ---> Allow access to binman information in the device tree
+--- a/target/riscv/machine.c
-+  $ ./scripts/config --disable ARCH_RV64I
++++ b/target/riscv/machine.c
-+  $ ./scripts/config --enable ARCH_RV32I
+@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
-+  $ ./scripts/config --set-val TEXT_BASE 0x80400000
+         VMSTATE_UINTTL(env.siselect, RISCVCPU),
-+  $ ./scripts/config --enable OF_BOARD
+         VMSTATE_UINT32(env.scounteren, RISCVCPU),
-+  $ ./scripts/config --disable BINMAN_FDT
+         VMSTATE_UINT32(env.mcounteren, RISCVCPU),
-+  $ ./scripts/config --disable SPL
++        VMSTATE_UINT32(env.scountinhibit, RISCVCPU),
-+  $ make olddefconfig
+         VMSTATE_UINT32(env.mcountinhibit, RISCVCPU),
+         VMSTATE_STRUCT_ARRAY(env.pmu_ctrs, RISCVCPU, RV_MAX_MHPMCOUNTERS, 0,
- Use the same command line options to boot the 32-bit U-Boot S-mode image:
+                              vmstate_pmu_ctr_state, PMUCTRState),
 --
-.43.0
+.48.1

-[PULL 23/65] hw/riscv/virt-acpi-build.c: Add IO controllers and devices
+[PULL v2 34/50] target/riscv: Add select value range check for counter delegation
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Kaiwen Xue <kaiwenx@rivosinc.com>
-Add basic IO controllers and devices like PCI, VirtIO and UART in the
+This adds checks in ops performed on xireg and xireg2-xireg6 so that the
-ACPI namespace.
+counter delegation function will receive a valid xiselect value with the
 proper extensions enabled.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Co-developed-by: Atish Patra <atishp@rivosinc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
-Message-ID: <20231218150247.466427-13-sunilvl@ventanamicro.com>
+Message-ID: <20250110-counter_delegation-v5-7-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 79 ++++++++++++++++++++++++++++++++++++--
+ target/riscv/csr.c | 36 +++++++++++++++++++++++++++++++++++-
- hw/riscv/Kconfig           |  1 +
+file changed, 35 insertions(+), 1 deletion(-)
 files changed, 76 insertions(+), 4 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/csr.c
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool xiselect_aia_range(target_ulong isel)
- #include "hw/acpi/acpi-defs.h"
+            (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST);
  #include "hw/acpi/acpi.h"
  #include "hw/acpi/aml-build.h"
 +#include "hw/acpi/pci.h"
  #include "hw/acpi/utils.h"
 +#include "hw/intc/riscv_aclint.h"
  #include "hw/nvram/fw_cfg_acpi.h"
 +#include "hw/pci-host/gpex.h"
 +#include "hw/riscv/virt.h"
 +#include "hw/riscv/numa.h"
 +#include "hw/virtio/virtio-acpi.h"
 +#include "migration/vmstate.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "sysemu/reset.h"
 -#include "migration/vmstate.h"
 -#include "hw/riscv/virt.h"
 -#include "hw/riscv/numa.h"
 -#include "hw/intc/riscv_aclint.h"
  #define ACPI_BUILD_TABLE_SIZE             0x20000
  #define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
      }
  }
-+static void
++static bool xiselect_cd_range(target_ulong isel)
 +acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
 +                    uint32_t uart_irq)
 +{
-+    Aml *dev = aml_device("COM0");
++    return (ISELECT_CD_FIRST <= isel && isel <= ISELECT_CD_LAST);
 +    aml_append(dev, aml_name_decl("_HID", aml_string("PNP0501")));
 +    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
 +
 +    Aml *crs = aml_resource_template();
 +    aml_append(crs, aml_memory32_fixed(uart_memmap->base,
 +                                         uart_memmap->size, AML_READ_WRITE));
 +    aml_append(crs,
 +                aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
 +                               AML_EXCLUSIVE, &uart_irq, 1));
 +    aml_append(dev, aml_name_decl("_CRS", crs));
 +
 +    Aml *pkg = aml_package(2);
 +    aml_append(pkg, aml_string("clock-frequency"));
 +    aml_append(pkg, aml_int(3686400));
 +
 +    Aml *UUID = aml_touuid("DAFFD814-6EBA-4D8C-8A91-BC9BBF4AA301");
 +
 +    Aml *pkg1 = aml_package(1);
 +    aml_append(pkg1, pkg);
 +
 +    Aml *package = aml_package(2);
 +    aml_append(package, UUID);
 +    aml_append(package, pkg1);
 +
 +    aml_append(dev, aml_name_decl("_DSD", package));
 +    aml_append(scope, dev);
 +}
 +
- /* RHCT Node[N] starts at offset 56 */
+ static int rmw_iprio(target_ulong xlen,
- #define RHCT_NODE_ARRAY_OFFSET 56
+                      target_ulong iselect, uint8_t *iprio,
+                      target_ulong *val, target_ulong new_val,
-@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@ done:
-                        RISCVVirtState *s)
+     return RISCV_EXCP_NONE;
  }
 +static int rmw_xireg_cd(CPURISCVState *env, int csrno,
 +                        target_ulong isel, target_ulong *val,
 +                        target_ulong new_val, target_ulong wr_mask)
 +{
 +    if (!riscv_cpu_cfg(env)->ext_smcdeleg) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +    /* TODO: Implement the functionality later */
 +    return RISCV_EXCP_NONE;
 +}
 +
  /*
   * rmw_xireg_csrind: Perform indirect access to xireg and xireg2-xireg6
   *
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
                                target_ulong isel, target_ulong *val,
                                target_ulong new_val, target_ulong wr_mask)
  {
-     Aml *scope, *dsdt;
+-    return -EINVAL;
-+    MachineState *ms = MACHINE(s);
++    int ret = -EINVAL;
-+    uint8_t socket_count;
++    bool virt = csrno == CSR_VSIREG ? true : false;
      const MemMapEntry *memmap = s->memmap;
      AcpiTable table = { .sig = "DSDT", .rev = 2, .oem_id = s->oem_id,
                          .oem_table_id = s->oem_table_id };
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
      fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
 +    socket_count = riscv_socket_count(ms);
 +
-+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART0], UART0_IRQ);
++    if (xiselect_cd_range(isel)) {
-+
++        ret = rmw_xireg_cd(env, csrno, isel, val, new_val, wr_mask);
 +    if (socket_count == 1) {
 +        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
 +                             memmap[VIRT_VIRTIO].size,
 +                             VIRTIO_IRQ, 0, VIRTIO_COUNT);
 +        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ);
 +    } else if (socket_count == 2) {
 +        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
 +                             memmap[VIRT_VIRTIO].size,
 +                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
 +                             VIRTIO_COUNT);
 +        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES);
 +    } else {
-+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
++        /*
-+                             memmap[VIRT_VIRTIO].size,
++         * As per the specification, access to unimplented region is undefined
-+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
++         * but recommendation is to raise illegal instruction exception.
-+                             VIRTIO_COUNT);
++         */
-+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES * 2);
++        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
-     aml_append(dsdt, scope);
++    if (ret) {
++        return (env->virt_enabled && virt) ?
-     /* copy AML table into ACPI tables blob and patch header there */
++               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
      acpi_add_table(table_offsets, tables_blob);
      build_rhct(tables_blob, tables->linker, s);
 +    acpi_add_table(table_offsets, tables_blob);
 +    {
 +        AcpiMcfgInfo mcfg = {
 +           .base = s->memmap[VIRT_PCIE_MMIO].base,
 +           .size = s->memmap[VIRT_PCIE_MMIO].size,
 +        };
 +        build_mcfg(tables_blob, tables->linker, &mcfg, s->oem_id,
 +                   s->oem_table_id);
 +    }
 +
-     /* XSDT is pointed to by RSDP */
++    return RISCV_EXCP_NONE;
-     xsdt = tables_blob->len;
+ }
-     build_xsdt(tables_blob, tables->linker, table_offsets, s->oem_id,
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+ static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select FW_CFG_DMA
      select PLATFORM_BUS
      select ACPI
 +    select ACPI_PCI
  config SHAKTI_C
      bool
 --
-.43.0
+.48.1

-[PULL 04/65] target/riscv: Not allow write mstatus_vs without RVV
+[PULL v2 35/50] target/riscv: Add counter delegation/configuration support
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Kaiwen Xue <kaiwenx@rivosinc.com>
-If CPU does not implement the Vector extension, it usually means
+The Smcdeleg/Ssccfg adds the support for counter delegation via
-mstatus vs hardwire to zero. So we should not allow write a
+S*indcsr and Ssccfg.
 non-zero value to this field.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+It also adds a new shadow CSR scountinhibit and menvcfg enable bit (CDE)
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+to enable this extension and scountovf virtualization.
-Message-ID: <20231215023313.1708-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
 Co-developed-by: Atish Patra <atishp@rivosinc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-8-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 5 ++++-
+ target/riscv/csr.c | 304 +++++++++++++++++++++++++++++++++++++++++++--
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 292 insertions(+), 12 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException aia_smode32(CPURISCVState *env, int csrno)
-     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
+     return smode32(env, csrno);
-         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
+ }
-         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
--        MSTATUS_TW | MSTATUS_VS;
++static RISCVException scountinhibit_pred(CPURISCVState *env, int csrno)
-+        MSTATUS_TW;
++{
++    RISCVCPU *cpu = env_archcpu(env);
-     if (riscv_has_ext(env, RVF)) {
++
-         mask |= MSTATUS_FS;
++    if (!cpu->cfg.ext_ssccfg || !cpu->cfg.ext_smcdeleg) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    if (env->virt_enabled) {
 +        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 +    }
 +
 +    return smode(env, csrno);
 +}
 +
  static bool csrind_extensions_present(CPURISCVState *env)
  {
      return riscv_cpu_cfg(env)->ext_smcsrind || riscv_cpu_cfg(env)->ext_sscsrind;
@@ -XXX,XX +XXX,XX @@ done:
      return result;
  }
 -static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
 -                                        target_ulong val)
 +static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, target_ulong val,
 +                                          uint32_t ctr_idx)
  {
 -    int ctr_idx = csrno - CSR_MCYCLE;
      PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
      uint64_t mhpmctr_val = val;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 -static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
 -                                         target_ulong val)
 +static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
 +                                          uint32_t ctr_idx)
  {
 -    int ctr_idx = csrno - CSR_MCYCLEH;
      PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
      uint64_t mhpmctr_val = counter->mhpmcounter_val;
      uint64_t mhpmctrh_val = val;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
 +{
 +    int ctr_idx = csrno - CSR_MCYCLE;
 +
 +    return riscv_pmu_write_ctr(env, val, ctr_idx);
 +}
 +
 +static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
 +{
 +    int ctr_idx = csrno - CSR_MCYCLEH;
 +
 +    return riscv_pmu_write_ctrh(env, val, ctr_idx);
 +}
 +
  RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
                                           bool upper_half, uint32_t ctr_idx)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
      return riscv_pmu_read_ctr(env, val, true, ctr_index);
  }
 +static int rmw_cd_mhpmcounter(CPURISCVState *env, int ctr_idx,
 +                              target_ulong *val, target_ulong new_val,
 +                              target_ulong wr_mask)
 +{
 +    if (wr_mask != 0 && wr_mask != -1) {
 +        return -EINVAL;
 +    }
 +
 +    if (!wr_mask && val) {
 +        riscv_pmu_read_ctr(env, val, false, ctr_idx);
 +    } else if (wr_mask) {
 +        riscv_pmu_write_ctr(env, new_val, ctr_idx);
 +    } else {
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 +
 +static int rmw_cd_mhpmcounterh(CPURISCVState *env, int ctr_idx,
 +                               target_ulong *val, target_ulong new_val,
 +                               target_ulong wr_mask)
 +{
 +    if (wr_mask != 0 && wr_mask != -1) {
 +        return -EINVAL;
 +    }
 +
 +    if (!wr_mask && val) {
 +        riscv_pmu_read_ctr(env, val, true, ctr_idx);
 +    } else if (wr_mask) {
 +        riscv_pmu_write_ctrh(env, new_val, ctr_idx);
 +    } else {
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 +
 +static int rmw_cd_mhpmevent(CPURISCVState *env, int evt_index,
 +                            target_ulong *val, target_ulong new_val,
 +                            target_ulong wr_mask)
 +{
 +    uint64_t mhpmevt_val = new_val;
 +
 +    if (wr_mask != 0 && wr_mask != -1) {
 +        return -EINVAL;
 +    }
 +
 +    if (!wr_mask && val) {
 +        *val = env->mhpmevent_val[evt_index];
 +        if (riscv_cpu_cfg(env)->ext_sscofpmf) {
 +            *val &= ~MHPMEVENT_BIT_MINH;
 +        }
 +    } else if (wr_mask) {
 +        wr_mask &= ~MHPMEVENT_BIT_MINH;
 +        mhpmevt_val = (new_val & wr_mask) |
 +                      (env->mhpmevent_val[evt_index] & ~wr_mask);
 +        if (riscv_cpu_mxl(env) == MXL_RV32) {
 +            mhpmevt_val = mhpmevt_val |
 +                          ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
 +        }
 +        env->mhpmevent_val[evt_index] = mhpmevt_val;
 +        riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
 +    } else {
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 +
 +static int rmw_cd_mhpmeventh(CPURISCVState *env, int evt_index,
 +                             target_ulong *val, target_ulong new_val,
 +                             target_ulong wr_mask)
 +{
 +    uint64_t mhpmevth_val;
 +    uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
 +
 +    if (wr_mask != 0 && wr_mask != -1) {
 +        return -EINVAL;
 +    }
 +
 +    if (!wr_mask && val) {
 +        *val = env->mhpmeventh_val[evt_index];
 +        if (riscv_cpu_cfg(env)->ext_sscofpmf) {
 +            *val &= ~MHPMEVENTH_BIT_MINH;
 +        }
 +    } else if (wr_mask) {
 +        wr_mask &= ~MHPMEVENTH_BIT_MINH;
 +        env->mhpmeventh_val[evt_index] =
 +            (new_val & wr_mask) | (env->mhpmeventh_val[evt_index] & ~wr_mask);
 +        mhpmevth_val = env->mhpmeventh_val[evt_index];
 +        mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
 +        riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
 +    } else {
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 +
 +static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, target_ulong *val,
 +                            target_ulong new_val, target_ulong wr_mask)
 +{
 +    switch (cfg_index) {
 +    case 0:             /* CYCLECFG */
 +        if (wr_mask) {
 +            wr_mask &= ~MCYCLECFG_BIT_MINH;
 +            env->mcyclecfg = (new_val & wr_mask) | (env->mcyclecfg & ~wr_mask);
 +        } else {
 +            *val = env->mcyclecfg &= ~MHPMEVENTH_BIT_MINH;
 +        }
 +        break;
 +    case 2:             /* INSTRETCFG */
 +        if (wr_mask) {
 +            wr_mask &= ~MINSTRETCFG_BIT_MINH;
 +            env->minstretcfg = (new_val & wr_mask) |
 +                               (env->minstretcfg & ~wr_mask);
 +        } else {
 +            *val = env->minstretcfg &= ~MHPMEVENTH_BIT_MINH;
 +        }
 +        break;
 +    default:
 +        return -EINVAL;
 +    }
 +    return 0;
 +}
 +
 +static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, target_ulong *val,
 +                            target_ulong new_val, target_ulong wr_mask)
 +{
 +
 +    if (riscv_cpu_mxl(env) != MXL_RV32) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    switch (cfg_index) {
 +    case 0:         /* CYCLECFGH */
 +        if (wr_mask) {
 +            wr_mask &= ~MCYCLECFGH_BIT_MINH;
 +            env->mcyclecfgh = (new_val & wr_mask) |
 +                              (env->mcyclecfgh & ~wr_mask);
 +        } else {
 +            *val = env->mcyclecfgh;
 +        }
 +        break;
 +    case 2:          /* INSTRETCFGH */
 +        if (wr_mask) {
 +            wr_mask &= ~MINSTRETCFGH_BIT_MINH;
 +            env->minstretcfgh = (new_val & wr_mask) |
 +                                (env->minstretcfgh & ~wr_mask);
 +        } else {
 +            *val = env->minstretcfgh;
 +        }
 +        break;
 +    default:
 +        return -EINVAL;
 +    }
 +    return 0;
 +}
 +
 +
  static RISCVException read_scountovf(CPURISCVState *env, int csrno,
                                       target_ulong *val)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_scountovf(CPURISCVState *env, int csrno,
      target_ulong *mhpm_evt_val;
      uint64_t of_bit_mask;
 +    /* Virtualize scountovf for counter delegation */
 +    if (riscv_cpu_cfg(env)->ext_sscofpmf &&
 +        riscv_cpu_cfg(env)->ext_ssccfg &&
 +        get_field(env->menvcfg, MENVCFG_CDE) &&
 +        env->virt_enabled) {
 +        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 +    }
 +
      if (riscv_cpu_mxl(env) == MXL_RV32) {
          mhpm_evt_val = env->mhpmeventh_val;
          of_bit_mask = MHPMEVENTH_BIT_OF;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_cd(CPURISCVState *env, int csrno,
                          target_ulong isel, target_ulong *val,
                          target_ulong new_val, target_ulong wr_mask)
  {
 -    if (!riscv_cpu_cfg(env)->ext_smcdeleg) {
 -        return RISCV_EXCP_ILLEGAL_INST;
 +    int ret = -EINVAL;
 +    int ctr_index = isel - ISELECT_CD_FIRST;
 +    int isel_hpm_start = ISELECT_CD_FIRST + 3;
 +
 +    if (!riscv_cpu_cfg(env)->ext_smcdeleg || !riscv_cpu_cfg(env)->ext_ssccfg) {
 +        ret = RISCV_EXCP_ILLEGAL_INST;
 +        goto done;
      }
-+    if (riscv_has_ext(env, RVV)) {
+-    /* TODO: Implement the functionality later */
-+        mask |= MSTATUS_VS;
+-    return RISCV_EXCP_NONE;
-+    }
++
++    /* Invalid siselect value for reserved */
-     if (xl != MXL_RV32 || env->debugger) {
++    if (ctr_index == 1) {
-         if (riscv_has_ext(env, RVH)) {
++        goto done;
 +    }
 +
 +    /* sireg4 and sireg5 provides access RV32 only CSRs */
 +    if (((csrno == CSR_SIREG5) || (csrno == CSR_SIREG4)) &&
 +        (riscv_cpu_mxl(env) != MXL_RV32)) {
 +        ret = RISCV_EXCP_ILLEGAL_INST;
 +        goto done;
 +    }
 +
 +    /* Check Sscofpmf dependancy */
 +    if (!riscv_cpu_cfg(env)->ext_sscofpmf && csrno == CSR_SIREG5 &&
 +        (isel_hpm_start <= isel && isel <= ISELECT_CD_LAST)) {
 +        goto done;
 +    }
 +
 +    /* Check smcntrpmf dependancy */
 +    if (!riscv_cpu_cfg(env)->ext_smcntrpmf &&
 +        (csrno == CSR_SIREG2 || csrno == CSR_SIREG5) &&
 +        (ISELECT_CD_FIRST <= isel && isel < isel_hpm_start)) {
 +        goto done;
 +    }
 +
 +    if (!get_field(env->mcounteren, BIT(ctr_index)) ||
 +        !get_field(env->menvcfg, MENVCFG_CDE)) {
 +        goto done;
 +    }
 +
 +    switch (csrno) {
 +    case CSR_SIREG:
 +        ret = rmw_cd_mhpmcounter(env, ctr_index, val, new_val, wr_mask);
 +        break;
 +    case CSR_SIREG4:
 +        ret = rmw_cd_mhpmcounterh(env, ctr_index, val, new_val, wr_mask);
 +        break;
 +    case CSR_SIREG2:
 +        if (ctr_index <= 2) {
 +            ret = rmw_cd_ctr_cfg(env, ctr_index, val, new_val, wr_mask);
 +        } else {
 +            ret = rmw_cd_mhpmevent(env, ctr_index, val, new_val, wr_mask);
 +        }
 +        break;
 +    case CSR_SIREG5:
 +        if (ctr_index <= 2) {
 +            ret = rmw_cd_ctr_cfgh(env, ctr_index, val, new_val, wr_mask);
 +        } else {
 +            ret = rmw_cd_mhpmeventh(env, ctr_index, val, new_val, wr_mask);
 +        }
 +        break;
 +    default:
 +        goto done;
 +    }
 +
 +done:
 +    return ret;
  }
  /*
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
 +                                         target_ulong *val)
 +{
 +    /* S-mode can only access the bits delegated by M-mode */
 +    *val = env->mcountinhibit & env->mcounteren;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException write_scountinhibit(CPURISCVState *env, int csrno,
 +                                          target_ulong val)
 +{
 +    write_mcountinhibit(env, csrno, val & env->mcounteren);
 +    return RISCV_EXCP_NONE;
 +}
 +
  static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
                                        target_ulong *val)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
                                      target_ulong val)
  {
      const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
 -    uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
 +    uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
 +                    MENVCFG_CBZE | MENVCFG_CDE;
      if (riscv_cpu_mxl(env) == MXL_RV64) {
          mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                  (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 +                (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
                  (cfg->ext_svadu ? MENVCFG_ADUE : 0);
          if (env_archcpu(env)->cfg.ext_zicfilp) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
      const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
      uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                      (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
 +                    (cfg->ext_svadu ? MENVCFG_ADUE : 0) |
 +                    (cfg->ext_smcdeleg ? MENVCFG_CDE : 0);
      uint64_t valh = (uint64_t)val << 32;
      env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MNSTATUS]  = { "mnstatus",  rnmi, read_mnstatus,  write_mnstatus,
                          .min_priv_ver = PRIV_VERSION_1_12_0               },
 +    /* Supervisor Counter Delegation */
 +    [CSR_SCOUNTINHIBIT] = {"scountinhibit", scountinhibit_pred,
 +                            read_scountinhibit, write_scountinhibit,
 +                           .min_priv_ver = PRIV_VERSION_1_12_0 },
 +
      /* Supervisor Trap Setup */
      [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
                           NULL,                read_sstatus_i128              },
 --
-.43.0
+.48.1

-[PULL 42/65] target/riscv/tcg: add hash table insert helpers
+[PULL v2 36/50] target/riscv: Invoke pmu init after feature enable
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Atish Patra <atishp@rivosinc.com>
-Previous patches added several g_hash_table_insert() patterns. Add two
+The dependant ISA features are enabled at the end of cpu_realize
-helpers, one for each user hash, to make the code cleaner.
+in finalize_features. Thus, PMU init should be invoked after that
 only. Move the init invocation to riscv_tcg_cpu_finalize_features.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-15-dbarboza@ventanamicro.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-9-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 28 ++++++++++++++++------------
+ target/riscv/tcg/tcg-cpu.c | 28 ++++++++++++++--------------
-file changed, 16 insertions(+), 12 deletions(-)
+file changed, 14 insertions(+), 14 deletions(-)
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
-                                  GUINT_TO_POINTER(ext_offset));
+         error_propagate(errp, local_err);
  }
 +static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
 +{
 +    g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
 +                        (gpointer)value);
 +}
 +
 +static void cpu_misa_ext_add_user_opt(uint32_t bit, bool value)
 +{
 +    g_hash_table_insert(misa_ext_user_opts, GUINT_TO_POINTER(bit),
 +                        (gpointer)value);
 +}
 +
  static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
                                       bool enabled)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
          return;
      }
++#ifndef CONFIG_USER_ONLY
--    g_hash_table_insert(misa_ext_user_opts,
++    if (cpu->cfg.pmu_mask) {
--                        GUINT_TO_POINTER(misa_bit),
++        riscv_pmu_init(cpu, &local_err);
--                        (gpointer)value);
++        if (local_err != NULL) {
-+    cpu_misa_ext_add_user_opt(misa_bit, value);
++            error_propagate(errp, local_err);
++            return;
-     prev_val = env->misa_ext & misa_bit;
++        }
++
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
++        if (cpu->cfg.ext_sscofpmf) {
-             continue;
++            cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-         }
++                                          riscv_pmu_timer_cb, cpu);
++        }
--        g_hash_table_insert(misa_ext_user_opts,
++    }
--                            GUINT_TO_POINTER(bit),
++#endif
--                            (gpointer)value);
+ }
-+        cpu_misa_ext_add_user_opt(bit, profile->enabled);
-         riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
+ void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
@@ -XXX,XX +XXX,XX @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
  #ifndef CONFIG_USER_ONLY
      CPURISCVState *env = &cpu->env;
 -    Error *local_err = NULL;
      tcg_cflags_set(CPU(cs), CF_PCREL);
@@ -XXX,XX +XXX,XX @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
          riscv_timer_init(cpu);
      }
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+-    if (cpu->cfg.pmu_mask) {
-             cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
+-        riscv_pmu_init(cpu, &local_err);
-         }
+-        if (local_err != NULL) {
+-            error_propagate(errp, local_err);
--        g_hash_table_insert(multi_ext_user_opts,
+-            return false;
--                            GUINT_TO_POINTER(ext_offset),
+-        }
--                            (gpointer)profile->enabled);
+-
-+        cpu_cfg_ext_add_user_opt(ext_offset, profile->enabled);
+-        if (cpu->cfg.ext_sscofpmf) {
-         isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
+-            cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-     }
+-                                          riscv_pmu_timer_cb, cpu);
- }
+-        }
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
+-    }
-                     multi_ext_cfg->name, lower);
+-
-     }
+     /* With H-Ext, VSSIP, VSTIP, VSEIP and SGEIP are hardwired to one. */
+     if (riscv_has_ext(env, RVH)) {
--    g_hash_table_insert(multi_ext_user_opts,
+         env->mideleg = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP | MIP_SGEIP;
 -                        GUINT_TO_POINTER(multi_ext_cfg->offset),
 -                        (gpointer)value);
 +    cpu_cfg_ext_add_user_opt(multi_ext_cfg->offset, value);
      prev_val = isa_ext_is_enabled(cpu, multi_ext_cfg->offset);
 --
-.43.0
+.48.1

-[PULL 53/65] target/riscv: add RVA22S64 profile
+[PULL v2 37/50] target/riscv: Add implied rule for counter delegation extensions
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Atish Patra <atishp@rivosinc.com>
-The RVA22S64 profile consists of the following:
+The counter delegation/configuration extensions depend on the following
 extensions.
-- all mandatory extensions of RVA22U64;
+. Smcdeleg - To enable counter delegation from M to S
-- priv spec v1.12.0;
+. S[m|s]csrind - To enable indirect access CSRs
 - satp mode sv39;
 - Ssccptr, a cache related named feature that we're assuming always
   enable since we don't implement a cache;
 - Other named features already implemented: Sstvecd, Sstvala,
   Sscounterenw;
 - the new Svade named feature that was recently added.
-Most of the work is already done, so this patch is enough to implement
+Add an implied rule so that these extensions are enabled by default
-the profile.
+if the sscfg extension is enabled.
-After this patch, the 'rva22s64' user flag alone can be used with the
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-rva64i CPU to boot Linux:
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
--cpu rv64i,rva22s64=true
+Message-ID: <20250110-counter_delegation-v5-10-e83d797ae294@rivosinc.com>
 This is the /proc/cpuinfo with this profile enabled:
  # cat /proc/cpuinfo
 processor    : 0
 hart        : 0
 isa        : rv64imafdc_zicbom_zicbop_zicboz_zicntr_zicsr_zifencei_zihintpause_zihpm_zfhmin_zca_zcd_zba_zbb_zbs_zkt_svinval_svpbmt
 mmu        : sv39
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-26-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
+ target/riscv/cpu.c | 12 +++++++++++-
-file changed, 32 insertions(+)
+file changed, 11 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
+@@ -XXX,XX +XXX,XX @@ static RISCVCPUImpliedExtsRule ZVKSG_IMPLIED = {
-     }
+     },
  };
-+/*
++static RISCVCPUImpliedExtsRule SSCFG_IMPLIED = {
-+ * As with RVA22U64, RVA22S64 also defines 'named features'.
++    .ext = CPU_CFG_OFFSET(ext_ssccfg),
-+ *
++    .implied_multi_exts = {
-+ * Cache related features that we consider enabled since we don't
++        CPU_CFG_OFFSET(ext_smcsrind), CPU_CFG_OFFSET(ext_sscsrind),
-+ * implement cache: Ssccptr
++        CPU_CFG_OFFSET(ext_smcdeleg),
 + *
 + * Other named features that we already implement: Sstvecd, Sstvala,
 + * Sscounterenw
 + *
 + * Named features that we need to enable: svade
 + *
 + * The remaining features/extensions comes from RVA22U64.
 + */
 +static RISCVCPUProfile RVA22S64 = {
 +    .parent = &RVA22U64,
 +    .name = "rva22s64",
 +    .misa_ext = RVS,
 +    .priv_spec = PRIV_VERSION_1_12_0,
 +    .satp_mode = VM_1_10_SV39,
 +    .ext_offsets = {
 +        /* rva22s64 exts */
 +        CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
 +        CPU_CFG_OFFSET(ext_svinval),
 +
-+        /* rva22s64 named features */
++        RISCV_IMPLIED_EXTS_RULE_END
-+        CPU_CFG_OFFSET(svade),
++    },
 +
 +        RISCV_PROFILE_EXT_LIST_END
 +    }
 +};
 +
- RISCVCPUProfile *riscv_profiles[] = {
+ RISCVCPUImpliedExtsRule *riscv_misa_ext_implied_rules[] = {
-     &RVA22U64,
+     &RVA_IMPLIED, &RVD_IMPLIED, &RVF_IMPLIED,
-+    &RVA22S64,
+     &RVM_IMPLIED, &RVV_IMPLIED, NULL
-     NULL,
+@@ -XXX,XX +XXX,XX @@ RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[] = {
      &ZVE64X_IMPLIED, &ZVFBFMIN_IMPLIED, &ZVFBFWMA_IMPLIED,
      &ZVFH_IMPLIED, &ZVFHMIN_IMPLIED, &ZVKN_IMPLIED,
      &ZVKNC_IMPLIED, &ZVKNG_IMPLIED, &ZVKNHB_IMPLIED,
 -    &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED,
 +    &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED, &SSCFG_IMPLIED,
      NULL
  };
 --
-.43.0
+.48.1

-[PULL 65/65] target/riscv: Ensure mideleg is set correctly on reset
+[PULL v2 38/50] target/riscv: Add configuration for S[m|s]csrind, Smcdeleg/Ssccfg
-From: Alistair Francis <alistair23@gmail.com>
+From: Atish Patra <atishp@rivosinc.com>
-Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor is
+Add configuration options so that they can be enabled/disabld from
-enabled. We currently only set them on accesses to mideleg, but they
+qemu commandline.
 aren't correctly set on reset. Let's ensure they are always the correct
 value.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1617
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20240108001328.280222-4-alistair.francis@wdc.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20250110-counter_delegation-v5-11-e83d797ae294@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 8 ++++++++
+ target/riscv/cpu.c | 4 ++++
-file changed, 8 insertions(+)
+file changed, 4 insertions(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-     /* mmte is supposed to have pm.current hardwired to 1 */
+     /* Defaults for standard extensions */
-     env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
+     MULTI_EXT_CFG_BOOL("sscofpmf", ext_sscofpmf, false),
+     MULTI_EXT_CFG_BOOL("smcntrpmf", ext_smcntrpmf, false),
-+    /*
++    MULTI_EXT_CFG_BOOL("smcsrind", ext_smcsrind, false),
-+     * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
++    MULTI_EXT_CFG_BOOL("smcdeleg", ext_smcdeleg, false),
-+     * extension is enabled.
++    MULTI_EXT_CFG_BOOL("sscsrind", ext_sscsrind, false),
-+     */
++    MULTI_EXT_CFG_BOOL("ssccfg", ext_ssccfg, false),
-+    if (riscv_has_ext(env, RVH)) {
+     MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true),
-+        env->mideleg |= HS_MODE_INTERRUPTS;
+     MULTI_EXT_CFG_BOOL("zicfilp", ext_zicfilp, false),
-+    }
+     MULTI_EXT_CFG_BOOL("zicfiss", ext_zicfiss, false),
 +
      /*
       * Clear mseccfg and unlock all the PMP entries upon reset.
       * This is allowed as per the priv and smepmp specifications
 --
-.43.0
+.48.1

-[PULL 10/65] target/riscv/kvm: add RISCV_CONFIG_REG()
+[PULL v2 39/50] target/riscv: Fix henvcfg potentially containing stale bits
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-Create a RISCV_CONFIG_REG() macro, similar to what other regs use, to
+With the current implementation, if we had the following scenario:
-hide away some of the boilerplate.
+- Set bit x in menvcfg
 - Set bit x in henvcfg
 - Clear bit x in menvcfg
 then, the internal variable env->henvcfg would still contain bit x due
 to both a wrong menvcfg mask used in write_henvcfg() as well as a
 missing update of henvcfg upon menvcfg update.
 This can lead to some wrong interpretation of the context. In order to
 update henvcfg upon menvcfg writing, call write_henvcfg() after writing
 menvcfg. Clearing henvcfg upon writing the new value is also needed in
 write_henvcfg() as well as clearing henvcfg upper part when writing it
 with write_henvcfgh().
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231208183835.2411523-5-dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250110125441.3208676-2-cleger@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 25 +++++++++++--------------
+ target/riscv/csr.c | 10 ++++++++--
-file changed, 11 insertions(+), 14 deletions(-)
+file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/target/riscv/csr.c
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
- #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
+     return RISCV_EXCP_NONE;
-                  KVM_REG_RISCV_CSR_REG(name))
+ }
-+#define RISCV_CONFIG_REG(env, name) \
++static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-+    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
++                                    target_ulong val);
-+                     KVM_REG_RISCV_CONFIG_REG(name))
+ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-+
+                                     target_ulong val)
- #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
+ {
-                  KVM_REG_RISCV_TIMER_REG(name))
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
+         }
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
      struct kvm_one_reg reg;
      int ret;
 -    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 -                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
 +    reg.id = RISCV_CONFIG_REG(env, mvendorid);
      reg.addr = (uint64_t)&cpu->cfg.mvendorid;
      ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
      if (ret != 0) {
          error_report("Unable to retrieve mvendorid from host, error %d", ret);
      }
+     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    write_henvcfg(env, CSR_HENVCFG, env->henvcfg);
--                              KVM_REG_RISCV_CONFIG_REG(marchid));
-+    reg.id = RISCV_CONFIG_REG(env, marchid);
+     return RISCV_EXCP_NONE;
-     reg.addr = (uint64_t)&cpu->cfg.marchid;
+ }
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
-     if (ret != 0) {
+     return RISCV_EXCP_NONE;
-         error_report("Unable to retrieve marchid from host, error %d", ret);
+ }
 +static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
 +                                    target_ulong val);
  static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
                                       target_ulong val)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
      uint64_t valh = (uint64_t)val << 32;
      env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
 +    write_henvcfgh(env, CSR_HENVCFGH, env->henvcfg >> 32);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
          }
      }
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+-    env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
--                              KVM_REG_RISCV_CONFIG_REG(mimpid));
++    env->henvcfg = val & mask;
-+    reg.id = RISCV_CONFIG_REG(env, mimpid);
-     reg.addr = (uint64_t)&cpu->cfg.mimpid;
+     return RISCV_EXCP_NONE;
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+ }
-     if (ret != 0) {
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
      struct kvm_one_reg reg;
      int ret;
 -    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 -                              KVM_REG_RISCV_CONFIG_REG(isa));
 +    reg.id = RISCV_CONFIG_REG(env, isa);
      reg.addr = (uint64_t)&env->misa_ext_mask;
      ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
      uint64_t id;
      int ret;
 -    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 -                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
 +    id = RISCV_CONFIG_REG(env, mvendorid);
      /*
       * cfg.mvendorid is an uint32 but a target_ulong will
       * be written. Assign it to a target_ulong var to avoid
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
          return ret;
      }
--    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+-    env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
--                          KVM_REG_RISCV_CONFIG_REG(marchid));
++    env->henvcfg = (env->henvcfg & 0xFFFFFFFF) | (valh & mask);
-+    id = RISCV_CONFIG_REG(env, marchid);
+     return RISCV_EXCP_NONE;
-     ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
+ }
-     if (ret != 0) {
          return ret;
      }
 -    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
 -                          KVM_REG_RISCV_CONFIG_REG(mimpid));
 +    id = RISCV_CONFIG_REG(env, mimpid);
      ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
      return ret;
 --
-.43.0
+.48.1

-[PULL 34/65] target/riscv/tcg: add 'zic64b' support
+[PULL v2 40/50] target/riscv: Add Ssdbltrp CSRs handling
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-zic64b is defined in the RVA22U64 profile [1] as a named feature for
+Add ext_ssdbltrp in RISCVCPUConfig and implement MSTATUS.SDT,
-"Cache blocks must be 64 bytes in size, naturally aligned in the address
+{H|M}ENVCFG.DTE and modify the availability of MTVAL2 based on the
-space". It's a fantasy name for 64 bytes cache blocks. The RVA22U64
+presence of the Ssdbltrp ISA extension.
-profile mandates this feature, meaning that applications using this
-profile expects 64 bytes cache blocks.
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 To make the upcoming RVA22U64 implementation complete, we'll zic64b as
 a 'named feature', not a regular extension. This means that:
 - it won't be exposed to users;
 - it won't be written in riscv,isa.
 This will be extended to other named extensions in the future, so we're
 creating some common boilerplate for them as well.
 zic64b is default to 'true' since we're already using 64 bytes blocks.
 If any cache block size (cbo{m,p,z}_blocksize) is changed to something
 different than 64, zic64b is set to 'false'.
 Our profile implementation will then be able to check the current state
 of zic64b and take the appropriate action (e.g. throw a warning).
 [1] https://github.com/riscv/riscv-profiles/releases/download/v1.0/profiles.pdf
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-7-dbarboza@ventanamicro.com>
+Message-ID: <20250110125441.3208676-3-cleger@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  1 +
+ target/riscv/cpu.h        |  1 +
- target/riscv/cpu_cfg.h     |  1 +
+ target/riscv/cpu_bits.h   |  6 ++++
- target/riscv/cpu.c         |  6 ++++++
+ target/riscv/cpu_cfg.h    |  1 +
- target/riscv/tcg/tcg-cpu.c | 26 ++++++++++++++++++++++++++
+ target/riscv/cpu_helper.c | 17 ++++++++++
-files changed, 34 insertions(+)
+ target/riscv/csr.c        | 71 ++++++++++++++++++++++++++++++++-------
 files changed, 84 insertions(+), 12 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct RISCVCPUMultiExtConfig {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
- extern const RISCVCPUMultiExtConfig riscv_cpu_extensions[];
+ int riscv_env_mmu_index(CPURISCVState *env, bool ifetch);
- extern const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[];
+ bool cpu_get_fcfien(CPURISCVState *env);
- extern const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[];
+ bool cpu_get_bcfien(CPURISCVState *env);
-+extern const RISCVCPUMultiExtConfig riscv_cpu_named_features[];
++bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt);
- extern const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[];
+ G_NORETURN void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
- extern Property riscv_cpu_options[];
+                                                MMUAccessType access_type,
+                                                int mmu_idx, uintptr_t retaddr);
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define MSTATUS_TW          0x00200000 /* since: priv-1.10 */
  #define MSTATUS_TSR         0x00400000 /* since: priv-1.10 */
  #define MSTATUS_SPELP       0x00800000 /* zicfilp */
 +#define MSTATUS_SDT         0x01000000
  #define MSTATUS_MPELP       0x020000000000 /* zicfilp */
  #define MSTATUS_GVA         0x4000000000ULL
  #define MSTATUS_MPV         0x8000000000ULL
@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define SSTATUS_SUM         0x00040000 /* since: priv-1.10 */
  #define SSTATUS_MXR         0x00080000
  #define SSTATUS_SPELP       MSTATUS_SPELP   /* zicfilp */
 +#define SSTATUS_SDT         MSTATUS_SDT
  #define SSTATUS64_UXL       0x0000000300000000ULL
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define MENVCFG_CBCFE                      BIT(6)
  #define MENVCFG_CBZE                       BIT(7)
  #define MENVCFG_PMM                        (3ULL << 32)
 +#define MENVCFG_DTE                        (1ULL << 59)
  #define MENVCFG_CDE                        (1ULL << 60)
  #define MENVCFG_ADUE                       (1ULL << 61)
  #define MENVCFG_PBMTE                      (1ULL << 62)
  #define MENVCFG_STCE                       (1ULL << 63)
  /* For RV32 */
 +#define MENVCFGH_DTE                       BIT(27)
  #define MENVCFGH_ADUE                      BIT(29)
  #define MENVCFGH_PBMTE                     BIT(30)
  #define MENVCFGH_STCE                      BIT(31)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define HENVCFG_CBCFE                      MENVCFG_CBCFE
  #define HENVCFG_CBZE                       MENVCFG_CBZE
  #define HENVCFG_PMM                        MENVCFG_PMM
 +#define HENVCFG_DTE                        MENVCFG_DTE
  #define HENVCFG_ADUE                       MENVCFG_ADUE
  #define HENVCFG_PBMTE                      MENVCFG_PBMTE
  #define HENVCFG_STCE                       MENVCFG_STCE
  /* For RV32 */
 +#define HENVCFGH_DTE                        MENVCFGH_DTE
  #define HENVCFGH_ADUE                       MENVCFGH_ADUE
  #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
  #define HENVCFGH_STCE                       MENVCFGH_STCE
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_smepmp;
+     bool ext_smcntrpmf;
-     bool rvv_ta_all_1s;
+     bool ext_smcsrind;
-     bool rvv_ma_all_1s;
+     bool ext_sscsrind;
-+    bool zic64b;
++    bool ext_ssdbltrp;
+     bool ext_svadu;
-     uint32_t mvendorid;
+     bool ext_svinval;
-     uint64_t marchid;
+     bool ext_svnapot;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+@@ -XXX,XX +XXX,XX @@ bool cpu_get_bcfien(CPURISCVState *env)
-     DEFINE_PROP_END_OF_LIST(),
+     }
- };
+ }
-+const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
++bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt)
 +    MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
 +
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
  /* Deprecated entries marked for future removal */
  const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[] = {
      MULTI_EXT_CFG_BOOL("Zifencei", ext_zifencei, true),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
      g_assert_not_reached();
  }
 +static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
 +{
-+    const RISCVCPUMultiExtConfig *feat;
++#ifdef CONFIG_USER_ONLY
-+
++    return false;
-+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
++#else
-+        if (feat->offset == ext_offset) {
++    if (virt) {
-+            return true;
++        return (env->henvcfg & HENVCFG_DTE) != 0;
 +    } else {
 +        return (env->menvcfg & MENVCFG_DTE) != 0;
 +    }
 +#endif
 +}
 +
  void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
                            uint64_t *cs_base, uint32_t *pflags)
  {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
      g_assert(riscv_has_ext(env, RVH));
 +    if (riscv_env_smode_dbltrp_enabled(env, current_virt)) {
 +        mstatus_mask |= MSTATUS_SDT;
 +    }
 +
      if (current_virt) {
          /* Current V=1 and we are about to change to V=0 */
          env->vsstatus = env->mstatus & mstatus_mask;
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_hmode32(CPURISCVState *env, int csrno)
      return hmode32(env, csrno);
  }
 +static RISCVException dbltrp_hmode(CPURISCVState *env, int csrno)
 +{
 +    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
 +        return RISCV_EXCP_NONE;
 +    }
 +
 +    return hmode(env, csrno);
 +}
 +
  static RISCVException pmp(CPURISCVState *env, int csrno)
  {
      if (riscv_cpu_cfg(env)->pmp) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
          mask |= MSTATUS_VS;
      }
 +    if (riscv_env_smode_dbltrp_enabled(env, env->virt_enabled)) {
 +        mask |= MSTATUS_SDT;
 +        if ((val & MSTATUS_SDT) != 0) {
 +            val &= ~MSTATUS_SIE;
 +        }
 +    }
 +
-+    return false;
+     if (xl != MXL_RV32 || env->debugger) {
-+}
+         if (riscv_has_ext(env, RVH)) {
-+
+             mask |= MSTATUS_MPV | MSTATUS_GVA;
- static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-                                         uint32_t ext_offset)
+         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                  (cfg->ext_sstc ? MENVCFG_STCE : 0) |
                  (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
 -                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
 +                (cfg->ext_svadu ? MENVCFG_ADUE : 0) |
 +                (cfg->ext_ssdbltrp ? MENVCFG_DTE : 0);
          if (env_archcpu(env)->cfg.ext_zicfilp) {
              mask |= MENVCFG_LPE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
          if (env_archcpu(env)->cfg.ext_smnpm &&
              get_field(val, MENVCFG_PMM) != PMM_FIELD_RESERVED) {
              mask |= MENVCFG_PMM;
 +    }
 +
 +        if ((val & MENVCFG_DTE) == 0) {
 +            env->mstatus &= ~MSTATUS_SDT;
          }
      }
      env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
      uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                      (cfg->ext_sstc ? MENVCFG_STCE : 0) |
                      (cfg->ext_svadu ? MENVCFG_ADUE : 0) |
 -                    (cfg->ext_smcdeleg ? MENVCFG_CDE : 0);
 +                    (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
 +                    (cfg->ext_ssdbltrp ? MENVCFG_DTE : 0);
      uint64_t valh = (uint64_t)val << 32;
 +    if ((valh & MENVCFG_DTE) == 0) {
 +        env->mstatus &= ~MSTATUS_SDT;
 +    }
 +
      env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
      write_henvcfgh(env, CSR_HENVCFGH, env->henvcfg >> 32);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
       * henvcfg.pbmte is read_only 0 when menvcfg.pbmte = 0
       * henvcfg.stce is read_only 0 when menvcfg.stce = 0
       * henvcfg.adue is read_only 0 when menvcfg.adue = 0
 +     * henvcfg.dte is read_only 0 when menvcfg.dte = 0
       */
 -    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
 -                           env->menvcfg);
 +    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
 +                             HENVCFG_DTE) | env->menvcfg);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
      }
      if (riscv_cpu_mxl(env) == MXL_RV64) {
 -        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
 +        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
 +                                HENVCFG_DTE);
          if (env_archcpu(env)->cfg.ext_zicfilp) {
              mask |= HENVCFG_LPE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
      }
      env->henvcfg = val & mask;
 +    if ((env->henvcfg & HENVCFG_DTE) == 0) {
 +        env->vsstatus &= ~MSTATUS_SDT;
 +    }
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
          return ret;
      }
 -    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
 -                            env->menvcfg)) >> 32;
 +    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
 +                              HENVCFG_DTE) | env->menvcfg)) >> 32;
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                       target_ulong val)
  {
-@@ -XXX,XX +XXX,XX @@ static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
+     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-         return;
+-                                    HENVCFG_ADUE);
-     }
++                                    HENVCFG_ADUE | HENVCFG_DTE);
+     uint64_t valh = (uint64_t)val << 32;
-+    if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+     RISCVException ret;
-+        return;
-+    }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-+
+     if (ret != RISCV_EXCP_NONE) {
-     ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
+         return ret;
+     }
-     if (env->priv_ver < ext_priv_ver) {
+-
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
+     env->henvcfg = (env->henvcfg & 0xFFFFFFFF) | (valh & mask);
-     }
++    if ((env->henvcfg & HENVCFG_DTE) == 0) {
- }
++        env->vsstatus &= ~MSTATUS_SDT;
++    }
-+static void riscv_cpu_update_named_features(RISCVCPU *cpu)
+     return RISCV_EXCP_NONE;
-+{
+ }
-+    cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
-+                      cpu->cfg.cbop_blocksize == 64 &&
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
-+                      cpu->cfg.cboz_blocksize == 64;
+     if (env->xl != MXL_RV32 || env->debugger) {
-+}
+         mask |= SSTATUS64_UXL;
-+
+     }
- /*
++    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
-  * Check consistency between chosen extensions while setting
++        mask |= SSTATUS_SDT;
-  * cpu->cfg accordingly.
++    }
-@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
-         return;
+     if (env_archcpu(env)->cfg.ext_zicfilp) {
-     }
+         mask |= SSTATUS_SPELP;
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
-+    riscv_cpu_update_named_features(cpu);
+     if (env_archcpu(env)->cfg.ext_zicfilp) {
-+
+         mask |= SSTATUS_SPELP;
-     if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
+     }
-         /*
+-
-          * Enhanced PMP should only be available
++    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
 +        mask |= SSTATUS_SDT;
 +    }
      /* TODO: Use SXL not MXL. */
      *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
      if (env_archcpu(env)->cfg.ext_zicfilp) {
          mask |= SSTATUS_SPELP;
      }
 -
 +    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
 +        mask |= SSTATUS_SDT;
 +    }
      target_ulong newval = (env->mstatus & ~mask) | (val & mask);
      return write_mstatus(env, CSR_MSTATUS, newval);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
      if ((val & VSSTATUS64_UXL) == 0) {
          mask &= ~VSSTATUS64_UXL;
      }
 +    if ((env->henvcfg & HENVCFG_DTE)) {
 +        if ((val & SSTATUS_SDT) != 0) {
 +            val &= ~SSTATUS_SIE;
 +        }
 +    } else {
 +        val &= ~SSTATUS_SDT;
 +    }
      env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
                            .min_priv_ver = PRIV_VERSION_1_12_0                },
 -    [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
 +    [CSR_MTVAL2]      = { "mtval2", dbltrp_hmode, read_mtval2, write_mtval2,
                            .min_priv_ver = PRIV_VERSION_1_12_0                },
      [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
                            .min_priv_ver = PRIV_VERSION_1_12_0                },
 --
-.43.0
+.48.1

-[PULL 58/65] target/riscv/kvm: do PR_RISCV_V_SET_CONTROL during realize()
+[PULL v2 41/50] target/riscv: Implement Ssdbltrp sret, mret and mnret behavior
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-Linux RISC-V vector documentation (Document/arch/riscv/vector.rst)
+When the Ssdbltrp extension is enabled, SSTATUS.SDT field is cleared
-mandates a prctl() in order to allow an userspace thread to use the
+when executing sret. When executing mret/mnret, SSTATUS.SDT is cleared
-Vector extension from the host.
+when returning to U, VS or VU and VSSTATUS.SDT is cleared when returning
 to VU from HS.
-This is something to be done in realize() time, after init(), when we
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
 already decided whether we're using RVV or not. We don't have a
 realize() callback for KVM yet, so add kvm_cpu_realize() and enable RVV
 for the thread via PR_RISCV_V_SET_CONTROL.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-4-dbarboza@ventanamicro.com>
+Message-ID: <20250110125441.3208676-4-cleger@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 29 +++++++++++++++++++++++++++++
+ target/riscv/op_helper.c | 35 ++++++++++++++++++++++++++++++++++-
-file changed, 29 insertions(+)
+file changed, 34 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/target/riscv/op_helper.c
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
+                         get_field(mstatus, MSTATUS_SPIE));
- #include "qemu/osdep.h"
+     mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
- #include <sys/ioctl.h>
+     mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
 +#include <sys/prctl.h>
  #include <linux/kvm.h>
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/runstate.h"
  #include "hw/riscv/numa.h"
 +#define PR_RISCV_V_SET_CONTROL            69
 +#define PR_RISCV_V_VSTATE_CTRL_ON          2
 +
- void riscv_kvm_aplic_request(void *opaque, int irq, int level)
++    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
- {
++        if (riscv_has_ext(env, RVH)) {
-     kvm_set_irq(kvm_state, irq, !!level);
++            target_ulong prev_vu = get_field(env->hstatus, HSTATUS_SPV) &&
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_instance_init(CPUState *cs)
++                                   prev_priv == PRV_U;
 +            /* Returning to VU from HS, vsstatus.sdt = 0 */
 +            if (!env->virt_enabled && prev_vu) {
 +                env->vsstatus = set_field(env->vsstatus, MSTATUS_SDT, 0);
 +            }
 +        }
 +        mstatus = set_field(mstatus, MSTATUS_SDT, 0);
 +    }
      if (env->priv_ver >= PRIV_VERSION_1_12_0) {
          mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
      }
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
          target_ulong hstatus = env->hstatus;
          prev_virt = get_field(hstatus, HSTATUS_SPV);
 -
          hstatus = set_field(hstatus, HSTATUS_SPV, 0);
          env->hstatus = hstatus;
@@ -XXX,XX +XXX,XX @@ static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
          riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
      }
  }
++static target_ulong ssdbltrp_mxret(CPURISCVState *env, target_ulong mstatus,
-+/*
++                                   target_ulong prev_priv,
-+ * We'll get here via the following path:
++                                   target_ulong prev_virt)
 + *
 + * riscv_cpu_realize()
 + *   -> cpu_exec_realizefn()
 + *      -> kvm_cpu_realize() (via accel_cpu_common_realize())
 + */
 +static bool kvm_cpu_realize(CPUState *cs, Error **errp)
 +{
-+    RISCVCPU *cpu = RISCV_CPU(cs);
++    /* If returning to U, VS or VU, sstatus.sdt = 0 */
-+    int ret;
++    if (prev_priv == PRV_U || (prev_virt &&
-+
++        (prev_priv == PRV_S || prev_priv == PRV_U))) {
-+    if (riscv_has_ext(&cpu->env, RVV)) {
++        mstatus = set_field(mstatus, MSTATUS_SDT, 0);
-+        ret = prctl(PR_RISCV_V_SET_CONTROL, PR_RISCV_V_VSTATE_CTRL_ON);
++        /* If returning to VU, vsstatus.sdt = 0 */
-+        if (ret) {
++        if (prev_virt && prev_priv == PRV_U) {
-+            error_setg(errp, "Error in prctl PR_RISCV_V_SET_CONTROL, code: %s",
++            env->vsstatus = set_field(env->vsstatus, MSTATUS_SDT, 0);
 +                       strerrorname_np(errno));
 +            return false;
 +        }
 +    }
 +
-+   return true;
++    return mstatus;
 +}
-+
- static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
+ target_ulong helper_mret(CPURISCVState *env)
  {
-     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
+     mstatus = set_field(mstatus, MSTATUS_MPP,
-     acc->cpu_instance_init = kvm_cpu_instance_init;
+                         riscv_has_ext(env, RVU) ? PRV_U : PRV_M);
-+    acc->cpu_target_realize = kvm_cpu_realize;
+     mstatus = set_field(mstatus, MSTATUS_MPV, 0);
- }
++    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
++        mstatus = ssdbltrp_mxret(env, mstatus, prev_priv, prev_virt);
- static const TypeInfo kvm_cpu_accel_type_info = {
++    }
      if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) {
          mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
      }
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
      if (prev_priv < PRV_M) {
          env->mstatus = set_field(env->mstatus, MSTATUS_MPRV, false);
      }
 +    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
 +        env->mstatus = ssdbltrp_mxret(env, env->mstatus, prev_priv, prev_virt);
 +    }
      if (riscv_has_ext(env, RVH) && prev_virt) {
          riscv_cpu_swap_hypervisor_regs(env);
 --
-.43.0
+.48.1

-[PULL 17/65] hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
+[PULL v2 42/50] target/riscv: Implement Ssdbltrp exception handling
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-Add IMSIC structure in MADT when IMSIC is configured.
+When the Ssdbltrp ISA extension is enabled, if a trap happens in S-mode
 while SSTATUS.SDT isn't cleared, generate a double trap exception to
 M-mode.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250110125441.3208676-5-cleger@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-7-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 35 +++++++++++++++++++++++++++++++++++
+ target/riscv/cpu_bits.h   |  1 +
-file changed, 35 insertions(+)
+ target/riscv/cpu.c        |  2 +-
  target/riscv/cpu_helper.c | 42 ++++++++++++++++++++++++++++++++++-----
 files changed, 39 insertions(+), 6 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/cpu_bits.h
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
-     MachineClass *mc = MACHINE_GET_CLASS(s);
+     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
-     MachineState *ms = MACHINE(s);
+     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
-     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
+     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
-+    uint8_t  group_index_bits = imsic_num_bits(riscv_socket_count(ms));
++    RISCV_EXCP_DOUBLE_TRAP = 0x10,
-+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
+     RISCV_EXCP_SW_CHECK = 0x12, /* since: priv-1.13.0 */
-+    uint16_t imsic_max_hart_per_socket = 0;
+     RISCV_EXCP_HW_ERR = 0x13, /* since: priv-1.13.0 */
-+    uint8_t  hart_index_bits;
+     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
-+    uint8_t  socket;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-+
+index XXXXXXX..XXXXXXX 100644
-+    for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+--- a/target/riscv/cpu.c
-+        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
++++ b/target/riscv/cpu.c
-+            imsic_max_hart_per_socket = s->soc[socket].num_harts;
+@@ -XXX,XX +XXX,XX @@ static const char * const riscv_excp_names[] = {
      "load_page_fault",
      "reserved",
      "store_page_fault",
 -    "reserved",
 +    "double_trap",
      "reserved",
      "reserved",
      "reserved",
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      bool virt = env->virt_enabled;
      bool write_gva = false;
      bool always_storeamo = (env->excp_uw2 & RISCV_UW2_ALWAYS_STORE_AMO);
 +    bool vsmode_exc;
      uint64_t s;
      int mode;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          !(env->mip & (1ULL << cause));
      bool vs_injected = env->hvip & (1ULL << cause) & env->hvien &&
          !(env->mip & (1ULL << cause));
 +    bool smode_double_trap = false;
 +    uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
      target_ulong tval = 0;
      target_ulong tinst = 0;
      target_ulong htval = 0;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      mode = env->priv <= PRV_S && cause < 64 &&
          (((deleg >> cause) & 1) || s_injected || vs_injected) ? PRV_S : PRV_M;
 +    vsmode_exc = env->virt_enabled && (((hdeleg >> cause) & 1) || vs_injected);
 +    /*
 +     * Check double trap condition only if already in S-mode and targeting
 +     * S-mode
 +     */
 +    if (cpu->cfg.ext_ssdbltrp && env->priv == PRV_S && mode == PRV_S) {
 +        bool dte = (env->menvcfg & MENVCFG_DTE) != 0;
 +        bool sdt = (env->mstatus & MSTATUS_SDT) != 0;
 +        /* In VS or HS */
 +        if (riscv_has_ext(env, RVH)) {
 +            if (vsmode_exc) {
 +                /* VS -> VS, use henvcfg instead of menvcfg*/
 +                dte = (env->henvcfg & HENVCFG_DTE) != 0;
 +            } else if (env->virt_enabled) {
 +                /* VS -> HS, use mstatus_hs */
 +                sdt = (env->mstatus_hs & MSTATUS_SDT) != 0;
 +            }
 +        }
 +        smode_double_trap = dte && sdt;
 +        if (smode_double_trap) {
 +            mode = PRV_M;
 +        }
 +    }
 +
-+    hart_index_bits = imsic_num_bits(imsic_max_hart_per_socket);
+     if (mode == PRV_S) {
+         /* handle the trap in S-mode */
-     AcpiTable table = { .sig = "APIC", .rev = 6, .oem_id = s->oem_id,
+         /* save elp status */
-                         .oem_table_id = s->oem_table_id };
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
+         }
-         riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
-     }
+         if (riscv_has_ext(env, RVH)) {
+-            uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
-+    /* IMSIC */
+-
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+-            if (env->virt_enabled &&
-+        /* IMSIC */
+-                (((hdeleg >> cause) & 1) || vs_injected)) {
-+        build_append_int_noprefix(table_data, 0x19, 1);     /* Type */
++            if (vsmode_exc) {
-+        build_append_int_noprefix(table_data, 16, 1);       /* Length */
+                 /* Trap to VS mode */
-+        build_append_int_noprefix(table_data, 1, 1);        /* Version */
+                 /*
-+        build_append_int_noprefix(table_data, 0, 1);        /* Reserved */
+                  * See if we need to adjust cause. Yes if its VS mode interrupt
-+        build_append_int_noprefix(table_data, 0, 4);        /* Flags */
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-+        /* Number of supervisor mode Interrupt Identities */
+         s = set_field(s, MSTATUS_SPIE, get_field(s, MSTATUS_SIE));
-+        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
+         s = set_field(s, MSTATUS_SPP, env->priv);
-+        /* Number of guest mode Interrupt Identities */
+         s = set_field(s, MSTATUS_SIE, 0);
-+        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
++        if (riscv_env_smode_dbltrp_enabled(env, virt)) {
-+        /* Guest Index Bits */
++            s = set_field(s, MSTATUS_SDT, 1);
-+        build_append_int_noprefix(table_data, guest_index_bits, 1);
++        }
-+        /* Hart Index Bits */
+         env->mstatus = s;
-+        build_append_int_noprefix(table_data, hart_index_bits, 1);
+         sxlen = 16 << riscv_cpu_sxl(env);
-+        /* Group Index Bits */
+         env->scause = cause | ((target_ulong)async << (sxlen - 1));
-+        build_append_int_noprefix(table_data, group_index_bits, 1);
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-+        /* Group Index Shift */
+         s = set_field(s, MSTATUS_MIE, 0);
-+        build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
+         env->mstatus = s;
-+    }
+         env->mcause = cause | ((target_ulong)async << (mxlen - 1));
-+
++        if (smode_double_trap) {
-     acpi_table_end(linker, &table);
++            env->mtval2 = env->mcause;
- }
++            env->mcause = RISCV_EXCP_DOUBLE_TRAP;
++        } else {
 +            env->mtval2 = mtval2;
 +        }
          env->mepc = env->pc;
          env->mtval = tval;
 -        env->mtval2 = mtval2;
          env->mtinst = tinst;
          /*
 --
-.43.0
+.48.1

-[PULL 06/65] target/riscv/cpu.c: fix machine IDs getters
+[PULL v2 43/50] target/riscv: Add Ssdbltrp ISA extension enable switch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-mvendorid is an uint32 property, mimpid/marchid are uint64 properties.
+Add the switch to enable the Ssdbltrp ISA extension.
 But their getters are returning bools. The reason this went under the
 radar for this long is because we have no code using the getters.
-The problem can be seem via the 'qom-get' API though. Launching QEMU
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
 with the 'veyron-v1' CPU, a model with:
 VEYRON_V1_MVENDORID: 0x61f (1567)
 VEYRON_V1_MIMPID: 0x111 (273)
 VEYRON_V1_MARCHID: 0x8000000000010000 (9223372036854841344)
 This is what the API returns when retrieving these properties:
 (qemu) qom-get /machine/soc0/harts[0] mvendorid
 true
 (qemu) qom-get /machine/soc0/harts[0] mimpid
 true
 (qemu) qom-get /machine/soc0/harts[0] marchid
 true
 After this patch:
 (qemu) qom-get /machine/soc0/harts[0] mvendorid
 (qemu) qom-get /machine/soc0/harts[0] mimpid
 (qemu) qom-get /machine/soc0/harts[0] marchid
 9223372036854841344
 Fixes: 1e34150045 ("target/riscv/cpu.c: restrict 'mvendorid' value")
 Fixes: a1863ad368 ("target/riscv/cpu.c: restrict 'mimpid' value")
 Fixes: d6a427e2c0 ("target/riscv/cpu.c: restrict 'marchid' value")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20250110125441.3208676-6-cleger@rivosinc.com>
 Message-ID: <20231211170732.2541368-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 12 ++++++------
+ target/riscv/cpu.c | 2 ++
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 2 insertions(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
- static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-                               void *opaque, Error **errp)
+     ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
- {
+     ISA_EXT_DATA_ENTRY(sscsrind, PRIV_VERSION_1_12_0, ext_sscsrind),
--    bool value = RISCV_CPU(obj)->cfg.mvendorid;
++    ISA_EXT_DATA_ENTRY(ssdbltrp, PRIV_VERSION_1_13_0, ext_ssdbltrp),
-+    uint32_t value = RISCV_CPU(obj)->cfg.mvendorid;
+     ISA_EXT_DATA_ENTRY(ssnpm, PRIV_VERSION_1_13_0, ext_ssnpm),
+     ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
--    visit_type_bool(v, name, &value, errp);
+     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
-+    visit_type_uint32(v, name, &value, errp);
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
- }
+     MULTI_EXT_CFG_BOOL("smnpm", ext_smnpm, false),
+     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
- static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
+     MULTI_EXT_CFG_BOOL("ssaia", ext_ssaia, false),
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
++    MULTI_EXT_CFG_BOOL("ssdbltrp", ext_ssdbltrp, false),
- static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
+     MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
-                            void *opaque, Error **errp)
+     MULTI_EXT_CFG_BOOL("svadu", ext_svadu, true),
- {
+     MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
 -    bool value = RISCV_CPU(obj)->cfg.mimpid;
 +    uint64_t value = RISCV_CPU(obj)->cfg.mimpid;
 -    visit_type_bool(v, name, &value, errp);
 +    visit_type_uint64(v, name, &value, errp);
  }
  static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
  static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
  {
 -    bool value = RISCV_CPU(obj)->cfg.marchid;
 +    uint64_t value = RISCV_CPU(obj)->cfg.marchid;
 -    visit_type_bool(v, name, &value, errp);
 +    visit_type_uint64(v, name, &value, errp);
  }
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
 --
-.43.0
+.48.1

-[PULL 08/65] target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM_REG_RISCV_FP_D regs are always u64 size. Using kvm_riscv_reg_id() in
-RISCV_FP_D_REG() ends up encoding the wrong size if we're running with
-TARGET_RISCV32.
-Create a new helper that returns a KVM ID with u64 size and use it with
-RISCV_FP_D_REG().
-Reported-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-3-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
-file changed, 8 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
-     return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
- }
-+static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-+{
-+    return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
-+}
-+
- #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
-                  KVM_REG_RISCV_CORE_REG(name))
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
- #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
--#define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
-+#define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
- #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
-     do { \
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
-     if (riscv_has_ext(env, RVD)) {
-         uint64_t reg;
-         for (i = 0; i < 32; i++) {
--            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
-+            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(i), &reg);
-             if (ret) {
-                 return ret;
-             }
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
-         uint64_t reg;
-         for (i = 0; i < 32; i++) {
-             reg = env->fpr[i];
--            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
-+            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(i), &reg);
-             if (ret) {
-                 return ret;
-             }
---
-.43.0

-[PULL 09/65] target/riscv/kvm: change timer regs size to u64
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM_REG_RISCV_TIMER regs are always u64 according to the KVM API, but at
-this moment we'll return u32 regs if we're running a RISCV32 target.
-Use the kvm_riscv_reg_id_u64() helper in RISCV_TIMER_REG() to fix it.
-Reported-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-4-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 26 +++++++++++++-------------
-file changed, 13 insertions(+), 13 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
- #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
-                  KVM_REG_RISCV_CSR_REG(name))
--#define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
-+#define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
-                  KVM_REG_RISCV_TIMER_REG(name))
- #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-         } \
-     } while (0)
--#define KVM_RISCV_GET_TIMER(cs, env, name, reg) \
-+#define KVM_RISCV_GET_TIMER(cs, name, reg) \
-     do { \
--        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
-+        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
-         if (ret) { \
-             abort(); \
-         } \
-     } while (0)
--#define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
-+#define KVM_RISCV_SET_TIMER(cs, name, reg) \
-     do { \
--        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
-+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
-         if (ret) { \
-             abort(); \
-         } \
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_get_regs_timer(CPUState *cs)
-         return;
-     }
--    KVM_RISCV_GET_TIMER(cs, env, time, env->kvm_timer_time);
--    KVM_RISCV_GET_TIMER(cs, env, compare, env->kvm_timer_compare);
--    KVM_RISCV_GET_TIMER(cs, env, state, env->kvm_timer_state);
--    KVM_RISCV_GET_TIMER(cs, env, frequency, env->kvm_timer_frequency);
-+    KVM_RISCV_GET_TIMER(cs, time, env->kvm_timer_time);
-+    KVM_RISCV_GET_TIMER(cs, compare, env->kvm_timer_compare);
-+    KVM_RISCV_GET_TIMER(cs, state, env->kvm_timer_state);
-+    KVM_RISCV_GET_TIMER(cs, frequency, env->kvm_timer_frequency);
-     env->kvm_timer_dirty = true;
- }
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-         return;
-     }
--    KVM_RISCV_SET_TIMER(cs, env, time, env->kvm_timer_time);
--    KVM_RISCV_SET_TIMER(cs, env, compare, env->kvm_timer_compare);
-+    KVM_RISCV_SET_TIMER(cs, time, env->kvm_timer_time);
-+    KVM_RISCV_SET_TIMER(cs, compare, env->kvm_timer_compare);
-     /*
-      * To set register of RISCV_TIMER_REG(state) will occur a error from KVM
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-      * TODO If KVM changes, adapt here.
-      */
-     if (env->kvm_timer_state) {
--        KVM_RISCV_SET_TIMER(cs, env, state, env->kvm_timer_state);
-+        KVM_RISCV_SET_TIMER(cs, state, env->kvm_timer_state);
-     }
-     /*
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-      * during the migration.
-      */
-     if (migration_is_running(migrate_get_current()->state)) {
--        KVM_RISCV_GET_TIMER(cs, env, frequency, reg);
-+        KVM_RISCV_GET_TIMER(cs, frequency, reg);
-         if (reg != env->kvm_timer_frequency) {
-             error_report("Dst Hosts timer frequency != Src Hosts");
-         }
---
-.43.0

-[PULL 11/65] target/riscv/kvm: rename riscv_reg_id() to riscv_reg_id_ulong()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-kvm_riscv_reg_id() returns an id encoded with an ulong size, i.e. an u32
-size when running TARGET_RISCV32 and u64 when running TARGET_RISCV64.
-Rename it to kvm_riscv_reg_id_ulong() to enhance code readability. It'll
-be in line with the existing kvm_riscv_reg_id_<size>() helpers.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-6-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 40 ++++++++++++++++++++------------------
-file changed, 21 insertions(+), 19 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ void riscv_kvm_aplic_request(void *opaque, int irq, int level)
- static bool cap_has_mp_state;
--static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-+static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
-                                  uint64_t idx)
- {
-     uint64_t id = KVM_REG_RISCV | type | idx;
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-     return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
- }
--#define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
--                 KVM_REG_RISCV_CORE_REG(name))
-+#define RISCV_CORE_REG(env, name) \
-+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, \
-+                           KVM_REG_RISCV_CORE_REG(name))
--#define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
--                 KVM_REG_RISCV_CSR_REG(name))
-+#define RISCV_CSR_REG(env, name) \
-+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CSR, \
-+                           KVM_REG_RISCV_CSR_REG(name))
- #define RISCV_CONFIG_REG(env, name) \
--    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
--                     KVM_REG_RISCV_CONFIG_REG(name))
-+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG, \
-+                           KVM_REG_RISCV_CONFIG_REG(name))
- #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
-                  KVM_REG_RISCV_TIMER_REG(name))
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
-         /* If we're here we're going to disable the MISA bit */
-         reg = 0;
--        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
--                              misa_cfg->kvm_reg_id);
-+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
-+                                    misa_cfg->kvm_reg_id);
-         ret = kvm_set_one_reg(cs, id, &reg);
-         if (ret != 0) {
-             /*
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
-             continue;
-         }
--        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
--                              multi_ext_cfg->kvm_reg_id);
-+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
-+                                    multi_ext_cfg->kvm_reg_id);
-         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
-         ret = kvm_set_one_reg(cs, id, &reg);
-         if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_core(CPUState *cs)
-     env->pc = reg;
-     for (i = 1; i < 32; i++) {
--        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
-+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
-         ret = kvm_get_one_reg(cs, id, &reg);
-         if (ret) {
-             return ret;
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_core(CPUState *cs)
-     }
-     for (i = 1; i < 32; i++) {
--        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
-+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
-         reg = env->gpr[i];
-         ret = kvm_set_one_reg(cs, id, &reg);
-         if (ret) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
-     struct kvm_one_reg reg;
-     int ret;
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                              cbomz_cfg->kvm_reg_id);
-+    reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
-+                                    cbomz_cfg->kvm_reg_id);
-     reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-     if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
-         KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
-         struct kvm_one_reg reg;
--        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
--                                  multi_ext_cfg->kvm_reg_id);
-+        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
-+                                        multi_ext_cfg->kvm_reg_id);
-         reg.addr = (uint64_t)&val;
-         ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-         if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
-     for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
-         multi_ext_cfg = &kvm_multi_ext_cfgs[i];
--        reg_id = kvm_riscv_reg_id(&cpu->env, KVM_REG_RISCV_ISA_EXT,
--                                  multi_ext_cfg->kvm_reg_id);
-+        reg_id = kvm_riscv_reg_id_ulong(&cpu->env, KVM_REG_RISCV_ISA_EXT,
-+                                        multi_ext_cfg->kvm_reg_id);
-         reg_search = bsearch(&reg_id, reglist->reg, reglist->n,
-                              sizeof(uint64_t), uint64_cmp);
-         if (!reg_search) {
---
-.43.0

-[PULL 13/65] hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-RISC-V also needs to create the virtio in DSDT in the same way as ARM.
-So, instead of duplicating the code, move this function to the device
-specific file which is common across architectures.
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-3-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/virtio/virtio-acpi.h | 16 ++++++++++++++++
- hw/arm/virt-acpi-build.c        | 32 ++++----------------------------
- hw/virtio/virtio-acpi.c         | 33 +++++++++++++++++++++++++++++++++
- hw/virtio/meson.build           |  1 +
-files changed, 54 insertions(+), 28 deletions(-)
- create mode 100644 include/hw/virtio/virtio-acpi.h
- create mode 100644 hw/virtio/virtio-acpi.c
-diff --git a/include/hw/virtio/virtio-acpi.h b/include/hw/virtio/virtio-acpi.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/virtio/virtio-acpi.h
-@@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0+ */
-+/*
-+ * ACPI support for virtio
-+ */
-+
-+#ifndef VIRTIO_ACPI_H
-+#define VIRTIO_ACPI_H
-+
-+#include "qemu/osdep.h"
-+#include "exec/hwaddr.h"
-+
-+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr virtio_mmio_base,
-+                          const hwaddr virtio_mmio_size, uint32_t mmio_irq,
-+                          long int start_index, int num);
-+
-+#endif
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
-+++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
- #include "migration/vmstate.h"
- #include "hw/acpi/ghes.h"
- #include "hw/acpi/viot.h"
-+#include "hw/virtio/virtio-acpi.h"
- #define ARM_SPI_BASE 32
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
-     aml_append(scope, dev);
- }
--static void acpi_dsdt_add_virtio(Aml *scope,
--                                 const MemMapEntry *virtio_mmio_memmap,
--                                 uint32_t mmio_irq, int num)
--{
--    hwaddr base = virtio_mmio_memmap->base;
--    hwaddr size = virtio_mmio_memmap->size;
--    int i;
--
--    for (i = 0; i < num; i++) {
--        uint32_t irq = mmio_irq + i;
--        Aml *dev = aml_device("VR%02u", i);
--        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
--        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
--        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
--
--        Aml *crs = aml_resource_template();
--        aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
--        aml_append(crs,
--                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
--                                 AML_EXCLUSIVE, &irq, 1));
--        aml_append(dev, aml_name_decl("_CRS", crs));
--        aml_append(scope, dev);
--        base += size;
--    }
--}
--
- static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
-                               uint32_t irq, VirtMachineState *vms)
- {
-@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
-         acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
-     }
-     fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
--    acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
--                    (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
-+    virtio_acpi_dsdt_add(scope, memmap[VIRT_MMIO].base, memmap[VIRT_MMIO].size,
-+                         (irqmap[VIRT_MMIO] + ARM_SPI_BASE),
-+                         0, NUM_VIRTIO_TRANSPORTS);
-     acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
-     if (vms->acpi_dev) {
-         build_ged_aml(scope, "\\_SB."GED_DEVICE,
-diff --git a/hw/virtio/virtio-acpi.c b/hw/virtio/virtio-acpi.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/virtio/virtio-acpi.c
-@@ -XXX,XX +XXX,XX @@
-+// SPDX-License-Identifier: GPL-2.0+
-+/*
-+ * virtio ACPI Support
-+ *
-+ */
-+
-+#include "hw/virtio/virtio-acpi.h"
-+#include "hw/acpi/aml-build.h"
-+
-+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr base, const hwaddr size,
-+                          uint32_t mmio_irq, long int start_index, int num)
-+{
-+    hwaddr virtio_base = base;
-+    uint32_t irq = mmio_irq;
-+    long int i;
-+
-+    for (i = start_index; i < start_index + num; i++) {
-+        Aml *dev = aml_device("VR%02u", (unsigned)i);
-+        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
-+        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
-+        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-+
-+        Aml *crs = aml_resource_template();
-+        aml_append(crs, aml_memory32_fixed(virtio_base, size, AML_READ_WRITE));
-+        aml_append(crs,
-+                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
-+                                 AML_EXCLUSIVE, &irq, 1));
-+        aml_append(dev, aml_name_decl("_CRS", crs));
-+        aml_append(scope, dev);
-+        virtio_base += size;
-+        irq++;
-+    }
-+}
-diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/meson.build
-+++ b/hw/virtio/meson.build
-@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('virtio-stub.c'))
- system_ss.add(files('virtio-hmp-cmds.c'))
- specific_ss.add_all(when: 'CONFIG_VIRTIO', if_true: specific_virtio_ss)
-+system_ss.add(when: 'CONFIG_ACPI', if_true: files('virtio-acpi.c'))
---
-.43.0

-[PULL 14/65] hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-With common function to add virtio in DSDT created now, update microvm
-code also to use it instead of duplicate code.
-Suggested-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-4-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/i386/acpi-microvm.c | 15 ++-------------
-file changed, 2 insertions(+), 13 deletions(-)
-diff --git a/hw/i386/acpi-microvm.c b/hw/i386/acpi-microvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/acpi-microvm.c
-+++ b/hw/i386/acpi-microvm.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/pci/pci.h"
- #include "hw/pci/pcie_host.h"
- #include "hw/usb/xhci.h"
-+#include "hw/virtio/virtio-acpi.h"
- #include "hw/virtio/virtio-mmio.h"
- #include "hw/input/i8042.h"
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_virtio(Aml *scope,
-             uint32_t irq = mms->virtio_irq_base + index;
-             hwaddr base = VIRTIO_MMIO_BASE + index * 512;
-             hwaddr size = 512;
--
--            Aml *dev = aml_device("VR%02u", (unsigned)index);
--            aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
--            aml_append(dev, aml_name_decl("_UID", aml_int(index)));
--            aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
--
--            Aml *crs = aml_resource_template();
--            aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
--            aml_append(crs,
--                       aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
--                                     AML_EXCLUSIVE, &irq, 1));
--            aml_append(dev, aml_name_decl("_CRS", crs));
--            aml_append(scope, dev);
-+            virtio_acpi_dsdt_add(scope, base, size, irq, index, 1);
-         }
-     }
- }
---
-.43.0

-[PULL 15/65] hw/riscv: virt: Make few IMSIC macros and functions public
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Some macros and static function related to IMSIC are defined in virt.c.
-They are required in virt-acpi-build.c. So, make them public.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-5-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/riscv/virt.h | 25 +++++++++++++++++++++++++
- hw/riscv/virt.c         | 25 +------------------------
-files changed, 26 insertions(+), 24 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
-+++ b/include/hw/riscv/virt.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/riscv_hart.h"
- #include "hw/sysbus.h"
- #include "hw/block/flash.h"
-+#include "hw/intc/riscv_imsic.h"
- #define VIRT_CPUS_MAX_BITS             9
- #define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
-@@ -XXX,XX +XXX,XX @@ enum {
- bool virt_is_acpi_enabled(RISCVVirtState *s);
- void virt_acpi_setup(RISCVVirtState *vms);
-+uint32_t imsic_num_bits(uint32_t count);
-+
-+/*
-+ * The virt machine physical address space used by some of the devices
-+ * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
-+ * number of CPUs, and number of IMSIC guest files.
-+ *
-+ * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
-+ * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
-+ * of virt machine physical address space.
-+ */
-+
-+#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
-+#if VIRT_IMSIC_GROUP_MAX_SIZE < \
-+    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
-+#error "Can't accomodate single IMSIC group in address space"
-+#endif
-+
-+#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
-+                                        VIRT_IMSIC_GROUP_MAX_SIZE)
-+#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
-+#error "Can't accomodate all IMSIC groups in address space"
-+#endif
-+
- #endif
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
- #include "kvm/kvm_riscv.h"
- #include "hw/intc/riscv_aclint.h"
- #include "hw/intc/riscv_aplic.h"
--#include "hw/intc/riscv_imsic.h"
- #include "hw/intc/sifive_plic.h"
- #include "hw/misc/sifive_test.h"
- #include "hw/platform-bus.h"
-@@ -XXX,XX +XXX,XX @@
- #include "hw/acpi/aml-build.h"
- #include "qapi/qapi-visit-common.h"
--/*
-- * The virt machine physical address space used by some of the devices
-- * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
-- * number of CPUs, and number of IMSIC guest files.
-- *
-- * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
-- * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
-- * of virt machine physical address space.
-- */
--
--#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
--#if VIRT_IMSIC_GROUP_MAX_SIZE < \
--    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
--#error "Can't accommodate single IMSIC group in address space"
--#endif
--
--#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
--                                        VIRT_IMSIC_GROUP_MAX_SIZE)
--#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
--#error "Can't accommodate all IMSIC groups in address space"
--#endif
--
- /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
- static bool virt_use_kvm_aia(RISCVVirtState *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
-     g_free(plic_cells);
- }
--static uint32_t imsic_num_bits(uint32_t count)
-+uint32_t imsic_num_bits(uint32_t count)
- {
-     uint32_t ret = 0;
---
-.43.0

-[PULL 16/65] hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Update the RINTC structure in MADT with AIA related fields.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-6-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 43 ++++++++++++++++++++++++++++++++++----
-file changed, 39 insertions(+), 4 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/intc/riscv_aclint.h"
- #define ACPI_BUILD_TABLE_SIZE             0x20000
-+#define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
- typedef struct AcpiBuildState {
-     /* Copy of table in RAM (for patching) */
-@@ -XXX,XX +XXX,XX @@ static void acpi_align_size(GArray *blob, unsigned align)
- static void riscv_acpi_madt_add_rintc(uint32_t uid,
-                                       const CPUArchIdList *arch_ids,
--                                      GArray *entry)
-+                                      GArray *entry,
-+                                      RISCVVirtState *s)
- {
-+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
-     uint64_t hart_id = arch_ids->cpus[uid].arch_id;
-+    uint32_t imsic_size, local_cpu_id, socket_id;
-+    uint64_t imsic_socket_addr, imsic_addr;
-+    MachineState *ms = MACHINE(s);
-+    socket_id = arch_ids->cpus[uid].props.node_id;
-+    local_cpu_id = (arch_ids->cpus[uid].arch_id -
-+                    riscv_socket_first_hartid(ms, socket_id)) %
-+                    riscv_socket_hart_count(ms, socket_id);
-+    imsic_socket_addr = s->memmap[VIRT_IMSIC_S].base +
-+                        (socket_id * VIRT_IMSIC_GROUP_MAX_SIZE);
-+    imsic_size = IMSIC_HART_SIZE(guest_index_bits);
-+    imsic_addr = imsic_socket_addr + local_cpu_id * imsic_size;
-     build_append_int_noprefix(entry, 0x18, 1);       /* Type     */
--    build_append_int_noprefix(entry, 20, 1);         /* Length   */
-+    build_append_int_noprefix(entry, 36, 1);         /* Length   */
-     build_append_int_noprefix(entry, 1, 1);          /* Version  */
-     build_append_int_noprefix(entry, 0, 1);          /* Reserved */
-     build_append_int_noprefix(entry, 0x1, 4);        /* Flags    */
-     build_append_int_noprefix(entry, hart_id, 8);    /* Hart ID  */
-     build_append_int_noprefix(entry, uid, 4);        /* ACPI Processor UID */
-+    /* External Interrupt Controller ID */
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-+        build_append_int_noprefix(entry,
-+                                  ACPI_BUILD_INTC_ID(
-+                                      arch_ids->cpus[uid].props.node_id,
-+                                      local_cpu_id),
-+                                  4);
-+    } else {
-+        build_append_int_noprefix(entry, 0, 4);
-+    }
-+
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-+        /* IMSIC Base address */
-+        build_append_int_noprefix(entry, imsic_addr, 8);
-+        /* IMSIC Size */
-+        build_append_int_noprefix(entry, imsic_size, 4);
-+    } else {
-+        build_append_int_noprefix(entry, 0, 8);
-+        build_append_int_noprefix(entry, 0, 4);
-+    }
- }
- static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
-                        aml_int(arch_ids->cpus[i].arch_id)));
-             /* build _MAT object */
--            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf);
-+            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf, s);
-             aml_append(dev, aml_name_decl("_MAT",
-                                           aml_buffer(madt_buf->len,
-                                           (uint8_t *)madt_buf->data)));
-@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
-  * 5.2.12 Multiple APIC Description Table (MADT)
-  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/15
-  *      https://drive.google.com/file/d/1R6k4MshhN3WTT-hwqAquu5nX6xSEqK2l/view
-+ *      https://drive.google.com/file/d/1oMGPyOD58JaPgMl1pKasT-VKsIKia7zR/view
-  */
- static void build_madt(GArray *table_data,
-                        BIOSLinker *linker,
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
-     /* RISC-V Local INTC structures per HART */
-     for (int i = 0; i < arch_ids->len; i++) {
--        riscv_acpi_madt_add_rintc(i, arch_ids, table_data);
-+        riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
-     }
-     acpi_table_end(linker, &table);
---
-.43.0

-[PULL 20/65] hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
+[PULL v2 44/50] target/riscv: Add Smdbltrp CSRs handling
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-MMU type information is available via MMU node in RHCT. Add this node in
+Add `ext_smdbltrp`in RISCVCPUConfig and implement MSTATUS.MDT behavior.
-RHCT.
+Also set MDT to 1 at reset according to the specification.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250110125441.3208676-7-cleger@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-10-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 36 +++++++++++++++++++++++++++++++++++-
+ target/riscv/cpu_bits.h |  1 +
-file changed, 35 insertions(+), 1 deletion(-)
+ target/riscv/cpu_cfg.h  |  1 +
  target/riscv/cpu.c      |  3 +++
  target/riscv/csr.c      | 13 +++++++++++++
 files changed, 18 insertions(+)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/cpu_bits.h
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@
-     size_t len, aligned_len;
+ #define MSTATUS_MPELP       0x020000000000 /* zicfilp */
-     uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
+ #define MSTATUS_GVA         0x4000000000ULL
-     RISCVCPU *cpu = &s->soc[0].harts[0];
+ #define MSTATUS_MPV         0x8000000000ULL
-+    uint32_t mmu_offset = 0;
++#define MSTATUS_MDT         0x40000000000ULL /* Smdbltrp extension */
-+    uint8_t satp_mode_max;
-     char *isa;
+ #define MSTATUS64_UXL       0x0000000300000000ULL
+ #define MSTATUS64_SXL       0x0000000C00000000ULL
-     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
+index XXXXXXX..XXXXXXX 100644
-         num_rhct_nodes++;
+--- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_smcsrind;
      bool ext_sscsrind;
      bool ext_ssdbltrp;
 +    bool ext_smdbltrp;
      bool ext_svadu;
      bool ext_svinval;
      bool ext_svnapot;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
              env->mstatus_hs = set_field(env->mstatus_hs,
                                          MSTATUS64_UXL, env->misa_mxl);
          }
 +        if (riscv_cpu_cfg(env)->ext_smdbltrp) {
 +            env->mstatus = set_field(env->mstatus, MSTATUS_MDT, 1);
 +        }
      }
+     env->mcause = 0;
-+    if (cpu->cfg.satp_mode.supported != 0) {
+     env->miclaim = MIP_SGEIP;
-+        num_rhct_nodes++;
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-+    }
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/riscv/csr.c
-     /* Number of RHCT nodes*/
++++ b/target/riscv/csr.c
-     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
          }
      }
-+    /* MMU node structure */
++    if (riscv_cpu_cfg(env)->ext_smdbltrp) {
-+    if (cpu->cfg.satp_mode.supported != 0) {
++        mask |= MSTATUS_MDT;
-+        satp_mode_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
++        if ((val & MSTATUS_MDT) != 0) {
-+        mmu_offset = table_data->len - table.table_offset;
++            val &= ~MSTATUS_MIE;
 +        build_append_int_noprefix(table_data, 2, 2);    /* Type */
 +        build_append_int_noprefix(table_data, 8, 2);    /* Length */
 +        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
 +        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
 +        /* MMU Type */
 +        if (satp_mode_max == VM_1_10_SV57) {
 +            build_append_int_noprefix(table_data, 2, 1);    /* Sv57 */
 +        } else if (satp_mode_max == VM_1_10_SV48) {
 +            build_append_int_noprefix(table_data, 1, 1);    /* Sv48 */
 +        } else if (satp_mode_max == VM_1_10_SV39) {
 +            build_append_int_noprefix(table_data, 0, 1);    /* Sv39 */
 +        } else {
 +            assert(1);
 +        }
 +    }
 +
-     /* Hart Info Node */
+     if (xl != MXL_RV32 || env->debugger) {
-     for (int i = 0; i < arch_ids->len; i++) {
+         if (riscv_has_ext(env, RVH)) {
-         len = 16;
+             mask |= MSTATUS_MPV | MSTATUS_GVA;
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
-             num_offsets++;
+     uint64_t valh = (uint64_t)val << 32;
-         }
+     uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
-+        if (mmu_offset) {
++    if (riscv_cpu_cfg(env)->ext_smdbltrp) {
-+            len += 4;
++        mask |= MSTATUS_MDT;
-+            num_offsets++;
++        if ((valh & MSTATUS_MDT) != 0) {
 +            mask |= MSTATUS_MIE;
 +        }
-+
++    }
-         build_append_int_noprefix(table_data, len, 2);
+     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
-         build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
-         /* Number of offsets */
+     return RISCV_EXCP_NONE;
          build_append_int_noprefix(table_data, num_offsets, 2);
          build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
 -
          /* Offsets */
          build_append_int_noprefix(table_data, isa_offset, 4);
          if (cmo_offset) {
              build_append_int_noprefix(table_data, cmo_offset, 4);
          }
 +
 +        if (mmu_offset) {
 +            build_append_int_noprefix(table_data, mmu_offset, 4);
 +        }
      }
      acpi_table_end(linker, &table);
 --
-.43.0
+.48.1

-[PULL 19/65] hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
+[PULL v2 45/50] target/riscv: Implement Smdbltrp sret, mret and mnret behavior
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-When CMO related extensions like Zicboz, Zicbom and Zicbop are enabled, the
+When the Ssdbltrp extension is enabled, SSTATUS.MDT field is cleared
-block size for those extensions need to be communicated via CMO node in
+when executing sret if executed in M-mode. When executing mret/mnret,
-RHCT. Add CMO node in RHCT if any of those CMO extensions are detected.
+SSTATUS.MDT is cleared.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250110125441.3208676-8-cleger@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-9-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 64 +++++++++++++++++++++++++++++++++-----
+ target/riscv/op_helper.c | 12 ++++++++++++
-file changed, 56 insertions(+), 8 deletions(-)
+file changed, 12 insertions(+)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/op_helper.c
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
-  * 5.2.36 RISC-V Hart Capabilities Table (RHCT)
+         }
-  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/16
+         mstatus = set_field(mstatus, MSTATUS_SDT, 0);
-  *      https://drive.google.com/file/d/1nP3nFiH4jkPMp6COOxP6123DCZKR-tia/view
+     }
-+ *      https://drive.google.com/file/d/1sKbOa8m1UZw1JkquZYe3F1zQBN1xXsaf/view
++    if (riscv_cpu_cfg(env)->ext_smdbltrp && env->priv >= PRV_M) {
-  */
++        mstatus = set_field(mstatus, MSTATUS_MDT, 0);
  static void build_rhct(GArray *table_data,
                         BIOSLinker *linker,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
      MachineState *ms = MACHINE(s);
      const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
      size_t len, aligned_len;
 -    uint32_t isa_offset, num_rhct_nodes;
 -    RISCVCPU *cpu;
 +    uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
 +    RISCVCPU *cpu = &s->soc[0].harts[0];
      char *isa;
      AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
      /* ISA + N hart info */
      num_rhct_nodes = 1 + ms->smp.cpus;
 +    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
 +        num_rhct_nodes++;
 +    }
+     if (env->priv_ver >= PRIV_VERSION_1_12_0) {
-     /* Number of RHCT nodes*/
+         mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
      build_append_int_noprefix(table_data, num_rhct_nodes, 4);
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
      isa_offset = table_data->len - table.table_offset;
      build_append_int_noprefix(table_data, 0, 2);   /* Type 0 */
 -    cpu = &s->soc[0].harts[0];
      isa = riscv_isa_string(cpu);
      len = 8 + strlen(isa) + 1;
      aligned_len = (len % 2) ? (len + 1) : len;
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
          build_append_int_noprefix(table_data, 0x0, 1);   /* Optional Padding */
      }
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
-+    /* CMO node */
+     if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
-+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
+         mstatus = ssdbltrp_mxret(env, mstatus, prev_priv, prev_virt);
-+        cmo_offset = table_data->len - table.table_offset;
+     }
-+        build_append_int_noprefix(table_data, 1, 2);    /* Type */
++    if (riscv_cpu_cfg(env)->ext_smdbltrp) {
-+        build_append_int_noprefix(table_data, 10, 2);   /* Length */
++        mstatus = set_field(mstatus, MSTATUS_MDT, 0);
-+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
++    }
-+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
+     if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) {
-+
+         mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
-+        /* CBOM block size */
+     }
-+        if (cpu->cfg.cbom_blocksize) {
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
-+            build_append_int_noprefix(table_data,
+         env->mstatus = ssdbltrp_mxret(env, env->mstatus, prev_priv, prev_virt);
-+                                      __builtin_ctz(cpu->cfg.cbom_blocksize),
+     }
-+                                      1);
-+        } else {
++    if (riscv_cpu_cfg(env)->ext_smdbltrp) {
-+            build_append_int_noprefix(table_data, 0, 1);
++        if (prev_priv < PRV_M) {
-+        }
++            env->mstatus = set_field(env->mstatus, MSTATUS_MDT, 0);
 +
 +        /* CBOP block size */
 +        build_append_int_noprefix(table_data, 0, 1);
 +
 +        /* CBOZ block size */
 +        if (cpu->cfg.cboz_blocksize) {
 +            build_append_int_noprefix(table_data,
 +                                      __builtin_ctz(cpu->cfg.cboz_blocksize),
 +                                      1);
 +        } else {
 +            build_append_int_noprefix(table_data, 0, 1);
 +        }
 +    }
 +
-     /* Hart Info Node */
+     if (riscv_has_ext(env, RVH) && prev_virt) {
-     for (int i = 0; i < arch_ids->len; i++) {
+         riscv_cpu_swap_hypervisor_regs(env);
 +        len = 16;
 +        int num_offsets = 1;
          build_append_int_noprefix(table_data, 0xFFFF, 2);  /* Type */
 -        build_append_int_noprefix(table_data, 16, 2);      /* Length */
 -        build_append_int_noprefix(table_data, 0x1, 2);     /* Revision */
 -        build_append_int_noprefix(table_data, 1, 2);    /* Number of offsets */
 -        build_append_int_noprefix(table_data, i, 4);    /* ACPI Processor UID */
 -        build_append_int_noprefix(table_data, isa_offset, 4); /* Offsets[0] */
 +
 +        /* Length */
 +        if (cmo_offset) {
 +            len += 4;
 +            num_offsets++;
 +        }
 +
 +        build_append_int_noprefix(table_data, len, 2);
 +        build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
 +        /* Number of offsets */
 +        build_append_int_noprefix(table_data, num_offsets, 2);
 +        build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
 +
 +        /* Offsets */
 +        build_append_int_noprefix(table_data, isa_offset, 4);
 +        if (cmo_offset) {
 +            build_append_int_noprefix(table_data, cmo_offset, 4);
 +        }
      }
-     acpi_table_end(linker, &table);
 --
-.43.0
+.48.1

-[PULL 24/65] hw/riscv/virt-acpi-build.c: Add PLIC in MADT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Add PLIC structures for each socket in the MADT when system is
-configured with PLIC as the external interrupt controller.
-Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-14-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 29 +++++++++++++++++++++++++++++
-file changed, 29 insertions(+)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_acpi_madt_add_rintc(uint32_t uid,
-                                       arch_ids->cpus[uid].props.node_id,
-                                       local_cpu_id),
-);
-+    } else if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-+        build_append_int_noprefix(entry,
-+                                  ACPI_BUILD_INTC_ID(
-+                                      arch_ids->cpus[uid].props.node_id,
-+                                      2 * local_cpu_id + 1),
-+                                  4);
-     } else {
-         build_append_int_noprefix(entry, 0, 4);
-     }
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
-             build_append_int_noprefix(table_data,
-                                       s->memmap[VIRT_APLIC_S].size, 4);
-         }
-+    } else {
-+        /* PLICs */
-+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
-+            aplic_addr = s->memmap[VIRT_PLIC].base +
-+                         s->memmap[VIRT_PLIC].size * socket;
-+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
-+            build_append_int_noprefix(table_data, 0x1B, 1);   /* Type */
-+            build_append_int_noprefix(table_data, 36, 1);     /* Length */
-+            build_append_int_noprefix(table_data, 1, 1);      /* Version */
-+            build_append_int_noprefix(table_data, socket, 1); /* PLIC ID */
-+            build_append_int_noprefix(table_data, 0, 8);      /* Hardware ID */
-+            /* Total External Interrupt Sources Supported */
-+            build_append_int_noprefix(table_data,
-+                                      VIRT_IRQCHIP_NUM_SOURCES - 1, 2);
-+            build_append_int_noprefix(table_data, 0, 2);     /* Max Priority */
-+            build_append_int_noprefix(table_data, 0, 4);     /* Flags */
-+            /* PLIC Size */
-+            build_append_int_noprefix(table_data, s->memmap[VIRT_PLIC].size, 4);
-+            /* PLIC Address */
-+            build_append_int_noprefix(table_data, aplic_addr, 8);
-+            /* Global System Interrupt Vector Base */
-+            build_append_int_noprefix(table_data, gsi_base, 4);
-+        }
-     }
-     acpi_table_end(linker, &table);
---
-.43.0

-[PULL 27/65] disas/riscv: Add amocas.[w,d,q] instructions
+Deleted patch
-From: Rob Bradford <rbradford@rivosinc.com>
-Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231207153842.32401-3-rbradford@rivosinc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_op_vwsll_vv = 872,
-     rv_op_vwsll_vx = 873,
-     rv_op_vwsll_vi = 874,
-+    rv_op_amocas_w = 875,
-+    rv_op_amocas_d = 876,
-+    rv_op_amocas_q = 877,
- } rv_op;
- /* register names */
-@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
-     { "vwsll.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
-     { "vwsll.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
-     { "vwsll.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
-+    { "amocas.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
-+    { "amocas.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
-+    { "amocas.q", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
- };
- /* CSR names */
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 34: op = rv_op_amoxor_w; break;
-             case 35: op = rv_op_amoxor_d; break;
-             case 36: op = rv_op_amoxor_q; break;
-+            case 42: op = rv_op_amocas_w; break;
-+            case 43: op = rv_op_amocas_d; break;
-+            case 44: op = rv_op_amocas_q; break;
-             case 66: op = rv_op_amoor_w; break;
-             case 67: op = rv_op_amoor_d; break;
-             case 68: op = rv_op_amoor_q; break;
---
-.43.0

-[PULL 28/65] docs/system/riscv: document acpi parameter of virt machine
+Deleted patch
-From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-Since QEMU v8.0.0 the RISC-V virt machine has a switch to disable ACPI
-table generation. Add it to the documentation.
-Fixes: 168b8c29cedb ("hw/riscv/virt: Add a switch to disable ACPI")
-Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231220193436.25909-1-heinrich.schuchardt@canonical.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- docs/system/riscv/virt.rst | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
-+++ b/docs/system/riscv/virt.rst
-@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
-   SiFive CLINT. When not specified, this option is assumed to be "off".
-   This option is restricted to the TCG accelerator.
-+- acpi=[on|off|auto]
-+
-+  When this option is "on" (which is the default), ACPI tables are generated and
-+  exposed as firmware tables etc/acpi/rsdp and etc/acpi/tables.
-+
- - aia=[none|aplic|aplic-imsic]
-   This option allows selecting interrupt controller defined by the AIA
---
-.43.0

-[PULL 43/65] target/riscv/tcg: honor user choice for G MISA bits
+[PULL v2 46/50] target/riscv: Implement Smdbltrp behavior
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-RVG behaves like a profile: a single flag enables a set of bits. Right
+When the Smsdbltrp ISA extension is enabled, if a trap happens while
-now we're considering user choice when handling RVG and zicsr/zifencei
+MSTATUS.MDT is already set, it will trigger an abort or an NMI is the
-and ignoring user choice on MISA bits.
+Smrnmi extension is available.
-We'll add user warnings for profiles when the user disables its
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
 mandatory extensions in the next patch. We'll do the same thing with RVG
 now to keep consistency between RVG and profile handling.
 First and foremost, create a new RVG only helper to avoid clogging
 riscv_cpu_validate_set_extensions(). We do not want to annoy users with
 RVG warnings like we did in the past (see 9b9741c38f), thus we'll only
 warn if RVG was user set and the user disabled a RVG extension in the
 command line.
 For every RVG MISA bit (IMAFD), zicsr and zifencei, the logic then
 becomes:
 - if enabled, do nothing;
 - if disabled and not user set, enable it;
 - if disabled and user set, throw a warning that it's a RVG mandatory
   extension.
 This same logic will be used for profiles in the next patch.
 Note that this is a behavior change, where we would error out if the
 user disabled either zicsr or zifencei. As long as users are explicitly
 disabling things in the command line we'll let them have a go at it, at
 least in this step. We'll error out later in the validation if needed.
 Other notable changes from the previous RVG code:
 - use riscv_cpu_write_misa_bit() instead of manually updating both
   env->misa_ext and env->misa_ext_mask;
 - set zicsr and zifencei directly. We're already checking if they
   were user set and priv version will never fail for these
   extensions, making cpu_cfg_ext_auto_update() redundant.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-16-dbarboza@ventanamicro.com>
+Message-ID: <20250110125441.3208676-9-cleger@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 73 +++++++++++++++++++++++++-------------
+ target/riscv/cpu_helper.c | 57 ++++++++++++++++++++++++++++-----------
-file changed, 48 insertions(+), 25 deletions(-)
+file changed, 41 insertions(+), 16 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ static target_ulong promote_load_fault(target_ulong orig_cause)
-                                  GUINT_TO_POINTER(ext_offset));
+     /* if no promotion, return original cause */
      return orig_cause;
  }
++
-+static bool cpu_misa_ext_is_user_set(uint32_t misa_bit)
++static void riscv_do_nmi(CPURISCVState *env, target_ulong cause, bool virt)
 +{
-+    return g_hash_table_contains(misa_ext_user_opts,
++    env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
-+                                 GUINT_TO_POINTER(misa_bit));
++    env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV, virt);
-+}
++    env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPP, env->priv);
 +    env->mncause = cause;
 +    env->mnepc = env->pc;
 +    env->pc = env->rnmi_irqvec;
 +
- static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
++    if (cpu_get_fcfien(env)) {
- {
++        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, env->elp);
      g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
                        cpu->cfg.cboz_blocksize == 64;
  }
 +static void riscv_cpu_validate_g(RISCVCPU *cpu)
 +{
 +    const char *warn_msg = "RVG mandates disabled extension %s";
 +    uint32_t g_misa_bits[] = {RVI, RVM, RVA, RVF, RVD};
 +    bool send_warn = cpu_misa_ext_is_user_set(RVG);
 +
 +    for (int i = 0; i < ARRAY_SIZE(g_misa_bits); i++) {
 +        uint32_t bit = g_misa_bits[i];
 +
 +        if (riscv_has_ext(&cpu->env, bit)) {
 +            continue;
 +        }
 +
 +        if (!cpu_misa_ext_is_user_set(bit)) {
 +            riscv_cpu_write_misa_bit(cpu, bit, true);
 +            continue;
 +        }
 +
 +        if (send_warn) {
 +            warn_report(warn_msg, riscv_get_misa_ext_name(bit));
 +        }
 +    }
 +
-+    if (!cpu->cfg.ext_zicsr) {
++    /* Trapping to M mode, virt is disabled */
-+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr))) {
++    riscv_cpu_set_mode(env, PRV_M, false);
 +            cpu->cfg.ext_zicsr = true;
 +        } else if (send_warn) {
 +            warn_report(warn_msg, "zicsr");
 +        }
 +    }
 +
 +    if (!cpu->cfg.ext_zifencei) {
 +        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei))) {
 +            cpu->cfg.ext_zifencei = true;
 +        } else if (send_warn) {
 +            warn_report(warn_msg, "zifencei");
 +        }
 +    }
 +}
 +
  /*
-  * Check consistency between chosen extensions while setting
+  * Handle Traps
-  * cpu->cfg accordingly.
+  *
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-     CPURISCVState *env = &cpu->env;
+     bool nnmi_excep = false;
-     Error *local_err = NULL;
+     if (cpu->cfg.ext_smrnmi && env->rnmip && async) {
--    /* Do some ISA extension error checking */
+-        env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
--    if (riscv_has_ext(env, RVG) &&
+-        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV,
--        !(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
+-                                  env->virt_enabled);
--          riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
+-        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPP,
--          riscv_has_ext(env, RVD) &&
+-                                  env->priv);
--          cpu->cfg.ext_zicsr && cpu->cfg.ext_zifencei)) {
+-        env->mncause = cause | ((target_ulong)1U << (mxlen - 1));
 -        env->mnepc = env->pc;
 -        env->pc = env->rnmi_irqvec;
 -
--        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr)) &&
+-        if (cpu_get_fcfien(env)) {
--            !cpu->cfg.ext_zicsr) {
+-            env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, env->elp);
 -            error_setg(errp, "RVG requires Zicsr but user set Zicsr to false");
 -            return;
 -        }
 -
--        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei)) &&
+-        /* Trapping to M mode, virt is disabled */
--            !cpu->cfg.ext_zifencei) {
+-        riscv_cpu_set_mode(env, PRV_M, false);
 -            error_setg(errp, "RVG requires Zifencei but user set "
 -                       "Zifencei to false");
 -            return;
 -        }
 -
--        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zicsr), true);
++        riscv_do_nmi(env, cause | ((target_ulong)1U << (mxlen - 1)),
--        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zifencei), true);
++                     env->virt_enabled);
--
+         return;
 -        env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
 -        env->misa_ext_mask |= RVI | RVM | RVA | RVF | RVD;
 +    if (riscv_has_ext(env, RVG)) {
 +        riscv_cpu_validate_g(cpu);
      }
-     if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
              /* Trapping to M mode, virt is disabled */
              virt = false;
          }
 +        /*
 +         * If the hart encounters an exception while executing in M-mode,
 +         * with the mnstatus.NMIE bit clear, the program counter is set to
 +         * the RNMI exception trap handler address.
 +         */
 +        nnmi_excep = cpu->cfg.ext_smrnmi &&
 +                     !get_field(env->mnstatus, MNSTATUS_NMIE) &&
 +                     !async;
          s = env->mstatus;
          s = set_field(s, MSTATUS_MPIE, get_field(s, MSTATUS_MIE));
          s = set_field(s, MSTATUS_MPP, env->priv);
          s = set_field(s, MSTATUS_MIE, 0);
 +        if (cpu->cfg.ext_smdbltrp) {
 +            if (env->mstatus & MSTATUS_MDT) {
 +                assert(env->priv == PRV_M);
 +                if (!cpu->cfg.ext_smrnmi || nnmi_excep) {
 +                    cpu_abort(CPU(cpu), "M-mode double trap\n");
 +                } else {
 +                    riscv_do_nmi(env, cause, false);
 +                    return;
 +                }
 +            }
 +
 +            s = set_field(s, MSTATUS_MDT, 1);
 +        }
          env->mstatus = s;
          env->mcause = cause | ((target_ulong)async << (mxlen - 1));
          if (smode_double_trap) {
 --
-.43.0
+.48.1

-[PULL 52/65] target/riscv: add 'parent' in profile description
+[PULL v2 47/50] target/riscv: Add Smdbltrp ISA extension enable switch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Clément Léger <cleger@rivosinc.com>
-Certain S-mode profiles, like RVA22S64 and RVA23S64, mandate all the
+Add the switch to enable the Smdbltrp ISA extension and disable it for
-mandatory extensions of their respective U-mode profiles. RVA22S64
+the max cpu. Indeed, OpenSBI when Smdbltrp is present, M-mode double
-includes all mandatory extensions of RVA22U64, and the same happens with
+trap is enabled by default and MSTATUS.MDT needs to be cleared to avoid
-RVA23 profiles.
+taking a double trap. OpenSBI does not currently support it so disable
 it for the max cpu to avoid breaking regression tests.
-Add a 'parent' field to allow profiles to enable other profiles. This
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
-will allow us to describe S-mode profiles by specifying their parent
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-U-mode profile, then adding just the S-mode specific extensions.
+Message-ID: <20250116131539.2475785-1-cleger@rivosinc.com>
 We're naming the field 'parent' to consider the possibility of other
 uses (e.g. a s-mode profile including a previous s-mode profile) in the
 future.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-25-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  1 +
+ target/riscv/cpu.c         |  2 ++
- target/riscv/cpu.c         |  1 +
+ target/riscv/tcg/tcg-cpu.c | 10 ++++++++++
- target/riscv/tcg/tcg-cpu.c | 14 +++++++++++++-
+files changed, 12 insertions(+)
 files changed, 15 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
- #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
- typedef struct riscv_cpu_profile {
-+    struct riscv_cpu_profile *parent;
-     const char *name;
-     uint32_t misa_ext;
-     bool enabled;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-  * having a cfg offset) at this moment.
+     ISA_EXT_DATA_ENTRY(smcdeleg, PRIV_VERSION_1_13_0, ext_smcdeleg),
-  */
+     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
- static RISCVCPUProfile RVA22U64 = {
+     ISA_EXT_DATA_ENTRY(smcsrind, PRIV_VERSION_1_13_0, ext_smcsrind),
-+    .parent = NULL,
++    ISA_EXT_DATA_ENTRY(smdbltrp, PRIV_VERSION_1_13_0, ext_smdbltrp),
-     .name = "rva22u64",
+     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
-     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+     ISA_EXT_DATA_ENTRY(smrnmi, PRIV_VERSION_1_12_0, ext_smrnmi),
-     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+     ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("ssnpm", ext_ssnpm, false),
      MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
 +    MULTI_EXT_CFG_BOOL("smdbltrp", ext_smdbltrp, false),
      MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
      MULTI_EXT_CFG_BOOL("smrnmi", ext_smrnmi, false),
      MULTI_EXT_CFG_BOOL("smmpm", ext_smmpm, false),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
-     CPURISCVState *env = &cpu->env;
+         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smrnmi), false);
-     const char *warn_msg = "Profile %s mandates disabled extension %s";
+         qemu_log("Smrnmi is disabled in the 'max' type CPU\n");
      bool send_warn = profile->user_set && profile->enabled;
 -    bool profile_impl = true;
 +    bool parent_enabled, profile_impl = true;
      int i;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
      }
-     profile->enabled = profile_impl;
 +
-+    if (profile->parent != NULL) {
++    /*
-+        parent_enabled = object_property_get_bool(OBJECT(cpu),
++     * ext_smdbltrp requires the firmware to clear MSTATUS.MDT on startup to
-+                                                  profile->parent->name,
++     * avoid generating a double trap. OpenSBI does not currently support it,
-+                                                  NULL);
++     * disable it for now.
-+        profile->enabled = profile->enabled && parent_enabled;
++     */
 +    if (cpu->cfg.ext_smdbltrp) {
 +        isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smdbltrp), false);
 +        qemu_log("Smdbltrp is disabled in the 'max' type CPU\n");
 +    }
  }
- static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
+ static bool riscv_cpu_has_max_extensions(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
      profile->user_set = true;
      profile->enabled = value;
 +    if (profile->parent != NULL) {
 +        object_property_set_bool(obj, profile->parent->name,
 +                                 profile->enabled, NULL);
 +    }
 +
      if (profile->enabled) {
          cpu->env.priv_ver = profile->priv_spec;
      }
 --
-.43.0
+.48.1

-[PULL 35/65] riscv-qmp-cmds.c: expose named features in cpu_model_expansion
+[PULL v2 48/50] hw/riscv/riscv-iommu.c: Introduce a translation tag for the page table cache
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Jason Chien <jason.chien@sifive.com>
-Named features (zic64b the sole example at this moment) aren't expose to
+This commit introduces a translation tag to avoid invalidating an entry
-users, thus we need another way to expose them.
+that should not be invalidated when IOMMU executes invalidation commands.
 E.g. IOTINVAL.VMA with GV=0, AV=0, PSCV=1 invalidates both a mapping
 of single stage translation and a mapping of nested translation with
 the same PSCID, but only the former one should be invalidated.
-Go through each named feature, get its boolean value, do the needed
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-conversions (bool to qbool, qbool to QObject) and add it to output dict.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20241108110147.11178-1-jason.chien@sifive.com>
 Another adjustment is needed: named features are evaluated during
 finalize(), so riscv_cpu_finalize_features() needs to be mandatory
 regardless of whether we have an input dict or not. Otherwise zic64b
 will always return 'false', which is incorrect: the default values of
 cache blocksizes ([cbom/cbop/cboz]_blocksize) are set to 64, satisfying
 the conditions for zic64b.
 Here's an API usage example after this patch:
  $ ./build/qemu-system-riscv64 -S -M virt -display none
     -qmp tcp:localhost:1234,server,wait=off
  $ ./scripts/qmp/qmp-shell localhost:1234
 Welcome to the QMP low-level shell!
 Connected to QEMU 8.1.50
 (QEMU) query-cpu-model-expansion type=full model={"name":"rv64"}
 {"return": {"model":
     {"name": "rv64", "props": {... "zic64b": true, ...}}}}
 zic64b is set to 'true', as expected, since all cache sizes are 64
 bytes by default.
 If we change one of the cache blocksizes, zic64b is returned as 'false':
 (QEMU) query-cpu-model-expansion type=full model={"name":"rv64","props":{"cbom_blocksize":128}}
 {"return": {"model":
     {"name": "rv64", "props": {... "zic64b": false, ...}}}}
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-8-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/riscv-qmp-cmds.c | 30 +++++++++++++++++++++++++-----
+ hw/riscv/riscv-iommu.c | 205 ++++++++++++++++++++++++++++++-----------
-file changed, 25 insertions(+), 5 deletions(-)
+file changed, 153 insertions(+), 52 deletions(-)
-diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/riscv-qmp-cmds.c
+--- a/hw/riscv/riscv-iommu.c
-+++ b/target/riscv/riscv-qmp-cmds.c
++++ b/hw/riscv/riscv-iommu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUContext {
+     uint64_t msiptp;            /* MSI redirection page table pointer */
- #include "qapi/error.h"
+ };
- #include "qapi/qapi-commands-machine-target.h"
-+#include "qapi/qmp/qbool.h"
++typedef enum RISCVIOMMUTransTag {
- #include "qapi/qmp/qdict.h"
++    RISCV_IOMMU_TRANS_TAG_BY,  /* Bypass */
- #include "qapi/qmp/qerror.h"
++    RISCV_IOMMU_TRANS_TAG_SS,  /* Single Stage */
- #include "qapi/qobject-input-visitor.h"
++    RISCV_IOMMU_TRANS_TAG_VG,  /* G-stage only */
-@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_multiext_props(Object *obj, QDict *qdict_out,
++    RISCV_IOMMU_TRANS_TAG_VN,  /* Nested translation */
-     }
++} RISCVIOMMUTransTag;
- }
++
+ /* Address translation cache entry */
-+static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
+ struct RISCVIOMMUEntry {
 +    RISCVIOMMUTransTag tag;     /* Translation Tag */
      uint64_t iova:44;           /* IOVA Page Number */
      uint64_t pscid:20;          /* Process Soft-Context identifier */
      uint64_t phys:44;           /* Physical Page Number */
@@ -XXX,XX +XXX,XX @@ static gboolean riscv_iommu_iot_equal(gconstpointer v1, gconstpointer v2)
      RISCVIOMMUEntry *t1 = (RISCVIOMMUEntry *) v1;
      RISCVIOMMUEntry *t2 = (RISCVIOMMUEntry *) v2;
      return t1->gscid == t2->gscid && t1->pscid == t2->pscid &&
 -           t1->iova == t2->iova;
 +           t1->iova == t2->iova && t1->tag == t2->tag;
  }
  static guint riscv_iommu_iot_hash(gconstpointer v)
@@ -XXX,XX +XXX,XX @@ static guint riscv_iommu_iot_hash(gconstpointer v)
      return (guint)t->iova;
  }
 -/* GV: 1 PSCV: 1 AV: 1 */
 +/* GV: 0 AV: 0 PSCV: 0 GVMA: 0 */
 +/* GV: 0 AV: 0 GVMA: 1 */
 +static
 +void riscv_iommu_iot_inval_all(gpointer key, gpointer value, gpointer data)
 +{
-+    const RISCVCPUMultiExtConfig *named_cfg;
++    RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
-+    QObject *value;
++    if (iot->tag == arg->tag) {
-+    bool flag_val;
++        iot->perm = IOMMU_NONE;
 +
 +    for (int i = 0; riscv_cpu_named_features[i].name != NULL; i++) {
 +        named_cfg = &riscv_cpu_named_features[i];
 +        flag_val = isa_ext_is_enabled(cpu, named_cfg->offset);
 +        value = QOBJECT(qbool_from_bool(flag_val));
 +
 +        qdict_put_obj(qdict_out, named_cfg->name, value);
 +    }
 +}
 +
- static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
++/* GV: 0 AV: 0 PSCV: 1 GVMA: 0 */
-                                            const QDict *qdict_in,
++static
-                                            Error **errp)
++void riscv_iommu_iot_inval_pscid(gpointer key, gpointer value, gpointer data)
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
++{
-         goto err;
++    RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
-     }
++    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
++    if (iot->tag == arg->tag &&
--    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
++        iot->pscid == arg->pscid) {
--    if (local_err) {
++        iot->perm = IOMMU_NONE;
--        goto err;
++    }
--    }
++}
--
++
-     visit_end_struct(visitor, NULL);
++/* GV: 0 AV: 1 PSCV: 0 GVMA: 0 */
++static
- err:
++void riscv_iommu_iot_inval_iova(gpointer key, gpointer value, gpointer data)
-@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
++{
 +    RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
 +    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
 +    if (iot->tag == arg->tag &&
 +        iot->iova == arg->iova) {
 +        iot->perm = IOMMU_NONE;
 +    }
 +}
 +
 +/* GV: 0 AV: 1 PSCV: 1 GVMA: 0 */
  static void riscv_iommu_iot_inval_pscid_iova(gpointer key, gpointer value,
                                               gpointer data)
  {
      RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
      RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
 -    if (iot->gscid == arg->gscid &&
 +    if (iot->tag == arg->tag &&
          iot->pscid == arg->pscid &&
          iot->iova == arg->iova) {
          iot->perm = IOMMU_NONE;
      }
  }
 -/* GV: 1 PSCV: 1 AV: 0 */
 -static void riscv_iommu_iot_inval_pscid(gpointer key, gpointer value,
 -                                        gpointer data)
 +/* GV: 1 AV: 0 PSCV: 0 GVMA: 0 */
 +/* GV: 1 AV: 0 GVMA: 1 */
 +static
 +void riscv_iommu_iot_inval_gscid(gpointer key, gpointer value, gpointer data)
  {
      RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
      RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
 -    if (iot->gscid == arg->gscid &&
 -        iot->pscid == arg->pscid) {
 +    if (iot->tag == arg->tag &&
 +        iot->gscid == arg->gscid) {
          iot->perm = IOMMU_NONE;
      }
  }
 -/* GV: 1 GVMA: 1 */
 -static void riscv_iommu_iot_inval_gscid_gpa(gpointer key, gpointer value,
 -                                            gpointer data)
 +/* GV: 1 AV: 0 PSCV: 1 GVMA: 0 */
 +static void riscv_iommu_iot_inval_gscid_pscid(gpointer key, gpointer value,
 +                                              gpointer data)
  {
      RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
      RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
 -    if (iot->gscid == arg->gscid) {
 -        /* simplified cache, no GPA matching */
 +    if (iot->tag == arg->tag &&
 +        iot->gscid == arg->gscid &&
 +        iot->pscid == arg->pscid) {
          iot->perm = IOMMU_NONE;
      }
  }
 -/* GV: 1 GVMA: 0 */
 -static void riscv_iommu_iot_inval_gscid(gpointer key, gpointer value,
 -                                        gpointer data)
 +/* GV: 1 AV: 1 PSCV: 0 GVMA: 0 */
 +/* GV: 1 AV: 1 GVMA: 1 */
 +static void riscv_iommu_iot_inval_gscid_iova(gpointer key, gpointer value,
 +                                             gpointer data)
  {
      RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
      RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
 -    if (iot->gscid == arg->gscid) {
 +    if (iot->tag == arg->tag &&
 +        iot->gscid == arg->gscid &&
 +        iot->iova == arg->iova) {
          iot->perm = IOMMU_NONE;
      }
  }
 -/* GV: 0 */
 -static void riscv_iommu_iot_inval_all(gpointer key, gpointer value,
 -                                      gpointer data)
 +/* GV: 1 AV: 1 PSCV: 1 GVMA: 0 */
 +static void riscv_iommu_iot_inval_gscid_pscid_iova(gpointer key, gpointer value,
 +                                                   gpointer data)
  {
      RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
 -    iot->perm = IOMMU_NONE;
 +    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
 +    if (iot->tag == arg->tag &&
 +        iot->gscid == arg->gscid &&
 +        iot->pscid == arg->pscid &&
 +        iot->iova == arg->iova) {
 +        iot->perm = IOMMU_NONE;
 +    }
  }
  /* caller should keep ref-count for iot_cache object */
  static RISCVIOMMUEntry *riscv_iommu_iot_lookup(RISCVIOMMUContext *ctx,
 -    GHashTable *iot_cache, hwaddr iova)
 +    GHashTable *iot_cache, hwaddr iova, RISCVIOMMUTransTag transtag)
  {
      RISCVIOMMUEntry key = {
 +        .tag   = transtag,
          .gscid = get_field(ctx->gatp, RISCV_IOMMU_DC_IOHGATP_GSCID),
          .pscid = get_field(ctx->ta, RISCV_IOMMU_DC_TA_PSCID),
          .iova  = PPN_DOWN(iova),
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_iot_update(RISCVIOMMUState *s,
  }
  static void riscv_iommu_iot_inval(RISCVIOMMUState *s, GHFunc func,
 -    uint32_t gscid, uint32_t pscid, hwaddr iova)
 +    uint32_t gscid, uint32_t pscid, hwaddr iova, RISCVIOMMUTransTag transtag)
  {
      GHashTable *iot_cache;
      RISCVIOMMUEntry key = {
 +        .tag = transtag,
          .gscid = gscid,
          .pscid = pscid,
          .iova  = PPN_DOWN(iova),
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_iot_inval(RISCVIOMMUState *s, GHFunc func,
      g_hash_table_unref(iot_cache);
  }
 +static RISCVIOMMUTransTag riscv_iommu_get_transtag(RISCVIOMMUContext *ctx)
 +{
 +    uint64_t satp = get_field(ctx->satp, RISCV_IOMMU_ATP_MODE_FIELD);
 +    uint64_t gatp = get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD);
 +
 +    if (satp == RISCV_IOMMU_DC_FSC_MODE_BARE) {
 +        return (gatp == RISCV_IOMMU_DC_IOHGATP_MODE_BARE) ?
 +            RISCV_IOMMU_TRANS_TAG_BY : RISCV_IOMMU_TRANS_TAG_VG;
 +    } else {
 +        return (gatp == RISCV_IOMMU_DC_IOHGATP_MODE_BARE) ?
 +            RISCV_IOMMU_TRANS_TAG_SS : RISCV_IOMMU_TRANS_TAG_VN;
 +    }
 +}
 +
  static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
      IOMMUTLBEntry *iotlb, bool enable_cache)
  {
 +    RISCVIOMMUTransTag transtag = riscv_iommu_get_transtag(ctx);
      RISCVIOMMUEntry *iot;
      IOMMUAccessFlags perm;
      bool enable_pid;
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
          }
      }
-+    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
+-    iot = riscv_iommu_iot_lookup(ctx, iot_cache, iotlb->iova);
-+    if (local_err) {
++    iot = riscv_iommu_iot_lookup(ctx, iot_cache, iotlb->iova, transtag);
-+        error_propagate(errp, local_err);
+     perm = iot ? iot->perm : IOMMU_NONE;
-+        object_unref(obj);
+     if (perm != IOMMU_NONE) {
-+        return NULL;
+         iotlb->translated_addr = PPN_PHYS(iot->phys);
-+    }
+@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
-+
+         iot->gscid = get_field(ctx->gatp, RISCV_IOMMU_DC_IOHGATP_GSCID);
-     expansion_info = g_new0(CpuModelExpansionInfo, 1);
+         iot->pscid = get_field(ctx->ta, RISCV_IOMMU_DC_TA_PSCID);
-     expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
+         iot->perm = iotlb->perm;
-     expansion_info->model->name = g_strdup(model->name);
++        iot->tag = transtag;
-@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+         riscv_iommu_iot_update(s, iot_cache, iot);
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_extensions);
+     }
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_process_cq_tail(RISCVIOMMUState *s)
-+    riscv_obj_add_named_feats_qdict(obj, qdict_out);
+         case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IOTINVAL_FUNC_GVMA,
-     /* Add our CPU boolean options too */
+                              RISCV_IOMMU_CMD_IOTINVAL_OPCODE):
-     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
+-            if (cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV) {
 +        {
 +            bool gv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV);
 +            bool av = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV);
 +            bool pscv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV);
 +            uint32_t gscid = get_field(cmd.dword0,
 +                                       RISCV_IOMMU_CMD_IOTINVAL_GSCID);
 +            uint32_t pscid = get_field(cmd.dword0,
 +                                       RISCV_IOMMU_CMD_IOTINVAL_PSCID);
 +            hwaddr iova = (cmd.dword1 << 2) & TARGET_PAGE_MASK;
 +
 +            if (pscv) {
                  /* illegal command arguments IOTINVAL.GVMA & PSCV == 1 */
                  goto cmd_ill;
 -            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV)) {
 -                /* invalidate all cache mappings */
 -                func = riscv_iommu_iot_inval_all;
 -            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV)) {
 -                /* invalidate cache matching GSCID */
 -                func = riscv_iommu_iot_inval_gscid;
 -            } else {
 -                /* invalidate cache matching GSCID and ADDR (GPA) */
 -                func = riscv_iommu_iot_inval_gscid_gpa;
              }
 -            riscv_iommu_iot_inval(s, func,
 -                get_field(cmd.dword0, RISCV_IOMMU_CMD_IOTINVAL_GSCID), 0,
 -                cmd.dword1 << 2 & TARGET_PAGE_MASK);
 +
 +            func = riscv_iommu_iot_inval_all;
 +
 +            if (gv) {
 +                func = (av) ? riscv_iommu_iot_inval_gscid_iova :
 +                              riscv_iommu_iot_inval_gscid;
 +            }
 +
 +            riscv_iommu_iot_inval(
 +                s, func, gscid, pscid, iova, RISCV_IOMMU_TRANS_TAG_VG);
 +
 +            riscv_iommu_iot_inval(
 +                s, func, gscid, pscid, iova, RISCV_IOMMU_TRANS_TAG_VN);
              break;
 +        }
          case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IOTINVAL_FUNC_VMA,
                               RISCV_IOMMU_CMD_IOTINVAL_OPCODE):
 -            if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV)) {
 -                /* invalidate all cache mappings, simplified model */
 -                func = riscv_iommu_iot_inval_all;
 -            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV)) {
 -                /* invalidate cache matching GSCID, simplified model */
 -                func = riscv_iommu_iot_inval_gscid;
 -            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV)) {
 -                /* invalidate cache matching GSCID and PSCID */
 -                func = riscv_iommu_iot_inval_pscid;
 +        {
 +            bool gv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV);
 +            bool av = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV);
 +            bool pscv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV);
 +            uint32_t gscid = get_field(cmd.dword0,
 +                                       RISCV_IOMMU_CMD_IOTINVAL_GSCID);
 +            uint32_t pscid = get_field(cmd.dword0,
 +                                       RISCV_IOMMU_CMD_IOTINVAL_PSCID);
 +            hwaddr iova = (cmd.dword1 << 2) & TARGET_PAGE_MASK;
 +            RISCVIOMMUTransTag transtag;
 +
 +            if (gv) {
 +                transtag = RISCV_IOMMU_TRANS_TAG_VN;
 +                if (pscv) {
 +                    func = (av) ? riscv_iommu_iot_inval_gscid_pscid_iova :
 +                                  riscv_iommu_iot_inval_gscid_pscid;
 +                } else {
 +                    func = (av) ? riscv_iommu_iot_inval_gscid_iova :
 +                                  riscv_iommu_iot_inval_gscid;
 +                }
              } else {
 -                /* invalidate cache matching GSCID and PSCID and ADDR (IOVA) */
 -                func = riscv_iommu_iot_inval_pscid_iova;
 +                transtag = RISCV_IOMMU_TRANS_TAG_SS;
 +                if (pscv) {
 +                    func = (av) ? riscv_iommu_iot_inval_pscid_iova :
 +                                  riscv_iommu_iot_inval_pscid;
 +                } else {
 +                    func = (av) ? riscv_iommu_iot_inval_iova :
 +                                  riscv_iommu_iot_inval_all;
 +                }
              }
 -            riscv_iommu_iot_inval(s, func,
 -                get_field(cmd.dword0, RISCV_IOMMU_CMD_IOTINVAL_GSCID),
 -                get_field(cmd.dword0, RISCV_IOMMU_CMD_IOTINVAL_PSCID),
 -                cmd.dword1 << 2 & TARGET_PAGE_MASK);
 +
 +            riscv_iommu_iot_inval(s, func, gscid, pscid, iova, transtag);
              break;
 +        }
          case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IODIR_FUNC_INVAL_DDT,
                               RISCV_IOMMU_CMD_IODIR_OPCODE):
 --
-.43.0
+.48.1

-[PULL 36/65] target/riscv: add rva22u64 profile definition
+[PULL v2 49/50] target/riscv: Support Supm and Sspm as part of Zjpm v1.0
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Alexey Baturo <baturo.alexey@gmail.com>
-The rva22U64 profile, described in:
+The Zjpm v1.0 spec states there should be Supm and Sspm extensions that
 are used in profile specification. Enabling Supm extension enables both
 Ssnpm and Smnpm, while Sspm enables only Smnpm.
-https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc#rva22-profiles
+Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Contains a set of CPU extensions aimed for 64-bit userspace
+Message-ID: <20250113194410.1307494-1-baturo.alexey@gmail.com>
 applications. Enabling this set to be enabled via a single user flag
 makes it convenient to enable a predictable set of features for the CPU,
 giving users more predicability when running/testing their workloads.
 QEMU implements all possible extensions of this profile. All the so
 called 'synthetic extensions' described in the profile that are cache
 related are ignored/assumed enabled (Za64rs, Zic64b, Ziccif, Ziccrse,
 Ziccamoa, Zicclsm) since we do not implement a cache model.
 An abstraction called RISCVCPUProfile is created to store the profile.
 'ext_offsets' contains mandatory extensions that QEMU supports. Same
 thing with the 'misa_ext' mask. Optional extensions must be enabled
 manually in the command line if desired.
 The design here is to use the common target/riscv/cpu.c file to store
 the profile declaration and export it to the accelerator files. Each
 accelerator is then responsible to expose it (or not) to users and how
 to enable the extensions.
 Next patches will implement the profile for TCG and KVM.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 12 ++++++++++++
+ target/riscv/cpu_cfg.h |  2 ++
- target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
+ target/riscv/cpu.c     | 23 +++++++++++++++++++++++
-files changed, 44 insertions(+)
+files changed, 25 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_ssnpm;
- #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
+     bool ext_smnpm;
+     bool ext_smmpm;
-+typedef struct riscv_cpu_profile {
++    bool ext_sspm;
-+    const char *name;
++    bool ext_supm;
-+    uint32_t misa_ext;
+     bool rvv_ta_all_1s;
-+    bool enabled;
+     bool rvv_ma_all_1s;
-+    bool user_set;
+     bool rvv_vl_half_avl;
 +    const int32_t ext_offsets[];
 +} RISCVCPUProfile;
 +
 +#define RISCV_PROFILE_EXT_LIST_END -1
 +
 +extern RISCVCPUProfile *riscv_profiles[];
 +
  /* Privileged specification version */
  enum {
      PRIV_VERSION_1_10_0 = 0,
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     DEFINE_PROP_END_OF_LIST(),
+     ISA_EXT_DATA_ENTRY(sscsrind, PRIV_VERSION_1_12_0, ext_sscsrind),
      ISA_EXT_DATA_ENTRY(ssdbltrp, PRIV_VERSION_1_13_0, ext_ssdbltrp),
      ISA_EXT_DATA_ENTRY(ssnpm, PRIV_VERSION_1_13_0, ext_ssnpm),
 +    ISA_EXT_DATA_ENTRY(sspm, PRIV_VERSION_1_13_0, ext_sspm),
      ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
      ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
      ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
      ISA_EXT_DATA_ENTRY(sstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
 +    ISA_EXT_DATA_ENTRY(supm, PRIV_VERSION_1_13_0, ext_supm),
      ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
      ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
      ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("zvfhmin", ext_zvfhmin, false),
      MULTI_EXT_CFG_BOOL("sstc", ext_sstc, true),
      MULTI_EXT_CFG_BOOL("ssnpm", ext_ssnpm, false),
 +    MULTI_EXT_CFG_BOOL("sspm", ext_sspm, false),
 +    MULTI_EXT_CFG_BOOL("supm", ext_supm, false),
      MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
      MULTI_EXT_CFG_BOOL("smdbltrp", ext_smdbltrp, false),
@@ -XXX,XX +XXX,XX @@ static RISCVCPUImpliedExtsRule SSCFG_IMPLIED = {
      },
  };
-+/*
++static RISCVCPUImpliedExtsRule SUPM_IMPLIED = {
-+ * RVA22U64 defines some 'named features' or 'synthetic extensions'
++    .ext = CPU_CFG_OFFSET(ext_supm),
-+ * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
++    .implied_multi_exts = {
-+ * and Zicclsm. We do not implement caching in QEMU so we'll consider
++        CPU_CFG_OFFSET(ext_ssnpm), CPU_CFG_OFFSET(ext_smnpm),
 + * all these named features as always enabled.
 + *
 + * There's no riscv,isa update for them (nor for zic64b, despite it
 + * having a cfg offset) at this moment.
 + */
 +static RISCVCPUProfile RVA22U64 = {
 +    .name = "rva22u64",
 +    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
 +    .ext_offsets = {
 +        CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
 +        CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
 +        CPU_CFG_OFFSET(ext_zbs), CPU_CFG_OFFSET(ext_zfhmin),
 +        CPU_CFG_OFFSET(ext_zkt), CPU_CFG_OFFSET(ext_zicntr),
 +        CPU_CFG_OFFSET(ext_zihpm), CPU_CFG_OFFSET(ext_zicbom),
 +        CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
 +
-+        /* mandatory named features for this profile */
++        RISCV_IMPLIED_EXTS_RULE_END
-+        CPU_CFG_OFFSET(zic64b),
++    },
 +
 +        RISCV_PROFILE_EXT_LIST_END
 +    }
 +};
 +
-+RISCVCPUProfile *riscv_profiles[] = {
++static RISCVCPUImpliedExtsRule SSPM_IMPLIED = {
-+    &RVA22U64,
++    .ext = CPU_CFG_OFFSET(ext_sspm),
-+    NULL,
++    .implied_multi_exts = {
 +        CPU_CFG_OFFSET(ext_smnpm),
 +
 +        RISCV_IMPLIED_EXTS_RULE_END
 +    },
 +};
 +
- static Property riscv_cpu_properties[] = {
+ RISCVCPUImpliedExtsRule *riscv_misa_ext_implied_rules[] = {
-     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
+     &RVA_IMPLIED, &RVD_IMPLIED, &RVF_IMPLIED,
      &RVM_IMPLIED, &RVV_IMPLIED, NULL
@@ -XXX,XX +XXX,XX @@ RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[] = {
      &ZVFH_IMPLIED, &ZVFHMIN_IMPLIED, &ZVKN_IMPLIED,
      &ZVKNC_IMPLIED, &ZVKNG_IMPLIED, &ZVKNHB_IMPLIED,
      &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED, &SSCFG_IMPLIED,
 +    &SUPM_IMPLIED, &SSPM_IMPLIED,
      NULL
  };
 --
-.43.0
+.48.1

-[PULL 55/65] target/riscv/kvm.c: remove group setting of KVM AIA if the machine only has 1 socket
+Deleted patch
-From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The emulated AIA within the Linux kernel restores the HART index
-of the IMSICs according to the configured AIA settings. During
-this process, the group setting is used only when the machine
-partitions harts into groups. It's unnecessary to set the group
-configuration if the machine has only one socket, as its address
-space might not contain the group shift.
-Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231218090543.22353-2-yongxuan.wang@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 31 +++++++++++++++++--------------
-file changed, 17 insertions(+), 14 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-         exit(1);
-     }
--    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
--    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
--                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
--                            &socket_bits, true, NULL);
--    if (ret < 0) {
--        error_report("KVM AIA: failed to set group_bits");
--        exit(1);
--    }
--    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
--                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
--                            &group_shift, true, NULL);
--    if (ret < 0) {
--        error_report("KVM AIA: failed to set group_shift");
--        exit(1);
-+    if (socket_count > 1) {
-+        socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
-+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
-+                                &socket_bits, true, NULL);
-+        if (ret < 0) {
-+            error_report("KVM AIA: failed to set group_bits");
-+            exit(1);
-+        }
-+
-+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
-+                                &group_shift, true, NULL);
-+        if (ret < 0) {
-+            error_report("KVM AIA: failed to set group_shift");
-+            exit(1);
-+        }
-     }
-     guest_bits = guest_num == 0 ? 0 :
---
-.43.0

-[PULL 56/65] linux-headers: Update to Linux v6.7-rc5
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We'll add a new RISC-V linux-header file, but first let's update all
-headers.
-Headers for 'asm-loongarch' were added in this update.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-2-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/standard-headers/drm/drm_fourcc.h     |   2 +
- include/standard-headers/linux/pci_regs.h     |  24 ++-
- include/standard-headers/linux/vhost_types.h  |   7 +
- .../standard-headers/linux/virtio_config.h    |   5 +
- include/standard-headers/linux/virtio_pci.h   |  11 ++
- linux-headers/asm-arm64/kvm.h                 |  32 ++++
- linux-headers/asm-generic/unistd.h            |  14 +-
- linux-headers/asm-loongarch/bitsperlong.h     |   1 +
- linux-headers/asm-loongarch/kvm.h             | 108 +++++++++++
- linux-headers/asm-loongarch/mman.h            |   1 +
- linux-headers/asm-loongarch/unistd.h          |   5 +
- linux-headers/asm-mips/unistd_n32.h           |   4 +
- linux-headers/asm-mips/unistd_n64.h           |   4 +
- linux-headers/asm-mips/unistd_o32.h           |   4 +
- linux-headers/asm-powerpc/unistd_32.h         |   4 +
- linux-headers/asm-powerpc/unistd_64.h         |   4 +
- linux-headers/asm-riscv/kvm.h                 |  12 ++
- linux-headers/asm-s390/unistd_32.h            |   4 +
- linux-headers/asm-s390/unistd_64.h            |   4 +
- linux-headers/asm-x86/unistd_32.h             |   4 +
- linux-headers/asm-x86/unistd_64.h             |   3 +
- linux-headers/asm-x86/unistd_x32.h            |   3 +
- linux-headers/linux/iommufd.h                 | 180 +++++++++++++++++-
- linux-headers/linux/kvm.h                     |  11 ++
- linux-headers/linux/psp-sev.h                 |   1 +
- linux-headers/linux/stddef.h                  |   9 +-
- linux-headers/linux/userfaultfd.h             |   9 +-
- linux-headers/linux/vfio.h                    |  47 +++--
- linux-headers/linux/vhost.h                   |   8 +
-files changed, 498 insertions(+), 27 deletions(-)
- create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
- create mode 100644 linux-headers/asm-loongarch/kvm.h
- create mode 100644 linux-headers/asm-loongarch/mman.h
- create mode 100644 linux-headers/asm-loongarch/unistd.h
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/drm/drm_fourcc.h
-+++ b/include/standard-headers/drm/drm_fourcc.h
-@@ -XXX,XX +XXX,XX @@ extern "C" {
-  * index 1 = Cr:Cb plane, [39:0] Cr1:Cb1:Cr0:Cb0 little endian
-  */
- #define DRM_FORMAT_NV15        fourcc_code('N', 'V', '1', '5') /* 2x2 subsampled Cr:Cb plane */
-+#define DRM_FORMAT_NV20        fourcc_code('N', 'V', '2', '0') /* 2x1 subsampled Cr:Cb plane */
-+#define DRM_FORMAT_NV30        fourcc_code('N', 'V', '3', '0') /* non-subsampled Cr:Cb plane */
- /*
-  * 2 plane YCbCr MSB aligned
-diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/pci_regs.h
-+++ b/include/standard-headers/linux/pci_regs.h
-@@ -XXX,XX +XXX,XX @@
- #define  PCI_HEADER_TYPE_NORMAL        0
- #define  PCI_HEADER_TYPE_BRIDGE        1
- #define  PCI_HEADER_TYPE_CARDBUS    2
-+#define  PCI_HEADER_TYPE_MFD        0x80    /* Multi-Function Device (possible) */
- #define PCI_BIST        0x0f    /* 8 bits */
- #define  PCI_BIST_CODE_MASK    0x0f    /* Return result */
-@@ -XXX,XX +XXX,XX @@
- #define PCI_EXP_RTCAP        0x1e    /* Root Capabilities */
- #define  PCI_EXP_RTCAP_CRSVIS    0x0001    /* CRS Software Visibility capability */
- #define PCI_EXP_RTSTA        0x20    /* Root Status */
-+#define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
- #define  PCI_EXP_RTSTA_PME    0x00010000 /* PME status */
- #define  PCI_EXP_RTSTA_PENDING    0x00020000 /* PME pending */
- /*
-@@ -XXX,XX +XXX,XX @@
- /* Process Address Space ID */
- #define PCI_PASID_CAP        0x04    /* PASID feature register */
--#define  PCI_PASID_CAP_EXEC    0x02    /* Exec permissions Supported */
--#define  PCI_PASID_CAP_PRIV    0x04    /* Privilege Mode Supported */
-+#define  PCI_PASID_CAP_EXEC    0x0002    /* Exec permissions Supported */
-+#define  PCI_PASID_CAP_PRIV    0x0004    /* Privilege Mode Supported */
-+#define  PCI_PASID_CAP_WIDTH    0x1f00
- #define PCI_PASID_CTRL        0x06    /* PASID control register */
--#define  PCI_PASID_CTRL_ENABLE    0x01    /* Enable bit */
--#define  PCI_PASID_CTRL_EXEC    0x02    /* Exec permissions Enable */
--#define  PCI_PASID_CTRL_PRIV    0x04    /* Privilege Mode Enable */
-+#define  PCI_PASID_CTRL_ENABLE    0x0001    /* Enable bit */
-+#define  PCI_PASID_CTRL_EXEC    0x0002    /* Exec permissions Enable */
-+#define  PCI_PASID_CTRL_PRIV    0x0004    /* Privilege Mode Enable */
- #define PCI_EXT_CAP_PASID_SIZEOF    8
- /* Single Root I/O Virtualization */
-@@ -XXX,XX +XXX,XX @@
- #define  PCI_LTR_VALUE_MASK    0x000003ff
- #define  PCI_LTR_SCALE_MASK    0x00001c00
- #define  PCI_LTR_SCALE_SHIFT    10
-+#define  PCI_LTR_NOSNOOP_VALUE    0x03ff0000 /* Max No-Snoop Latency Value */
-+#define  PCI_LTR_NOSNOOP_SCALE    0x1c000000 /* Scale for Max Value */
- #define PCI_EXT_CAP_LTR_SIZEOF    8
- /* Access Control Service */
-@@ -XXX,XX +XXX,XX @@
- #define PCI_EXP_DPC_STATUS        0x08    /* DPC Status */
- #define  PCI_EXP_DPC_STATUS_TRIGGER        0x0001 /* Trigger Status */
- #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN        0x0006 /* Trigger Reason */
-+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_UNCOR  0x0000 /* Uncorrectable error */
-+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_NFE    0x0002 /* Rcvd ERR_NONFATAL */
-+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_FE     0x0004 /* Rcvd ERR_FATAL */
-+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_IN_EXT 0x0006 /* Reason in Trig Reason Extension field */
- #define  PCI_EXP_DPC_STATUS_INTERRUPT        0x0008 /* Interrupt Status */
- #define  PCI_EXP_DPC_RP_BUSY            0x0010 /* Root Port Busy */
- #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_EXT 0x0060 /* Trig Reason Extension */
-+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_RP_PIO        0x0000    /* RP PIO error */
-+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_SW_TRIGGER    0x0020    /* DPC SW Trigger bit */
-+#define  PCI_EXP_DPC_RP_PIO_FEP            0x1f00 /* RP PIO First Err Ptr */
- #define PCI_EXP_DPC_SOURCE_ID         0x0A    /* DPC Source Identifier */
-@@ -XXX,XX +XXX,XX @@
- #define  PCI_L1SS_CTL1_LTR_L12_TH_VALUE    0x03ff0000  /* LTR_L1.2_THRESHOLD_Value */
- #define  PCI_L1SS_CTL1_LTR_L12_TH_SCALE    0xe0000000  /* LTR_L1.2_THRESHOLD_Scale */
- #define PCI_L1SS_CTL2        0x0c    /* Control 2 Register */
-+#define  PCI_L1SS_CTL2_T_PWR_ON_SCALE    0x00000003  /* T_POWER_ON Scale */
-+#define  PCI_L1SS_CTL2_T_PWR_ON_VALUE    0x000000f8  /* T_POWER_ON Value */
- /* Designated Vendor-Specific (DVSEC, PCI_EXT_CAP_ID_DVSEC) */
- #define PCI_DVSEC_HEADER1        0x4 /* Designated Vendor-Specific Header1 */
-diff --git a/include/standard-headers/linux/vhost_types.h b/include/standard-headers/linux/vhost_types.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/vhost_types.h
-+++ b/include/standard-headers/linux/vhost_types.h
-@@ -XXX,XX +XXX,XX @@ struct vhost_vdpa_iova_range {
-  * DRIVER_OK
-  */
- #define VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK  0x6
-+/* Device may expose the virtqueue's descriptor area, driver area and
-+ * device area to a different group for ASID binding than where its
-+ * buffers may reside. Requires VHOST_BACKEND_F_IOTLB_ASID.
-+ */
-+#define VHOST_BACKEND_F_DESC_ASID    0x7
-+/* IOTLB don't flush memory mapping across device reset */
-+#define VHOST_BACKEND_F_IOTLB_PERSIST  0x8
- #endif
-diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/virtio_config.h
-+++ b/include/standard-headers/linux/virtio_config.h
-@@ -XXX,XX +XXX,XX @@
-  */
- #define VIRTIO_F_NOTIFICATION_DATA    38
-+/* This feature indicates that the driver uses the data provided by the device
-+ * as a virtqueue identifier in available buffer notifications.
-+ */
-+#define VIRTIO_F_NOTIF_CONFIG_DATA    39
-+
- /*
-  * This feature indicates that the driver can reset a queue individually.
-  */
-diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/virtio_pci.h
-+++ b/include/standard-headers/linux/virtio_pci.h
-@@ -XXX,XX +XXX,XX @@ struct virtio_pci_common_cfg {
-     uint32_t queue_used_hi;        /* read-write */
- };
-+/*
-+ * Warning: do not use sizeof on this: use offsetofend for
-+ * specific fields you need.
-+ */
-+struct virtio_pci_modern_common_cfg {
-+    struct virtio_pci_common_cfg cfg;
-+
-+    uint16_t queue_notify_data;    /* read-write */
-+    uint16_t queue_reset;        /* read-write */
-+};
-+
- /* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
- struct virtio_pci_cfg_cap {
-     struct virtio_pci_cap cap;
-diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-arm64/kvm.h
-+++ b/linux-headers/asm-arm64/kvm.h
-@@ -XXX,XX +XXX,XX @@ struct kvm_smccc_filter {
- #define KVM_HYPERCALL_EXIT_SMC        (1U << 0)
- #define KVM_HYPERCALL_EXIT_16BIT    (1U << 1)
-+/*
-+ * Get feature ID registers userspace writable mask.
-+ *
-+ * From DDI0487J.a, D19.2.66 ("ID_AA64MMFR2_EL1, AArch64 Memory Model
-+ * Feature Register 2"):
-+ *
-+ * "The Feature ID space is defined as the System register space in
-+ * AArch64 with op0==3, op1=={0, 1, 3}, CRn==0, CRm=={0-7},
-+ * op2=={0-7}."
-+ *
-+ * This covers all currently known R/O registers that indicate
-+ * anything useful feature wise, including the ID registers.
-+ *
-+ * If we ever need to introduce a new range, it will be described as
-+ * such in the range field.
-+ */
-+#define KVM_ARM_FEATURE_ID_RANGE_IDX(op0, op1, crn, crm, op2)        \
-+    ({                                \
-+        __u64 __op1 = (op1) & 3;                \
-+        __op1 -= (__op1 == 3);                    \
-+        (__op1 << 6 | ((crm) & 7) << 3 | (op2));        \
-+    })
-+
-+#define KVM_ARM_FEATURE_ID_RANGE    0
-+#define KVM_ARM_FEATURE_ID_RANGE_SIZE    (3 * 8 * 8)
-+
-+struct reg_mask_range {
-+    __u64 addr;        /* Pointer to mask array */
-+    __u32 range;        /* Requested range */
-+    __u32 reserved[13];
-+};
-+
- #endif
- #endif /* __ARM_KVM_H__ */
-diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-generic/unistd.h
-+++ b/linux-headers/asm-generic/unistd.h
-@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fremovexattr, sys_fremovexattr)
- #define __NR_getcwd 17
- __SYSCALL(__NR_getcwd, sys_getcwd)
- #define __NR_lookup_dcookie 18
--__SC_COMP(__NR_lookup_dcookie, sys_lookup_dcookie, compat_sys_lookup_dcookie)
-+__SYSCALL(__NR_lookup_dcookie, sys_ni_syscall)
- #define __NR_eventfd2 19
- __SYSCALL(__NR_eventfd2, sys_eventfd2)
- #define __NR_epoll_create1 20
-@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_process_mrelease, sys_process_mrelease)
- __SYSCALL(__NR_futex_waitv, sys_futex_waitv)
- #define __NR_set_mempolicy_home_node 450
- __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node)
--
- #define __NR_cachestat 451
- __SYSCALL(__NR_cachestat, sys_cachestat)
--
- #define __NR_fchmodat2 452
- __SYSCALL(__NR_fchmodat2, sys_fchmodat2)
-+#define __NR_map_shadow_stack 453
-+__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack)
-+#define __NR_futex_wake 454
-+__SYSCALL(__NR_futex_wake, sys_futex_wake)
-+#define __NR_futex_wait 455
-+__SYSCALL(__NR_futex_wait, sys_futex_wait)
-+#define __NR_futex_requeue 456
-+__SYSCALL(__NR_futex_requeue, sys_futex_requeue)
- #undef __NR_syscalls
--#define __NR_syscalls 453
-+#define __NR_syscalls 457
- /*
-  * 32 bit systems traditionally used different
-diff --git a/linux-headers/asm-loongarch/bitsperlong.h b/linux-headers/asm-loongarch/bitsperlong.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/linux-headers/asm-loongarch/bitsperlong.h
-@@ -0,0 +1 @@
-+#include <asm-generic/bitsperlong.h>
-diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/linux-headers/asm-loongarch/kvm.h
-@@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-+/*
-+ * Copyright (C) 2020-2023 Loongson Technology Corporation Limited
-+ */
-+
-+#ifndef __UAPI_ASM_LOONGARCH_KVM_H
-+#define __UAPI_ASM_LOONGARCH_KVM_H
-+
-+#include <linux/types.h>
-+
-+/*
-+ * KVM LoongArch specific structures and definitions.
-+ *
-+ * Some parts derived from the x86 version of this file.
-+ */
-+
-+#define __KVM_HAVE_READONLY_MEM
-+
-+#define KVM_COALESCED_MMIO_PAGE_OFFSET    1
-+#define KVM_DIRTY_LOG_PAGE_OFFSET    64
-+
-+/*
-+ * for KVM_GET_REGS and KVM_SET_REGS
-+ */
-+struct kvm_regs {
-+    /* out (KVM_GET_REGS) / in (KVM_SET_REGS) */
-+    __u64 gpr[32];
-+    __u64 pc;
-+};
-+
-+/*
-+ * for KVM_GET_FPU and KVM_SET_FPU
-+ */
-+struct kvm_fpu {
-+    __u32 fcsr;
-+    __u64 fcc;    /* 8x8 */
-+    struct kvm_fpureg {
-+        __u64 val64[4];
-+    } fpr[32];
-+};
-+
-+/*
-+ * For LoongArch, we use KVM_SET_ONE_REG and KVM_GET_ONE_REG to access various
-+ * registers.  The id field is broken down as follows:
-+ *
-+ *  bits[63..52] - As per linux/kvm.h
-+ *  bits[51..32] - Must be zero.
-+ *  bits[31..16] - Register set.
-+ *
-+ * Register set = 0: GP registers from kvm_regs (see definitions below).
-+ *
-+ * Register set = 1: CSR registers.
-+ *
-+ * Register set = 2: KVM specific registers (see definitions below).
-+ *
-+ * Register set = 3: FPU / SIMD registers (see definitions below).
-+ *
-+ * Other sets registers may be added in the future.  Each set would
-+ * have its own identifier in bits[31..16].
-+ */
-+
-+#define KVM_REG_LOONGARCH_GPR        (KVM_REG_LOONGARCH | 0x00000ULL)
-+#define KVM_REG_LOONGARCH_CSR        (KVM_REG_LOONGARCH | 0x10000ULL)
-+#define KVM_REG_LOONGARCH_KVM        (KVM_REG_LOONGARCH | 0x20000ULL)
-+#define KVM_REG_LOONGARCH_FPSIMD    (KVM_REG_LOONGARCH | 0x30000ULL)
-+#define KVM_REG_LOONGARCH_CPUCFG    (KVM_REG_LOONGARCH | 0x40000ULL)
-+#define KVM_REG_LOONGARCH_MASK        (KVM_REG_LOONGARCH | 0x70000ULL)
-+#define KVM_CSR_IDX_MASK        0x7fff
-+#define KVM_CPUCFG_IDX_MASK        0x7fff
-+
-+/*
-+ * KVM_REG_LOONGARCH_KVM - KVM specific control registers.
-+ */
-+
-+#define KVM_REG_LOONGARCH_COUNTER    (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 1)
-+#define KVM_REG_LOONGARCH_VCPU_RESET    (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 2)
-+
-+#define LOONGARCH_REG_SHIFT        3
-+#define LOONGARCH_REG_64(TYPE, REG)    (TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
-+#define KVM_IOC_CSRID(REG)        LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
-+#define KVM_IOC_CPUCFG(REG)        LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
-+
-+struct kvm_debug_exit_arch {
-+};
-+
-+/* for KVM_SET_GUEST_DEBUG */
-+struct kvm_guest_debug_arch {
-+};
-+
-+/* definition of registers in kvm_run */
-+struct kvm_sync_regs {
-+};
-+
-+/* dummy definition */
-+struct kvm_sregs {
-+};
-+
-+struct kvm_iocsr_entry {
-+    __u32 addr;
-+    __u32 pad;
-+    __u64 data;
-+};
-+
-+#define KVM_NR_IRQCHIPS        1
-+#define KVM_IRQCHIP_NUM_PINS    64
-+#define KVM_MAX_CORES        256
-+
-+#endif /* __UAPI_ASM_LOONGARCH_KVM_H */
-diff --git a/linux-headers/asm-loongarch/mman.h b/linux-headers/asm-loongarch/mman.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/linux-headers/asm-loongarch/mman.h
-@@ -0,0 +1 @@
-+#include <asm-generic/mman.h>
-diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/linux-headers/asm-loongarch/unistd.h
-@@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-+#define __ARCH_WANT_SYS_CLONE
-+#define __ARCH_WANT_SYS_CLONE3
-+
-+#include <asm-generic/unistd.h>
-diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-mips/unistd_n32.h
-+++ b/linux-headers/asm-mips/unistd_n32.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
- #define __NR_cachestat (__NR_Linux + 451)
- #define __NR_fchmodat2 (__NR_Linux + 452)
-+#define __NR_map_shadow_stack (__NR_Linux + 453)
-+#define __NR_futex_wake (__NR_Linux + 454)
-+#define __NR_futex_wait (__NR_Linux + 455)
-+#define __NR_futex_requeue (__NR_Linux + 456)
- #endif /* _ASM_UNISTD_N32_H */
-diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-mips/unistd_n64.h
-+++ b/linux-headers/asm-mips/unistd_n64.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
- #define __NR_cachestat (__NR_Linux + 451)
- #define __NR_fchmodat2 (__NR_Linux + 452)
-+#define __NR_map_shadow_stack (__NR_Linux + 453)
-+#define __NR_futex_wake (__NR_Linux + 454)
-+#define __NR_futex_wait (__NR_Linux + 455)
-+#define __NR_futex_requeue (__NR_Linux + 456)
- #endif /* _ASM_UNISTD_N64_H */
-diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-mips/unistd_o32.h
-+++ b/linux-headers/asm-mips/unistd_o32.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
- #define __NR_cachestat (__NR_Linux + 451)
- #define __NR_fchmodat2 (__NR_Linux + 452)
-+#define __NR_map_shadow_stack (__NR_Linux + 453)
-+#define __NR_futex_wake (__NR_Linux + 454)
-+#define __NR_futex_wait (__NR_Linux + 455)
-+#define __NR_futex_requeue (__NR_Linux + 456)
- #endif /* _ASM_UNISTD_O32_H */
-diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-powerpc/unistd_32.h
-+++ b/linux-headers/asm-powerpc/unistd_32.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node 450
- #define __NR_cachestat 451
- #define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-powerpc/unistd_64.h
-+++ b/linux-headers/asm-powerpc/unistd_64.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node 450
- #define __NR_cachestat 451
- #define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-riscv/kvm.h
-+++ b/linux-headers/asm-riscv/kvm.h
-@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_csr {
-     unsigned long sip;
-     unsigned long satp;
-     unsigned long scounteren;
-+    unsigned long senvcfg;
- };
- /* AIA CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
-@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_aia_csr {
-     unsigned long iprio2h;
- };
-+/* Smstateen CSR for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
-+struct kvm_riscv_smstateen_csr {
-+    unsigned long sstateen0;
-+};
-+
- /* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
- struct kvm_riscv_timer {
-     __u64 frequency;
-@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
-     KVM_RISCV_ISA_EXT_ZICSR,
-     KVM_RISCV_ISA_EXT_ZIFENCEI,
-     KVM_RISCV_ISA_EXT_ZIHPM,
-+    KVM_RISCV_ISA_EXT_SMSTATEEN,
-+    KVM_RISCV_ISA_EXT_ZICOND,
-     KVM_RISCV_ISA_EXT_MAX,
- };
-@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
-     KVM_RISCV_SBI_EXT_PMU,
-     KVM_RISCV_SBI_EXT_EXPERIMENTAL,
-     KVM_RISCV_SBI_EXT_VENDOR,
-+    KVM_RISCV_SBI_EXT_DBCN,
-     KVM_RISCV_SBI_EXT_MAX,
- };
-@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
- #define KVM_REG_RISCV_CSR        (0x03 << KVM_REG_RISCV_TYPE_SHIFT)
- #define KVM_REG_RISCV_CSR_GENERAL    (0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
- #define KVM_REG_RISCV_CSR_AIA        (0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
-+#define KVM_REG_RISCV_CSR_SMSTATEEN    (0x2 << KVM_REG_RISCV_SUBTYPE_SHIFT)
- #define KVM_REG_RISCV_CSR_REG(name)    \
-         (offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
- #define KVM_REG_RISCV_CSR_AIA_REG(name)    \
-     (offsetof(struct kvm_riscv_aia_csr, name) / sizeof(unsigned long))
-+#define KVM_REG_RISCV_CSR_SMSTATEEN_REG(name)  \
-+    (offsetof(struct kvm_riscv_smstateen_csr, name) / sizeof(unsigned long))
- /* Timer registers are mapped as type 4 */
- #define KVM_REG_RISCV_TIMER        (0x04 << KVM_REG_RISCV_TYPE_SHIFT)
-diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-s390/unistd_32.h
-+++ b/linux-headers/asm-s390/unistd_32.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node 450
- #define __NR_cachestat 451
- #define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
- #endif /* _ASM_S390_UNISTD_32_H */
-diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-s390/unistd_64.h
-+++ b/linux-headers/asm-s390/unistd_64.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node 450
- #define __NR_cachestat 451
- #define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
- #endif /* _ASM_S390_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-x86/unistd_32.h
-+++ b/linux-headers/asm-x86/unistd_32.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node 450
- #define __NR_cachestat 451
- #define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-x86/unistd_64.h
-+++ b/linux-headers/asm-x86/unistd_64.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_cachestat 451
- #define __NR_fchmodat2 452
- #define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-x86/unistd_x32.h
-+++ b/linux-headers/asm-x86/unistd_x32.h
-@@ -XXX,XX +XXX,XX @@
- #define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
- #define __NR_cachestat (__X32_SYSCALL_BIT + 451)
- #define __NR_fchmodat2 (__X32_SYSCALL_BIT + 452)
-+#define __NR_futex_wake (__X32_SYSCALL_BIT + 454)
-+#define __NR_futex_wait (__X32_SYSCALL_BIT + 455)
-+#define __NR_futex_requeue (__X32_SYSCALL_BIT + 456)
- #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
- #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
- #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
-diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/iommufd.h
-+++ b/linux-headers/linux/iommufd.h
-@@ -XXX,XX +XXX,XX @@ enum {
-     IOMMUFD_CMD_VFIO_IOAS,
-     IOMMUFD_CMD_HWPT_ALLOC,
-     IOMMUFD_CMD_GET_HW_INFO,
-+    IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
-+    IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
- };
- /**
-@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
- };
- #define IOMMU_VFIO_IOAS _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VFIO_IOAS)
-+/**
-+ * enum iommufd_hwpt_alloc_flags - Flags for HWPT allocation
-+ * @IOMMU_HWPT_ALLOC_NEST_PARENT: If set, allocate a HWPT that can serve as
-+ *                                the parent HWPT in a nesting configuration.
-+ * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
-+ *                                   enforced on device attachment
-+ */
-+enum iommufd_hwpt_alloc_flags {
-+    IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
-+    IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
-+};
-+
-+/**
-+ * enum iommu_hwpt_vtd_s1_flags - Intel VT-d stage-1 page table
-+ *                                entry attributes
-+ * @IOMMU_VTD_S1_SRE: Supervisor request
-+ * @IOMMU_VTD_S1_EAFE: Extended access enable
-+ * @IOMMU_VTD_S1_WPE: Write protect enable
-+ */
-+enum iommu_hwpt_vtd_s1_flags {
-+    IOMMU_VTD_S1_SRE = 1 << 0,
-+    IOMMU_VTD_S1_EAFE = 1 << 1,
-+    IOMMU_VTD_S1_WPE = 1 << 2,
-+};
-+
-+/**
-+ * struct iommu_hwpt_vtd_s1 - Intel VT-d stage-1 page table
-+ *                            info (IOMMU_HWPT_DATA_VTD_S1)
-+ * @flags: Combination of enum iommu_hwpt_vtd_s1_flags
-+ * @pgtbl_addr: The base address of the stage-1 page table.
-+ * @addr_width: The address width of the stage-1 page table
-+ * @__reserved: Must be 0
-+ */
-+struct iommu_hwpt_vtd_s1 {
-+    __aligned_u64 flags;
-+    __aligned_u64 pgtbl_addr;
-+    __u32 addr_width;
-+    __u32 __reserved;
-+};
-+
-+/**
-+ * enum iommu_hwpt_data_type - IOMMU HWPT Data Type
-+ * @IOMMU_HWPT_DATA_NONE: no data
-+ * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
-+ */
-+enum iommu_hwpt_data_type {
-+    IOMMU_HWPT_DATA_NONE,
-+    IOMMU_HWPT_DATA_VTD_S1,
-+};
-+
- /**
-  * struct iommu_hwpt_alloc - ioctl(IOMMU_HWPT_ALLOC)
-  * @size: sizeof(struct iommu_hwpt_alloc)
-- * @flags: Must be 0
-+ * @flags: Combination of enum iommufd_hwpt_alloc_flags
-  * @dev_id: The device to allocate this HWPT for
-- * @pt_id: The IOAS to connect this HWPT to
-+ * @pt_id: The IOAS or HWPT to connect this HWPT to
-  * @out_hwpt_id: The ID of the new HWPT
-  * @__reserved: Must be 0
-+ * @data_type: One of enum iommu_hwpt_data_type
-+ * @data_len: Length of the type specific data
-+ * @data_uptr: User pointer to the type specific data
-  *
-  * Explicitly allocate a hardware page table object. This is the same object
-  * type that is returned by iommufd_device_attach() and represents the
-  * underlying iommu driver's iommu_domain kernel object.
-  *
-- * A HWPT will be created with the IOVA mappings from the given IOAS.
-+ * A kernel-managed HWPT will be created with the mappings from the given
-+ * IOAS via the @pt_id. The @data_type for this allocation must be set to
-+ * IOMMU_HWPT_DATA_NONE. The HWPT can be allocated as a parent HWPT for a
-+ * nesting configuration by passing IOMMU_HWPT_ALLOC_NEST_PARENT via @flags.
-+ *
-+ * A user-managed nested HWPT will be created from a given parent HWPT via
-+ * @pt_id, in which the parent HWPT must be allocated previously via the
-+ * same ioctl from a given IOAS (@pt_id). In this case, the @data_type
-+ * must be set to a pre-defined type corresponding to an I/O page table
-+ * type supported by the underlying IOMMU hardware.
-+ *
-+ * If the @data_type is set to IOMMU_HWPT_DATA_NONE, @data_len and
-+ * @data_uptr should be zero. Otherwise, both @data_len and @data_uptr
-+ * must be given.
-  */
- struct iommu_hwpt_alloc {
-     __u32 size;
-@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_alloc {
-     __u32 pt_id;
-     __u32 out_hwpt_id;
-     __u32 __reserved;
-+    __u32 data_type;
-+    __u32 data_len;
-+    __aligned_u64 data_uptr;
- };
- #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
-+/**
-+ * enum iommu_hw_info_vtd_flags - Flags for VT-d hw_info
-+ * @IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17: If set, disallow read-only mappings
-+ *                                         on a nested_parent domain.
-+ *                                         https://www.intel.com/content/www/us/en/content-details/772415/content-details.html
-+ */
-+enum iommu_hw_info_vtd_flags {
-+    IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 = 1 << 0,
-+};
-+
- /**
-  * struct iommu_hw_info_vtd - Intel VT-d hardware information
-  *
-- * @flags: Must be 0
-+ * @flags: Combination of enum iommu_hw_info_vtd_flags
-  * @__reserved: Must be 0
-  *
-  * @cap_reg: Value of Intel VT-d capability register defined in VT-d spec
-@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
-     IOMMU_HW_INFO_TYPE_INTEL_VTD,
- };
-+/**
-+ * enum iommufd_hw_capabilities
-+ * @IOMMU_HW_CAP_DIRTY_TRACKING: IOMMU hardware support for dirty tracking
-+ *                               If available, it means the following APIs
-+ *                               are supported:
-+ *
-+ *                                   IOMMU_HWPT_GET_DIRTY_BITMAP
-+ *                                   IOMMU_HWPT_SET_DIRTY_TRACKING
-+ *
-+ */
-+enum iommufd_hw_capabilities {
-+    IOMMU_HW_CAP_DIRTY_TRACKING = 1 << 0,
-+};
-+
- /**
-  * struct iommu_hw_info - ioctl(IOMMU_GET_HW_INFO)
-  * @size: sizeof(struct iommu_hw_info)
-@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
-  *             the iommu type specific hardware information data
-  * @out_data_type: Output the iommu hardware info type as defined in the enum
-  *                 iommu_hw_info_type.
-+ * @out_capabilities: Output the generic iommu capability info type as defined
-+ *                    in the enum iommu_hw_capabilities.
-  * @__reserved: Must be 0
-  *
-  * Query an iommu type specific hardware information data from an iommu behind
-@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info {
-     __aligned_u64 data_uptr;
-     __u32 out_data_type;
-     __u32 __reserved;
-+    __aligned_u64 out_capabilities;
- };
- #define IOMMU_GET_HW_INFO _IO(IOMMUFD_TYPE, IOMMUFD_CMD_GET_HW_INFO)
-+
-+/*
-+ * enum iommufd_hwpt_set_dirty_tracking_flags - Flags for steering dirty
-+ *                                              tracking
-+ * @IOMMU_HWPT_DIRTY_TRACKING_ENABLE: Enable dirty tracking
-+ */
-+enum iommufd_hwpt_set_dirty_tracking_flags {
-+    IOMMU_HWPT_DIRTY_TRACKING_ENABLE = 1,
-+};
-+
-+/**
-+ * struct iommu_hwpt_set_dirty_tracking - ioctl(IOMMU_HWPT_SET_DIRTY_TRACKING)
-+ * @size: sizeof(struct iommu_hwpt_set_dirty_tracking)
-+ * @flags: Combination of enum iommufd_hwpt_set_dirty_tracking_flags
-+ * @hwpt_id: HW pagetable ID that represents the IOMMU domain
-+ * @__reserved: Must be 0
-+ *
-+ * Toggle dirty tracking on an HW pagetable.
-+ */
-+struct iommu_hwpt_set_dirty_tracking {
-+    __u32 size;
-+    __u32 flags;
-+    __u32 hwpt_id;
-+    __u32 __reserved;
-+};
-+#define IOMMU_HWPT_SET_DIRTY_TRACKING _IO(IOMMUFD_TYPE, \
-+                      IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING)
-+
-+/**
-+ * enum iommufd_hwpt_get_dirty_bitmap_flags - Flags for getting dirty bits
-+ * @IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR: Just read the PTEs without clearing
-+ *                                        any dirty bits metadata. This flag
-+ *                                        can be passed in the expectation
-+ *                                        where the next operation is an unmap
-+ *                                        of the same IOVA range.
-+ *
-+ */
-+enum iommufd_hwpt_get_dirty_bitmap_flags {
-+    IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR = 1,
-+};
-+
-+/**
-+ * struct iommu_hwpt_get_dirty_bitmap - ioctl(IOMMU_HWPT_GET_DIRTY_BITMAP)
-+ * @size: sizeof(struct iommu_hwpt_get_dirty_bitmap)
-+ * @hwpt_id: HW pagetable ID that represents the IOMMU domain
-+ * @flags: Combination of enum iommufd_hwpt_get_dirty_bitmap_flags
-+ * @__reserved: Must be 0
-+ * @iova: base IOVA of the bitmap first bit
-+ * @length: IOVA range size
-+ * @page_size: page size granularity of each bit in the bitmap
-+ * @data: bitmap where to set the dirty bits. The bitmap bits each
-+ *        represent a page_size which you deviate from an arbitrary iova.
-+ *
-+ * Checking a given IOVA is dirty:
-+ *
-+ *  data[(iova / page_size) / 64] & (1ULL << ((iova / page_size) % 64))
-+ *
-+ * Walk the IOMMU pagetables for a given IOVA range to return a bitmap
-+ * with the dirty IOVAs. In doing so it will also by default clear any
-+ * dirty bit metadata set in the IOPTE.
-+ */
-+struct iommu_hwpt_get_dirty_bitmap {
-+    __u32 size;
-+    __u32 hwpt_id;
-+    __u32 flags;
-+    __u32 __reserved;
-+    __aligned_u64 iova;
-+    __aligned_u64 length;
-+    __aligned_u64 page_size;
-+    __aligned_u64 data;
-+};
-+#define IOMMU_HWPT_GET_DIRTY_BITMAP _IO(IOMMUFD_TYPE, \
-+                    IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP)
-+
- #endif
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
- #define KVM_EXIT_RISCV_SBI        35
- #define KVM_EXIT_RISCV_CSR        36
- #define KVM_EXIT_NOTIFY           37
-+#define KVM_EXIT_LOONGARCH_IOCSR  38
- /* For KVM_EXIT_INTERNAL_ERROR */
- /* Emulate instruction failed. */
-@@ -XXX,XX +XXX,XX @@ struct kvm_run {
-             __u32 len;
-             __u8  is_write;
-         } mmio;
-+        /* KVM_EXIT_LOONGARCH_IOCSR */
-+        struct {
-+            __u64 phys_addr;
-+            __u8  data[8];
-+            __u32 len;
-+            __u8  is_write;
-+        } iocsr_io;
-         /* KVM_EXIT_HYPERCALL */
-         struct {
-             __u64 nr;
-@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
- #define KVM_CAP_COUNTER_OFFSET 227
- #define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
- #define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
-+#define KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES 230
- #ifdef KVM_CAP_IRQ_ROUTING
-@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
- #define KVM_REG_ARM64        0x6000000000000000ULL
- #define KVM_REG_MIPS        0x7000000000000000ULL
- #define KVM_REG_RISCV        0x8000000000000000ULL
-+#define KVM_REG_LOONGARCH    0x9000000000000000ULL
- #define KVM_REG_SIZE_SHIFT    52
- #define KVM_REG_SIZE_MASK    0x00f0000000000000ULL
-@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
- #define KVM_ARM_MTE_COPY_TAGS      _IOR(KVMIO,  0xb4, struct kvm_arm_copy_mte_tags)
- /* Available with KVM_CAP_COUNTER_OFFSET */
- #define KVM_ARM_SET_COUNTER_OFFSET _IOW(KVMIO,  0xb5, struct kvm_arm_counter_offset)
-+#define KVM_ARM_GET_REG_WRITABLE_MASKS _IOR(KVMIO,  0xb6, struct reg_mask_range)
- /* ioctl for vm fd */
- #define KVM_CREATE_DEVICE      _IOWR(KVMIO,  0xe0, struct kvm_create_device)
-diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/psp-sev.h
-+++ b/linux-headers/linux/psp-sev.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     SEV_RET_INVALID_PARAM,
-     SEV_RET_RESOURCE_LIMIT,
-     SEV_RET_SECURE_DATA_INVALID,
-+    SEV_RET_INVALID_KEY = 0x27,
-     SEV_RET_MAX,
- } sev_ret_code;
-diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/stddef.h
-+++ b/linux-headers/linux/stddef.h
-@@ -XXX,XX +XXX,XX @@
-     union { \
-         struct { MEMBERS } ATTRS; \
-         struct TAG { MEMBERS } ATTRS NAME; \
--    }
-+    } ATTRS
-+#ifdef __cplusplus
-+/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */
-+#define __DECLARE_FLEX_ARRAY(T, member)    \
-+    T member[0]
-+#else
- /**
-  * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
-  *
-@@ -XXX,XX +XXX,XX @@
- #ifndef __counted_by
- #define __counted_by(m)
- #endif
-+
-+#endif /* _LINUX_STDDEF_H */
-diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/userfaultfd.h
-+++ b/linux-headers/linux/userfaultfd.h
-@@ -XXX,XX +XXX,XX @@
-                UFFD_FEATURE_EXACT_ADDRESS |        \
-                UFFD_FEATURE_WP_HUGETLBFS_SHMEM |    \
-                UFFD_FEATURE_WP_UNPOPULATED |    \
--               UFFD_FEATURE_POISON)
-+               UFFD_FEATURE_POISON |        \
-+               UFFD_FEATURE_WP_ASYNC)
- #define UFFD_API_IOCTLS                \
-     ((__u64)1 << _UFFDIO_REGISTER |        \
-      (__u64)1 << _UFFDIO_UNREGISTER |    \
-@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
-      * (i.e. empty ptes).  This will be the default behavior for shmem
-      * & hugetlbfs, so this flag only affects anonymous memory behavior
-      * when userfault write-protection mode is registered.
-+     *
-+     * UFFD_FEATURE_WP_ASYNC indicates that userfaultfd write-protection
-+     * asynchronous mode is supported in which the write fault is
-+     * automatically resolved and write-protection is un-set.
-+     * It implies UFFD_FEATURE_WP_UNPOPULATED.
-      */
- #define UFFD_FEATURE_PAGEFAULT_FLAG_WP        (1<<0)
- #define UFFD_FEATURE_EVENT_FORK            (1<<1)
-@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
- #define UFFD_FEATURE_WP_HUGETLBFS_SHMEM        (1<<12)
- #define UFFD_FEATURE_WP_UNPOPULATED        (1<<13)
- #define UFFD_FEATURE_POISON            (1<<14)
-+#define UFFD_FEATURE_WP_ASYNC            (1<<15)
-     __u64 features;
-     __u64 ioctls;
-diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/vfio.h
-+++ b/linux-headers/linux/vfio.h
-@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
- #define VFIO_REGION_INFO_FLAG_CAPS    (1 << 3) /* Info supports caps */
-     __u32    index;        /* Region index */
-     __u32    cap_offset;    /* Offset within info struct of first cap */
--    __u64    size;        /* Region size (bytes) */
--    __u64    offset;        /* Region offset from start of device fd */
-+    __aligned_u64    size;    /* Region size (bytes) */
-+    __aligned_u64    offset;    /* Region offset from start of device fd */
- };
- #define VFIO_DEVICE_GET_REGION_INFO    _IO(VFIO_TYPE, VFIO_BASE + 8)
-@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
- #define VFIO_REGION_INFO_CAP_SPARSE_MMAP    1
- struct vfio_region_sparse_mmap_area {
--    __u64    offset;    /* Offset of mmap'able area within region */
--    __u64    size;    /* Size of mmap'able area */
-+    __aligned_u64    offset;    /* Offset of mmap'able area within region */
-+    __aligned_u64    size;    /* Size of mmap'able area */
- };
- struct vfio_region_info_cap_sparse_mmap {
-@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
-                          VFIO_DEVICE_STATE_V1_RESUMING)
-     __u32 reserved;
--    __u64 pending_bytes;
--    __u64 data_offset;
--    __u64 data_size;
-+    __aligned_u64 pending_bytes;
-+    __aligned_u64 data_offset;
-+    __aligned_u64 data_size;
- };
- /*
-@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
- struct vfio_region_info_cap_nvlink2_ssatgt {
-     struct vfio_info_cap_header header;
--    __u64 tgt;
-+    __aligned_u64 tgt;
- };
- /*
-@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
-     __u32 drm_plane_type;    /* type of plane: DRM_PLANE_TYPE_* */
-     /* out */
-     __u32 drm_format;    /* drm format of plane */
--    __u64 drm_format_mod;   /* tiled mode */
-+    __aligned_u64 drm_format_mod;   /* tiled mode */
-     __u32 width;    /* width of plane */
-     __u32 height;    /* height of plane */
-     __u32 stride;    /* stride of plane */
-@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
-         __u32 region_index;    /* region index */
-         __u32 dmabuf_id;    /* dma-buf id */
-     };
-+    __u32 reserved;
- };
- #define VFIO_DEVICE_QUERY_GFX_PLANE _IO(VFIO_TYPE, VFIO_BASE + 14)
-@@ -XXX,XX +XXX,XX @@ struct vfio_device_ioeventfd {
- #define VFIO_DEVICE_IOEVENTFD_32    (1 << 2) /* 4-byte write */
- #define VFIO_DEVICE_IOEVENTFD_64    (1 << 3) /* 8-byte write */
- #define VFIO_DEVICE_IOEVENTFD_SIZE_MASK    (0xf)
--    __u64    offset;            /* device fd offset of write */
--    __u64    data;            /* data to be written */
-+    __aligned_u64    offset;        /* device fd offset of write */
-+    __aligned_u64    data;        /* data to be written */
-     __s32    fd;            /* -1 for de-assignment */
-+    __u32    reserved;
- };
- #define VFIO_DEVICE_IOEVENTFD        _IO(VFIO_TYPE, VFIO_BASE + 16)
-@@ -XXX,XX +XXX,XX @@ struct vfio_device_feature_mig_data_size {
- #define VFIO_DEVICE_FEATURE_MIG_DATA_SIZE 9
-+/**
-+ * Upon VFIO_DEVICE_FEATURE_SET, set or clear the BUS mastering for the device
-+ * based on the operation specified in op flag.
-+ *
-+ * The functionality is incorporated for devices that needs bus master control,
-+ * but the in-band device interface lacks the support. Consequently, it is not
-+ * applicable to PCI devices, as bus master control for PCI devices is managed
-+ * in-band through the configuration space. At present, this feature is supported
-+ * only for CDX devices.
-+ * When the device's BUS MASTER setting is configured as CLEAR, it will result in
-+ * blocking all incoming DMA requests from the device. On the other hand, configuring
-+ * the device's BUS MASTER setting as SET (enable) will grant the device the
-+ * capability to perform DMA to the host memory.
-+ */
-+struct vfio_device_feature_bus_master {
-+    __u32 op;
-+#define        VFIO_DEVICE_FEATURE_CLEAR_MASTER    0    /* Clear Bus Master */
-+#define        VFIO_DEVICE_FEATURE_SET_MASTER        1    /* Set Bus Master */
-+};
-+#define VFIO_DEVICE_FEATURE_BUS_MASTER 10
-+
- /* -------- API for Type1 VFIO IOMMU -------- */
- /**
-@@ -XXX,XX +XXX,XX @@ struct vfio_iommu_type1_info {
-     __u32    flags;
- #define VFIO_IOMMU_INFO_PGSIZES (1 << 0)    /* supported page sizes info */
- #define VFIO_IOMMU_INFO_CAPS    (1 << 1)    /* Info supports caps */
--    __u64    iova_pgsizes;    /* Bitmap of supported page sizes */
-+    __aligned_u64    iova_pgsizes;        /* Bitmap of supported page sizes */
-     __u32   cap_offset;    /* Offset within info struct of first cap */
-     __u32   pad;
- };
-diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/vhost.h
-+++ b/linux-headers/linux/vhost.h
-@@ -XXX,XX +XXX,XX @@
-  */
- #define VHOST_VDPA_RESUME        _IO(VHOST_VIRTIO, 0x7E)
-+/* Get the group for the descriptor table including driver & device areas
-+ * of a virtqueue: read index, write group in num.
-+ * The virtqueue index is stored in the index field of vhost_vring_state.
-+ * The group ID of the descriptor table for this specific virtqueue
-+ * is returned via num field of vhost_vring_state.
-+ */
-+#define VHOST_VDPA_GET_VRING_DESC_GROUP    _IOWR(VHOST_VIRTIO, 0x7F,    \
-+                          struct vhost_vring_state)
- #endif
---
-.43.0

-[PULL 57/65] linux-headers: riscv: add ptrace.h
+[PULL v2 50/50] hw/char/riscv_htif: Convert HTIF_DEBUG() to trace events
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-KVM vector support for RISC-V requires the linux-header ptrace.h.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250116223609.81594-1-philmd@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218204321.75757-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- linux-headers/asm-riscv/ptrace.h | 132 +++++++++++++++++++++++++++++++
+ hw/char/riscv_htif.c | 15 +++------------
- scripts/update-linux-headers.sh  |   3 +
+ hw/char/trace-events |  4 ++++
-files changed, 135 insertions(+)
+files changed, 7 insertions(+), 12 deletions(-)
  create mode 100644 linux-headers/asm-riscv/ptrace.h
-diff --git a/linux-headers/asm-riscv/ptrace.h b/linux-headers/asm-riscv/ptrace.h
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/hw/char/riscv_htif.c
---- /dev/null
++++ b/hw/char/riscv_htif.c
 +++ b/linux-headers/asm-riscv/ptrace.h
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+ #include "exec/tswap.h"
-+/*
+ #include "system/dma.h"
-+ * Copyright (C) 2012 Regents of the University of California
+ #include "system/runstate.h"
-+ */
+-
 -#define RISCV_DEBUG_HTIF 0
 -#define HTIF_DEBUG(fmt, ...)                                                   \
 -    do {                                                                       \
 -        if (RISCV_DEBUG_HTIF) {                                                \
 -            qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\
 -        }                                                                      \
 -    } while (0)
 +#include "trace.h"
  #define HTIF_DEV_SHIFT          56
  #define HTIF_CMD_SHIFT          48
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
      uint64_t payload = val_written & 0xFFFFFFFFFFFFULL;
      int resp = 0;
 -    HTIF_DEBUG("mtohost write: device: %d cmd: %d what: %02" PRIx64
 -        " -payload: %016" PRIx64 "\n", device, cmd, payload & 0xFF, payload);
 +    trace_htif_uart_write_to_host(device, cmd, payload);
      /*
       * Currently, there is a fixed mapping of devices:
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
          }
      } else {
          qemu_log("HTIF unknown device or command\n");
 -        HTIF_DEBUG("device: %d cmd: %d what: %02" PRIx64
 -            " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload);
 +        trace_htif_uart_unknown_device_command(device, cmd, payload);
      }
      /*
       * Latest bbl does not set fromhost to 0 if there is a value in tohost.
 diff --git a/hw/char/trace-events b/hw/char/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/trace-events
 +++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ stm32f2xx_usart_read(char *id, unsigned size, uint64_t ofs, uint64_t val) " %s s
  stm32f2xx_usart_write(char *id, unsigned size, uint64_t ofs, uint64_t val) "%s size %d ofs 0x%02" PRIx64 " <- 0x%02" PRIx64
  stm32f2xx_usart_drop(char *id) " %s dropping the chars"
  stm32f2xx_usart_receive(char *id, uint8_t chr) " %s receiving '%c'"
 +
-+#ifndef _ASM_RISCV_PTRACE_H
++# riscv_htif.c
-+#define _ASM_RISCV_PTRACE_H
++htif_uart_write_to_host(uint8_t device, uint8_t cmd, uint64_t payload) "device: %u cmd: %02u payload: %016" PRIx64
-+
++htif_uart_unknown_device_command(uint8_t device, uint8_t cmd, uint64_t payload) "device: %u cmd: %02u payload: %016" PRIx64
 +#ifndef __ASSEMBLY__
 +
 +#include <linux/types.h>
 +
 +#define PTRACE_GETFDPIC        33
 +
 +#define PTRACE_GETFDPIC_EXEC    0
 +#define PTRACE_GETFDPIC_INTERP    1
 +
 +/*
 + * User-mode register state for core dumps, ptrace, sigcontext
 + *
 + * This decouples struct pt_regs from the userspace ABI.
 + * struct user_regs_struct must form a prefix of struct pt_regs.
 + */
 +struct user_regs_struct {
 +    unsigned long pc;
 +    unsigned long ra;
 +    unsigned long sp;
 +    unsigned long gp;
 +    unsigned long tp;
 +    unsigned long t0;
 +    unsigned long t1;
 +    unsigned long t2;
 +    unsigned long s0;
 +    unsigned long s1;
 +    unsigned long a0;
 +    unsigned long a1;
 +    unsigned long a2;
 +    unsigned long a3;
 +    unsigned long a4;
 +    unsigned long a5;
 +    unsigned long a6;
 +    unsigned long a7;
 +    unsigned long s2;
 +    unsigned long s3;
 +    unsigned long s4;
 +    unsigned long s5;
 +    unsigned long s6;
 +    unsigned long s7;
 +    unsigned long s8;
 +    unsigned long s9;
 +    unsigned long s10;
 +    unsigned long s11;
 +    unsigned long t3;
 +    unsigned long t4;
 +    unsigned long t5;
 +    unsigned long t6;
 +};
 +
 +struct __riscv_f_ext_state {
 +    __u32 f[32];
 +    __u32 fcsr;
 +};
 +
 +struct __riscv_d_ext_state {
 +    __u64 f[32];
 +    __u32 fcsr;
 +};
 +
 +struct __riscv_q_ext_state {
 +    __u64 f[64] __attribute__((aligned(16)));
 +    __u32 fcsr;
 +    /*
 +     * Reserved for expansion of sigcontext structure.  Currently zeroed
 +     * upon signal, and must be zero upon sigreturn.
 +     */
 +    __u32 reserved[3];
 +};
 +
 +struct __riscv_ctx_hdr {
 +    __u32 magic;
 +    __u32 size;
 +};
 +
 +struct __riscv_extra_ext_header {
 +    __u32 __padding[129] __attribute__((aligned(16)));
 +    /*
 +     * Reserved for expansion of sigcontext structure.  Currently zeroed
 +     * upon signal, and must be zero upon sigreturn.
 +     */
 +    __u32 reserved;
 +    struct __riscv_ctx_hdr hdr;
 +};
 +
 +union __riscv_fp_state {
 +    struct __riscv_f_ext_state f;
 +    struct __riscv_d_ext_state d;
 +    struct __riscv_q_ext_state q;
 +};
 +
 +struct __riscv_v_ext_state {
 +    unsigned long vstart;
 +    unsigned long vl;
 +    unsigned long vtype;
 +    unsigned long vcsr;
 +    unsigned long vlenb;
 +    void *datap;
 +    /*
 +     * In signal handler, datap will be set a correct user stack offset
 +     * and vector registers will be copied to the address of datap
 +     * pointer.
 +     */
 +};
 +
 +struct __riscv_v_regset_state {
 +    unsigned long vstart;
 +    unsigned long vl;
 +    unsigned long vtype;
 +    unsigned long vcsr;
 +    unsigned long vlenb;
 +    char vreg[];
 +};
 +
 +/*
 + * According to spec: The number of bits in a single vector register,
 + * VLEN >= ELEN, which must be a power of 2, and must be no greater than
 + * 2^16 = 65536bits = 8192bytes
 + */
 +#define RISCV_MAX_VLENB (8192)
 +
 +#endif /* __ASSEMBLY__ */
 +
 +#endif /* _ASM_RISCV_PTRACE_H */
 diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
 index XXXXXXX..XXXXXXX 100755
 --- a/scripts/update-linux-headers.sh
 +++ b/scripts/update-linux-headers.sh
@@ -XXX,XX +XXX,XX @@ for arch in $ARCHLIST; do
          cp_portable "$tmpdir/bootparam.h" \
                      "$output/include/standard-headers/asm-$arch"
      fi
 +    if [ $arch = riscv ]; then
 +        cp "$tmpdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
 +    fi
  done
  rm -rf "$output/linux-headers/linux"
 --
-.43.0
+.48.1

The following changes since commit 9468484fe904ab4691de6d9c34616667f377ceac:

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2024-01-09 10:32:23 +0000)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240110

for you to fetch changes up to 71b76da33a1558bcd59100188f5753737ef6fa21:

target/riscv: Ensure mideleg is set correctly on reset (2024-01-10 18:47:47 +1000)

----------------------------------------------------------------
RISC-V PR for 9.0

* Make vector whole-register move (vmv) depend on vtype register
* Fix th.dcache.cval1 priviledge check
* Don't allow write mstatus_vs without RVV
* Use hwaddr instead of target_ulong for RV32
* Fix machine IDs QOM getters\
* Fix KVM reg id sizes
* ACPI: Enable AIA, PLIC and update RHCT
* Fix the interrupts-extended property format of PLIC
* Add support for Zacas extension
* Add amocas.[w,d,q] instructions
* Document acpi parameter of virt machine
* RVA22 profiles support
* Remove group setting of KVM AIA if the machine only has 1 socket
* Add RVV CSRs to KVM
* sifive_u: Update S-mode U-Boot image build instructions
* Upgrade OpenSBI from v1.3.1 to v1.4
* pmp: Ignore writes when RW=01 and MML=0
* Assert that the CSR numbers will be correct
* Don't adjust vscause for exceptions
* Ensure mideleg is set correctly on reset

----------------------------------------------------------------
Alistair Francis (3):
      target/riscv: Assert that the CSR numbers will be correct
      target/riscv: Don't adjust vscause for exceptions
      target/riscv: Ensure mideleg is set correctly on reset

Bin Meng (2):
      docs/system/riscv: sifive_u: Update S-mode U-Boot image build instructions
      roms/opensbi: Upgrade from v1.3.1 to v1.4

Daniel Henrique Barboza (36):
      target/riscv/cpu.c: fix machine IDs getters
      target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
      target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
      target/riscv/kvm: change timer regs size to u64
      target/riscv/kvm: add RISCV_CONFIG_REG()
      target/riscv/kvm: rename riscv_reg_id() to riscv_reg_id_ulong()
      target/riscv: create TYPE_RISCV_VENDOR_CPU
      target/riscv/tcg: do not use "!generic" CPU checks
      target/riscv/tcg: update priv_ver on user_set extensions
      target/riscv: add rv64i CPU
      target/riscv: add zicbop extension flag
      target/riscv/tcg: add 'zic64b' support
      riscv-qmp-cmds.c: expose named features in cpu_model_expansion
      target/riscv: add rva22u64 profile definition
      target/riscv/kvm: add 'rva22u64' flag as unavailable
      target/riscv/tcg: add user flag for profile support
      target/riscv/tcg: add MISA user options hash
      target/riscv/tcg: add riscv_cpu_write_misa_bit()
      target/riscv/tcg: handle profile MISA bits
      target/riscv/tcg: add hash table insert helpers
      target/riscv/tcg: honor user choice for G MISA bits
      target/riscv/tcg: validate profiles during finalize
      riscv-qmp-cmds.c: add profile flags in cpu-model-expansion
      target/riscv: add 'rva22u64' CPU
      target/riscv: implement svade
      target/riscv: add priv ver restriction to profiles
      target/riscv/cpu.c: finalize satp_mode earlier
      target/riscv/cpu.c: add riscv_cpu_is_32bit()
      target/riscv: add satp_mode profile support
      target/riscv: add 'parent' in profile description
      target/riscv: add RVA22S64 profile
      target/riscv: add rva22s64 cpu
      linux-headers: Update to Linux v6.7-rc5
      linux-headers: riscv: add ptrace.h
      target/riscv/kvm: do PR_RISCV_V_SET_CONTROL during realize()
      target/riscv/kvm: add RVV and Vector CSR regs

Heinrich Schuchardt (1):
      docs/system/riscv: document acpi parameter of virt machine

Ivan Klokov (2):
      target/riscv/pmp: Use hwaddr instead of target_ulong for RV32
      target/riscv: pmp: Ignore writes when RW=01 and MML=0

LIU Zhiwei (2):
      target/riscv: Fix th.dcache.cval1 priviledge check
      target/riscv: Not allow write mstatus_vs without RVV

Max Chou (2):
      target/riscv: Add vill check for whole vector register move instructions
      target/riscv: The whole vector register move instructions depend on vsew

Rob Bradford (1):
      disas/riscv: Add amocas.[w,d,q] instructions

Sunil V L (13):
      hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
      hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
      hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
      hw/riscv: virt: Make few IMSIC macros and functions public
      hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
      hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
      hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
      hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
      hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
      hw/pci-host/gpex: Define properties for MMIO ranges
      hw/riscv/virt: Update GPEX MMIO related properties
      hw/riscv/virt-acpi-build.c: Add IO controllers and devices
      hw/riscv/virt-acpi-build.c: Add PLIC in MADT

Weiwei Li (1):
      target/riscv: Add support for Zacas extension

Yong-Xuan Wang (2):
      hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
      target/riscv/kvm.c: remove group setting of KVM AIA if the machine only has 1 socket

docs/system/riscv/sifive_u.rst                 |  33 +-
 docs/system/riscv/virt.rst                     |   5 +
 include/hw/nvram/fw_cfg_acpi.h                 |  15 +
 include/hw/pci-host/gpex.h                     |  28 +-
 include/hw/riscv/virt.h                        |  26 ++
 include/hw/virtio/virtio-acpi.h                |  16 +
 include/standard-headers/drm/drm_fourcc.h      |   2 +
 include/standard-headers/linux/pci_regs.h      |  24 +-
 include/standard-headers/linux/vhost_types.h   |   7 +
 include/standard-headers/linux/virtio_config.h |   5 +
 include/standard-headers/linux/virtio_pci.h    |  11 +
 linux-headers/asm-arm64/kvm.h                  |  32 ++
 linux-headers/asm-generic/unistd.h             |  14 +-
 linux-headers/asm-loongarch/bitsperlong.h      |   1 +
 linux-headers/asm-loongarch/kvm.h              | 108 ++++++
 linux-headers/asm-loongarch/mman.h             |   1 +
 linux-headers/asm-loongarch/unistd.h           |   5 +
 linux-headers/asm-mips/unistd_n32.h            |   4 +
 linux-headers/asm-mips/unistd_n64.h            |   4 +
 linux-headers/asm-mips/unistd_o32.h            |   4 +
 linux-headers/asm-powerpc/unistd_32.h          |   4 +
 linux-headers/asm-powerpc/unistd_64.h          |   4 +
 linux-headers/asm-riscv/kvm.h                  |  12 +
 linux-headers/asm-riscv/ptrace.h               | 132 +++++++
 linux-headers/asm-s390/unistd_32.h             |   4 +
 linux-headers/asm-s390/unistd_64.h             |   4 +
 linux-headers/asm-x86/unistd_32.h              |   4 +
 linux-headers/asm-x86/unistd_64.h              |   3 +
 linux-headers/asm-x86/unistd_x32.h             |   3 +
 linux-headers/linux/iommufd.h                  | 180 +++++++++-
 linux-headers/linux/kvm.h                      |  11 +
 linux-headers/linux/psp-sev.h                  |   1 +
 linux-headers/linux/stddef.h                   |   9 +-
 linux-headers/linux/userfaultfd.h              |   9 +-
 linux-headers/linux/vfio.h                     |  47 ++-
 linux-headers/linux/vhost.h                    |   8 +
 target/riscv/cpu-qom.h                         |   5 +
 target/riscv/cpu.h                             |  18 +
 target/riscv/cpu_cfg.h                         |   5 +
 target/riscv/pmp.h                             |   8 +-
 target/riscv/insn32.decode                     |   6 +
 disas/riscv.c                                  |   9 +
 hw/arm/virt-acpi-build.c                       |  51 +--
 hw/i386/acpi-microvm.c                         |  15 +-
 hw/nvram/fw_cfg-acpi.c                         |  23 ++
 hw/pci-host/gpex-acpi.c                        |  13 +
 hw/pci-host/gpex.c                             |  12 +
 hw/riscv/virt-acpi-build.c                     | 323 ++++++++++++++++--
 hw/riscv/virt.c                                | 124 +++----
 hw/virtio/virtio-acpi.c                        |  33 ++
 target/riscv/cpu.c                             | 223 ++++++++++--
 target/riscv/cpu_helper.c                      |   4 +-
 target/riscv/csr.c                             |  10 +-
 target/riscv/kvm/kvm-cpu.c                     | 250 ++++++++++----
 target/riscv/pmp.c                             |  28 +-
 target/riscv/riscv-qmp-cmds.c                  |  44 ++-
 target/riscv/tcg/tcg-cpu.c                     | 455 ++++++++++++++++++++++---
 target/riscv/translate.c                       |   1 +
 target/riscv/insn_trans/trans_rvv.c.inc        |   8 +-
 target/riscv/insn_trans/trans_rvzacas.c.inc    | 150 ++++++++
 target/riscv/insn_trans/trans_xthead.c.inc     |   2 +-
 hw/nvram/meson.build                           |   1 +
 hw/riscv/Kconfig                               |   1 +
 hw/virtio/meson.build                          |   1 +
 pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 135376 -> 267416 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 138368 -> 270808 bytes
 roms/opensbi                                   |   2 +-
 scripts/update-linux-headers.sh                |   3 +
 68 files changed, 2248 insertions(+), 360 deletions(-)
 create mode 100644 include/hw/nvram/fw_cfg_acpi.h
 create mode 100644 include/hw/virtio/virtio-acpi.h
 create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
 create mode 100644 linux-headers/asm-loongarch/kvm.h
 create mode 100644 linux-headers/asm-loongarch/mman.h
 create mode 100644 linux-headers/asm-loongarch/unistd.h
 create mode 100644 linux-headers/asm-riscv/ptrace.h
 create mode 100644 hw/nvram/fw_cfg-acpi.c
 create mode 100644 hw/virtio/virtio-acpi.c
 create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc

From: Max Chou <max.chou@sifive.com>

The ratified version of RISC-V V spec section 16.6 says that
`The instructions operate as if EEW=SEW`.

So the whole vector register move instructions depend on the vtype
register that means the whole vector register move instructions should
raise an illegal-instruction exception when vtype.vill=1.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231129170400.21251-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
 }
 
 /*
- * Whole Vector Register Move Instructions ignore vtype and vl setting.
- * Thus, we don't need to check vill bit. (Section 16.6)
+ * Whole Vector Register Move Instructions depend on vtype register(vsew).
+ * Thus, we need to check vill bit. (Section 16.6)
  */
 #define GEN_VMV_WHOLE_TRANS(NAME, LEN)                             \
 static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
 {                                                                       \
     if (require_rvv(s) &&                                               \
+        vext_check_isa_ill(s) &&                                        \
         QEMU_IS_ALIGNED(a->rd, LEN) &&                                  \
         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
-- 
2.43.0

From: Max Chou <max.chou@sifive.com>

The RISC-V v spec 16.6 section says that the whole vector register move
instructions operate as if EEW=SEW. So it should depends on the vsew
field of vtype register.

Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231129170400.21251-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
         if (s->vstart_eq_zero) {                                        \
-            /* EEW = 8 */                                               \
-            tcg_gen_gvec_mov(MO_8, vreg_ofs(s, a->rd),                  \
+            tcg_gen_gvec_mov(s->sew, vreg_ofs(s, a->rd),                \
                              vreg_ofs(s, a->rs2), maxsz, maxsz);        \
             mark_vs_dirty(s);                                           \
         } else {                                                        \
-- 
2.43.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

According to the specification, the th.dcache.cvall1 can be executed
under all priviledges.
The specification about xtheadcmo located in,
https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadcmo/dcache_cval1.adoc

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Christoph Muellner <christoph.muellner@vrull.eu>
Message-ID: <20231208094315.177-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_xthead.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -XXX,XX +XXX,XX @@ NOP_PRIVCHECK(th_dcache_csw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_dcache_cisw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_dcache_isw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_dcache_cpal1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
-NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
+NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU)
 
 NOP_PRIVCHECK(th_icache_iall, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_icache_ialls, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
-- 
2.43.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

If CPU does not implement the Vector extension, it usually means
mstatus vs hardwire to zero. So we should not allow write a
non-zero value to this field.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231215023313.1708-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
-        MSTATUS_TW | MSTATUS_VS;
+        MSTATUS_TW;
 
     if (riscv_has_ext(env, RVF)) {
         mask |= MSTATUS_FS;
     }
+    if (riscv_has_ext(env, RVV)) {
+        mask |= MSTATUS_VS;
+    }
 
     if (xl != MXL_RV32 || env->debugger) {
         if (riscv_has_ext(env, RVH)) {
-- 
2.43.0

From: Ivan Klokov <ivan.klokov@syntacore.com>

The Sv32 page-based virtual-memory scheme described in RISCV privileged
spec Section 5.3 supports 34-bit physical addresses for RV32, so the
PMP scheme must support addresses wider than XLEN for RV32. However,
PMP address register format is still 32 bit wide.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231123091214.20312-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h |  8 ++++----
 target/riscv/pmp.c | 26 ++++++++++++--------------
 2 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 } pmp_entry_t;
 
 typedef struct {
-    target_ulong sa;
-    target_ulong ea;
+    hwaddr sa;
+    hwaddr ea;
 } pmp_addr_t;
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env);
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
                        target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
-bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
                         target_ulong size, pmp_priv_t privs,
                         pmp_priv_t *allowed_privs,
                         target_ulong mode);
-target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr);
+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
 void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ void pmp_unlock_entries(CPURISCVState *env)
     }
 }
 
-static void pmp_decode_napot(target_ulong a, target_ulong *sa,
-                             target_ulong *ea)
+static void pmp_decode_napot(hwaddr a, hwaddr *sa, hwaddr *ea)
 {
     /*
      * aaaa...aaa0   8-byte NAPOT range
@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
     target_ulong prev_addr = 0u;
-    target_ulong sa = 0u;
-    target_ulong ea = 0u;
+    hwaddr sa = 0u;
+    hwaddr ea = 0u;
 
     if (pmp_index >= 1u) {
         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_nums(CPURISCVState *env)
     }
 }
 
-static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
-                           target_ulong addr)
+static int pmp_is_in_range(CPURISCVState *env, int pmp_index, hwaddr addr)
 {
     int result = 0;
 
@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, pmp_priv_t privs,
  * Return true if a pmp rule match or default match
  * Return false if no match
  */
-bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
                         target_ulong size, pmp_priv_t privs,
                         pmp_priv_t *allowed_privs, target_ulong mode)
 {
     int i = 0;
     int pmp_size = 0;
-    target_ulong s = 0;
-    target_ulong e = 0;
+    hwaddr s = 0;
+    hwaddr e = 0;
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env)
  * To avoid this we return a size of 1 (which means no caching) if the PMP
  * region only covers partial of the TLB page.
  */
-target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr)
+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr)
 {
-    target_ulong pmp_sa;
-    target_ulong pmp_ea;
-    target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
-    target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
+    hwaddr pmp_sa;
+    hwaddr pmp_ea;
+    hwaddr tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
+    hwaddr tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
     int i;
 
     /*
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

mvendorid is an uint32 property, mimpid/marchid are uint64 properties.
But their getters are returning bools. The reason this went under the
radar for this long is because we have no code using the getters.

The problem can be seem via the 'qom-get' API though. Launching QEMU
with the 'veyron-v1' CPU, a model with:

VEYRON_V1_MVENDORID: 0x61f (1567)
VEYRON_V1_MIMPID: 0x111 (273)
VEYRON_V1_MARCHID: 0x8000000000010000 (9223372036854841344)

This is what the API returns when retrieving these properties:

(qemu) qom-get /machine/soc0/harts[0] mvendorid
true
(qemu) qom-get /machine/soc0/harts[0] mimpid
true
(qemu) qom-get /machine/soc0/harts[0] marchid
true

After this patch:

(qemu) qom-get /machine/soc0/harts[0] mvendorid
1567
(qemu) qom-get /machine/soc0/harts[0] mimpid
273
(qemu) qom-get /machine/soc0/harts[0] marchid
9223372036854841344

Fixes: 1e34150045 ("target/riscv/cpu.c: restrict 'mvendorid' value")
Fixes: a1863ad368 ("target/riscv/cpu.c: restrict 'mimpid' value")
Fixes: d6a427e2c0 ("target/riscv/cpu.c: restrict 'marchid' value")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231211170732.2541368-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
 static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
                               void *opaque, Error **errp)
 {
-    bool value = RISCV_CPU(obj)->cfg.mvendorid;
+    uint32_t value = RISCV_CPU(obj)->cfg.mvendorid;
 
-    visit_type_bool(v, name, &value, errp);
+    visit_type_uint32(v, name, &value, errp);
 }
 
 static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
 static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
                            void *opaque, Error **errp)
 {
-    bool value = RISCV_CPU(obj)->cfg.mimpid;
+    uint64_t value = RISCV_CPU(obj)->cfg.mimpid;
 
-    visit_type_bool(v, name, &value, errp);
+    visit_type_uint64(v, name, &value, errp);
 }
 
 static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
 static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
                            void *opaque, Error **errp)
 {
-    bool value = RISCV_CPU(obj)->cfg.marchid;
+    uint64_t value = RISCV_CPU(obj)->cfg.marchid;
 
-    visit_type_bool(v, name, &value, errp);
+    visit_type_uint64(v, name, &value, errp);
 }
 
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM_REG_RISCV_FP_F regs have u32 size according to the API, but by using
kvm_riscv_reg_id() in RISCV_FP_F_REG() we're returning u64 sizes when
running with TARGET_RISCV64. The most likely reason why no one noticed
this is because we're not implementing kvm_cpu_synchronize_state() in
RISC-V yet.

Create a new helper that returns a KVM ID with u32 size and use it in
RISCV_FP_F_REG().

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
     return id;
 }
 
+static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
+{
+    return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
+}
+
 #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
                  KVM_REG_RISCV_CORE_REG(name))
 
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 #define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
-#define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
+#define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
 
 #define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
 
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
     if (riscv_has_ext(env, RVF)) {
         uint32_t reg;
         for (i = 0; i < 32; i++) {
-            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
+            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(i), &reg);
             if (ret) {
                 return ret;
             }
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
         uint32_t reg;
         for (i = 0; i < 32; i++) {
             reg = env->fpr[i];
-            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
+            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(i), &reg);
             if (ret) {
                 return ret;
             }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM_REG_RISCV_FP_D regs are always u64 size. Using kvm_riscv_reg_id() in
RISCV_FP_D_REG() ends up encoding the wrong size if we're running with
TARGET_RISCV32.

Create a new helper that returns a KVM ID with u64 size and use it with
RISCV_FP_D_REG().

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
     return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
 }
 
+static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
+{
+    return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
+}
+
 #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
                  KVM_REG_RISCV_CORE_REG(name))
 
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
 
 #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
 
-#define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
+#define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
 
 #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
     do { \
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
     if (riscv_has_ext(env, RVD)) {
         uint64_t reg;
         for (i = 0; i < 32; i++) {
-            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
+            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(i), &reg);
             if (ret) {
                 return ret;
             }
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
         uint64_t reg;
         for (i = 0; i < 32; i++) {
             reg = env->fpr[i];
-            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
+            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(i), &reg);
             if (ret) {
                 return ret;
             }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM_REG_RISCV_TIMER regs are always u64 according to the KVM API, but at
this moment we'll return u32 regs if we're running a RISCV32 target.

Use the kvm_riscv_reg_id_u64() helper in RISCV_TIMER_REG() to fix it.

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
 #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
                  KVM_REG_RISCV_CSR_REG(name))
 
-#define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
+#define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
 #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
         } \
     } while (0)
 
-#define KVM_RISCV_GET_TIMER(cs, env, name, reg) \
+#define KVM_RISCV_GET_TIMER(cs, name, reg) \
     do { \
-        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
+        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
         if (ret) { \
             abort(); \
         } \
     } while (0)
 
-#define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
+#define KVM_RISCV_SET_TIMER(cs, name, reg) \
     do { \
-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
         if (ret) { \
             abort(); \
         } \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_get_regs_timer(CPUState *cs)
         return;
     }
 
-    KVM_RISCV_GET_TIMER(cs, env, time, env->kvm_timer_time);
-    KVM_RISCV_GET_TIMER(cs, env, compare, env->kvm_timer_compare);
-    KVM_RISCV_GET_TIMER(cs, env, state, env->kvm_timer_state);
-    KVM_RISCV_GET_TIMER(cs, env, frequency, env->kvm_timer_frequency);
+    KVM_RISCV_GET_TIMER(cs, time, env->kvm_timer_time);
+    KVM_RISCV_GET_TIMER(cs, compare, env->kvm_timer_compare);
+    KVM_RISCV_GET_TIMER(cs, state, env->kvm_timer_state);
+    KVM_RISCV_GET_TIMER(cs, frequency, env->kvm_timer_frequency);
 
     env->kvm_timer_dirty = true;
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
         return;
     }
 
-    KVM_RISCV_SET_TIMER(cs, env, time, env->kvm_timer_time);
-    KVM_RISCV_SET_TIMER(cs, env, compare, env->kvm_timer_compare);
+    KVM_RISCV_SET_TIMER(cs, time, env->kvm_timer_time);
+    KVM_RISCV_SET_TIMER(cs, compare, env->kvm_timer_compare);
 
     /*
      * To set register of RISCV_TIMER_REG(state) will occur a error from KVM
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
      * TODO If KVM changes, adapt here.
      */
     if (env->kvm_timer_state) {
-        KVM_RISCV_SET_TIMER(cs, env, state, env->kvm_timer_state);
+        KVM_RISCV_SET_TIMER(cs, state, env->kvm_timer_state);
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
      * during the migration.
      */
     if (migration_is_running(migrate_get_current()->state)) {
-        KVM_RISCV_GET_TIMER(cs, env, frequency, reg);
+        KVM_RISCV_GET_TIMER(cs, frequency, reg);
         if (reg != env->kvm_timer_frequency) {
             error_report("Dst Hosts timer frequency != Src Hosts");
         }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a RISCV_CONFIG_REG() macro, similar to what other regs use, to
hide away some of the boilerplate.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
 #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
                  KVM_REG_RISCV_CSR_REG(name))
 
+#define RISCV_CONFIG_REG(env, name) \
+    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
+                     KVM_REG_RISCV_CONFIG_REG(name))
+
 #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    reg.id = RISCV_CONFIG_REG(env, mvendorid);
     reg.addr = (uint64_t)&cpu->cfg.mvendorid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(marchid));
+    reg.id = RISCV_CONFIG_REG(env, marchid);
     reg.addr = (uint64_t)&cpu->cfg.marchid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
         error_report("Unable to retrieve marchid from host, error %d", ret);
     }
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(mimpid));
+    reg.id = RISCV_CONFIG_REG(env, mimpid);
     reg.addr = (uint64_t)&cpu->cfg.mimpid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(isa));
+    reg.id = RISCV_CONFIG_REG(env, isa);
     reg.addr = (uint64_t)&env->misa_ext_mask;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
     uint64_t id;
     int ret;
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    id = RISCV_CONFIG_REG(env, mvendorid);
     /*
      * cfg.mvendorid is an uint32 but a target_ulong will
      * be written. Assign it to a target_ulong var to avoid
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
         return ret;
     }
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(marchid));
+    id = RISCV_CONFIG_REG(env, marchid);
     ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
     if (ret != 0) {
         return ret;
     }
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(mimpid));
+    id = RISCV_CONFIG_REG(env, mimpid);
     ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
 
     return ret;
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

kvm_riscv_reg_id() returns an id encoded with an ulong size, i.e. an u32
size when running TARGET_RISCV32 and u64 when running TARGET_RISCV64.

Rename it to kvm_riscv_reg_id_ulong() to enhance code readability. It'll
be in line with the existing kvm_riscv_reg_id_<size>() helpers.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 40 ++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 
 static bool cap_has_mp_state;
 
-static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
     uint64_t id = KVM_REG_RISCV | type | idx;
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
     return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
 }
 
-#define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
-                 KVM_REG_RISCV_CORE_REG(name))
+#define RISCV_CORE_REG(env, name) \
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, \
+                           KVM_REG_RISCV_CORE_REG(name))
 
-#define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
-                 KVM_REG_RISCV_CSR_REG(name))
+#define RISCV_CSR_REG(env, name) \
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CSR, \
+                           KVM_REG_RISCV_CSR_REG(name))
 
 #define RISCV_CONFIG_REG(env, name) \
-    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
-                     KVM_REG_RISCV_CONFIG_REG(name))
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG, \
+                           KVM_REG_RISCV_CONFIG_REG(name))
 
 #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
 
         /* If we're here we're going to disable the MISA bit */
         reg = 0;
-        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-                              misa_cfg->kvm_reg_id);
+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+                                    misa_cfg->kvm_reg_id);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
             /*
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
             continue;
         }
 
-        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-                              multi_ext_cfg->kvm_reg_id);
+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+                                    multi_ext_cfg->kvm_reg_id);
         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_core(CPUState *cs)
     env->pc = reg;
 
     for (i = 1; i < 32; i++) {
-        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
         ret = kvm_get_one_reg(cs, id, &reg);
         if (ret) {
             return ret;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_core(CPUState *cs)
     }
 
     for (i = 1; i < 32; i++) {
-        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
         reg = env->gpr[i];
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              cbomz_cfg->kvm_reg_id);
+    reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
+                                    cbomz_cfg->kvm_reg_id);
     reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
         KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
         struct kvm_one_reg reg;
 
-        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-                                  multi_ext_cfg->kvm_reg_id);
+        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+                                        multi_ext_cfg->kvm_reg_id);
         reg.addr = (uint64_t)&val;
         ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
         if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
     for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
         multi_ext_cfg = &kvm_multi_ext_cfgs[i];
-        reg_id = kvm_riscv_reg_id(&cpu->env, KVM_REG_RISCV_ISA_EXT,
-                                  multi_ext_cfg->kvm_reg_id);
+        reg_id = kvm_riscv_reg_id_ulong(&cpu->env, KVM_REG_RISCV_ISA_EXT,
+                                        multi_ext_cfg->kvm_reg_id);
         reg_search = bsearch(&reg_id, reglist->reg, reglist->n,
                              sizeof(uint64_t), uint64_cmp);
         if (!reg_search) {
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

RISC-V also needs to use the same code to create fw_cfg in DSDT. So,
avoid code duplication by moving the code in arm and riscv to a device
specific file.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-2-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/nvram/fw_cfg_acpi.h | 15 +++++++++++++++
 hw/arm/virt-acpi-build.c       | 19 ++-----------------
 hw/nvram/fw_cfg-acpi.c         | 23 +++++++++++++++++++++++
 hw/riscv/virt-acpi-build.c     | 19 ++-----------------
 hw/nvram/meson.build           |  1 +
 5 files changed, 43 insertions(+), 34 deletions(-)
 create mode 100644 include/hw/nvram/fw_cfg_acpi.h
 create mode 100644 hw/nvram/fw_cfg-acpi.c

diff --git a/include/hw/nvram/fw_cfg_acpi.h b/include/hw/nvram/fw_cfg_acpi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/nvram/fw_cfg_acpi.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * ACPI support for fw_cfg
+ *
+ */
+
+#ifndef FW_CFG_ACPI_H
+#define FW_CFG_ACPI_H
+
+#include "qemu/osdep.h"
+#include "exec/hwaddr.h"
+
+void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap);
+
+#endif
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/cpu.h"
 #include "hw/acpi/acpi-defs.h"
 #include "hw/acpi/acpi.h"
-#include "hw/nvram/fw_cfg.h"
+#include "hw/nvram/fw_cfg_acpi.h"
 #include "hw/acpi/bios-linker-loader.h"
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/utils.h"
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
     aml_append(scope, dev);
 }
 
-static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
-{
-    Aml *dev = aml_device("FWCF");
-    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
-    /* device present, functioning, decoding, not shown in UI */
-    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
-    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-    Aml *crs = aml_resource_template();
-    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
-                                       fw_cfg_memmap->size, AML_READ_WRITE));
-    aml_append(dev, aml_name_decl("_CRS", crs));
-    aml_append(scope, dev);
-}
-
 static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
 {
     Aml *dev, *crs;
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     if (vmc->acpi_expose_flash) {
         acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
     }
-    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
+    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
     acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
                     (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
     acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
diff --git a/hw/nvram/fw_cfg-acpi.c b/hw/nvram/fw_cfg-acpi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/nvram/fw_cfg-acpi.c
@@ -XXX,XX +XXX,XX @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Add fw_cfg device in DSDT
+ *
+ */
+
+#include "hw/nvram/fw_cfg_acpi.h"
+#include "hw/acpi/aml-build.h"
+
+void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap)
+{
+    Aml *dev = aml_device("FWCF");
+    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
+    /* device present, functioning, decoding, not shown in UI */
+    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+
+    Aml *crs = aml_resource_template();
+    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
+                                       fw_cfg_memmap->size, AML_READ_WRITE));
+    aml_append(dev, aml_name_decl("_CRS", crs));
+    aml_append(scope, dev);
+}
diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/utils.h"
+#include "hw/nvram/fw_cfg_acpi.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/reset.h"
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
     }
 }
 
-static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
-{
-    Aml *dev = aml_device("FWCF");
-    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
-
-    /* device present, functioning, decoding, not shown in UI */
-    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
-    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-    Aml *crs = aml_resource_template();
-    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
-                                       fw_cfg_memmap->size, AML_READ_WRITE));
-    aml_append(dev, aml_name_decl("_CRS", crs));
-    aml_append(scope, dev);
-}
-
 /* RHCT Node[N] starts at offset 56 */
 #define RHCT_NODE_ARRAY_OFFSET 56
 
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
     scope = aml_scope("\\_SB");
     acpi_dsdt_add_cpus(scope, s);
 
-    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
+    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
 
     aml_append(dsdt, scope);
 
diff --git a/hw/nvram/meson.build b/hw/nvram/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/meson.build
+++ b/hw/nvram/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_XLNX_EFUSE_ZYNQMP', if_true: files(
 system_ss.add(when: 'CONFIG_XLNX_BBRAM', if_true: files('xlnx-bbram.c'))
 
 specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_nvram.c'))
+specific_ss.add(when: 'CONFIG_ACPI', if_true: files('fw_cfg-acpi.c'))
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

RISC-V also needs to create the virtio in DSDT in the same way as ARM.
So, instead of duplicating the code, move this function to the device
specific file which is common across architectures.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-3-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/virtio/virtio-acpi.h | 16 ++++++++++++++++
 hw/arm/virt-acpi-build.c        | 32 ++++----------------------------
 hw/virtio/virtio-acpi.c         | 33 +++++++++++++++++++++++++++++++++
 hw/virtio/meson.build           |  1 +
 4 files changed, 54 insertions(+), 28 deletions(-)
 create mode 100644 include/hw/virtio/virtio-acpi.h
 create mode 100644 hw/virtio/virtio-acpi.c

diff --git a/include/hw/virtio/virtio-acpi.h b/include/hw/virtio/virtio-acpi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/virtio/virtio-acpi.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * ACPI support for virtio
+ */
+
+#ifndef VIRTIO_ACPI_H
+#define VIRTIO_ACPI_H
+
+#include "qemu/osdep.h"
+#include "exec/hwaddr.h"
+
+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr virtio_mmio_base,
+                          const hwaddr virtio_mmio_size, uint32_t mmio_irq,
+                          long int start_index, int num);
+
+#endif
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "hw/acpi/ghes.h"
 #include "hw/acpi/viot.h"
+#include "hw/virtio/virtio-acpi.h"
 
 #define ARM_SPI_BASE 32
 
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
     aml_append(scope, dev);
 }
 
-static void acpi_dsdt_add_virtio(Aml *scope,
-                                 const MemMapEntry *virtio_mmio_memmap,
-                                 uint32_t mmio_irq, int num)
-{
-    hwaddr base = virtio_mmio_memmap->base;
-    hwaddr size = virtio_mmio_memmap->size;
-    int i;
-
-    for (i = 0; i < num; i++) {
-        uint32_t irq = mmio_irq + i;
-        Aml *dev = aml_device("VR%02u", i);
-        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
-        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
-        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-        Aml *crs = aml_resource_template();
-        aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
-        aml_append(crs,
-                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
-                                 AML_EXCLUSIVE, &irq, 1));
-        aml_append(dev, aml_name_decl("_CRS", crs));
-        aml_append(scope, dev);
-        base += size;
-    }
-}
-
 static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
                               uint32_t irq, VirtMachineState *vms)
 {
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
     }
     fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
-    acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
-                    (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
+    virtio_acpi_dsdt_add(scope, memmap[VIRT_MMIO].base, memmap[VIRT_MMIO].size,
+                         (irqmap[VIRT_MMIO] + ARM_SPI_BASE),
+                         0, NUM_VIRTIO_TRANSPORTS);
     acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
     if (vms->acpi_dev) {
         build_ged_aml(scope, "\\_SB."GED_DEVICE,
diff --git a/hw/virtio/virtio-acpi.c b/hw/virtio/virtio-acpi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/virtio-acpi.c
@@ -XXX,XX +XXX,XX @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * virtio ACPI Support
+ *
+ */
+
+#include "hw/virtio/virtio-acpi.h"
+#include "hw/acpi/aml-build.h"
+
+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr base, const hwaddr size,
+                          uint32_t mmio_irq, long int start_index, int num)
+{
+    hwaddr virtio_base = base;
+    uint32_t irq = mmio_irq;
+    long int i;
+
+    for (i = start_index; i < start_index + num; i++) {
+        Aml *dev = aml_device("VR%02u", (unsigned)i);
+        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
+        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
+        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+
+        Aml *crs = aml_resource_template();
+        aml_append(crs, aml_memory32_fixed(virtio_base, size, AML_READ_WRITE));
+        aml_append(crs,
+                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
+                                 AML_EXCLUSIVE, &irq, 1));
+        aml_append(dev, aml_name_decl("_CRS", crs));
+        aml_append(scope, dev);
+        virtio_base += size;
+        irq++;
+    }
+}
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('virtio-stub.c'))
 system_ss.add(files('virtio-hmp-cmds.c'))
 
 specific_ss.add_all(when: 'CONFIG_VIRTIO', if_true: specific_virtio_ss)
+system_ss.add(when: 'CONFIG_ACPI', if_true: files('virtio-acpi.c'))
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

With common function to add virtio in DSDT created now, update microvm
code also to use it instead of duplicate code.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-4-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/i386/acpi-microvm.c | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/hw/i386/acpi-microvm.c b/hw/i386/acpi-microvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/acpi-microvm.c
+++ b/hw/i386/acpi-microvm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/pci.h"
 #include "hw/pci/pcie_host.h"
 #include "hw/usb/xhci.h"
+#include "hw/virtio/virtio-acpi.h"
 #include "hw/virtio/virtio-mmio.h"
 #include "hw/input/i8042.h"
 
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_virtio(Aml *scope,
             uint32_t irq = mms->virtio_irq_base + index;
             hwaddr base = VIRTIO_MMIO_BASE + index * 512;
             hwaddr size = 512;
-
-            Aml *dev = aml_device("VR%02u", (unsigned)index);
-            aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
-            aml_append(dev, aml_name_decl("_UID", aml_int(index)));
-            aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-            Aml *crs = aml_resource_template();
-            aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
-            aml_append(crs,
-                       aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
-                                     AML_EXCLUSIVE, &irq, 1));
-            aml_append(dev, aml_name_decl("_CRS", crs));
-            aml_append(scope, dev);
+            virtio_acpi_dsdt_add(scope, base, size, irq, index, 1);
         }
     }
 }
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Some macros and static function related to IMSIC are defined in virt.c.
They are required in virt-acpi-build.c. So, make them public.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-5-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h | 25 +++++++++++++++++++++++++
 hw/riscv/virt.c         | 25 +------------------------
 2 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/sysbus.h"
 #include "hw/block/flash.h"
+#include "hw/intc/riscv_imsic.h"
 
 #define VIRT_CPUS_MAX_BITS             9
 #define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
@@ -XXX,XX +XXX,XX @@ enum {
 
 bool virt_is_acpi_enabled(RISCVVirtState *s);
 void virt_acpi_setup(RISCVVirtState *vms);
+uint32_t imsic_num_bits(uint32_t count);
+
+/*
+ * The virt machine physical address space used by some of the devices
+ * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
+ * number of CPUs, and number of IMSIC guest files.
+ *
+ * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
+ * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
+ * of virt machine physical address space.
+ */
+
+#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
+#if VIRT_IMSIC_GROUP_MAX_SIZE < \
+    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
+#error "Can't accomodate single IMSIC group in address space"
+#endif
+
+#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
+                                        VIRT_IMSIC_GROUP_MAX_SIZE)
+#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
+#error "Can't accomodate all IMSIC groups in address space"
+#endif
+
 #endif
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm/kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
-#include "hw/intc/riscv_imsic.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "hw/platform-bus.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/acpi/aml-build.h"
 #include "qapi/qapi-visit-common.h"
 
-/*
- * The virt machine physical address space used by some of the devices
- * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
- * number of CPUs, and number of IMSIC guest files.
- *
- * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
- * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
- * of virt machine physical address space.
- */
-
-#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
-#if VIRT_IMSIC_GROUP_MAX_SIZE < \
-    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
-#error "Can't accommodate single IMSIC group in address space"
-#endif
-
-#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
-                                        VIRT_IMSIC_GROUP_MAX_SIZE)
-#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
-#error "Can't accommodate all IMSIC groups in address space"
-#endif
-
 /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 static bool virt_use_kvm_aia(RISCVVirtState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     g_free(plic_cells);
 }
 
-static uint32_t imsic_num_bits(uint32_t count)
+uint32_t imsic_num_bits(uint32_t count)
 {
     uint32_t ret = 0;
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Update the RINTC structure in MADT with AIA related fields.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-6-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 43 ++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/riscv_aclint.h"
 
 #define ACPI_BUILD_TABLE_SIZE             0x20000
+#define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
 
 typedef struct AcpiBuildState {
     /* Copy of table in RAM (for patching) */
@@ -XXX,XX +XXX,XX @@ static void acpi_align_size(GArray *blob, unsigned align)
 
 static void riscv_acpi_madt_add_rintc(uint32_t uid,
                                       const CPUArchIdList *arch_ids,
-                                      GArray *entry)
+                                      GArray *entry,
+                                      RISCVVirtState *s)
 {
+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
     uint64_t hart_id = arch_ids->cpus[uid].arch_id;
+    uint32_t imsic_size, local_cpu_id, socket_id;
+    uint64_t imsic_socket_addr, imsic_addr;
+    MachineState *ms = MACHINE(s);
 
+    socket_id = arch_ids->cpus[uid].props.node_id;
+    local_cpu_id = (arch_ids->cpus[uid].arch_id -
+                    riscv_socket_first_hartid(ms, socket_id)) %
+                    riscv_socket_hart_count(ms, socket_id);
+    imsic_socket_addr = s->memmap[VIRT_IMSIC_S].base +
+                        (socket_id * VIRT_IMSIC_GROUP_MAX_SIZE);
+    imsic_size = IMSIC_HART_SIZE(guest_index_bits);
+    imsic_addr = imsic_socket_addr + local_cpu_id * imsic_size;
     build_append_int_noprefix(entry, 0x18, 1);       /* Type     */
-    build_append_int_noprefix(entry, 20, 1);         /* Length   */
+    build_append_int_noprefix(entry, 36, 1);         /* Length   */
     build_append_int_noprefix(entry, 1, 1);          /* Version  */
     build_append_int_noprefix(entry, 0, 1);          /* Reserved */
     build_append_int_noprefix(entry, 0x1, 4);        /* Flags    */
     build_append_int_noprefix(entry, hart_id, 8);    /* Hart ID  */
     build_append_int_noprefix(entry, uid, 4);        /* ACPI Processor UID */
+    /* External Interrupt Controller ID */
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+        build_append_int_noprefix(entry,
+                                  ACPI_BUILD_INTC_ID(
+                                      arch_ids->cpus[uid].props.node_id,
+                                      local_cpu_id),
+                                  4);
+    } else {
+        build_append_int_noprefix(entry, 0, 4);
+    }
+
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        /* IMSIC Base address */
+        build_append_int_noprefix(entry, imsic_addr, 8);
+        /* IMSIC Size */
+        build_append_int_noprefix(entry, imsic_size, 4);
+    } else {
+        build_append_int_noprefix(entry, 0, 8);
+        build_append_int_noprefix(entry, 0, 4);
+    }
 }
 
 static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
                        aml_int(arch_ids->cpus[i].arch_id)));
 
             /* build _MAT object */
-            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf);
+            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf, s);
             aml_append(dev, aml_name_decl("_MAT",
                                           aml_buffer(madt_buf->len,
                                           (uint8_t *)madt_buf->data)));
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
  * 5.2.12 Multiple APIC Description Table (MADT)
  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/15
  *      https://drive.google.com/file/d/1R6k4MshhN3WTT-hwqAquu5nX6xSEqK2l/view
+ *      https://drive.google.com/file/d/1oMGPyOD58JaPgMl1pKasT-VKsIKia7zR/view
  */
 static void build_madt(GArray *table_data,
                        BIOSLinker *linker,
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
 
     /* RISC-V Local INTC structures per HART */
     for (int i = 0; i < arch_ids->len; i++) {
-        riscv_acpi_madt_add_rintc(i, arch_ids, table_data);
+        riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add IMSIC structure in MADT when IMSIC is configured.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-7-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
     MachineClass *mc = MACHINE_GET_CLASS(s);
     MachineState *ms = MACHINE(s);
     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
+    uint8_t  group_index_bits = imsic_num_bits(riscv_socket_count(ms));
+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
+    uint16_t imsic_max_hart_per_socket = 0;
+    uint8_t  hart_index_bits;
+    uint8_t  socket;
+
+    for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
+            imsic_max_hart_per_socket = s->soc[socket].num_harts;
+        }
+    }
+
+    hart_index_bits = imsic_num_bits(imsic_max_hart_per_socket);
 
     AcpiTable table = { .sig = "APIC", .rev = 6, .oem_id = s->oem_id,
                         .oem_table_id = s->oem_table_id };
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
         riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
     }
 
+    /* IMSIC */
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        /* IMSIC */
+        build_append_int_noprefix(table_data, 0x19, 1);     /* Type */
+        build_append_int_noprefix(table_data, 16, 1);       /* Length */
+        build_append_int_noprefix(table_data, 1, 1);        /* Version */
+        build_append_int_noprefix(table_data, 0, 1);        /* Reserved */
+        build_append_int_noprefix(table_data, 0, 4);        /* Flags */
+        /* Number of supervisor mode Interrupt Identities */
+        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
+        /* Number of guest mode Interrupt Identities */
+        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
+        /* Guest Index Bits */
+        build_append_int_noprefix(table_data, guest_index_bits, 1);
+        /* Hart Index Bits */
+        build_append_int_noprefix(table_data, hart_index_bits, 1);
+        /* Group Index Bits */
+        build_append_int_noprefix(table_data, group_index_bits, 1);
+        /* Group Index Shift */
+        build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
+    }
+
     acpi_table_end(linker, &table);
 }
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add APLIC structures for each socket in the MADT when system is configured
with APLIC as the external wired interrupt controller.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-8-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
     uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
     uint16_t imsic_max_hart_per_socket = 0;
     uint8_t  hart_index_bits;
+    uint64_t aplic_addr;
+    uint32_t gsi_base;
     uint8_t  socket;
 
     for (socket = 0; socket < riscv_socket_count(ms); socket++) {
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
         build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
     }
 
+    if (s->aia_type != VIRT_AIA_TYPE_NONE) {
+        /* APLICs */
+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+            aplic_addr = s->memmap[VIRT_APLIC_S].base +
+                             s->memmap[VIRT_APLIC_S].size * socket;
+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
+            build_append_int_noprefix(table_data, 0x1A, 1);    /* Type */
+            build_append_int_noprefix(table_data, 36, 1);      /* Length */
+            build_append_int_noprefix(table_data, 1, 1);       /* Version */
+            build_append_int_noprefix(table_data, socket, 1);  /* APLIC ID */
+            build_append_int_noprefix(table_data, 0, 4);       /* Flags */
+            build_append_int_noprefix(table_data, 0, 8);       /* Hardware ID */
+            /* Number of IDCs */
+            if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+                build_append_int_noprefix(table_data,
+                                          s->soc[socket].num_harts,
+                                          2);
+            } else {
+                build_append_int_noprefix(table_data, 0, 2);
+            }
+            /* Total External Interrupt Sources Supported */
+            build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_SOURCES, 2);
+            /* Global System Interrupt Base */
+            build_append_int_noprefix(table_data, gsi_base, 4);
+            /* APLIC Address */
+            build_append_int_noprefix(table_data, aplic_addr, 8);
+            /* APLIC size */
+            build_append_int_noprefix(table_data,
+                                      s->memmap[VIRT_APLIC_S].size, 4);
+        }
+    }
+
     acpi_table_end(linker, &table);
 }
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

When CMO related extensions like Zicboz, Zicbom and Zicbop are enabled, the
block size for those extensions need to be communicated via CMO node in
RHCT. Add CMO node in RHCT if any of those CMO extensions are detected.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-9-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 64 +++++++++++++++++++++++++++++++++-----
 1 file changed, 56 insertions(+), 8 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
  * 5.2.36 RISC-V Hart Capabilities Table (RHCT)
  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/16
  *      https://drive.google.com/file/d/1nP3nFiH4jkPMp6COOxP6123DCZKR-tia/view
+ *      https://drive.google.com/file/d/1sKbOa8m1UZw1JkquZYe3F1zQBN1xXsaf/view
  */
 static void build_rhct(GArray *table_data,
                        BIOSLinker *linker,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
     MachineState *ms = MACHINE(s);
     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
     size_t len, aligned_len;
-    uint32_t isa_offset, num_rhct_nodes;
-    RISCVCPU *cpu;
+    uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
+    RISCVCPU *cpu = &s->soc[0].harts[0];
     char *isa;
 
     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
 
     /* ISA + N hart info */
     num_rhct_nodes = 1 + ms->smp.cpus;
+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
+        num_rhct_nodes++;
+    }
 
     /* Number of RHCT nodes*/
     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
     isa_offset = table_data->len - table.table_offset;
     build_append_int_noprefix(table_data, 0, 2);   /* Type 0 */
 
-    cpu = &s->soc[0].harts[0];
     isa = riscv_isa_string(cpu);
     len = 8 + strlen(isa) + 1;
     aligned_len = (len % 2) ? (len + 1) : len;
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
         build_append_int_noprefix(table_data, 0x0, 1);   /* Optional Padding */
     }
 
+    /* CMO node */
+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
+        cmo_offset = table_data->len - table.table_offset;
+        build_append_int_noprefix(table_data, 1, 2);    /* Type */
+        build_append_int_noprefix(table_data, 10, 2);   /* Length */
+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
+
+        /* CBOM block size */
+        if (cpu->cfg.cbom_blocksize) {
+            build_append_int_noprefix(table_data,
+                                      __builtin_ctz(cpu->cfg.cbom_blocksize),
+                                      1);
+        } else {
+            build_append_int_noprefix(table_data, 0, 1);
+        }
+
+        /* CBOP block size */
+        build_append_int_noprefix(table_data, 0, 1);
+
+        /* CBOZ block size */
+        if (cpu->cfg.cboz_blocksize) {
+            build_append_int_noprefix(table_data,
+                                      __builtin_ctz(cpu->cfg.cboz_blocksize),
+                                      1);
+        } else {
+            build_append_int_noprefix(table_data, 0, 1);
+        }
+    }
+
     /* Hart Info Node */
     for (int i = 0; i < arch_ids->len; i++) {
+        len = 16;
+        int num_offsets = 1;
         build_append_int_noprefix(table_data, 0xFFFF, 2);  /* Type */
-        build_append_int_noprefix(table_data, 16, 2);      /* Length */
-        build_append_int_noprefix(table_data, 0x1, 2);     /* Revision */
-        build_append_int_noprefix(table_data, 1, 2);    /* Number of offsets */
-        build_append_int_noprefix(table_data, i, 4);    /* ACPI Processor UID */
-        build_append_int_noprefix(table_data, isa_offset, 4); /* Offsets[0] */
+
+        /* Length */
+        if (cmo_offset) {
+            len += 4;
+            num_offsets++;
+        }
+
+        build_append_int_noprefix(table_data, len, 2);
+        build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
+        /* Number of offsets */
+        build_append_int_noprefix(table_data, num_offsets, 2);
+        build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
+
+        /* Offsets */
+        build_append_int_noprefix(table_data, isa_offset, 4);
+        if (cmo_offset) {
+            build_append_int_noprefix(table_data, cmo_offset, 4);
+        }
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

MMU type information is available via MMU node in RHCT. Add this node in
RHCT.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-10-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
     size_t len, aligned_len;
     uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
     RISCVCPU *cpu = &s->soc[0].harts[0];
+    uint32_t mmu_offset = 0;
+    uint8_t satp_mode_max;
     char *isa;
 
     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
         num_rhct_nodes++;
     }
 
+    if (cpu->cfg.satp_mode.supported != 0) {
+        num_rhct_nodes++;
+    }
+
     /* Number of RHCT nodes*/
     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
 
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
         }
     }
 
+    /* MMU node structure */
+    if (cpu->cfg.satp_mode.supported != 0) {
+        satp_mode_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
+        mmu_offset = table_data->len - table.table_offset;
+        build_append_int_noprefix(table_data, 2, 2);    /* Type */
+        build_append_int_noprefix(table_data, 8, 2);    /* Length */
+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
+        /* MMU Type */
+        if (satp_mode_max == VM_1_10_SV57) {
+            build_append_int_noprefix(table_data, 2, 1);    /* Sv57 */
+        } else if (satp_mode_max == VM_1_10_SV48) {
+            build_append_int_noprefix(table_data, 1, 1);    /* Sv48 */
+        } else if (satp_mode_max == VM_1_10_SV39) {
+            build_append_int_noprefix(table_data, 0, 1);    /* Sv39 */
+        } else {
+            assert(1);
+        }
+    }
+
     /* Hart Info Node */
     for (int i = 0; i < arch_ids->len; i++) {
         len = 16;
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
             num_offsets++;
         }
 
+        if (mmu_offset) {
+            len += 4;
+            num_offsets++;
+        }
+
         build_append_int_noprefix(table_data, len, 2);
         build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
         /* Number of offsets */
         build_append_int_noprefix(table_data, num_offsets, 2);
         build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
-
         /* Offsets */
         build_append_int_noprefix(table_data, isa_offset, 4);
         if (cmo_offset) {
             build_append_int_noprefix(table_data, cmo_offset, 4);
         }
+
+        if (mmu_offset) {
+            build_append_int_noprefix(table_data, mmu_offset, 4);
+        }
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

ACPI DSDT generator needs information like ECAM range, PIO range, 32-bit
and 64-bit PCI MMIO range etc related to the PCI host bridge. Instead of
making these values machine specific, create properties for the GPEX
host bridge with default value 0. During initialization, the firmware
can initialize these properties with correct values for the platform.
This basically allows DSDT generator code independent of the machine
specific memory map accesses.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231218150247.466427-11-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/pci-host/gpex.h | 28 ++++++++++++++++++++--------
 hw/pci-host/gpex-acpi.c    | 13 +++++++++++++
 hw/pci-host/gpex.c         | 12 ++++++++++++
 3 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -XXX,XX +XXX,XX @@ struct GPEXRootState {
     /*< public >*/
 };
 
+struct GPEXConfig {
+    MemMapEntry ecam;
+    MemMapEntry mmio32;
+    MemMapEntry mmio64;
+    MemMapEntry pio;
+    int         irq;
+    PCIBus      *bus;
+};
+
 struct GPEXHost {
     /*< private >*/
     PCIExpressHost parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GPEXHost {
     int irq_num[GPEX_NUM_IRQS];
 
     bool allow_unmapped_accesses;
-};
 
-struct GPEXConfig {
-    MemMapEntry ecam;
-    MemMapEntry mmio32;
-    MemMapEntry mmio64;
-    MemMapEntry pio;
-    int         irq;
-    PCIBus      *bus;
+    struct GPEXConfig gpex_cfg;
 };
 
 int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
 
 void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg);
+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq);
+
+#define PCI_HOST_PIO_BASE               "x-pio-base"
+#define PCI_HOST_PIO_SIZE               "x-pio-size"
+#define PCI_HOST_ECAM_BASE              "x-ecam-base"
+#define PCI_HOST_ECAM_SIZE              "x-ecam-size"
+#define PCI_HOST_BELOW_4G_MMIO_BASE     "x-below-4g-mmio-base"
+#define PCI_HOST_BELOW_4G_MMIO_SIZE     "x-below-4g-mmio-size"
+#define PCI_HOST_ABOVE_4G_MMIO_BASE     "x-above-4g-mmio-base"
+#define PCI_HOST_ABOVE_4G_MMIO_SIZE     "x-above-4g-mmio-size"
 
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -XXX,XX +XXX,XX @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
 
     crs_range_set_free(&crs_range_set);
 }
+
+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq)
+{
+    bool ambig;
+    Object *obj = object_resolve_path_type("", TYPE_GPEX_HOST, &ambig);
+
+    if (!obj || ambig) {
+        return;
+    }
+
+    GPEX_HOST(obj)->gpex_cfg.irq = irq;
+    acpi_dsdt_add_gpex(scope, &GPEX_HOST(obj)->gpex_cfg);
+}
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ static Property gpex_host_properties[] = {
      */
     DEFINE_PROP_BOOL("allow-unmapped-accesses", GPEXHost,
                      allow_unmapped_accesses, true),
+    DEFINE_PROP_UINT64(PCI_HOST_ECAM_BASE, GPEXHost, gpex_cfg.ecam.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_ECAM_SIZE, GPEXHost, gpex_cfg.ecam.size, 0),
+    DEFINE_PROP_UINT64(PCI_HOST_PIO_BASE, GPEXHost, gpex_cfg.pio.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_PIO_SIZE, GPEXHost, gpex_cfg.pio.size, 0),
+    DEFINE_PROP_UINT64(PCI_HOST_BELOW_4G_MMIO_BASE, GPEXHost,
+                       gpex_cfg.mmio32.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_BELOW_4G_MMIO_SIZE, GPEXHost,
+                     gpex_cfg.mmio32.size, 0),
+    DEFINE_PROP_UINT64(PCI_HOST_ABOVE_4G_MMIO_BASE, GPEXHost,
+                       gpex_cfg.mmio64.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MMIO_SIZE, GPEXHost,
+                     gpex_cfg.mmio64.size, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Update the GPEX host bridge properties related to MMIO ranges with
values set for the virt machine.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-12-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  1 +
 hw/riscv/virt.c         | 47 ++++++++++++++++++++++++++++-------------
 2 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     char *oem_table_id;
     OnOffAuto acpi;
     const MemMapEntry *memmap;
+    struct GPEXHost *gpex_host;
 };
 
 enum {
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
 }
 
 static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
-                                          hwaddr ecam_base, hwaddr ecam_size,
-                                          hwaddr mmio_base, hwaddr mmio_size,
-                                          hwaddr high_mmio_base,
-                                          hwaddr high_mmio_size,
-                                          hwaddr pio_base,
-                                          DeviceState *irqchip)
+                                          DeviceState *irqchip,
+                                          RISCVVirtState *s)
 {
     DeviceState *dev;
     MemoryRegion *ecam_alias, *ecam_reg;
     MemoryRegion *mmio_alias, *high_mmio_alias, *mmio_reg;
+    hwaddr ecam_base = s->memmap[VIRT_PCIE_ECAM].base;
+    hwaddr ecam_size = s->memmap[VIRT_PCIE_ECAM].size;
+    hwaddr mmio_base = s->memmap[VIRT_PCIE_MMIO].base;
+    hwaddr mmio_size = s->memmap[VIRT_PCIE_MMIO].size;
+    hwaddr high_mmio_base = virt_high_pcie_memmap.base;
+    hwaddr high_mmio_size = virt_high_pcie_memmap.size;
+    hwaddr pio_base = s->memmap[VIRT_PCIE_PIO].base;
+    hwaddr pio_size = s->memmap[VIRT_PCIE_PIO].size;
     qemu_irq irq;
     int i;
 
     dev = qdev_new(TYPE_GPEX_HOST);
 
+    /* Set GPEX object properties for the virt machine */
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_BASE,
+                            ecam_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_SIZE,
+                            ecam_size, NULL);
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
+                             PCI_HOST_BELOW_4G_MMIO_BASE,
+                             mmio_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_BELOW_4G_MMIO_SIZE,
+                            mmio_size, NULL);
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
+                             PCI_HOST_ABOVE_4G_MMIO_BASE,
+                             high_mmio_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ABOVE_4G_MMIO_SIZE,
+                            high_mmio_size, NULL);
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_BASE,
+                            pio_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_SIZE,
+                            pio_size, NULL);
+
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     ecam_alias = g_new0(MemoryRegion, 1);
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
         gpex_set_irq_num(GPEX_HOST(dev), i, PCIE_IRQ + i);
     }
 
+    GPEX_HOST(dev)->gpex_cfg.bus = PCI_HOST_BRIDGE(GPEX_HOST(dev))->bus;
     return dev;
 }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
             qdev_get_gpio_in(virtio_irqchip, VIRTIO_IRQ + i));
     }
 
-    gpex_pcie_init(system_memory,
-                   memmap[VIRT_PCIE_ECAM].base,
-                   memmap[VIRT_PCIE_ECAM].size,
-                   memmap[VIRT_PCIE_MMIO].base,
-                   memmap[VIRT_PCIE_MMIO].size,
-                   virt_high_pcie_memmap.base,
-                   virt_high_pcie_memmap.size,
-                   memmap[VIRT_PCIE_PIO].base,
-                   pcie_irqchip);
+    gpex_pcie_init(system_memory, pcie_irqchip, s);
 
     create_platform_bus(s, mmio_irqchip);
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add basic IO controllers and devices like PCI, VirtIO and UART in the
ACPI namespace.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-13-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 79 ++++++++++++++++++++++++++++++++++++--
 hw/riscv/Kconfig           |  1 +
 2 files changed, 76 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/acpi/acpi-defs.h"
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/aml-build.h"
+#include "hw/acpi/pci.h"
 #include "hw/acpi/utils.h"
+#include "hw/intc/riscv_aclint.h"
 #include "hw/nvram/fw_cfg_acpi.h"
+#include "hw/pci-host/gpex.h"
+#include "hw/riscv/virt.h"
+#include "hw/riscv/numa.h"
+#include "hw/virtio/virtio-acpi.h"
+#include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/reset.h"
-#include "migration/vmstate.h"
-#include "hw/riscv/virt.h"
-#include "hw/riscv/numa.h"
-#include "hw/intc/riscv_aclint.h"
 
 #define ACPI_BUILD_TABLE_SIZE             0x20000
 #define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
     }
 }
 
+static void
+acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
+                    uint32_t uart_irq)
+{
+    Aml *dev = aml_device("COM0");
+    aml_append(dev, aml_name_decl("_HID", aml_string("PNP0501")));
+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+
+    Aml *crs = aml_resource_template();
+    aml_append(crs, aml_memory32_fixed(uart_memmap->base,
+                                         uart_memmap->size, AML_READ_WRITE));
+    aml_append(crs,
+                aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
+                               AML_EXCLUSIVE, &uart_irq, 1));
+    aml_append(dev, aml_name_decl("_CRS", crs));
+
+    Aml *pkg = aml_package(2);
+    aml_append(pkg, aml_string("clock-frequency"));
+    aml_append(pkg, aml_int(3686400));
+
+    Aml *UUID = aml_touuid("DAFFD814-6EBA-4D8C-8A91-BC9BBF4AA301");
+
+    Aml *pkg1 = aml_package(1);
+    aml_append(pkg1, pkg);
+
+    Aml *package = aml_package(2);
+    aml_append(package, UUID);
+    aml_append(package, pkg1);
+
+    aml_append(dev, aml_name_decl("_DSD", package));
+    aml_append(scope, dev);
+}
+
 /* RHCT Node[N] starts at offset 56 */
 #define RHCT_NODE_ARRAY_OFFSET 56
 
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
                        RISCVVirtState *s)
 {
     Aml *scope, *dsdt;
+    MachineState *ms = MACHINE(s);
+    uint8_t socket_count;
     const MemMapEntry *memmap = s->memmap;
     AcpiTable table = { .sig = "DSDT", .rev = 2, .oem_id = s->oem_id,
                         .oem_table_id = s->oem_table_id };
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
 
     fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
 
+    socket_count = riscv_socket_count(ms);
+
+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART0], UART0_IRQ);
+
+    if (socket_count == 1) {
+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
+                             memmap[VIRT_VIRTIO].size,
+                             VIRTIO_IRQ, 0, VIRTIO_COUNT);
+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ);
+    } else if (socket_count == 2) {
+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
+                             memmap[VIRT_VIRTIO].size,
+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
+                             VIRTIO_COUNT);
+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES);
+    } else {
+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
+                             memmap[VIRT_VIRTIO].size,
+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
+                             VIRTIO_COUNT);
+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES * 2);
+    }
+
     aml_append(dsdt, scope);
 
     /* copy AML table into ACPI tables blob and patch header there */
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
     acpi_add_table(table_offsets, tables_blob);
     build_rhct(tables_blob, tables->linker, s);
 
+    acpi_add_table(table_offsets, tables_blob);
+    {
+        AcpiMcfgInfo mcfg = {
+           .base = s->memmap[VIRT_PCIE_MMIO].base,
+           .size = s->memmap[VIRT_PCIE_MMIO].size,
+        };
+        build_mcfg(tables_blob, tables->linker, &mcfg, s->oem_id,
+                   s->oem_table_id);
+    }
+
     /* XSDT is pointed to by RSDP */
     xsdt = tables_blob->len;
     build_xsdt(tables_blob, tables->linker, table_offsets, s->oem_id,
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select FW_CFG_DMA
     select PLATFORM_BUS
     select ACPI
+    select ACPI_PCI
 
 config SHAKTI_C
     bool
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add PLIC structures for each socket in the MADT when system is
configured with PLIC as the external interrupt controller.

Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-14-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void riscv_acpi_madt_add_rintc(uint32_t uid,
                                       arch_ids->cpus[uid].props.node_id,
                                       local_cpu_id),
                                   4);
+    } else if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+        build_append_int_noprefix(entry,
+                                  ACPI_BUILD_INTC_ID(
+                                      arch_ids->cpus[uid].props.node_id,
+                                      2 * local_cpu_id + 1),
+                                  4);
     } else {
         build_append_int_noprefix(entry, 0, 4);
     }
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
             build_append_int_noprefix(table_data,
                                       s->memmap[VIRT_APLIC_S].size, 4);
         }
+    } else {
+        /* PLICs */
+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+            aplic_addr = s->memmap[VIRT_PLIC].base +
+                         s->memmap[VIRT_PLIC].size * socket;
+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
+            build_append_int_noprefix(table_data, 0x1B, 1);   /* Type */
+            build_append_int_noprefix(table_data, 36, 1);     /* Length */
+            build_append_int_noprefix(table_data, 1, 1);      /* Version */
+            build_append_int_noprefix(table_data, socket, 1); /* PLIC ID */
+            build_append_int_noprefix(table_data, 0, 8);      /* Hardware ID */
+            /* Total External Interrupt Sources Supported */
+            build_append_int_noprefix(table_data,
+                                      VIRT_IRQCHIP_NUM_SOURCES - 1, 2);
+            build_append_int_noprefix(table_data, 0, 2);     /* Max Priority */
+            build_append_int_noprefix(table_data, 0, 4);     /* Flags */
+            /* PLIC Size */
+            build_append_int_noprefix(table_data, s->memmap[VIRT_PLIC].size, 4);
+            /* PLIC Address */
+            build_append_int_noprefix(table_data, aplic_addr, 8);
+            /* Global System Interrupt Vector Base */
+            build_append_int_noprefix(table_data, gsi_base, 4);
+        }
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

The interrupts-extended property of PLIC only has 2 * hart number
fields when KVM enabled, copy 4 * hart number fields to fdt will
expose some uninitialized value.

In this patch, I also refactor the code about the setting of
interrupts-extended property of PLIC for improved readability.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231218090543.22353-1-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 47 +++++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
         "sifive,plic-1.0.0", "riscv,plic0"
     };
 
-    if (kvm_enabled()) {
-        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
-    } else {
-        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
-    }
-
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        if (kvm_enabled()) {
-            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-        } else {
-            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
-            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
-            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
-            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
-        }
-    }
-
     plic_phandles[socket] = (*phandle)++;
     plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
     plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
                                   (char **)&plic_compat,
                                   ARRAY_SIZE(plic_compat));
     qemu_fdt_setprop(ms->fdt, plic_name, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
-        plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+
+    if (kvm_enabled()) {
+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+
+        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+        }
+
+        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
+                         plic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+   } else {
+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
+            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
+        }
+
+        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
+                         plic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+    }
+
     qemu_fdt_setprop_cells(ms->fdt, plic_name, "reg",
         0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
     qemu_fdt_setprop_cell(ms->fdt, plic_name, "riscv,ndev",
-- 
2.43.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add support for amocas.w/d/q instructions which are part of the ratified
Zacas extension: https://github.com/riscv/riscv-zacas

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231207153842.32401-2-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                      |   1 +
 target/riscv/insn32.decode                  |   6 +
 target/riscv/cpu.c                          |   2 +
 target/riscv/tcg/tcg-cpu.c                  |   5 +
 target/riscv/translate.c                    |   1 +
 target/riscv/insn_trans/trans_rvzacas.c.inc | 150 ++++++++++++++++++++
 6 files changed, 165 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svnapot;
     bool ext_svpbmt;
     bool ext_zdinx;
+    bool ext_zacas;
     bool ext_zawrs;
     bool ext_zfa;
     bool ext_zfbfmin;
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
+
+# *** RV32 Zacas Standard Extension ***
+amocas_w    00101 . . ..... ..... 010 ..... 0101111 @atom_st
+amocas_d    00101 . . ..... ..... 011 ..... 0101111 @atom_st
+# *** RV64 Zacas Standard Extension ***
+amocas_q    00101 . . ..... ..... 100 ..... 0101111 @atom_st
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+    ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true),
     MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
     MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
+    MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
     MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
     MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if ((cpu->cfg.ext_zacas) && !riscv_has_ext(env, RVA)) {
+        error_setg(errp, "Zacas extension requires A extension");
+        return;
+    }
+
     if ((cpu->cfg.ext_zawrs) && !riscv_has_ext(env, RVA)) {
         error_setg(errp, "Zawrs extension requires A extension");
         return;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvv.c.inc"
 #include "insn_trans/trans_rvb.c.inc"
 #include "insn_trans/trans_rvzicond.c.inc"
+#include "insn_trans/trans_rvzacas.c.inc"
 #include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzicbo.c.inc"
 #include "insn_trans/trans_rvzfa.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the RV64 Zacas Standard Extension.
+ *
+ * Copyright (c) 2020-2023 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZACAS(ctx) do {          \
+    if (!ctx->cfg_ptr->ext_zacas) {      \
+        return false;                     \
+    }                                     \
+} while (0)
+
+static bool gen_cmpxchg(DisasContext *ctx, arg_atomic *a, MemOp mop)
+{
+    TCGv dest = get_gpr(ctx, a->rd, EXT_NONE);
+    TCGv src1 = get_address(ctx, a->rs1, 0);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+
+    decode_save_opc(ctx);
+    tcg_gen_atomic_cmpxchg_tl(dest, src1, dest, src2, ctx->mem_idx, mop);
+
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+static bool trans_amocas_w(DisasContext *ctx, arg_amocas_w *a)
+{
+    REQUIRE_ZACAS(ctx);
+    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TESL);
+}
+
+static TCGv_i64 get_gpr_pair(DisasContext *ctx, int reg_num)
+{
+    TCGv_i64 t;
+
+    assert(get_ol(ctx) == MXL_RV32);
+
+    if (reg_num == 0) {
+        return tcg_constant_i64(0);
+    }
+
+    t = tcg_temp_new_i64();
+    tcg_gen_concat_tl_i64(t, cpu_gpr[reg_num], cpu_gpr[reg_num + 1]);
+    return t;
+}
+
+static void gen_set_gpr_pair(DisasContext *ctx, int reg_num, TCGv_i64 t)
+{
+    assert(get_ol(ctx) == MXL_RV32);
+
+    if (reg_num != 0) {
+#ifdef TARGET_RISCV32
+        tcg_gen_extr_i64_i32(cpu_gpr[reg_num], cpu_gpr[reg_num + 1], t);
+#else
+        tcg_gen_ext32s_i64(cpu_gpr[reg_num], t);
+        tcg_gen_sari_i64(cpu_gpr[reg_num + 1], t, 32);
+#endif
+
+        if (get_xl_max(ctx) == MXL_RV128) {
+            tcg_gen_sari_tl(cpu_gprh[reg_num], cpu_gpr[reg_num], 63);
+            tcg_gen_sari_tl(cpu_gprh[reg_num + 1], cpu_gpr[reg_num + 1], 63);
+        }
+    }
+}
+
+static bool gen_cmpxchg64(DisasContext *ctx, arg_atomic *a, MemOp mop)
+{
+    /*
+     * Encodings with odd numbered registers specified in rs2 and rd are
+     * reserved.
+     */
+    if ((a->rs2 | a->rd) & 1) {
+        return false;
+    }
+
+    TCGv_i64 dest = get_gpr_pair(ctx, a->rd);
+    TCGv src1 = get_address(ctx, a->rs1, 0);
+    TCGv_i64 src2 = get_gpr_pair(ctx, a->rs2);
+
+    decode_save_opc(ctx);
+    tcg_gen_atomic_cmpxchg_i64(dest, src1, dest, src2, ctx->mem_idx, mop);
+
+    gen_set_gpr_pair(ctx, a->rd, dest);
+    return true;
+}
+
+static bool trans_amocas_d(DisasContext *ctx, arg_amocas_d *a)
+{
+    REQUIRE_ZACAS(ctx);
+    switch (get_ol(ctx)) {
+    case MXL_RV32:
+        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TEUQ);
+    case MXL_RV64:
+    case MXL_RV128:
+        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TEUQ);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
+{
+    REQUIRE_ZACAS(ctx);
+    REQUIRE_64BIT(ctx);
+
+    /*
+     * Encodings with odd numbered registers specified in rs2 and rd are
+     * reserved.
+     */
+    if ((a->rs2 | a->rd) & 1) {
+        return false;
+    }
+
+#ifdef TARGET_RISCV64
+    TCGv_i128 dest = tcg_temp_new_i128();
+    TCGv src1 = get_address(ctx, a->rs1, 0);
+    TCGv_i128 src2 = tcg_temp_new_i128();
+    TCGv_i64 src2l = get_gpr(ctx, a->rs2, EXT_NONE);
+    TCGv_i64 src2h = get_gpr(ctx, a->rs2 == 0 ? 0 : a->rs2 + 1, EXT_NONE);
+    TCGv_i64 destl = get_gpr(ctx, a->rd, EXT_NONE);
+    TCGv_i64 desth = get_gpr(ctx, a->rd == 0 ? 0 : a->rd + 1, EXT_NONE);
+
+    tcg_gen_concat_i64_i128(src2, src2l, src2h);
+    tcg_gen_concat_i64_i128(dest, destl, desth);
+    decode_save_opc(ctx);
+    tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx,
+                                (MO_ALIGN | MO_TEUO));
+
+    tcg_gen_extr_i128_i64(destl, desth, dest);
+
+    if (a->rd != 0) {
+        gen_set_gpr(ctx, a->rd, destl);
+        gen_set_gpr(ctx, a->rd + 1, desth);
+    }
+#endif
+
+    return true;
+}
-- 
2.43.0

From: Rob Bradford <rbradford@rivosinc.com>

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231207153842.32401-3-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_vwsll_vv = 872,
     rv_op_vwsll_vx = 873,
     rv_op_vwsll_vi = 874,
+    rv_op_amocas_w = 875,
+    rv_op_amocas_d = 876,
+    rv_op_amocas_q = 877,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "vwsll.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
     { "vwsll.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
     { "vwsll.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+    { "amocas.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
+    { "amocas.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
+    { "amocas.q", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 34: op = rv_op_amoxor_w; break;
             case 35: op = rv_op_amoxor_d; break;
             case 36: op = rv_op_amoxor_q; break;
+            case 42: op = rv_op_amocas_w; break;
+            case 43: op = rv_op_amocas_d; break;
+            case 44: op = rv_op_amocas_q; break;
             case 66: op = rv_op_amoor_w; break;
             case 67: op = rv_op_amoor_d; break;
             case 68: op = rv_op_amoor_q; break;
-- 
2.43.0

From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

Since QEMU v8.0.0 the RISC-V virt machine has a switch to disable ACPI
table generation. Add it to the documentation.

Fixes: 168b8c29cedb ("hw/riscv/virt: Add a switch to disable ACPI")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231220193436.25909-1-heinrich.schuchardt@canonical.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
   SiFive CLINT. When not specified, this option is assumed to be "off".
   This option is restricted to the TCG accelerator.
 
+- acpi=[on|off|auto]
+
+  When this option is "on" (which is the default), ACPI tables are generated and
+  exposed as firmware tables etc/acpi/rsdp and etc/acpi/tables.
+
 - aia=[none|aplic|aplic-imsic]
 
   This option allows selecting interrupt controller defined by the AIA
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We want to add a new CPU type for bare CPUs that will inherit specific
traits of the 2 existing types:

- it will allow for extensions to be enabled/disabled, like generic
  CPUs;

- it will NOT inherit defaults, like vendor CPUs.

We can make this conditions met by adding an explicit type for the
existing vendor CPUs and change the existing logic to not imply that
"not generic" means vendor CPUs.

Let's add the "vendor" CPU type first.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 30 +++++++++++++++++++++---------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 
 #define TYPE_RISCV_CPU "riscv-cpu"
 #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
+#define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
 
 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
         .instance_init = initfn               \
     }
 
+#define DEFINE_VENDOR_CPU(type_name, initfn) \
+    {                                        \
+        .name = type_name,                   \
+        .parent = TYPE_RISCV_VENDOR_CPU,     \
+        .instance_init = initfn              \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .parent = TYPE_RISCV_CPU,
         .abstract = true,
     },
+    {
+        .name = TYPE_RISCV_VENDOR_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+    },
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
 #if defined(TARGET_RISCV32)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,   rv32_base_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,       rv32_sifive_e_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,       rv32_imafcu_nommu_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,       rv32_sifive_u_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,        rv32_ibex_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31,  rv32_sifive_e_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34,  rv32_imafcu_nommu_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34,  rv32_sifive_u_cpu_init),
 #elif defined(TARGET_RISCV64)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,       rv64_sifive_e_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_VEYRON_V1,        rv64_veyron_v1_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51,  rv64_sifive_e_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54,  rv64_sifive_u_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,    rv64_sifive_u_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
 #endif
 };
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Our current logic in get/setters of MISA and multi-letter extensions
works because we have only 2 CPU types, generic and vendor, and by using
"!generic" we're implying that we're talking about vendor CPUs. When adding
a third CPU type this logic will break so let's handle it beforehand.

In set_misa_ext_cfg() and set_multi_ext_cfg(), check for "vendor" cpu instead
of "not generic". The "generic CPU" checks remaining are from
riscv_cpu_add_misa_properties() and cpu_add_multi_ext_prop() before
applying default values for the extensions.

This leaves us with:

- vendor CPUs will not allow extension enablement, all other CPUs will;

- generic CPUs will inherit default values for extensions, all others
  won't.

And now we can add a new, third CPU type, that will allow extensions to
be enabled and will not inherit defaults, without changing the existing
logic.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_is_generic(Object *cpu_obj)
     return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
 }
 
+static bool riscv_cpu_is_vendor(Object *cpu_obj)
+{
+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_VENDOR_CPU) != NULL;
+}
+
 /*
  * We'll get here via the following path:
  *
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     target_ulong misa_bit = misa_ext_cfg->misa_bit;
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
-    bool generic_cpu = riscv_cpu_is_generic(obj);
+    bool vendor_cpu = riscv_cpu_is_vendor(obj);
     bool prev_val, value;
 
     if (!visit_type_bool(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     }
 
     if (value) {
-        if (!generic_cpu) {
+        if (vendor_cpu) {
             g_autofree char *cpuname = riscv_cpu_get_name(cpu);
             error_setg(errp, "'%s' CPU does not allow enabling extensions",
                        cpuname);
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
 {
     const RISCVCPUMultiExtConfig *multi_ext_cfg = opaque;
     RISCVCPU *cpu = RISCV_CPU(obj);
-    bool generic_cpu = riscv_cpu_is_generic(obj);
+    bool vendor_cpu = riscv_cpu_is_vendor(obj);
     bool prev_val, value;
 
     if (!visit_type_bool(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    if (value && !generic_cpu) {
+    if (value && vendor_cpu) {
         g_autofree char *cpuname = riscv_cpu_get_name(cpu);
         error_setg(errp, "'%s' CPU does not allow enabling extensions",
                    cpuname);
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We'll add a new bare CPU type that won't have any default priv_ver. This
means that the CPU will default to priv_ver = 0, i.e. 1.10.0.

At the same we'll allow these CPUs to enable extensions at will, but
then, if the extension has a priv_ver newer than 1.10, we'll end up
disabling it. Users will then need to manually set priv_ver to something
other than 1.10 to enable the extensions they want, which is not ideal.

Change the setter() of extensions to allow user enabled extensions to
bump the priv_ver of the CPU. This will make it convenient for users to
enable extensions for CPUs that doesn't set a default priv_ver.

This change does not affect any existing CPU: vendor CPUs does not allow
extensions to be enabled, and generic CPUs are already set to priv_ver
LATEST.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We don't have any form of a 'bare bones' CPU. rv64, our default CPUs,
comes with a lot of defaults. This is fine for most regular uses but
it's not suitable when more control of what is actually loaded in the
CPU is required.

A bare-bones CPU would be annoying to deal with if not by profile
support, a way to load a multitude of extensions with a single flag.
Profile support is going to be implemented shortly, so let's add a CPU
for it.

The new 'rv64i' CPU will have only RVI loaded. It is inspired in the
profile specification that dictates, for RVA22U64 [1]:

"RVA22U64 Mandatory Base
 RV64I is the mandatory base ISA for RVA22U64"

And so it seems that RV64I is the mandatory base ISA for all profiles
listed in [1], making it an ideal CPU to use with profile support.

rv64i is a CPU of type TYPE_RISCV_BARE_CPU. It has a mix of features
from pre-existent CPUs:

- it allows extensions to be enabled, like generic CPUs;
- it will not inherit extension defaults, like vendor CPUs.

This is the minimum extension set to boot OpenSBI and buildroot using
rv64i:

./build/qemu-system-riscv64 -nographic -M virt \
    -cpu rv64i,sv39=true,g=true,c=true,s=true,u=true

Our minimal riscv,isa in this case will be:

# cat /proc/device-tree/cpus/cpu@0/riscv,isa
rv64imafdc_zicntr_zicsr_zifencei_zihpm_zca_zcd#

[1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  2 ++
 target/riscv/cpu.c     | 46 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU "riscv-cpu"
 #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
 #define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
+#define TYPE_RISCV_BARE_CPU "riscv-bare-cpu"
 
 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
 #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
 #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
+#define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
 /* Set the satp mode to the max supported */
 static void set_satp_mode_default_map(RISCVCPU *cpu)
 {
+    /*
+     * Bare CPUs do not default to the max available.
+     * Users must set a valid satp_mode in the command
+     * line.
+     */
+    if (object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_BARE_CPU) != NULL) {
+        warn_report("No satp mode set. Defaulting to 'bare'");
+        cpu->cfg.satp_mode.map = (1 << VM_1_10_MBARE);
+        return;
+    }
+
     cpu->cfg.satp_mode.map = cpu->cfg.satp_mode.supported;
 }
 #endif
@@ -XXX,XX +XXX,XX @@ static void rv128_base_cpu_init(Object *obj)
     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
 #endif
 }
+
+static void rv64i_bare_cpu_init(Object *obj)
+{
+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+    riscv_cpu_set_misa(env, MXL_RV64, RVI);
+
+    /* Remove the defaults from the parent class */
+    RISCV_CPU(obj)->cfg.ext_zicntr = false;
+    RISCV_CPU(obj)->cfg.ext_zihpm = false;
+
+    /* Set to QEMU's first supported priv version */
+    env->priv_ver = PRIV_VERSION_1_10_0;
+
+    /*
+     * Support all available satp_mode settings. The default
+     * value will be set to MBARE if the user doesn't set
+     * satp_mode manually (see set_satp_mode_default()).
+     */
+#ifndef CONFIG_USER_ONLY
+    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV64);
+#endif
+}
 #else
 static void rv32_base_cpu_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
         .instance_init = initfn              \
     }
 
+#define DEFINE_BARE_CPU(type_name, initfn) \
+    {                                      \
+        .name = type_name,                 \
+        .parent = TYPE_RISCV_BARE_CPU,     \
+        .instance_init = initfn            \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .parent = TYPE_RISCV_CPU,
         .abstract = true,
     },
+    {
+        .name = TYPE_RISCV_BARE_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+    },
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
 #if defined(TARGET_RISCV32)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
+    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
 #endif
 };
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

QEMU already implements zicbom (Cache Block Management Operations) and
zicboz (Cache Block Zero Operations). Commit 59cb29d6a5 ("target/riscv:
add Zicbop cbo.prefetch{i, r, m} placeholder") added placeholders for
what would be the instructions for zicbop (Cache Block Prefetch
Operations), which are now no-ops.

The RVA22U64 profile mandates zicbop, which means that applications that
run with this profile might expect zicbop to be present in the riscv,isa
DT and might behave badly if it's absent.

Adding zicbop as an extension will make our future RVA22U64
implementation more in line with what userspace expects and, if/when
cache block prefetch operations became relevant to QEMU, we already have
the extension flag to turn then on/off as needed.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 2 ++
 hw/riscv/virt.c        | 5 +++++
 target/riscv/cpu.c     | 3 +++
 3 files changed, 10 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zic64b is defined in the RVA22U64 profile [1] as a named feature for
"Cache blocks must be 64 bytes in size, naturally aligned in the address
space". It's a fantasy name for 64 bytes cache blocks. The RVA22U64
profile mandates this feature, meaning that applications using this
profile expects 64 bytes cache blocks.

To make the upcoming RVA22U64 implementation complete, we'll zic64b as
a 'named feature', not a regular extension. This means that:

- it won't be exposed to users;
- it won't be written in riscv,isa.

This will be extended to other named extensions in the future, so we're
creating some common boilerplate for them as well.

zic64b is default to 'true' since we're already using 64 bytes blocks.
If any cache block size (cbo{m,p,z}_blocksize) is changed to something
different than 64, zic64b is set to 'false'.

Our profile implementation will then be able to check the current state
of zic64b and take the appropriate action (e.g. throw a warning).

[1] https://github.com/riscv/riscv-profiles/releases/download/v1.0/profiles.pdf

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/cpu_cfg.h     |  1 +
 target/riscv/cpu.c         |  6 ++++++
 target/riscv/tcg/tcg-cpu.c | 26 ++++++++++++++++++++++++++
 4 files changed, 34 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVCPUMultiExtConfig {
 extern const RISCVCPUMultiExtConfig riscv_cpu_extensions[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[];
+extern const RISCVCPUMultiExtConfig riscv_cpu_named_features[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[];
 extern Property riscv_cpu_options[];
 
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smepmp;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
+    bool zic64b;
 
     uint32_t mvendorid;
     uint64_t marchid;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+    MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
+
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 /* Deprecated entries marked for future removal */
 const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[] = {
     MULTI_EXT_CFG_BOOL("Zifencei", ext_zifencei, true),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
     g_assert_not_reached();
 }
 
+static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
+{
+    const RISCVCPUMultiExtConfig *feat;
+
+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
+        if (feat->offset == ext_offset) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
                                         uint32_t ext_offset)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
         return;
     }
 
+    if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+        return;
+    }
+
     ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
 
     if (env->priv_ver < ext_priv_ver) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
     }
 }
 
+static void riscv_cpu_update_named_features(RISCVCPU *cpu)
+{
+    cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
+                      cpu->cfg.cbop_blocksize == 64 &&
+                      cpu->cfg.cboz_blocksize == 64;
+}
+
 /*
  * Check consistency between chosen extensions while setting
  * cpu->cfg accordingly.
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    riscv_cpu_update_named_features(cpu);
+
     if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
         /*
          * Enhanced PMP should only be available
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Named features (zic64b the sole example at this moment) aren't expose to
users, thus we need another way to expose them.

Go through each named feature, get its boolean value, do the needed
conversions (bool to qbool, qbool to QObject) and add it to output dict.

Another adjustment is needed: named features are evaluated during
finalize(), so riscv_cpu_finalize_features() needs to be mandatory
regardless of whether we have an input dict or not. Otherwise zic64b
will always return 'false', which is incorrect: the default values of
cache blocksizes ([cbom/cbop/cboz]_blocksize) are set to 64, satisfying
the conditions for zic64b.

Here's an API usage example after this patch:

$ ./build/qemu-system-riscv64 -S -M virt -display none
    -qmp tcp:localhost:1234,server,wait=off

$ ./scripts/qmp/qmp-shell localhost:1234
Welcome to the QMP low-level shell!
Connected to QEMU 8.1.50

(QEMU) query-cpu-model-expansion type=full model={"name":"rv64"}
{"return": {"model":
    {"name": "rv64", "props": {... "zic64b": true, ...}}}}

zic64b is set to 'true', as expected, since all cache sizes are 64
bytes by default.

If we change one of the cache blocksizes, zic64b is returned as 'false':

(QEMU) query-cpu-model-expansion type=full model={"name":"rv64","props":{"cbom_blocksize":128}}
{"return": {"model":
    {"name": "rv64", "props": {... "zic64b": false, ...}}}}

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/riscv-qmp-cmds.c | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
 #include "qapi/qobject-input-visitor.h"
@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_multiext_props(Object *obj, QDict *qdict_out,
     }
 }
 
+static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
+{
+    const RISCVCPUMultiExtConfig *named_cfg;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    QObject *value;
+    bool flag_val;
+
+    for (int i = 0; riscv_cpu_named_features[i].name != NULL; i++) {
+        named_cfg = &riscv_cpu_named_features[i];
+        flag_val = isa_ext_is_enabled(cpu, named_cfg->offset);
+        value = QOBJECT(qbool_from_bool(flag_val));
+
+        qdict_put_obj(qdict_out, named_cfg->name, value);
+    }
+}
+
 static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
                                            const QDict *qdict_in,
                                            Error **errp)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
         goto err;
     }
 
-    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
-    if (local_err) {
-        goto err;
-    }
-
     visit_end_struct(visitor, NULL);
 
 err:
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
         }
     }
 
+    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        object_unref(obj);
+        return NULL;
+    }
+
     expansion_info = g_new0(CpuModelExpansionInfo, 1);
     expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
     expansion_info->model->name = g_strdup(model->name);
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_extensions);
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
+    riscv_obj_add_named_feats_qdict(obj, qdict_out);
 
     /* Add our CPU boolean options too */
     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The rva22U64 profile, described in:

https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc#rva22-profiles

Contains a set of CPU extensions aimed for 64-bit userspace
applications. Enabling this set to be enabled via a single user flag
makes it convenient to enable a predictable set of features for the CPU,
giving users more predicability when running/testing their workloads.

QEMU implements all possible extensions of this profile. All the so
called 'synthetic extensions' described in the profile that are cache
related are ignored/assumed enabled (Za64rs, Zic64b, Ziccif, Ziccrse,
Ziccamoa, Zicclsm) since we do not implement a cache model.

An abstraction called RISCVCPUProfile is created to store the profile.
'ext_offsets' contains mandatory extensions that QEMU supports. Same
thing with the 'misa_ext' mask. Optional extensions must be enabled
manually in the command line if desired.

The design here is to use the common target/riscv/cpu.c file to store
the profile declaration and export it to the accelerator files. Each
accelerator is then responsible to expose it (or not) to users and how
to enable the extensions.

Next patches will implement the profile for TCG and KVM.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 12 ++++++++++++
 target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
 
 #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
 
+typedef struct riscv_cpu_profile {
+    const char *name;
+    uint32_t misa_ext;
+    bool enabled;
+    bool user_set;
+    const int32_t ext_offsets[];
+} RISCVCPUProfile;
+
+#define RISCV_PROFILE_EXT_LIST_END -1
+
+extern RISCVCPUProfile *riscv_profiles[];
+
 /* Privileged specification version */
 enum {
     PRIV_VERSION_1_10_0 = 0,
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+/*
+ * RVA22U64 defines some 'named features' or 'synthetic extensions'
+ * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
+ * and Zicclsm. We do not implement caching in QEMU so we'll consider
+ * all these named features as always enabled.
+ *
+ * There's no riscv,isa update for them (nor for zic64b, despite it
+ * having a cfg offset) at this moment.
+ */
+static RISCVCPUProfile RVA22U64 = {
+    .name = "rva22u64",
+    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+    .ext_offsets = {
+        CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
+        CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
+        CPU_CFG_OFFSET(ext_zbs), CPU_CFG_OFFSET(ext_zfhmin),
+        CPU_CFG_OFFSET(ext_zkt), CPU_CFG_OFFSET(ext_zicntr),
+        CPU_CFG_OFFSET(ext_zihpm), CPU_CFG_OFFSET(ext_zicbom),
+        CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
+
+        /* mandatory named features for this profile */
+        CPU_CFG_OFFSET(zic64b),
+
+        RISCV_PROFILE_EXT_LIST_END
+    }
+};
+
+RISCVCPUProfile *riscv_profiles[] = {
+    &RVA22U64,
+    NULL,
+};
+
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM does not have the means to support enabling the rva22u64 profile.
The main reasons are:

- we're missing support for some mandatory rva22u64 extensions in the
  KVM module;

- we can't make promises about enabling a profile since it all depends
  on host support in the end.

We'll revisit this decision in the future if needed. For now mark the
'rva22u64' profile as unavailable when running a KVM CPU:

$ qemu-system-riscv64 -machine virt,accel=kvm -cpu rv64,rva22u64=true
qemu-system-riscv64: can't apply global rv64-riscv-cpu.rva22u64=true:
    'rva22u64' is not available with KVM

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-10-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
     }
 
     if (value) {
-        error_setg(errp, "extension %s is not available with KVM",
+        error_setg(errp, "'%s' is not available with KVM",
                    propname);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_extensions);
     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_vendor_exts);
     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_experimental_exts);
+
+   /* We don't have the needed KVM support for profiles */
+    for (i = 0; riscv_profiles[i] != NULL; i++) {
+        riscv_cpu_add_kvm_unavail_prop(cpu_obj, riscv_profiles[i]->name);
+    }
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The TCG emulation implements all the extensions described in the
RVA22U64 profile, both mandatory and optional. The mandatory extensions
will be enabled via the profile flag. We'll leave the optional
extensions to be enabled by hand.

Given that this is the first profile we're implementing in TCG we'll
need some ground work first:

- all profiles declared in riscv_profiles[] will be exposed to users.
TCG is the main accelerator we're considering when adding profile
support in QEMU, so for now it's safe to assume that all profiles in
riscv_profiles[] will be relevant to TCG;

- we'll not support user profile settings for vendor CPUs. The flags
will still be exposed but users won't be able to change them;

- profile support, albeit available for all non-vendor CPUs, will be
based on top of the new 'rv64i' CPU. Setting a profile to 'true' means
enable all mandatory extensions of this profile, setting it to 'false'
will disable all mandatory profile extensions of the CPU, which will
obliterate preset defaults. This is not a problem for a bare CPU like
rv64i but it can allow for silly scenarios when using other CPUs. E.g.
an user can do "-cpu rv64,rva22u64=false" and have a bunch of default
rv64 extensions disabled. The recommended way of using profiles is the
rv64i CPU, but users are free to experiment.

For now we'll handle multi-letter extensions only. MISA extensions need
additional steps that we'll take care later. At this point we can boot a
Linux buildroot using rva22u64 using the following options:

-cpu rv64i,rva22u64=true,sv39=true,g=true,c=true,s=true

Note that being an usermode/application profile we still need to
explicitly set 's=true' to enable Supervisor mode to boot Linux.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 80 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
     return false;
 }
 
+static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
+{
+    switch (feat_offset) {
+    case CPU_CFG_OFFSET(zic64b):
+        cpu->cfg.cbom_blocksize = 64;
+        cpu->cfg.cbop_blocksize = 64;
+        cpu->cfg.cboz_blocksize = 64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
                                         uint32_t ext_offset)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
     }
 }
 
+static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    RISCVCPUProfile *profile = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    bool value;
+    int i, ext_offset;
+
+    if (riscv_cpu_is_vendor(obj)) {
+        error_setg(errp, "Profile %s is not available for vendor CPUs",
+                   profile->name);
+        return;
+    }
+
+    if (cpu->env.misa_mxl != MXL_RV64) {
+        error_setg(errp, "Profile %s only available for 64 bit CPUs",
+                   profile->name);
+        return;
+    }
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    profile->user_set = true;
+    profile->enabled = value;
+
+    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
+        ext_offset = profile->ext_offsets[i];
+
+        if (profile->enabled) {
+            if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+                riscv_cpu_enable_named_feat(cpu, ext_offset);
+            }
+
+            cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
+        }
+
+        g_hash_table_insert(multi_ext_user_opts,
+                            GUINT_TO_POINTER(ext_offset),
+                            (gpointer)profile->enabled);
+        isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
+    }
+}
+
+static void cpu_get_profile(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    RISCVCPUProfile *profile = opaque;
+    bool value = profile->enabled;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
+static void riscv_cpu_add_profiles(Object *cpu_obj)
+{
+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+        const RISCVCPUProfile *profile = riscv_profiles[i];
+
+        object_property_add(cpu_obj, profile->name, "bool",
+                            cpu_get_profile, cpu_set_profile,
+                            NULL, (void *)profile);
+    }
+}
+
 static bool cpu_ext_is_deprecated(const char *ext_name)
 {
     return isupper(ext_name[0]);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 
     riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_deprecated_exts);
 
+    riscv_cpu_add_profiles(obj);
+
     for (Property *prop = riscv_cpu_options; prop && prop->name; prop++) {
         qdev_property_add_static(DEVICE(obj), prop);
     }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We already track user choice for multi-letter extensions because we
needed to honor user choice when enabling/disabling extensions during
realize(). We refrained from adding the same mechanism for MISA
extensions since we didn't need it.

Profile support requires tne need to check for user choice for MISA
extensions, so let's add the corresponding hash now. It works like the
existing multi-letter hash (multi_ext_user_opts) but tracking MISA bits
options in the cpu_set_misa_ext_cfg() callback.

Note that we can't re-use the same hash from multi-letter extensions
because that hash uses cpu->cfg offsets as keys, while for MISA
extensions we're using MISA bits as keys.

After adding the user hash in cpu_set_misa_ext_cfg(), setting default
values with object_property_set_bool() in add_misa_properties() will end
up marking the user choice hash with them. Set the default value
manually to avoid it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@
 
 /* Hash that stores user set extensions */
 static GHashTable *multi_ext_user_opts;
+static GHashTable *misa_ext_user_opts;
 
 static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
+    g_hash_table_insert(misa_ext_user_opts,
+                        GUINT_TO_POINTER(misa_bit),
+                        (gpointer)value);
+
     prev_val = env->misa_ext & misa_bit;
 
     if (value == prev_val) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  */
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 {
+    CPURISCVState *env = &RISCV_CPU(cpu_obj)->env;
     bool use_def_vals = riscv_cpu_is_generic(cpu_obj);
     int i;
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
                             NULL, (void *)misa_cfg);
         object_property_set_description(cpu_obj, name, desc);
         if (use_def_vals) {
-            object_property_set_bool(cpu_obj, name, misa_cfg->enabled, NULL);
+            if (misa_cfg->enabled) {
+                env->misa_ext |= bit;
+                env->misa_ext_mask |= bit;
+            } else {
+                env->misa_ext &= ~bit;
+                env->misa_ext_mask &= ~bit;
+            }
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_cpu_instance_init(CPUState *cs)
     RISCVCPU *cpu = RISCV_CPU(cs);
     Object *obj = OBJECT(cpu);
 
+    misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
     multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
     riscv_cpu_add_user_properties(obj);
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We have two instances of the setting/clearing a MISA bit from
env->misa_ext and env->misa_ext_mask pattern. And the next patch will
end up adding one more.

Create a helper to avoid code repetition.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The profile support is handling multi-letter extensions only. Let's add
support for MISA bits as well.

We'll go through every known MISA bit. If the profile doesn't declare
the bit as mandatory, ignore it. Otherwise, set the bit in env->misa_ext
and env->misa_ext_mask.

Now that we're setting profile MISA bits, one can use the rv64i CPU to boot
Linux using the following options:

-cpu rv64i,rva22u64=true,rv39=true,s=true,zifencei=true

In the near future, when rva22s64 (where, 's', 'zifencei' and sv39 are
mandatory), is implemented, rv64i will be able to boot Linux loading
rva22s64 and no additional flags.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
+    for (i = 0; misa_bits[i] != 0; i++) {
+        uint32_t bit = misa_bits[i];
+
+        if  (!(profile->misa_ext & bit)) {
+            continue;
+        }
+
+        if (bit == RVI && !profile->enabled) {
+            /*
+             * Disabling profiles will not disable the base
+             * ISA RV64I.
+             */
+            continue;
+        }
+
+        g_hash_table_insert(misa_ext_user_opts,
+                            GUINT_TO_POINTER(bit),
+                            (gpointer)value);
+        riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
+    }
+
     for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
         ext_offset = profile->ext_offsets[i];
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Previous patches added several g_hash_table_insert() patterns. Add two
helpers, one for each user hash, to make the code cleaner.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
                                  GUINT_TO_POINTER(ext_offset));
 }
 
+static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
+{
+    g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
+                        (gpointer)value);
+}
+
+static void cpu_misa_ext_add_user_opt(uint32_t bit, bool value)
+{
+    g_hash_table_insert(misa_ext_user_opts, GUINT_TO_POINTER(bit),
+                        (gpointer)value);
+}
+
 static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
                                      bool enabled)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    g_hash_table_insert(misa_ext_user_opts,
-                        GUINT_TO_POINTER(misa_bit),
-                        (gpointer)value);
+    cpu_misa_ext_add_user_opt(misa_bit, value);
 
     prev_val = env->misa_ext & misa_bit;
 
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
             continue;
         }
 
-        g_hash_table_insert(misa_ext_user_opts,
-                            GUINT_TO_POINTER(bit),
-                            (gpointer)value);
+        cpu_misa_ext_add_user_opt(bit, profile->enabled);
         riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
     }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
             cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
         }
 
-        g_hash_table_insert(multi_ext_user_opts,
-                            GUINT_TO_POINTER(ext_offset),
-                            (gpointer)profile->enabled);
+        cpu_cfg_ext_add_user_opt(ext_offset, profile->enabled);
         isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
                     multi_ext_cfg->name, lower);
     }
 
-    g_hash_table_insert(multi_ext_user_opts,
-                        GUINT_TO_POINTER(multi_ext_cfg->offset),
-                        (gpointer)value);
+    cpu_cfg_ext_add_user_opt(multi_ext_cfg->offset, value);
 
     prev_val = isa_ext_is_enabled(cpu, multi_ext_cfg->offset);
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

RVG behaves like a profile: a single flag enables a set of bits. Right
now we're considering user choice when handling RVG and zicsr/zifencei
and ignoring user choice on MISA bits.

We'll add user warnings for profiles when the user disables its
mandatory extensions in the next patch. We'll do the same thing with RVG
now to keep consistency between RVG and profile handling.

First and foremost, create a new RVG only helper to avoid clogging
riscv_cpu_validate_set_extensions(). We do not want to annoy users with
RVG warnings like we did in the past (see 9b9741c38f), thus we'll only
warn if RVG was user set and the user disabled a RVG extension in the
command line.

For every RVG MISA bit (IMAFD), zicsr and zifencei, the logic then
becomes:

- if enabled, do nothing;
- if disabled and not user set, enable it;
- if disabled and user set, throw a warning that it's a RVG mandatory
  extension.

This same logic will be used for profiles in the next patch.

Note that this is a behavior change, where we would error out if the
user disabled either zicsr or zifencei. As long as users are explicitly
disabling things in the command line we'll let them have a go at it, at
least in this step. We'll error out later in the validation if needed.

Other notable changes from the previous RVG code:

- use riscv_cpu_write_misa_bit() instead of manually updating both
  env->misa_ext and env->misa_ext_mask;

- set zicsr and zifencei directly. We're already checking if they
  were user set and priv version will never fail for these
  extensions, making cpu_cfg_ext_auto_update() redundant.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 73 +++++++++++++++++++++++++-------------
 1 file changed, 48 insertions(+), 25 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
                                  GUINT_TO_POINTER(ext_offset));
 }
 
+static bool cpu_misa_ext_is_user_set(uint32_t misa_bit)
+{
+    return g_hash_table_contains(misa_ext_user_opts,
+                                 GUINT_TO_POINTER(misa_bit));
+}
+
 static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
 {
     g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
                       cpu->cfg.cboz_blocksize == 64;
 }
 
+static void riscv_cpu_validate_g(RISCVCPU *cpu)
+{
+    const char *warn_msg = "RVG mandates disabled extension %s";
+    uint32_t g_misa_bits[] = {RVI, RVM, RVA, RVF, RVD};
+    bool send_warn = cpu_misa_ext_is_user_set(RVG);
+
+    for (int i = 0; i < ARRAY_SIZE(g_misa_bits); i++) {
+        uint32_t bit = g_misa_bits[i];
+
+        if (riscv_has_ext(&cpu->env, bit)) {
+            continue;
+        }
+
+        if (!cpu_misa_ext_is_user_set(bit)) {
+            riscv_cpu_write_misa_bit(cpu, bit, true);
+            continue;
+        }
+
+        if (send_warn) {
+            warn_report(warn_msg, riscv_get_misa_ext_name(bit));
+        }
+    }
+
+    if (!cpu->cfg.ext_zicsr) {
+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr))) {
+            cpu->cfg.ext_zicsr = true;
+        } else if (send_warn) {
+            warn_report(warn_msg, "zicsr");
+        }
+    }
+
+    if (!cpu->cfg.ext_zifencei) {
+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei))) {
+            cpu->cfg.ext_zifencei = true;
+        } else if (send_warn) {
+            warn_report(warn_msg, "zifencei");
+        }
+    }
+}
+
 /*
  * Check consistency between chosen extensions while setting
  * cpu->cfg accordingly.
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
-    /* Do some ISA extension error checking */
-    if (riscv_has_ext(env, RVG) &&
-        !(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
-          riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
-          riscv_has_ext(env, RVD) &&
-          cpu->cfg.ext_zicsr && cpu->cfg.ext_zifencei)) {
-
-        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr)) &&
-            !cpu->cfg.ext_zicsr) {
-            error_setg(errp, "RVG requires Zicsr but user set Zicsr to false");
-            return;
-        }
-
-        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei)) &&
-            !cpu->cfg.ext_zifencei) {
-            error_setg(errp, "RVG requires Zifencei but user set "
-                       "Zifencei to false");
-            return;
-        }
-
-        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zicsr), true);
-        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zifencei), true);
-
-        env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
-        env->misa_ext_mask |= RVI | RVM | RVA | RVF | RVD;
+    if (riscv_has_ext(env, RVG)) {
+        riscv_cpu_validate_g(cpu);
     }
 
     if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Enabling a profile and then disabling some of its mandatory extensions
is a valid use. It can be useful for debugging and testing. But the
common expected use of enabling a profile is to enable all its mandatory
extensions.

Add an user warning when mandatory extensions from an enabled profile
are disabled in the command line. We're also going to disable the
profile flag in this case since the profile must include all the
mandatory extensions. This flag can be exposed by QMP to indicate the
actual profile state after the CPU is realized.

After this patch, this will throw warnings:

-cpu rv64,rva22u64=true,zihintpause=false,zicbom=false,zicboz=false

qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zihintpause
qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicbom
qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicboz

Note that the following will NOT throw warnings because the profile is
being enabled last, hence all its mandatory extensions will be enabled:

-cpu rv64,zihintpause=false,zicbom=false,zicboz=false,rva22u64=true

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 69 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
     g_assert_not_reached();
 }
 
+static const char *cpu_cfg_ext_get_name(uint32_t ext_offset)
+{
+    const RISCVCPUMultiExtConfig *feat;
+    const RISCVIsaExtData *edata;
+
+    for (edata = isa_edata_arr; edata->name != NULL; edata++) {
+        if (edata->ext_enable_offset == ext_offset) {
+            return edata->name;
+        }
+    }
+
+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
+        if (feat->offset == ext_offset) {
+            return feat->name;
+        }
+    }
+
+    g_assert_not_reached();
+}
+
 static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
 {
     const RISCVCPUMultiExtConfig *feat;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     riscv_cpu_disable_priv_spec_isa_exts(cpu);
 }
 
+static void riscv_cpu_validate_profile(RISCVCPU *cpu,
+                                       RISCVCPUProfile *profile)
+{
+    const char *warn_msg = "Profile %s mandates disabled extension %s";
+    bool send_warn = profile->user_set && profile->enabled;
+    bool profile_impl = true;
+    int i;
+
+    for (i = 0; misa_bits[i] != 0; i++) {
+        uint32_t bit = misa_bits[i];
+
+        if (!(profile->misa_ext & bit)) {
+            continue;
+        }
+
+        if (!riscv_has_ext(&cpu->env, bit)) {
+            profile_impl = false;
+
+            if (send_warn) {
+                warn_report(warn_msg, profile->name,
+                            riscv_get_misa_ext_name(bit));
+            }
+        }
+    }
+
+    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
+        int ext_offset = profile->ext_offsets[i];
+
+        if (!isa_ext_is_enabled(cpu, ext_offset)) {
+            profile_impl = false;
+
+            if (send_warn) {
+                warn_report(warn_msg, profile->name,
+                            cpu_cfg_ext_get_name(ext_offset));
+            }
+        }
+    }
+
+    profile->enabled = profile_impl;
+}
+
+static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
+{
+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+        riscv_cpu_validate_profile(cpu, riscv_profiles[i]);
+    }
+}
+
 void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     }
 
     riscv_cpu_update_named_features(cpu);
+    riscv_cpu_validate_profiles(cpu);
 
     if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
         /*
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Expose all profile flags for all CPUs when executing
query-cpu-model-expansion. This will allow callers to quickly determine
if a certain profile is implemented by a given CPU. This includes vendor
CPUs - the fact that they don't have profile user flags doesn't mean
that they don't implement the profile.

After this change it's possible to quickly determine if our stock CPUs
implement the existing rva22u64 profile. Here's a few examples:

$ ./build/qemu-system-riscv64 -S -M virt -display none
-qmp tcp:localhost:1234,server,wait=off

$ ./scripts/qmp/qmp-shell localhost:1234
Welcome to the QMP low-level shell!
Connected to QEMU 8.1.50

- As expected, the 'max' CPU implements the rva22u64 profile.

(QEMU) query-cpu-model-expansion type=full model={"name":"max"}
    {"return": {"model":
        {"name": "rv64", "props": {... "rva22u64": true, ...}}}}

- rv64 is missing "zba", "zbb", "zbs", "zkt" and "zfhmin":

query-cpu-model-expansion type=full model={"name":"rv64"}
    {"return": {"model":
        {"name": "rv64", "props": {... "rva22u64": false, ...}}}}

query-cpu-model-expansion type=full model={"name":"rv64",
    "props":{"zba":true,"zbb":true,"zbs":true,"zkt":true,"zfhmin":true}}
    {"return": {"model":
        {"name": "rv64", "props": {... "rva22u64": true, ...}}}}

We have no vendor CPUs that supports rva22u64 (veyron-v1 is the closest
- it is missing just 'zkt').

In short, aside from the 'max' CPU, we have no CPUs that supports
rva22u64 by default.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/riscv-qmp-cmds.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
     }
 }
 
+static void riscv_obj_add_profiles_qdict(Object *obj, QDict *qdict_out)
+{
+    RISCVCPUProfile *profile;
+    QObject *value;
+
+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+        profile = riscv_profiles[i];
+        value = QOBJECT(qbool_from_bool(profile->enabled));
+
+        qdict_put_obj(qdict_out, profile->name, value);
+    }
+}
+
 static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
                                            const QDict *qdict_in,
                                            Error **errp)
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
     riscv_obj_add_named_feats_qdict(obj, qdict_out);
+    riscv_obj_add_profiles_qdict(obj, qdict_out);
 
     /* Add our CPU boolean options too */
     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This CPU was suggested by Alistair [1] and others during the profile
design discussions. It consists of the bare 'rv64i' CPU with rva22u64
enabled by default, like an alias of '-cpu rv64i,rva22u64=true'.

Users now have an even easier way of consuming this user-mode profile by
doing '-cpu rva22u64'. Extensions can be enabled/disabled at will on top
of it.

We can boot Linux with this "user-mode" CPU by doing:

-cpu rva22u64,sv39=true,s=true,zifencei=true

[1] https://lore.kernel.org/qemu-riscv/CAKmqyKP7xzZ9Sx=-Lbx2Ob0qCfB7Z+JO944FQ2TQ+49mqo0q_Q@mail.gmail.com/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h     |  1 +
 target/riscv/cpu.c         | 17 +++++++++++++++++
 target/riscv/tcg/tcg-cpu.c |  9 +++++++++
 3 files changed, 27 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
 #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
 #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
+#define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#if defined(TARGET_RISCV64)
+static void rva22u64_profile_cpu_init(Object *obj)
+{
+    rv64i_bare_cpu_init(obj);
+
+    RVA22U64.enabled = true;
+}
+#endif
+
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
         .instance_init = initfn            \
     }
 
+#define DEFINE_PROFILE_CPU(type_name, initfn) \
+    {                                         \
+        .name = type_name,                    \
+        .parent = TYPE_RISCV_BARE_CPU,        \
+        .instance_init = initfn               \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
 #endif
 };
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_profiles(Object *cpu_obj)
         object_property_add(cpu_obj, profile->name, "bool",
                             cpu_get_profile, cpu_set_profile,
                             NULL, (void *)profile);
+
+        /*
+         * CPUs might enable a profile right from the start.
+         * Enable its mandatory extensions right away in this
+         * case.
+         */
+        if (profile->enabled) {
+            object_property_set_bool(cpu_obj, profile->name, true, NULL);
+        }
     }
 }
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'svade' is a RVA22S64 profile requirement, a profile we're going to add
shortly. It is a named feature (i.e. not a formal extension, not defined
in riscv,isa DT at this moment) defined in [1] as:

"Page-fault exceptions are raised when a page is accessed when A bit is
clear, or written when D bit is clear.".

As far as the spec goes, 'svade' is one of the two distinct modes of
handling PTE_A and PTE_D. The other way, i.e. update PTE_A/PTE_D when
they're cleared, is defined by the 'svadu' extension. Checking
cpu_helper.c, get_physical_address(), we can verify that QEMU is
compliant with that: we will update PTE_A/PTE_D if 'svadu' is enabled,
or throw a page-fault exception if 'svadu' isn't enabled.

So, as far as we're concerned, 'svade' translates to 'svadu must be
disabled'.

We'll implement it like 'zic64b': an internal flag that profiles can
enable. The flag will not be exposed to users.

[1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     | 1 +
 target/riscv/cpu.c         | 1 +
 target/riscv/tcg/tcg-cpu.c | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smepmp;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
+    bool svade;
     bool zic64b;
 
     uint32_t mvendorid;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
 };
 
 const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+    MULTI_EXT_CFG_BOOL("svade", svade, true),
     MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
         cpu->cfg.cbop_blocksize = 64;
         cpu->cfg.cboz_blocksize = 64;
         break;
+    case CPU_CFG_OFFSET(svade):
+        cpu->cfg.ext_svadu = false;
+        break;
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
     cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
                       cpu->cfg.cbop_blocksize == 64 &&
                       cpu->cfg.cboz_blocksize == 64;
+
+    cpu->cfg.svade = !cpu->cfg.ext_svadu;
 }
 
 static void riscv_cpu_validate_g(RISCVCPU *cpu)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Some profiles, like RVA22S64, has a priv_spec requirement.

Make this requirement explicit for all profiles. We'll validate this
requirement finalize() time and, in case the user chooses an
incompatible priv_spec while activating a profile, a warning will be
shown.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  2 ++
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 31 +++++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
     uint32_t misa_ext;
     bool enabled;
     bool user_set;
+    int priv_spec;
     const int32_t ext_offsets[];
 } RISCVCPUProfile;
 
 #define RISCV_PROFILE_EXT_LIST_END -1
+#define RISCV_PROFILE_ATTR_UNUSED -1
 
 extern RISCVCPUProfile *riscv_profiles[];
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
 static RISCVCPUProfile RVA22U64 = {
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+    .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
     .ext_offsets = {
         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
     }
 }
 
+static const char *cpu_priv_ver_to_str(int priv_ver)
+{
+    switch (priv_ver) {
+    case PRIV_VERSION_1_10_0:
+        return "v1.10.0";
+    case PRIV_VERSION_1_11_0:
+        return "v1.11.0";
+    case PRIV_VERSION_1_12_0:
+        return "v1.12.0";
+    }
+
+    g_assert_not_reached();
+}
+
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_validate_profile(RISCVCPU *cpu,
                                        RISCVCPUProfile *profile)
 {
+    CPURISCVState *env = &cpu->env;
     const char *warn_msg = "Profile %s mandates disabled extension %s";
     bool send_warn = profile->user_set && profile->enabled;
     bool profile_impl = true;
     int i;
 
+    if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
+        profile->priv_spec != env->priv_ver) {
+        profile_impl = false;
+
+        if (send_warn) {
+            warn_report("Profile %s requires priv spec %s, "
+                        "but priv ver %s was set", profile->name,
+                        cpu_priv_ver_to_str(profile->priv_spec),
+                        cpu_priv_ver_to_str(env->priv_ver));
+        }
+    }
+
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];
 
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
+    if (profile->enabled) {
+        cpu->env.priv_ver = profile->priv_spec;
+    }
+
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Profiles will need to validate satp_mode during their own finalize
methods. This will occur inside riscv_tcg_cpu_finalize_features() for
TCG. Given that satp_mode does not have any pre-req from the accelerator
finalize() method, it's safe to finalize it earlier.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-22-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
 {
     Error *local_err = NULL;
 
+#ifndef CONFIG_USER_ONLY
+    riscv_cpu_satp_mode_finalize(cpu, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+#endif
+
     /*
      * KVM accel does not have a specialized finalize()
      * callback because its extensions are validated
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
             return;
         }
     }
-
-#ifndef CONFIG_USER_ONLY
-    riscv_cpu_satp_mode_finalize(cpu, &local_err);
-    if (local_err != NULL) {
-        error_propagate(errp, local_err);
-        return;
-    }
-#endif
 }
 
 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Next patch will need to retrieve if a given RISCVCPU is 32 or 64 bit.
The existing helper riscv_is_32bit() (hw/riscv/boot.c) will always check
the first CPU of a given hart array, not any given CPU.

Create a helper to retrieve the info for any given CPU, not the first
CPU of the hart array. The helper is using the same 32 bit check that
riscv_cpu_satp_mode_finalize() was doing.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-23-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 +
 target/riscv/cpu.c | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'satp_mode' is a requirement for supervisor profiles like RVA22S64.
User-mode/application profiles like RVA22U64 doesn't care.

Add 'satp_mode' to the profile description. If a profile requires it,
set it during cpu_set_profile(). We'll also check it during finalize()
to validate if the running config implements the profile.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-24-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 40 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
     bool enabled;
     bool user_set;
     int priv_spec;
+    int satp_mode;
     const int32_t ext_offsets[];
 } RISCVCPUProfile;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+    .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
     .ext_offsets = {
         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     riscv_cpu_disable_priv_spec_isa_exts(cpu);
 }
 
+#ifndef CONFIG_USER_ONLY
+static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
+                                            RISCVCPUProfile *profile,
+                                            bool send_warn)
+{
+    int satp_max = satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+
+    if (profile->satp_mode > satp_max) {
+        if (send_warn) {
+            bool is_32bit = riscv_cpu_is_32bit(cpu);
+            const char *req_satp = satp_mode_str(profile->satp_mode, is_32bit);
+            const char *cur_satp = satp_mode_str(satp_max, is_32bit);
+
+            warn_report("Profile %s requires satp mode %s, "
+                        "but satp mode %s was set", profile->name,
+                        req_satp, cur_satp);
+        }
+
+        return false;
+    }
+
+    return true;
+}
+#endif
+
 static void riscv_cpu_validate_profile(RISCVCPU *cpu,
                                        RISCVCPUProfile *profile)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
     bool profile_impl = true;
     int i;
 
+#ifndef CONFIG_USER_ONLY
+    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+        profile_impl = riscv_cpu_validate_profile_satp(cpu, profile,
+                                                       send_warn);
+    }
+#endif
+
     if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
         profile->priv_spec != env->priv_ver) {
         profile_impl = false;
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
         cpu->env.priv_ver = profile->priv_spec;
     }
 
+#ifndef CONFIG_USER_ONLY
+    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+        const char *satp_prop = satp_mode_str(profile->satp_mode,
+                                              riscv_cpu_is_32bit(cpu));
+        object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
+    }
+#endif
+
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Certain S-mode profiles, like RVA22S64 and RVA23S64, mandate all the
mandatory extensions of their respective U-mode profiles. RVA22S64
includes all mandatory extensions of RVA22U64, and the same happens with
RVA23 profiles.

Add a 'parent' field to allow profiles to enable other profiles. This
will allow us to describe S-mode profiles by specifying their parent
U-mode profile, then adding just the S-mode specific extensions.

We're naming the field 'parent' to consider the possibility of other
uses (e.g. a s-mode profile including a previous s-mode profile) in the
future.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-25-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 14 +++++++++++++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
 #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
 
 typedef struct riscv_cpu_profile {
+    struct riscv_cpu_profile *parent;
     const char *name;
     uint32_t misa_ext;
     bool enabled;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
  * having a cfg offset) at this moment.
  */
 static RISCVCPUProfile RVA22U64 = {
+    .parent = NULL,
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
     CPURISCVState *env = &cpu->env;
     const char *warn_msg = "Profile %s mandates disabled extension %s";
     bool send_warn = profile->user_set && profile->enabled;
-    bool profile_impl = true;
+    bool parent_enabled, profile_impl = true;
     int i;
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
     }
 
     profile->enabled = profile_impl;
+
+    if (profile->parent != NULL) {
+        parent_enabled = object_property_get_bool(OBJECT(cpu),
+                                                  profile->parent->name,
+                                                  NULL);
+        profile->enabled = profile->enabled && parent_enabled;
+    }
 }
 
 static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
+    if (profile->parent != NULL) {
+        object_property_set_bool(obj, profile->parent->name,
+                                 profile->enabled, NULL);
+    }
+
     if (profile->enabled) {
         cpu->env.priv_ver = profile->priv_spec;
     }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The RVA22S64 profile consists of the following:

- all mandatory extensions of RVA22U64;
- priv spec v1.12.0;
- satp mode sv39;
- Ssccptr, a cache related named feature that we're assuming always
  enable since we don't implement a cache;
- Other named features already implemented: Sstvecd, Sstvala,
  Sscounterenw;
- the new Svade named feature that was recently added.

Most of the work is already done, so this patch is enough to implement
the profile.

After this patch, the 'rva22s64' user flag alone can be used with the
rva64i CPU to boot Linux:

-cpu rv64i,rva22s64=true

This is the /proc/cpuinfo with this profile enabled:

# cat /proc/cpuinfo
processor	: 0
hart		: 0
isa		: rv64imafdc_zicbom_zicbop_zicboz_zicntr_zicsr_zifencei_zihintpause_zihpm_zfhmin_zca_zcd_zba_zbb_zbs_zkt_svinval_svpbmt
mmu		: sv39

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-26-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
     }
 };
 
+/*
+ * As with RVA22U64, RVA22S64 also defines 'named features'.
+ *
+ * Cache related features that we consider enabled since we don't
+ * implement cache: Ssccptr
+ *
+ * Other named features that we already implement: Sstvecd, Sstvala,
+ * Sscounterenw
+ *
+ * Named features that we need to enable: svade
+ *
+ * The remaining features/extensions comes from RVA22U64.
+ */
+static RISCVCPUProfile RVA22S64 = {
+    .parent = &RVA22U64,
+    .name = "rva22s64",
+    .misa_ext = RVS,
+    .priv_spec = PRIV_VERSION_1_12_0,
+    .satp_mode = VM_1_10_SV39,
+    .ext_offsets = {
+        /* rva22s64 exts */
+        CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
+        CPU_CFG_OFFSET(ext_svinval),
+
+        /* rva22s64 named features */
+        CPU_CFG_OFFSET(svade),
+
+        RISCV_PROFILE_EXT_LIST_END
+    }
+};
+
 RISCVCPUProfile *riscv_profiles[] = {
     &RVA22U64,
+    &RVA22S64,
     NULL,
 };
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add a new profile CPU 'rva22s64' to work as an alias of

-cpu rv64i,rva22s64

Like the existing rva22u64 CPU already does with the RVA22U64 profile.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-27-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h | 1 +
 target/riscv/cpu.c     | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
 #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
 #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
+#define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rva22u64_profile_cpu_init(Object *obj)
 
     RVA22U64.enabled = true;
 }
+
+static void rva22s64_profile_cpu_init(Object *obj)
+{
+    rv64i_bare_cpu_init(obj);
+
+    RVA22S64.enabled = true;
+}
 #endif
 
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64, rva22s64_profile_cpu_init),
 #endif
 };
 
-- 
2.43.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

The emulated AIA within the Linux kernel restores the HART index
of the IMSICs according to the configured AIA settings. During
this process, the group setting is used only when the machine
partitions harts into groups. It's unnecessary to set the group
configuration if the machine has only one socket, as its address
space might not contain the group shift.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231218090543.22353-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         exit(1);
     }
 
-    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
-                            &socket_bits, true, NULL);
-    if (ret < 0) {
-        error_report("KVM AIA: failed to set group_bits");
-        exit(1);
-    }
 
-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
-                            &group_shift, true, NULL);
-    if (ret < 0) {
-        error_report("KVM AIA: failed to set group_shift");
-        exit(1);
+    if (socket_count > 1) {
+        socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                                &socket_bits, true, NULL);
+        if (ret < 0) {
+            error_report("KVM AIA: failed to set group_bits");
+            exit(1);
+        }
+
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                                &group_shift, true, NULL);
+        if (ret < 0) {
+            error_report("KVM AIA: failed to set group_shift");
+            exit(1);
+        }
     }
 
     guest_bits = guest_num == 0 ? 0 :
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We'll add a new RISC-V linux-header file, but first let's update all
headers.

Headers for 'asm-loongarch' were added in this update.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/standard-headers/drm/drm_fourcc.h     |   2 +
 include/standard-headers/linux/pci_regs.h     |  24 ++-
 include/standard-headers/linux/vhost_types.h  |   7 +
 .../standard-headers/linux/virtio_config.h    |   5 +
 include/standard-headers/linux/virtio_pci.h   |  11 ++
 linux-headers/asm-arm64/kvm.h                 |  32 ++++
 linux-headers/asm-generic/unistd.h            |  14 +-
 linux-headers/asm-loongarch/bitsperlong.h     |   1 +
 linux-headers/asm-loongarch/kvm.h             | 108 +++++++++++
 linux-headers/asm-loongarch/mman.h            |   1 +
 linux-headers/asm-loongarch/unistd.h          |   5 +
 linux-headers/asm-mips/unistd_n32.h           |   4 +
 linux-headers/asm-mips/unistd_n64.h           |   4 +
 linux-headers/asm-mips/unistd_o32.h           |   4 +
 linux-headers/asm-powerpc/unistd_32.h         |   4 +
 linux-headers/asm-powerpc/unistd_64.h         |   4 +
 linux-headers/asm-riscv/kvm.h                 |  12 ++
 linux-headers/asm-s390/unistd_32.h            |   4 +
 linux-headers/asm-s390/unistd_64.h            |   4 +
 linux-headers/asm-x86/unistd_32.h             |   4 +
 linux-headers/asm-x86/unistd_64.h             |   3 +
 linux-headers/asm-x86/unistd_x32.h            |   3 +
 linux-headers/linux/iommufd.h                 | 180 +++++++++++++++++-
 linux-headers/linux/kvm.h                     |  11 ++
 linux-headers/linux/psp-sev.h                 |   1 +
 linux-headers/linux/stddef.h                  |   9 +-
 linux-headers/linux/userfaultfd.h             |   9 +-
 linux-headers/linux/vfio.h                    |  47 +++--
 linux-headers/linux/vhost.h                   |   8 +
 29 files changed, 498 insertions(+), 27 deletions(-)
 create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
 create mode 100644 linux-headers/asm-loongarch/kvm.h
 create mode 100644 linux-headers/asm-loongarch/mman.h
 create mode 100644 linux-headers/asm-loongarch/unistd.h

diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -XXX,XX +XXX,XX @@ extern "C" {
  * index 1 = Cr:Cb plane, [39:0] Cr1:Cb1:Cr0:Cb0 little endian
  */
 #define DRM_FORMAT_NV15		fourcc_code('N', 'V', '1', '5') /* 2x2 subsampled Cr:Cb plane */
+#define DRM_FORMAT_NV20		fourcc_code('N', 'V', '2', '0') /* 2x1 subsampled Cr:Cb plane */
+#define DRM_FORMAT_NV30		fourcc_code('N', 'V', '3', '0') /* non-subsampled Cr:Cb plane */
 
 /*
  * 2 plane YCbCr MSB aligned
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
 #define  PCI_HEADER_TYPE_NORMAL		0
 #define  PCI_HEADER_TYPE_BRIDGE		1
 #define  PCI_HEADER_TYPE_CARDBUS	2
+#define  PCI_HEADER_TYPE_MFD		0x80	/* Multi-Function Device (possible) */
 
 #define PCI_BIST		0x0f	/* 8 bits */
 #define  PCI_BIST_CODE_MASK	0x0f	/* Return result */
@@ -XXX,XX +XXX,XX @@
 #define PCI_EXP_RTCAP		0x1e	/* Root Capabilities */
 #define  PCI_EXP_RTCAP_CRSVIS	0x0001	/* CRS Software Visibility capability */
 #define PCI_EXP_RTSTA		0x20	/* Root Status */
+#define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
 #define  PCI_EXP_RTSTA_PME	0x00010000 /* PME status */
 #define  PCI_EXP_RTSTA_PENDING	0x00020000 /* PME pending */
 /*
@@ -XXX,XX +XXX,XX @@
 
 /* Process Address Space ID */
 #define PCI_PASID_CAP		0x04    /* PASID feature register */
-#define  PCI_PASID_CAP_EXEC	0x02	/* Exec permissions Supported */
-#define  PCI_PASID_CAP_PRIV	0x04	/* Privilege Mode Supported */
+#define  PCI_PASID_CAP_EXEC	0x0002	/* Exec permissions Supported */
+#define  PCI_PASID_CAP_PRIV	0x0004	/* Privilege Mode Supported */
+#define  PCI_PASID_CAP_WIDTH	0x1f00
 #define PCI_PASID_CTRL		0x06    /* PASID control register */
-#define  PCI_PASID_CTRL_ENABLE	0x01	/* Enable bit */
-#define  PCI_PASID_CTRL_EXEC	0x02	/* Exec permissions Enable */
-#define  PCI_PASID_CTRL_PRIV	0x04	/* Privilege Mode Enable */
+#define  PCI_PASID_CTRL_ENABLE	0x0001	/* Enable bit */
+#define  PCI_PASID_CTRL_EXEC	0x0002	/* Exec permissions Enable */
+#define  PCI_PASID_CTRL_PRIV	0x0004	/* Privilege Mode Enable */
 #define PCI_EXT_CAP_PASID_SIZEOF	8
 
 /* Single Root I/O Virtualization */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_LTR_VALUE_MASK	0x000003ff
 #define  PCI_LTR_SCALE_MASK	0x00001c00
 #define  PCI_LTR_SCALE_SHIFT	10
+#define  PCI_LTR_NOSNOOP_VALUE	0x03ff0000 /* Max No-Snoop Latency Value */
+#define  PCI_LTR_NOSNOOP_SCALE	0x1c000000 /* Scale for Max Value */
 #define PCI_EXT_CAP_LTR_SIZEOF	8
 
 /* Access Control Service */
@@ -XXX,XX +XXX,XX @@
 #define PCI_EXP_DPC_STATUS		0x08	/* DPC Status */
 #define  PCI_EXP_DPC_STATUS_TRIGGER	    0x0001 /* Trigger Status */
 #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN	    0x0006 /* Trigger Reason */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_UNCOR  0x0000 /* Uncorrectable error */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_NFE    0x0002 /* Rcvd ERR_NONFATAL */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_FE     0x0004 /* Rcvd ERR_FATAL */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_IN_EXT 0x0006 /* Reason in Trig Reason Extension field */
 #define  PCI_EXP_DPC_STATUS_INTERRUPT	    0x0008 /* Interrupt Status */
 #define  PCI_EXP_DPC_RP_BUSY		    0x0010 /* Root Port Busy */
 #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_EXT 0x0060 /* Trig Reason Extension */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_RP_PIO		0x0000	/* RP PIO error */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_SW_TRIGGER	0x0020	/* DPC SW Trigger bit */
+#define  PCI_EXP_DPC_RP_PIO_FEP		    0x1f00 /* RP PIO First Err Ptr */
 
 #define PCI_EXP_DPC_SOURCE_ID		 0x0A	/* DPC Source Identifier */
 
@@ -XXX,XX +XXX,XX @@
 #define  PCI_L1SS_CTL1_LTR_L12_TH_VALUE	0x03ff0000  /* LTR_L1.2_THRESHOLD_Value */
 #define  PCI_L1SS_CTL1_LTR_L12_TH_SCALE	0xe0000000  /* LTR_L1.2_THRESHOLD_Scale */
 #define PCI_L1SS_CTL2		0x0c	/* Control 2 Register */
+#define  PCI_L1SS_CTL2_T_PWR_ON_SCALE	0x00000003  /* T_POWER_ON Scale */
+#define  PCI_L1SS_CTL2_T_PWR_ON_VALUE	0x000000f8  /* T_POWER_ON Value */
 
 /* Designated Vendor-Specific (DVSEC, PCI_EXT_CAP_ID_DVSEC) */
 #define PCI_DVSEC_HEADER1		0x4 /* Designated Vendor-Specific Header1 */
diff --git a/include/standard-headers/linux/vhost_types.h b/include/standard-headers/linux/vhost_types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/vhost_types.h
+++ b/include/standard-headers/linux/vhost_types.h
@@ -XXX,XX +XXX,XX @@ struct vhost_vdpa_iova_range {
  * DRIVER_OK
  */
 #define VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK  0x6
+/* Device may expose the virtqueue's descriptor area, driver area and
+ * device area to a different group for ASID binding than where its
+ * buffers may reside. Requires VHOST_BACKEND_F_IOTLB_ASID.
+ */
+#define VHOST_BACKEND_F_DESC_ASID    0x7
+/* IOTLB don't flush memory mapping across device reset */
+#define VHOST_BACKEND_F_IOTLB_PERSIST  0x8
 
 #endif
diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_config.h
+++ b/include/standard-headers/linux/virtio_config.h
@@ -XXX,XX +XXX,XX @@
  */
 #define VIRTIO_F_NOTIFICATION_DATA	38
 
+/* This feature indicates that the driver uses the data provided by the device
+ * as a virtqueue identifier in available buffer notifications.
+ */
+#define VIRTIO_F_NOTIF_CONFIG_DATA	39
+
 /*
  * This feature indicates that the driver can reset a queue individually.
  */
diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_pci.h
+++ b/include/standard-headers/linux/virtio_pci.h
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_common_cfg {
 	uint32_t queue_used_hi;		/* read-write */
 };
 
+/*
+ * Warning: do not use sizeof on this: use offsetofend for
+ * specific fields you need.
+ */
+struct virtio_pci_modern_common_cfg {
+	struct virtio_pci_common_cfg cfg;
+
+	uint16_t queue_notify_data;	/* read-write */
+	uint16_t queue_reset;		/* read-write */
+};
+
 /* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
 struct virtio_pci_cfg_cap {
 	struct virtio_pci_cap cap;
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_smccc_filter {
 #define KVM_HYPERCALL_EXIT_SMC		(1U << 0)
 #define KVM_HYPERCALL_EXIT_16BIT	(1U << 1)
 
+/*
+ * Get feature ID registers userspace writable mask.
+ *
+ * From DDI0487J.a, D19.2.66 ("ID_AA64MMFR2_EL1, AArch64 Memory Model
+ * Feature Register 2"):
+ *
+ * "The Feature ID space is defined as the System register space in
+ * AArch64 with op0==3, op1=={0, 1, 3}, CRn==0, CRm=={0-7},
+ * op2=={0-7}."
+ *
+ * This covers all currently known R/O registers that indicate
+ * anything useful feature wise, including the ID registers.
+ *
+ * If we ever need to introduce a new range, it will be described as
+ * such in the range field.
+ */
+#define KVM_ARM_FEATURE_ID_RANGE_IDX(op0, op1, crn, crm, op2)		\
+	({								\
+		__u64 __op1 = (op1) & 3;				\
+		__op1 -= (__op1 == 3);					\
+		(__op1 << 6 | ((crm) & 7) << 3 | (op2));		\
+	})
+
+#define KVM_ARM_FEATURE_ID_RANGE	0
+#define KVM_ARM_FEATURE_ID_RANGE_SIZE	(3 * 8 * 8)
+
+struct reg_mask_range {
+	__u64 addr;		/* Pointer to mask array */
+	__u32 range;		/* Requested range */
+	__u32 reserved[13];
+};
+
 #endif
 
 #endif /* __ARM_KVM_H__ */
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fremovexattr, sys_fremovexattr)
 #define __NR_getcwd 17
 __SYSCALL(__NR_getcwd, sys_getcwd)
 #define __NR_lookup_dcookie 18
-__SC_COMP(__NR_lookup_dcookie, sys_lookup_dcookie, compat_sys_lookup_dcookie)
+__SYSCALL(__NR_lookup_dcookie, sys_ni_syscall)
 #define __NR_eventfd2 19
 __SYSCALL(__NR_eventfd2, sys_eventfd2)
 #define __NR_epoll_create1 20
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_process_mrelease, sys_process_mrelease)
 __SYSCALL(__NR_futex_waitv, sys_futex_waitv)
 #define __NR_set_mempolicy_home_node 450
 __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node)
-
 #define __NR_cachestat 451
 __SYSCALL(__NR_cachestat, sys_cachestat)
-
 #define __NR_fchmodat2 452
 __SYSCALL(__NR_fchmodat2, sys_fchmodat2)
+#define __NR_map_shadow_stack 453
+__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack)
+#define __NR_futex_wake 454
+__SYSCALL(__NR_futex_wake, sys_futex_wake)
+#define __NR_futex_wait 455
+__SYSCALL(__NR_futex_wait, sys_futex_wait)
+#define __NR_futex_requeue 456
+__SYSCALL(__NR_futex_requeue, sys_futex_requeue)
 
 #undef __NR_syscalls
-#define __NR_syscalls 453
+#define __NR_syscalls 457
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-loongarch/bitsperlong.h b/linux-headers/asm-loongarch/bitsperlong.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/bitsperlong.h
@@ -0,0 +1 @@
+#include <asm-generic/bitsperlong.h>
diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/kvm.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2020-2023 Loongson Technology Corporation Limited
+ */
+
+#ifndef __UAPI_ASM_LOONGARCH_KVM_H
+#define __UAPI_ASM_LOONGARCH_KVM_H
+
+#include <linux/types.h>
+
+/*
+ * KVM LoongArch specific structures and definitions.
+ *
+ * Some parts derived from the x86 version of this file.
+ */
+
+#define __KVM_HAVE_READONLY_MEM
+
+#define KVM_COALESCED_MMIO_PAGE_OFFSET	1
+#define KVM_DIRTY_LOG_PAGE_OFFSET	64
+
+/*
+ * for KVM_GET_REGS and KVM_SET_REGS
+ */
+struct kvm_regs {
+	/* out (KVM_GET_REGS) / in (KVM_SET_REGS) */
+	__u64 gpr[32];
+	__u64 pc;
+};
+
+/*
+ * for KVM_GET_FPU and KVM_SET_FPU
+ */
+struct kvm_fpu {
+	__u32 fcsr;
+	__u64 fcc;    /* 8x8 */
+	struct kvm_fpureg {
+		__u64 val64[4];
+	} fpr[32];
+};
+
+/*
+ * For LoongArch, we use KVM_SET_ONE_REG and KVM_GET_ONE_REG to access various
+ * registers.  The id field is broken down as follows:
+ *
+ *  bits[63..52] - As per linux/kvm.h
+ *  bits[51..32] - Must be zero.
+ *  bits[31..16] - Register set.
+ *
+ * Register set = 0: GP registers from kvm_regs (see definitions below).
+ *
+ * Register set = 1: CSR registers.
+ *
+ * Register set = 2: KVM specific registers (see definitions below).
+ *
+ * Register set = 3: FPU / SIMD registers (see definitions below).
+ *
+ * Other sets registers may be added in the future.  Each set would
+ * have its own identifier in bits[31..16].
+ */
+
+#define KVM_REG_LOONGARCH_GPR		(KVM_REG_LOONGARCH | 0x00000ULL)
+#define KVM_REG_LOONGARCH_CSR		(KVM_REG_LOONGARCH | 0x10000ULL)
+#define KVM_REG_LOONGARCH_KVM		(KVM_REG_LOONGARCH | 0x20000ULL)
+#define KVM_REG_LOONGARCH_FPSIMD	(KVM_REG_LOONGARCH | 0x30000ULL)
+#define KVM_REG_LOONGARCH_CPUCFG	(KVM_REG_LOONGARCH | 0x40000ULL)
+#define KVM_REG_LOONGARCH_MASK		(KVM_REG_LOONGARCH | 0x70000ULL)
+#define KVM_CSR_IDX_MASK		0x7fff
+#define KVM_CPUCFG_IDX_MASK		0x7fff
+
+/*
+ * KVM_REG_LOONGARCH_KVM - KVM specific control registers.
+ */
+
+#define KVM_REG_LOONGARCH_COUNTER	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 1)
+#define KVM_REG_LOONGARCH_VCPU_RESET	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 2)
+
+#define LOONGARCH_REG_SHIFT		3
+#define LOONGARCH_REG_64(TYPE, REG)	(TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
+#define KVM_IOC_CSRID(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
+#define KVM_IOC_CPUCFG(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
+
+struct kvm_debug_exit_arch {
+};
+
+/* for KVM_SET_GUEST_DEBUG */
+struct kvm_guest_debug_arch {
+};
+
+/* definition of registers in kvm_run */
+struct kvm_sync_regs {
+};
+
+/* dummy definition */
+struct kvm_sregs {
+};
+
+struct kvm_iocsr_entry {
+	__u32 addr;
+	__u32 pad;
+	__u64 data;
+};
+
+#define KVM_NR_IRQCHIPS		1
+#define KVM_IRQCHIP_NUM_PINS	64
+#define KVM_MAX_CORES		256
+
+#endif /* __UAPI_ASM_LOONGARCH_KVM_H */
diff --git a/linux-headers/asm-loongarch/mman.h b/linux-headers/asm-loongarch/mman.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/mman.h
@@ -0,0 +1 @@
+#include <asm-generic/mman.h>
diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/unistd.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#define __ARCH_WANT_SYS_CLONE
+#define __ARCH_WANT_SYS_CLONE3
+
+#include <asm-generic/unistd.h>
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
 #define __NR_cachestat (__NR_Linux + 451)
 #define __NR_fchmodat2 (__NR_Linux + 452)
+#define __NR_map_shadow_stack (__NR_Linux + 453)
+#define __NR_futex_wake (__NR_Linux + 454)
+#define __NR_futex_wait (__NR_Linux + 455)
+#define __NR_futex_requeue (__NR_Linux + 456)
 
 #endif /* _ASM_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
 #define __NR_cachestat (__NR_Linux + 451)
 #define __NR_fchmodat2 (__NR_Linux + 452)
+#define __NR_map_shadow_stack (__NR_Linux + 453)
+#define __NR_futex_wake (__NR_Linux + 454)
+#define __NR_futex_wait (__NR_Linux + 455)
+#define __NR_futex_requeue (__NR_Linux + 456)
 
 #endif /* _ASM_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
 #define __NR_cachestat (__NR_Linux + 451)
 #define __NR_fchmodat2 (__NR_Linux + 452)
+#define __NR_map_shadow_stack (__NR_Linux + 453)
+#define __NR_futex_wake (__NR_Linux + 454)
+#define __NR_futex_wait (__NR_Linux + 455)
+#define __NR_futex_requeue (__NR_Linux + 456)
 
 #endif /* _ASM_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_csr {
 	unsigned long sip;
 	unsigned long satp;
 	unsigned long scounteren;
+	unsigned long senvcfg;
 };
 
 /* AIA CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_aia_csr {
 	unsigned long iprio2h;
 };
 
+/* Smstateen CSR for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_smstateen_csr {
+	unsigned long sstateen0;
+};
+
 /* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
 struct kvm_riscv_timer {
 	__u64 frequency;
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_ZICSR,
 	KVM_RISCV_ISA_EXT_ZIFENCEI,
 	KVM_RISCV_ISA_EXT_ZIHPM,
+	KVM_RISCV_ISA_EXT_SMSTATEEN,
+	KVM_RISCV_ISA_EXT_ZICOND,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 	KVM_RISCV_SBI_EXT_PMU,
 	KVM_RISCV_SBI_EXT_EXPERIMENTAL,
 	KVM_RISCV_SBI_EXT_VENDOR,
+	KVM_RISCV_SBI_EXT_DBCN,
 	KVM_RISCV_SBI_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 #define KVM_REG_RISCV_CSR		(0x03 << KVM_REG_RISCV_TYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_GENERAL	(0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_AIA		(0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_CSR_SMSTATEEN	(0x2 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_REG(name)	\
 		(offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
 #define KVM_REG_RISCV_CSR_AIA_REG(name)	\
 	(offsetof(struct kvm_riscv_aia_csr, name) / sizeof(unsigned long))
+#define KVM_REG_RISCV_CSR_SMSTATEEN_REG(name)  \
+	(offsetof(struct kvm_riscv_smstateen_csr, name) / sizeof(unsigned long))
 
 /* Timer registers are mapped as type 4 */
 #define KVM_REG_RISCV_TIMER		(0x04 << KVM_REG_RISCV_TYPE_SHIFT)
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
 #define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
 #define __NR_cachestat (__X32_SYSCALL_BIT + 451)
 #define __NR_fchmodat2 (__X32_SYSCALL_BIT + 452)
+#define __NR_futex_wake (__X32_SYSCALL_BIT + 454)
+#define __NR_futex_wait (__X32_SYSCALL_BIT + 455)
+#define __NR_futex_requeue (__X32_SYSCALL_BIT + 456)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@ enum {
 	IOMMUFD_CMD_VFIO_IOAS,
 	IOMMUFD_CMD_HWPT_ALLOC,
 	IOMMUFD_CMD_GET_HW_INFO,
+	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
+	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
 };
 #define IOMMU_VFIO_IOAS _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VFIO_IOAS)
 
+/**
+ * enum iommufd_hwpt_alloc_flags - Flags for HWPT allocation
+ * @IOMMU_HWPT_ALLOC_NEST_PARENT: If set, allocate a HWPT that can serve as
+ *                                the parent HWPT in a nesting configuration.
+ * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
+ *                                   enforced on device attachment
+ */
+enum iommufd_hwpt_alloc_flags {
+	IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
+	IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
+};
+
+/**
+ * enum iommu_hwpt_vtd_s1_flags - Intel VT-d stage-1 page table
+ *                                entry attributes
+ * @IOMMU_VTD_S1_SRE: Supervisor request
+ * @IOMMU_VTD_S1_EAFE: Extended access enable
+ * @IOMMU_VTD_S1_WPE: Write protect enable
+ */
+enum iommu_hwpt_vtd_s1_flags {
+	IOMMU_VTD_S1_SRE = 1 << 0,
+	IOMMU_VTD_S1_EAFE = 1 << 1,
+	IOMMU_VTD_S1_WPE = 1 << 2,
+};
+
+/**
+ * struct iommu_hwpt_vtd_s1 - Intel VT-d stage-1 page table
+ *                            info (IOMMU_HWPT_DATA_VTD_S1)
+ * @flags: Combination of enum iommu_hwpt_vtd_s1_flags
+ * @pgtbl_addr: The base address of the stage-1 page table.
+ * @addr_width: The address width of the stage-1 page table
+ * @__reserved: Must be 0
+ */
+struct iommu_hwpt_vtd_s1 {
+	__aligned_u64 flags;
+	__aligned_u64 pgtbl_addr;
+	__u32 addr_width;
+	__u32 __reserved;
+};
+
+/**
+ * enum iommu_hwpt_data_type - IOMMU HWPT Data Type
+ * @IOMMU_HWPT_DATA_NONE: no data
+ * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
+ */
+enum iommu_hwpt_data_type {
+	IOMMU_HWPT_DATA_NONE,
+	IOMMU_HWPT_DATA_VTD_S1,
+};
+
 /**
  * struct iommu_hwpt_alloc - ioctl(IOMMU_HWPT_ALLOC)
  * @size: sizeof(struct iommu_hwpt_alloc)
- * @flags: Must be 0
+ * @flags: Combination of enum iommufd_hwpt_alloc_flags
  * @dev_id: The device to allocate this HWPT for
- * @pt_id: The IOAS to connect this HWPT to
+ * @pt_id: The IOAS or HWPT to connect this HWPT to
  * @out_hwpt_id: The ID of the new HWPT
  * @__reserved: Must be 0
+ * @data_type: One of enum iommu_hwpt_data_type
+ * @data_len: Length of the type specific data
+ * @data_uptr: User pointer to the type specific data
  *
  * Explicitly allocate a hardware page table object. This is the same object
  * type that is returned by iommufd_device_attach() and represents the
  * underlying iommu driver's iommu_domain kernel object.
  *
- * A HWPT will be created with the IOVA mappings from the given IOAS.
+ * A kernel-managed HWPT will be created with the mappings from the given
+ * IOAS via the @pt_id. The @data_type for this allocation must be set to
+ * IOMMU_HWPT_DATA_NONE. The HWPT can be allocated as a parent HWPT for a
+ * nesting configuration by passing IOMMU_HWPT_ALLOC_NEST_PARENT via @flags.
+ *
+ * A user-managed nested HWPT will be created from a given parent HWPT via
+ * @pt_id, in which the parent HWPT must be allocated previously via the
+ * same ioctl from a given IOAS (@pt_id). In this case, the @data_type
+ * must be set to a pre-defined type corresponding to an I/O page table
+ * type supported by the underlying IOMMU hardware.
+ *
+ * If the @data_type is set to IOMMU_HWPT_DATA_NONE, @data_len and
+ * @data_uptr should be zero. Otherwise, both @data_len and @data_uptr
+ * must be given.
  */
 struct iommu_hwpt_alloc {
 	__u32 size;
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_alloc {
 	__u32 pt_id;
 	__u32 out_hwpt_id;
 	__u32 __reserved;
+	__u32 data_type;
+	__u32 data_len;
+	__aligned_u64 data_uptr;
 };
 #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
 
+/**
+ * enum iommu_hw_info_vtd_flags - Flags for VT-d hw_info
+ * @IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17: If set, disallow read-only mappings
+ *                                         on a nested_parent domain.
+ *                                         https://www.intel.com/content/www/us/en/content-details/772415/content-details.html
+ */
+enum iommu_hw_info_vtd_flags {
+	IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 = 1 << 0,
+};
+
 /**
  * struct iommu_hw_info_vtd - Intel VT-d hardware information
  *
- * @flags: Must be 0
+ * @flags: Combination of enum iommu_hw_info_vtd_flags
  * @__reserved: Must be 0
  *
  * @cap_reg: Value of Intel VT-d capability register defined in VT-d spec
@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
 	IOMMU_HW_INFO_TYPE_INTEL_VTD,
 };
 
+/**
+ * enum iommufd_hw_capabilities
+ * @IOMMU_HW_CAP_DIRTY_TRACKING: IOMMU hardware support for dirty tracking
+ *                               If available, it means the following APIs
+ *                               are supported:
+ *
+ *                                   IOMMU_HWPT_GET_DIRTY_BITMAP
+ *                                   IOMMU_HWPT_SET_DIRTY_TRACKING
+ *
+ */
+enum iommufd_hw_capabilities {
+	IOMMU_HW_CAP_DIRTY_TRACKING = 1 << 0,
+};
+
 /**
  * struct iommu_hw_info - ioctl(IOMMU_GET_HW_INFO)
  * @size: sizeof(struct iommu_hw_info)
@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
  *             the iommu type specific hardware information data
  * @out_data_type: Output the iommu hardware info type as defined in the enum
  *                 iommu_hw_info_type.
+ * @out_capabilities: Output the generic iommu capability info type as defined
+ *                    in the enum iommu_hw_capabilities.
  * @__reserved: Must be 0
  *
  * Query an iommu type specific hardware information data from an iommu behind
@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info {
 	__aligned_u64 data_uptr;
 	__u32 out_data_type;
 	__u32 __reserved;
+	__aligned_u64 out_capabilities;
 };
 #define IOMMU_GET_HW_INFO _IO(IOMMUFD_TYPE, IOMMUFD_CMD_GET_HW_INFO)
+
+/*
+ * enum iommufd_hwpt_set_dirty_tracking_flags - Flags for steering dirty
+ *                                              tracking
+ * @IOMMU_HWPT_DIRTY_TRACKING_ENABLE: Enable dirty tracking
+ */
+enum iommufd_hwpt_set_dirty_tracking_flags {
+	IOMMU_HWPT_DIRTY_TRACKING_ENABLE = 1,
+};
+
+/**
+ * struct iommu_hwpt_set_dirty_tracking - ioctl(IOMMU_HWPT_SET_DIRTY_TRACKING)
+ * @size: sizeof(struct iommu_hwpt_set_dirty_tracking)
+ * @flags: Combination of enum iommufd_hwpt_set_dirty_tracking_flags
+ * @hwpt_id: HW pagetable ID that represents the IOMMU domain
+ * @__reserved: Must be 0
+ *
+ * Toggle dirty tracking on an HW pagetable.
+ */
+struct iommu_hwpt_set_dirty_tracking {
+	__u32 size;
+	__u32 flags;
+	__u32 hwpt_id;
+	__u32 __reserved;
+};
+#define IOMMU_HWPT_SET_DIRTY_TRACKING _IO(IOMMUFD_TYPE, \
+					  IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING)
+
+/**
+ * enum iommufd_hwpt_get_dirty_bitmap_flags - Flags for getting dirty bits
+ * @IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR: Just read the PTEs without clearing
+ *                                        any dirty bits metadata. This flag
+ *                                        can be passed in the expectation
+ *                                        where the next operation is an unmap
+ *                                        of the same IOVA range.
+ *
+ */
+enum iommufd_hwpt_get_dirty_bitmap_flags {
+	IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR = 1,
+};
+
+/**
+ * struct iommu_hwpt_get_dirty_bitmap - ioctl(IOMMU_HWPT_GET_DIRTY_BITMAP)
+ * @size: sizeof(struct iommu_hwpt_get_dirty_bitmap)
+ * @hwpt_id: HW pagetable ID that represents the IOMMU domain
+ * @flags: Combination of enum iommufd_hwpt_get_dirty_bitmap_flags
+ * @__reserved: Must be 0
+ * @iova: base IOVA of the bitmap first bit
+ * @length: IOVA range size
+ * @page_size: page size granularity of each bit in the bitmap
+ * @data: bitmap where to set the dirty bits. The bitmap bits each
+ *        represent a page_size which you deviate from an arbitrary iova.
+ *
+ * Checking a given IOVA is dirty:
+ *
+ *  data[(iova / page_size) / 64] & (1ULL << ((iova / page_size) % 64))
+ *
+ * Walk the IOMMU pagetables for a given IOVA range to return a bitmap
+ * with the dirty IOVAs. In doing so it will also by default clear any
+ * dirty bit metadata set in the IOPTE.
+ */
+struct iommu_hwpt_get_dirty_bitmap {
+	__u32 size;
+	__u32 hwpt_id;
+	__u32 flags;
+	__u32 __reserved;
+	__aligned_u64 iova;
+	__aligned_u64 length;
+	__aligned_u64 page_size;
+	__aligned_u64 data;
+};
+#define IOMMU_HWPT_GET_DIRTY_BITMAP _IO(IOMMUFD_TYPE, \
+					IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP)
+
 #endif
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
 #define KVM_EXIT_RISCV_SBI        35
 #define KVM_EXIT_RISCV_CSR        36
 #define KVM_EXIT_NOTIFY           37
+#define KVM_EXIT_LOONGARCH_IOCSR  38
 
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
@@ -XXX,XX +XXX,XX @@ struct kvm_run {
 			__u32 len;
 			__u8  is_write;
 		} mmio;
+		/* KVM_EXIT_LOONGARCH_IOCSR */
+		struct {
+			__u64 phys_addr;
+			__u8  data[8];
+			__u32 len;
+			__u8  is_write;
+		} iocsr_io;
 		/* KVM_EXIT_HYPERCALL */
 		struct {
 			__u64 nr;
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_COUNTER_OFFSET 227
 #define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
 #define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
+#define KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES 230
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
 #define KVM_REG_ARM64		0x6000000000000000ULL
 #define KVM_REG_MIPS		0x7000000000000000ULL
 #define KVM_REG_RISCV		0x8000000000000000ULL
+#define KVM_REG_LOONGARCH	0x9000000000000000ULL
 
 #define KVM_REG_SIZE_SHIFT	52
 #define KVM_REG_SIZE_MASK	0x00f0000000000000ULL
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
 #define KVM_ARM_MTE_COPY_TAGS	  _IOR(KVMIO,  0xb4, struct kvm_arm_copy_mte_tags)
 /* Available with KVM_CAP_COUNTER_OFFSET */
 #define KVM_ARM_SET_COUNTER_OFFSET _IOW(KVMIO,  0xb5, struct kvm_arm_counter_offset)
+#define KVM_ARM_GET_REG_WRITABLE_MASKS _IOR(KVMIO,  0xb6, struct reg_mask_range)
 
 /* ioctl for vm fd */
 #define KVM_CREATE_DEVICE	  _IOWR(KVMIO,  0xe0, struct kvm_create_device)
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 	SEV_RET_INVALID_PARAM,
 	SEV_RET_RESOURCE_LIMIT,
 	SEV_RET_SECURE_DATA_INVALID,
+	SEV_RET_INVALID_KEY = 0x27,
 	SEV_RET_MAX,
 } sev_ret_code;
 
diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/stddef.h
+++ b/linux-headers/linux/stddef.h
@@ -XXX,XX +XXX,XX @@
 	union { \
 		struct { MEMBERS } ATTRS; \
 		struct TAG { MEMBERS } ATTRS NAME; \
-	}
+	} ATTRS
 
+#ifdef __cplusplus
+/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */
+#define __DECLARE_FLEX_ARRAY(T, member)	\
+	T member[0]
+#else
 /**
  * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
  *
@@ -XXX,XX +XXX,XX @@
 #ifndef __counted_by
 #define __counted_by(m)
 #endif
+
+#endif /* _LINUX_STDDEF_H */
diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/userfaultfd.h
+++ b/linux-headers/linux/userfaultfd.h
@@ -XXX,XX +XXX,XX @@
 			   UFFD_FEATURE_EXACT_ADDRESS |		\
 			   UFFD_FEATURE_WP_HUGETLBFS_SHMEM |	\
 			   UFFD_FEATURE_WP_UNPOPULATED |	\
-			   UFFD_FEATURE_POISON)
+			   UFFD_FEATURE_POISON |		\
+			   UFFD_FEATURE_WP_ASYNC)
 #define UFFD_API_IOCTLS				\
 	((__u64)1 << _UFFDIO_REGISTER |		\
 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
 	 * (i.e. empty ptes).  This will be the default behavior for shmem
 	 * & hugetlbfs, so this flag only affects anonymous memory behavior
 	 * when userfault write-protection mode is registered.
+	 *
+	 * UFFD_FEATURE_WP_ASYNC indicates that userfaultfd write-protection
+	 * asynchronous mode is supported in which the write fault is
+	 * automatically resolved and write-protection is un-set.
+	 * It implies UFFD_FEATURE_WP_UNPOPULATED.
 	 */
 #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
 #define UFFD_FEATURE_EVENT_FORK			(1<<1)
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
 #define UFFD_FEATURE_WP_HUGETLBFS_SHMEM		(1<<12)
 #define UFFD_FEATURE_WP_UNPOPULATED		(1<<13)
 #define UFFD_FEATURE_POISON			(1<<14)
+#define UFFD_FEATURE_WP_ASYNC			(1<<15)
 	__u64 features;
 
 	__u64 ioctls;
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
 #define VFIO_REGION_INFO_FLAG_CAPS	(1 << 3) /* Info supports caps */
 	__u32	index;		/* Region index */
 	__u32	cap_offset;	/* Offset within info struct of first cap */
-	__u64	size;		/* Region size (bytes) */
-	__u64	offset;		/* Region offset from start of device fd */
+	__aligned_u64	size;	/* Region size (bytes) */
+	__aligned_u64	offset;	/* Region offset from start of device fd */
 };
 #define VFIO_DEVICE_GET_REGION_INFO	_IO(VFIO_TYPE, VFIO_BASE + 8)
 
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
 #define VFIO_REGION_INFO_CAP_SPARSE_MMAP	1
 
 struct vfio_region_sparse_mmap_area {
-	__u64	offset;	/* Offset of mmap'able area within region */
-	__u64	size;	/* Size of mmap'able area */
+	__aligned_u64	offset;	/* Offset of mmap'able area within region */
+	__aligned_u64	size;	/* Size of mmap'able area */
 };
 
 struct vfio_region_info_cap_sparse_mmap {
@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
 					     VFIO_DEVICE_STATE_V1_RESUMING)
 
 	__u32 reserved;
-	__u64 pending_bytes;
-	__u64 data_offset;
-	__u64 data_size;
+	__aligned_u64 pending_bytes;
+	__aligned_u64 data_offset;
+	__aligned_u64 data_size;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
 
 struct vfio_region_info_cap_nvlink2_ssatgt {
 	struct vfio_info_cap_header header;
-	__u64 tgt;
+	__aligned_u64 tgt;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
 	__u32 drm_plane_type;	/* type of plane: DRM_PLANE_TYPE_* */
 	/* out */
 	__u32 drm_format;	/* drm format of plane */
-	__u64 drm_format_mod;   /* tiled mode */
+	__aligned_u64 drm_format_mod;   /* tiled mode */
 	__u32 width;	/* width of plane */
 	__u32 height;	/* height of plane */
 	__u32 stride;	/* stride of plane */
@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
 		__u32 region_index;	/* region index */
 		__u32 dmabuf_id;	/* dma-buf id */
 	};
+	__u32 reserved;
 };
 
 #define VFIO_DEVICE_QUERY_GFX_PLANE _IO(VFIO_TYPE, VFIO_BASE + 14)
@@ -XXX,XX +XXX,XX @@ struct vfio_device_ioeventfd {
 #define VFIO_DEVICE_IOEVENTFD_32	(1 << 2) /* 4-byte write */
 #define VFIO_DEVICE_IOEVENTFD_64	(1 << 3) /* 8-byte write */
 #define VFIO_DEVICE_IOEVENTFD_SIZE_MASK	(0xf)
-	__u64	offset;			/* device fd offset of write */
-	__u64	data;			/* data to be written */
+	__aligned_u64	offset;		/* device fd offset of write */
+	__aligned_u64	data;		/* data to be written */
 	__s32	fd;			/* -1 for de-assignment */
+	__u32	reserved;
 };
 
 #define VFIO_DEVICE_IOEVENTFD		_IO(VFIO_TYPE, VFIO_BASE + 16)
@@ -XXX,XX +XXX,XX @@ struct vfio_device_feature_mig_data_size {
 
 #define VFIO_DEVICE_FEATURE_MIG_DATA_SIZE 9
 
+/**
+ * Upon VFIO_DEVICE_FEATURE_SET, set or clear the BUS mastering for the device
+ * based on the operation specified in op flag.
+ *
+ * The functionality is incorporated for devices that needs bus master control,
+ * but the in-band device interface lacks the support. Consequently, it is not
+ * applicable to PCI devices, as bus master control for PCI devices is managed
+ * in-band through the configuration space. At present, this feature is supported
+ * only for CDX devices.
+ * When the device's BUS MASTER setting is configured as CLEAR, it will result in
+ * blocking all incoming DMA requests from the device. On the other hand, configuring
+ * the device's BUS MASTER setting as SET (enable) will grant the device the
+ * capability to perform DMA to the host memory.
+ */
+struct vfio_device_feature_bus_master {
+	__u32 op;
+#define		VFIO_DEVICE_FEATURE_CLEAR_MASTER	0	/* Clear Bus Master */
+#define		VFIO_DEVICE_FEATURE_SET_MASTER		1	/* Set Bus Master */
+};
+#define VFIO_DEVICE_FEATURE_BUS_MASTER 10
+
 /* -------- API for Type1 VFIO IOMMU -------- */
 
 /**
@@ -XXX,XX +XXX,XX @@ struct vfio_iommu_type1_info {
 	__u32	flags;
 #define VFIO_IOMMU_INFO_PGSIZES (1 << 0)	/* supported page sizes info */
 #define VFIO_IOMMU_INFO_CAPS	(1 << 1)	/* Info supports caps */
-	__u64	iova_pgsizes;	/* Bitmap of supported page sizes */
+	__aligned_u64	iova_pgsizes;		/* Bitmap of supported page sizes */
 	__u32   cap_offset;	/* Offset within info struct of first cap */
 	__u32   pad;
 };
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vhost.h
+++ b/linux-headers/linux/vhost.h
@@ -XXX,XX +XXX,XX @@
  */
 #define VHOST_VDPA_RESUME		_IO(VHOST_VIRTIO, 0x7E)
 
+/* Get the group for the descriptor table including driver & device areas
+ * of a virtqueue: read index, write group in num.
+ * The virtqueue index is stored in the index field of vhost_vring_state.
+ * The group ID of the descriptor table for this specific virtqueue
+ * is returned via num field of vhost_vring_state.
+ */
+#define VHOST_VDPA_GET_VRING_DESC_GROUP	_IOWR(VHOST_VIRTIO, 0x7F,	\
+					      struct vhost_vring_state)
 #endif
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM vector support for RISC-V requires the linux-header ptrace.h.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-headers/asm-riscv/ptrace.h | 132 +++++++++++++++++++++++++++++++
 scripts/update-linux-headers.sh  |   3 +
 2 files changed, 135 insertions(+)
 create mode 100644 linux-headers/asm-riscv/ptrace.h

diff --git a/linux-headers/asm-riscv/ptrace.h b/linux-headers/asm-riscv/ptrace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-riscv/ptrace.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2012 Regents of the University of California
+ */
+
+#ifndef _ASM_RISCV_PTRACE_H
+#define _ASM_RISCV_PTRACE_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/types.h>
+
+#define PTRACE_GETFDPIC		33
+
+#define PTRACE_GETFDPIC_EXEC	0
+#define PTRACE_GETFDPIC_INTERP	1
+
+/*
+ * User-mode register state for core dumps, ptrace, sigcontext
+ *
+ * This decouples struct pt_regs from the userspace ABI.
+ * struct user_regs_struct must form a prefix of struct pt_regs.
+ */
+struct user_regs_struct {
+	unsigned long pc;
+	unsigned long ra;
+	unsigned long sp;
+	unsigned long gp;
+	unsigned long tp;
+	unsigned long t0;
+	unsigned long t1;
+	unsigned long t2;
+	unsigned long s0;
+	unsigned long s1;
+	unsigned long a0;
+	unsigned long a1;
+	unsigned long a2;
+	unsigned long a3;
+	unsigned long a4;
+	unsigned long a5;
+	unsigned long a6;
+	unsigned long a7;
+	unsigned long s2;
+	unsigned long s3;
+	unsigned long s4;
+	unsigned long s5;
+	unsigned long s6;
+	unsigned long s7;
+	unsigned long s8;
+	unsigned long s9;
+	unsigned long s10;
+	unsigned long s11;
+	unsigned long t3;
+	unsigned long t4;
+	unsigned long t5;
+	unsigned long t6;
+};
+
+struct __riscv_f_ext_state {
+	__u32 f[32];
+	__u32 fcsr;
+};
+
+struct __riscv_d_ext_state {
+	__u64 f[32];
+	__u32 fcsr;
+};
+
+struct __riscv_q_ext_state {
+	__u64 f[64] __attribute__((aligned(16)));
+	__u32 fcsr;
+	/*
+	 * Reserved for expansion of sigcontext structure.  Currently zeroed
+	 * upon signal, and must be zero upon sigreturn.
+	 */
+	__u32 reserved[3];
+};
+
+struct __riscv_ctx_hdr {
+	__u32 magic;
+	__u32 size;
+};
+
+struct __riscv_extra_ext_header {
+	__u32 __padding[129] __attribute__((aligned(16)));
+	/*
+	 * Reserved for expansion of sigcontext structure.  Currently zeroed
+	 * upon signal, and must be zero upon sigreturn.
+	 */
+	__u32 reserved;
+	struct __riscv_ctx_hdr hdr;
+};
+
+union __riscv_fp_state {
+	struct __riscv_f_ext_state f;
+	struct __riscv_d_ext_state d;
+	struct __riscv_q_ext_state q;
+};
+
+struct __riscv_v_ext_state {
+	unsigned long vstart;
+	unsigned long vl;
+	unsigned long vtype;
+	unsigned long vcsr;
+	unsigned long vlenb;
+	void *datap;
+	/*
+	 * In signal handler, datap will be set a correct user stack offset
+	 * and vector registers will be copied to the address of datap
+	 * pointer.
+	 */
+};
+
+struct __riscv_v_regset_state {
+	unsigned long vstart;
+	unsigned long vl;
+	unsigned long vtype;
+	unsigned long vcsr;
+	unsigned long vlenb;
+	char vreg[];
+};
+
+/*
+ * According to spec: The number of bits in a single vector register,
+ * VLEN >= ELEN, which must be a power of 2, and must be no greater than
+ * 2^16 = 65536bits = 8192bytes
+ */
+#define RISCV_MAX_VLENB (8192)
+
+#endif /* __ASSEMBLY__ */
+
+#endif /* _ASM_RISCV_PTRACE_H */
diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -XXX,XX +XXX,XX @@ for arch in $ARCHLIST; do
         cp_portable "$tmpdir/bootparam.h" \
                     "$output/include/standard-headers/asm-$arch"
     fi
+    if [ $arch = riscv ]; then
+        cp "$tmpdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
+    fi
 done
 
 rm -rf "$output/linux-headers/linux"
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Linux RISC-V vector documentation (Document/arch/riscv/vector.rst)
mandates a prctl() in order to allow an userspace thread to use the
Vector extension from the host.

This is something to be done in realize() time, after init(), when we
already decided whether we're using RVV or not. We don't have a
realize() callback for KVM yet, so add kvm_cpu_realize() and enable RVV
for the thread via PR_RISCV_V_SET_CONTROL.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include <sys/ioctl.h>
+#include <sys/prctl.h>
 
 #include <linux/kvm.h>
 
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+#define PR_RISCV_V_SET_CONTROL            69
+#define PR_RISCV_V_VSTATE_CTRL_ON          2
+
 void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 {
     kvm_set_irq(kvm_state, irq, !!level);
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_instance_init(CPUState *cs)
     }
 }
 
+/*
+ * We'll get here via the following path:
+ *
+ * riscv_cpu_realize()
+ *   -> cpu_exec_realizefn()
+ *      -> kvm_cpu_realize() (via accel_cpu_common_realize())
+ */
+static bool kvm_cpu_realize(CPUState *cs, Error **errp)
+{
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    int ret;
+
+    if (riscv_has_ext(&cpu->env, RVV)) {
+        ret = prctl(PR_RISCV_V_SET_CONTROL, PR_RISCV_V_VSTATE_CTRL_ON);
+        if (ret) {
+            error_setg(errp, "Error in prctl PR_RISCV_V_SET_CONTROL, code: %s",
+                       strerrorname_np(errno));
+            return false;
+        }
+    }
+
+   return true;
+}
+
 static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
     acc->cpu_instance_init = kvm_cpu_instance_init;
+    acc->cpu_target_realize = kvm_cpu_realize;
 }
 
 static const TypeInfo kvm_cpu_accel_type_info = {
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add support for RVV and Vector CSR KVM regs vstart, vl and vtype.

Support for vregs[] requires KVM side changes and an extra reg (vlenb)
and will be added later.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 74 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
 
 #define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
 
+#define RISCV_VECTOR_CSR_REG(env, name) \
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_VECTOR, \
+                           KVM_REG_RISCV_VECTOR_CSR_REG(name))
+
 #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
     do { \
         int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_misa_ext_cfgs[] = {
     KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
     KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
     KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
+    KVM_MISA_CFG(RVV, KVM_RISCV_ISA_EXT_V),
 };
 
 static void kvm_cpu_get_misa_ext_cfg(Object *obj, Visitor *v,
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
+static int kvm_riscv_get_regs_vector(CPUState *cs)
+{
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    target_ulong reg;
+    int ret = 0;
+
+    if (!riscv_has_ext(env, RVV)) {
+        return 0;
+    }
+
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->vstart = reg;
+
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->vl = reg;
+
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->vtype = reg;
+
+    return 0;
+}
+
+static int kvm_riscv_put_regs_vector(CPUState *cs)
+{
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    target_ulong reg;
+    int ret = 0;
+
+    if (!riscv_has_ext(env, RVV)) {
+        return 0;
+    }
+
+    reg = env->vstart;
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg = env->vl;
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg = env->vtype;
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
+
+    return ret;
+}
+
 typedef struct KVMScratchCPU {
     int kvmfd;
     int vmfd;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         return ret;
     }
 
+    ret = kvm_riscv_get_regs_vector(cs);
+    if (ret) {
+        return ret;
+    }
+
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
+    ret = kvm_riscv_put_regs_vector(cs);
+    if (ret) {
+        return ret;
+    }
+
     if (KVM_PUT_RESET_STATE == level) {
         RISCVCPU *cpu = RISCV_CPU(cs);
         if (cs->cpu_index == 0) {
-- 
2.43.0

From: Bin Meng <bmeng@tinylab.org>

Currently, the documentation outlines the process for building the
S-mode U-Boot image using `make menuconfig` and manual actions within
the menuconfig UI. However, this approach is fragile due to Kconfig
options potentially changing across different releases. For example,
CONFIG_OF_PRIOR_STAGE has been replaced by CONFIG_BOARD since v2022.01
release, and CONFIG_TEXT_BASE has been moved to the 'General setup'
menu from the 'Boot options' menu in v2024.01 release.

This update aims to make the S-mode U-Boot image build instructions
future-proof. It leverages the 'config' script provided in the U-Boot
source tree to edit the .config file, followed by a `make olddefconfig`.

Validated with U-Boot v2024.01 release.

Signed-off-by: Bin Meng <bmeng@tinylab.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240104071523.273702-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/sifive_u.rst | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/sifive_u.rst
+++ b/docs/system/riscv/sifive_u.rst
@@ -XXX,XX +XXX,XX @@ command line options with ``qemu-system-riscv32``.
 Running U-Boot
 --------------
 
-U-Boot mainline v2021.07 release is tested at the time of writing. To build a
+U-Boot mainline v2024.01 release is tested at the time of writing. To build a
 U-Boot mainline bootloader that can be booted by the ``sifive_u`` machine, use
 the sifive_unleashed_defconfig with similar commands as described above for
 Linux:
@@ -XXX,XX +XXX,XX @@ configuration of U-Boot:
 
   $ export CROSS_COMPILE=riscv64-linux-
   $ make sifive_unleashed_defconfig
-  $ make menuconfig
-
-then manually select the following configuration:
-
-  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
-
-and unselect the following configuration:
-
-  * Library routines ---> Allow access to binman information in the device tree
+  $ ./scripts/config --enable OF_BOARD
+  $ ./scripts/config --disable BINMAN_FDT
+  $ ./scripts/config --disable SPL
+  $ make olddefconfig
 
 This changes U-Boot to use the QEMU generated device tree blob, and bypass
 running the U-Boot SPL stage.
@@ -XXX,XX +XXX,XX @@ It's possible to create a 32-bit U-Boot S-mode image as well.
 
   $ export CROSS_COMPILE=riscv64-linux-
   $ make sifive_unleashed_defconfig
-  $ make menuconfig
-
-then manually update the following configuration in U-Boot:
-
-  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
-  * RISC-V architecture ---> Base ISA ---> RV32I
-  * Boot options ---> Boot images ---> Text Base ---> 0x80400000
-
-and unselect the following configuration:
-
-  * Library routines ---> Allow access to binman information in the device tree
+  $ ./scripts/config --disable ARCH_RV64I
+  $ ./scripts/config --enable ARCH_RV32I
+  $ ./scripts/config --set-val TEXT_BASE 0x80400000
+  $ ./scripts/config --enable OF_BOARD
+  $ ./scripts/config --disable BINMAN_FDT
+  $ ./scripts/config --disable SPL
+  $ make olddefconfig
 
 Use the same command line options to boot the 32-bit U-Boot S-mode image:
 
-- 
2.43.0

From: Bin Meng <bmeng@tinylab.org>

Upgrade OpenSBI from v1.3.1 to v1.4 and the pre-built bios images.

The v1.4 release includes the following commits:

1a398d9 lib: sbi: Add Zicntr as a HART ISA extension
669089c lib: sbi: Add Zihpm as a HART ISA extension
72b9c8f lib: sbi: Alphabetically sort HART ISA extensions
5359fc6 lib: sbi: Rename hart_pmu_get_allowed_bits() function
976895c lib: sbi: Fix Priv spec version for [m|s]counteren and mcountinhibit CSRs
6053917 lib: sbi: Fix how print gets flags
35ef182 lib: sbi: print not fill '0' when left-aligned
40dac06 lib: sbi: Add '+' flags for print
458fa74 lib: sbi: Add ' ' '\'' flags for print
05cbb6e lib: sbi: implifying the parameters of printi
fe08281 lib: sbi: print add 'o' type
c6ee5ae lib: sbi: Fix printi
3b6fcdd lib: sbi: Simplify prints
cc89fa7 lib: sbi: Fix printc
ff43168 lib: sbi: Fix timing of clearing tbuf
a73982d lib: sbi: Fix missing '\0' when buffer szie equal 1
ea6533a lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
c3b98c6 include: sbi: Add macro definitions for mseccfg CSR
1c099c4 lib: sbi: Add functions to manipulate PMP entries
6c202c5 include: sbi: Add Smepmp specific access flags for PMP entries
cbcfc7b lib: sbi: Add smepmp in hart extensions
d72f5f1 lib: utils: Add detection of Smepmp from ISA string in FDT
4a42a23 lib: sbi: Grant SU R/W/X permissions to whole memory
f3fdd04 lib: sbi: Change the order of PMP initialization
5dd8db5 lib: sbi: Add support for Smepmp
6e44ef6 lib: sbi: Add functions to map/unmap shared memory
0ad8660 lib: sbi: Map/Unmap debug console shared memory buffers
057eb10 lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
0e2111e libfdt: fix SPDX license identifiers
e05a9cf lib: sbi: Update system suspend to spec
5e20d25 include: sbi: fix CSR define of mseccfg
44c5151 include: sbi_utils: Remove driver pointer from struct i2c_adapter
14a35b0 lib: utils/regmap: Add generic regmap access library
8e97275 lib: utils/regmap: Add simple FDT based regmap framework
f21d8f7 lib: utils/regmap: Add simple FDT based syscon regmap driver
4a344a9 lib: utils/reset: Add syscon based reboot and poweroff
c2e6027 lib: utils/reset: Remove SiFive Test reset driver
f536e0b gitignore: allow gitignore to ignore most dot file
c744ed7 lib: sbi_pmu: Enable noncontigous hpm event and counters
6259b2e lib: utils/fdt: Fix fdt_parse_isa_extensions() implementation
f46a564 lib: sbi: Fix typo for finding fixed event counter
94197a8 fw_base.S: Fix assembler error with clang 16+
c104c60 lib: sbi: Add support for smcntrpmf
7aabeee Makefile: Fix grep warning
e7e73aa platform: generic: allwinner: correct mhpmevent count
ee1f83c lib: sbi_pmu: remove mhpm_count field in hart feature
a9cffd6 firmware: payload: test: Change to SBI v2.0 DBCN ecalls
b20bd47 lib: sbi: improve the definition of SBI_IPI_EVENT_MAX
664692f lib: sbi_pmu: ensure update hpm counter before starting counting
c9a296d platform: generic: allwinner: fix OF process for T-HEAD c9xx pmu
901d3d7 lib: sbi_pmu: keep overflow interrupt of stopped hpm counter disabled
cacfba3 platform: Allow platforms to specify the size of tlb fifo
5bd9694 lib: sbi: alloc tlb fifo by sbi_malloc
130e65d lib: sbi: Implement SET_FS_DIRTY() to make sure the mstatus FS dirty is set
d1e4dff lib: sbi: Introduce HART index in sbi_scratch
e6125c3 lib: sbi: Remove sbi_platform_hart_index/invalid() functions
296e70d lib: sbi: Extend sbi_hartmask to support both hartid and hartindex
e632cd7 lib: sbi: Use sbi_scratch_last_hartindex() in remote TLB managment
78c667b lib: sbi: Prefer hartindex over hartid in IPI framework
22d6ff8 lib: sbi: Remove sbi_scratch_last_hartid() macro
112daa2 lib: sbi: Maximize the use of HART index in sbi_domain
9560fb3 include: sbi: Remove sbi_hartmask_for_each_hart() macro
b8fb96e include: sbi_domain: Fix permission test macros
bff27c1 lib: sbi: Factor-out Smepmp configuration as separate function
5240d31 lib: sbi: Don't clear mseccfg.MML bit in sbi_hart_smepmp_configure()
2b51a9d lib: sbi: Fix pmp_flags for Smepmp read-only shared region
73aea28 lib: sbi: Populate M-only Smepmp entries before setting mseccfg.MML
e8bc162 lib: utils/serial: Add shared regions for serial drivers
b7e9d34 lib: utils/regmap: Mark syscon region as shared read-write
3669153 platform: generic: thead: fix stale TLB entries for th1520/sg2042
de525ac firmware: Remove ALIGN in .rela.dyn in linker script
2a6d725 firmware: Remove handling of R_RISCV_{32,64}
6ed125a Makefile: Add --exclude-libs ALL to avoid .dynsym
e21901d doc: Fix fw_payload.md
a125423 lib: utils/serial: Ensure proper allocation of PMP entries for uart8250
d36709f lib: utils: timer/ipi: Update memregion flags for PLMT and PLICSW
8197c2f lib: sbi: fix sbi_domain_get_assigned_hartmask()
9da30f6 lib: utils/fdt: simplify dt_parse_isa_extensions
942aca2 lib: utils: Simplify SET_ISA_EXT_MAP()
f831b93 lib: sbi_pmu: check for index overflows
d891cae gpio/starfive: redundant readl() call
e8114c6 docs: platform: update platform_requirements.md
3632f2b lib: sbi: Add support for mconfigptr
ec0559e lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP
cbdd869 include: sbi: Change spec version to 2.0
5d0ed1b lib: sbi: simplify sanitize_domain()
c1a6987 platform: generic: thead: move to thead c9xx header to vendor specific postion
8e941e7 platform: generic: thead: separate implement of T-HEAD c9xx pmu
492d9b1 platform: generic: thead: separate implement of T-HEAD c9xx errata
3e21b96 platform: generic: thead: initialize PMU by default in thead generic platform
a140a4e lib: sbi: Correctly limit flushes to a single ASID/VMID
88ae718 platform: generic: thead: improve tlb flush errata
52fd64b platform: Uses hart count as the default size of tlb info
07f2ccd lib: utils/serial: Optimize semihosting_putc implementation
fccdf41 firmware: fw_base.S: Fix boot hart status synchronization
d1e0f7f utils/reset: Remove fdt_reset_thead
896d2c9 lib: utils/timer: Allow ACLINT MTIMER driver to setup quirks
accafb1 lib: utils/timer: mtimer: add separate T-Head C9xx CLINT mtimer compatible
98bc25f lib: utils/ipi: mswi: add separate T-Head C9xx CLINT mswi compatible
5b2f55d lib: sbi: separate the swap operation of domain region
3b03cdd lib: sbi: Add regions merging when sanitizing domain region
2bfdb9e platform: generic: Add Sophgo sg2042 platform support
280f7ae include: sbi: macros for mseccfg.sseed and .useed
efcac33 lib: sbi: Add Zkr in hart extensions
6e5b0cf lib: sbi: enable seed access in S-mode
6602e11 lib: sbi: change sbi_hart_features.extensions as an array
3aaed4f lib: sbi: Make console_puts/console_putc interchangeable
dc0bb19 lib: utils/serial: remove semihosting_putc
16bb930 lib: sbi: Fix PMP granularity handling in sbi_hart_map_saddr()
574b9c8 lib: sbi_pmu: avoid buffer overflow
791704c lib: utils/irqchip: Avoid redundant writes to APLIC CLRIE register
f520256 lib: sbi: Allow relaxed MMIO writes in device ipi_send() callback
b70d628 lib: sbi: Allow relaxed MMIO writes in device ipi_clear() callback
bd74931 lib: ipi: Adjust Andes PLICSW to single-bit-per-hart scheme
291403f sbi: sbi_pmu: Improve sbi_pmu_init() error handling
090fa99 lib: sbi: Add XAndesPMU in hart extensions
a48f2cf sbi: sbi_pmu: Add hw_counter_filter_mode() to pmu device
51ec60c platform: include: andes45: Add PMU related CSR defines
effd89a platform: generic: Introduce pmu_init() platform override
1b9e743 platform: andes: Add Andes custom PMU support
2e50c24 platform: andes: Enable Andes PMU for AE350
535c661 platform: rzfive: Enable Andes PMU for RZ/Five
0b3262e lib: utils: fdt_fixup: Allow preserving PMU properties
009ae4e platform: andes: Factor out is_andes() helper
0308f93 lib: utils: fdt_pmu: Make the fdt_pmu_evt_select table global variable
e19d419 lib: utils: fdt_pmu: Do not iterate over the fdt_pmu_evt_select table
d162009 docs: pmu: Add Andes PMU node example
6b9a849 lib: sbi: Remove xchg/cmpxchg implemented via lr/sc
11bf49b lib: sbi: Fix __atomic_op_bit_ord and comments
8839869 lib: sbi: Replace __atomic_op_bit_ord with __atomic intrinsics
07419ec lib: sbi: Prevent redundant sbi_ipi_process
93da66b lib: sbi_hart: Store PMP granularity as log base 2
ee72517 lib: sbi_pmu: Add PMU snapshot definitions
11a0ba5 lib: sbi_pmu: Fix the counter info function
0696810 firmware: fix section types
a25fc74 lib: sbi_hsm: Put the resume_pending hart in the interruptible hart mask
87aa306 platform: recalculate heap size to support new tlb entry number
a2e254e lib: sbi: skip wait_for_coldboot when coolboot done
6112d58 lib: utils/fdt: Allow to use reg-names when parsing ACLINT
35cba92 lib: sbi_tlb: Check tlb_range_flush_limit only once per request
a894187 lib: sbi_ipi: Do not ignore errors from sbi_ipi_send()
446fa65 lib: sbi_ipi: Process self-IPIs in sbi_ipi_send()
2707250 lib: sbi_ipi: Drop unnecessary ipi_process check
925ce14 lib: sbi: Simplify the initialization of root_hmask in sbi_domain_init
2c8be56 lib: sbi: Improve the code of privilege mode and extensions detection
056fe6f lib: sbi: Refactor the code for enable extensions in menvfg CSR
776770d lib: sbi: Using one array to define the name of extensions
3daac8f lib: sbi: Detect extensions from the ISA string in DT
416ceb3 lib: sbi_tlb: Reduce size of struct sbi_tlb_info
80169b2 platform: generic: Fine tune fw_platform_calculate_heap_size()
cdebae2 lib: utils/irqchip: Add shared MMIO region for PLIC in root domain
3284bea lib: sbi: Allow ecall handlers to directly update register state
5a57e8c lib: sbi: Remove the SBI_ETRAP error code
2b80b92 lib: sbi: Do not enter OpenSBI with mseccfg.MML == 1
63e09ad lib: sbi: Fix shift bug in sbi_system_reset
ba29293 lib: utils/timer: mtimer: only use regname for aclint
bbd065d lib: sbi: Detect Zicntr extension only based on traps
a2b255b include: Bump-up version to 1.4

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20240102151153.133896-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 135376 -> 267416 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 138368 -> 270808 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index XXXXXXX..XXXXXXX 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 057eb10b6d523540012e6947d5c9f63e95244e94
+Subproject commit a2b255b88918715173942f2c5e1f97ac9e90c877
-- 
2.43.0

From: Ivan Klokov <ivan.klokov@syntacore.com>

This patch changes behavior on writing RW=01 to pmpcfg with MML=0.
RWX filed is form of collective WARL with the combination of
pmpcfg.RW=01 remains reserved for future standard use.

According to definition of WARL writing the CSR has no other side
effect. But current implementation change architectural state and
change system behavior. After writing we will get unreadable-unwriteble
region regardless on the previous state.

On the other side WARL said that we should read legal value and nothing
says about what we should write. Current behavior change system state
regardless of whether we read this register or not.

Fixes: ac66f2f0 ("target/riscv: pmp: Ignore writes when RW=01")

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231220153205.11072-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
             /* If !mseccfg.MML then ignore writes with encoding RW=01 */
             if ((val & PMP_WRITE) && !(val & PMP_READ) &&
                 !MSECCFG_MML_ISSET(env)) {
-                val &= ~(PMP_WRITE | PMP_READ);
+                return false;
             }
             env->pmp_state.pmp[pmp_index].cfg_reg = val;
             pmp_update_rule_addr(env, pmp_index);
-- 
2.43.0

From: Alistair Francis <alistair23@gmail.com>

The CSRs will always be between either CSR_MHPMCOUNTER3 and
CSR_MHPMCOUNTER31 or CSR_MHPMCOUNTER3H and CSR_MHPMCOUNTER31H.

So although ctr_index can't be negative, Coverity doesn't know this and
it isn't obvious to human readers either. Let's add an assert to ensure
that Coverity knows the values will be within range.

To simplify the code let's also change the RV32 adjustment.

Fixes: Coverity CID 1523910
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240108001328.280222-2-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr(CPURISCVState *env, int csrno)
 
     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
         /* Offset for RV32 mhpmcounternh counters */
-        base_csrno += 0x80;
+        csrno -= 0x80;
     }
+
+    g_assert(csrno >= CSR_MHPMCOUNTER3 && csrno <= CSR_MHPMCOUNTER31);
+
     ctr_index = csrno - base_csrno;
     if ((BIT(ctr_index) & pmu_avail_ctrs >> 3) == 0) {
         /* The PMU is not enabled or counter is out of range */
-- 
2.43.0

From: Alistair Francis <alistair23@gmail.com>

We have been incorrectly adjusting both the interrupt and exception
cause when using the hypervisor extension and trapping to VS-mode. This
patch changes the conditional to ensure we only adjust the cause for
interrupts and not exceptions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1708
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240108001328.280222-3-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                  * See if we need to adjust cause. Yes if its VS mode interrupt
                  * no if hypervisor has delegated one of hs mode's interrupt
                  */
-                if (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
-                    cause == IRQ_VS_EXT) {
+                if (async && (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
+                              cause == IRQ_VS_EXT)) {
                     cause = cause - 1;
                 }
                 write_gva = false;
-- 
2.43.0

From: Alistair Francis <alistair23@gmail.com>

Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor is
enabled. We currently only set them on accesses to mideleg, but they
aren't correctly set on reset. Let's ensure they are always the correct
value.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1617
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240108001328.280222-4-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     /* mmte is supposed to have pm.current hardwired to 1 */
     env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
 
+    /*
+     * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
+     * extension is enabled.
+     */
+    if (riscv_has_ext(env, RVH)) {
+        env->mideleg |= HS_MODE_INTERRUPTS;
+    }
+
     /*
      * Clear mseccfg and unlock all the PMP entries upon reset.
      * This is allowed as per the priv and smepmp specifications
-- 
2.43.0

The following changes since commit 0e3aff9ec34059512d597eacfcf4d1b5d4570c50:

Merge tag 'pull-10.0-gdb-plugins-doc-updates-170125-1' of https://gitlab.com/stsquad/qemu into staging (2025-01-17 10:13:07 -0500)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20250119-1

for you to fetch changes up to f04cac4f8f254931f2af9d059b2175769e576afa:

hw/char/riscv_htif: Convert HTIF_DEBUG() to trace events (2025-01-19 09:44:35 +1000)

----------------------------------------------------------------
Second RISC-V PR for 10.0

* Reduce the overhead for simple RISC-V vector unit-stride loads and stores
* Add V bit to GDB priv reg
* Add 'sha' support
* Add traces for exceptions in user mode
* Update Pointer Masking to Zjpm v1.0
* Add Smrnmi support
* Fix timebase-frequency when using KVM acceleration
* Add RISC-V Counter delegation ISA extension support
* Add support for Smdbltrp and Ssdbltrp extensions
* Introduce a translation tag for the IOMMU page table cache
* Support Supm and Sspm as part of Zjpm v1.0
* Convert htif debug prints to trace event

----------------------------------------------------------------
Alexey Baturo (8):
      target/riscv: Remove obsolete pointer masking extension code.
      target/riscv: Add new CSR fields for S{sn, mn, m}pm extensions as part of Zjpm v1.0
      target/riscv: Add helper functions to calculate current number of masked bits for pointer masking
      target/riscv: Add pointer masking tb flags
      target/riscv: Update address modify functions to take into account pointer masking
      target/riscv: Apply pointer masking for virtualized memory accesses
      target/riscv: Enable updates for pointer masking variables and thus enable pointer masking extension
      target/riscv: Support Supm and Sspm as part of Zjpm v1.0

Atish Patra (5):
      target/riscv: Enable S*stateen bits for AIA
      target/riscv: Add properties for counter delegation ISA extensions
      target/riscv: Invoke pmu init after feature enable
      target/riscv: Add implied rule for counter delegation extensions
      target/riscv: Add configuration for S[m|s]csrind, Smcdeleg/Ssccfg

Clément Léger (9):
      target/riscv: Fix henvcfg potentially containing stale bits
      target/riscv: Add Ssdbltrp CSRs handling
      target/riscv: Implement Ssdbltrp sret, mret and mnret behavior
      target/riscv: Implement Ssdbltrp exception handling
      target/riscv: Add Ssdbltrp ISA extension enable switch
      target/riscv: Add Smdbltrp CSRs handling
      target/riscv: Implement Smdbltrp sret, mret and mnret behavior
      target/riscv: Implement Smdbltrp behavior
      target/riscv: Add Smdbltrp ISA extension enable switch

Craig Blackmore (2):
      target/riscv: rvv: fix typo in vext continuous ldst function names
      target/riscv: rvv: speed up small unit-stride loads and stores

Daniel Henrique Barboza (9):
      target/riscv: add shcounterenw
      target/riscv: add shvstvala
      target/riscv: add shtvala
      target/riscv: add shvstvecd
      target/riscv: add shvsatpa
      target/riscv: add shgatpa
      target/riscv/tcg: add sha
      target/riscv: use RISCVException enum in exception helpers
      target/riscv: add trace in riscv_raise_exception()

Frank Chang (1):
      target/riscv: Add Zicfilp support for Smrnmi

Jason Chien (1):
      hw/riscv/riscv-iommu.c: Introduce a translation tag for the page table cache

Kaiwen Xue (6):
      target/riscv: Add properties for Indirect CSR Access extension
      target/riscv: Decouple AIA processing from xiselect and xireg
      target/riscv: Support generic CSR indirect access
      target/riscv: Add counter delegation definitions
      target/riscv: Add select value range check for counter delegation
      target/riscv: Add counter delegation/configuration support

Philippe Mathieu-Daudé (3):
      target/riscv: Have kvm_riscv_get_timebase_frequency() take RISCVCPU cpu
      hw/riscv/virt: Remove unnecessary use of &first_cpu
      hw/char/riscv_htif: Convert HTIF_DEBUG() to trace events

Tommy Wu (5):
      target/riscv: Add 'ext_smrnmi' in the RISCVCPUConfig
      target/riscv: Add Smrnmi CSRs
      target/riscv: Handle Smrnmi interrupt and exception
      target/riscv: Add Smrnmi mnret instruction
      target/riscv: Add Smrnmi cpu extension

Yanfeng Liu (1):
      riscv/gdbstub: add V bit to priv reg

From: Craig Blackmore <craig.blackmore@embecosm.com>

Replace `continus` with `continuous`.

Signed-off-by: Craig Blackmore <craig.blackmore@embecosm.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241218142353.1027938-2-craig.blackmore@embecosm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_ELEM(ste_w, uint32_t, H4, stl)
 GEN_VEXT_ST_ELEM(ste_d, uint64_t, H8, stq)
 
 static inline QEMU_ALWAYS_INLINE void
-vext_continus_ldst_tlb(CPURISCVState *env, vext_ldst_elem_fn_tlb *ldst_tlb,
+vext_continuous_ldst_tlb(CPURISCVState *env, vext_ldst_elem_fn_tlb *ldst_tlb,
                        void *vd, uint32_t evl, target_ulong addr,
                        uint32_t reg_start, uintptr_t ra, uint32_t esz,
                        bool is_load)
@@ -XXX,XX +XXX,XX @@ vext_continus_ldst_tlb(CPURISCVState *env, vext_ldst_elem_fn_tlb *ldst_tlb,
 }
 
 static inline QEMU_ALWAYS_INLINE void
-vext_continus_ldst_host(CPURISCVState *env, vext_ldst_elem_fn_host *ldst_host,
+vext_continuous_ldst_host(CPURISCVState *env, vext_ldst_elem_fn_host *ldst_host,
                         void *vd, uint32_t evl, uint32_t reg_start, void *host,
                         uint32_t esz, bool is_load)
 {
@@ -XXX,XX +XXX,XX @@ vext_page_ldst_us(CPURISCVState *env, void *vd, target_ulong addr,
 
     if (flags == 0) {
         if (nf == 1) {
-            vext_continus_ldst_host(env, ldst_host, vd, evl, env->vstart, host,
-                                    esz, is_load);
+            vext_continuous_ldst_host(env, ldst_host, vd, evl, env->vstart,
+                                      host, esz, is_load);
         } else {
             for (i = env->vstart; i < evl; ++i) {
                 k = 0;
@@ -XXX,XX +XXX,XX @@ vext_page_ldst_us(CPURISCVState *env, void *vd, target_ulong addr,
         env->vstart += elems;
     } else {
         if (nf == 1) {
-            vext_continus_ldst_tlb(env, ldst_tlb, vd, evl, addr, env->vstart,
+            vext_continuous_ldst_tlb(env, ldst_tlb, vd, evl, addr, env->vstart,
                                    ra, esz, is_load);
         } else {
             /* load bytes from guest memory */
-- 
2.48.1

From: Craig Blackmore <craig.blackmore@embecosm.com>

Calling `vext_continuous_ldst_tlb` for load/stores up to 6 bytes
significantly improves performance.

Co-authored-by: Helene CHELIN <helene.chelin@embecosm.com>
Co-authored-by: Paolo Savini <paolo.savini@embecosm.com>
Co-authored-by: Craig Blackmore <craig.blackmore@embecosm.com>

Signed-off-by: Helene CHELIN <helene.chelin@embecosm.com>
Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
Signed-off-by: Craig Blackmore <craig.blackmore@embecosm.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241218142353.1027938-3-craig.blackmore@embecosm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
         return;
     }
 
+#if defined(CONFIG_USER_ONLY)
+    /*
+     * For data sizes <= 6 bytes we get better performance by simply calling
+     * vext_continuous_ldst_tlb
+     */
+    if (nf == 1 && (evl << log2_esz) <= 6) {
+        addr = base + (env->vstart << log2_esz);
+        vext_continuous_ldst_tlb(env, ldst_tlb, vd, evl, addr, env->vstart, ra,
+                                 esz, is_load);
+
+        env->vstart = 0;
+        vext_set_tail_elems_1s(evl, vd, desc, nf, esz, max_elems);
+        return;
+    }
+#endif
+
     /* Calculate the page range of first page */
     addr = base + ((env->vstart * nf) << log2_esz);
     page_split = -(addr | TARGET_PAGE_MASK);
-- 
2.48.1

From: Yanfeng Liu <yfliu2008@qq.com>

This adds virtualization mode (V bit) as bit(2) of register `priv`
per RiscV debug spec v1.0.0-rc4. Checked with gdb-multiarch v12.1.

Note that GDB may display `INVALID` tag for `priv` reg when V bit
is set, this doesn't affect actual access to the bit though.

Signed-off-by: Yanfeng Liu <yfliu2008@qq.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <tencent_1993B55C24DE7979BF34B200F78287002907@qq.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_virtual(CPUState *cs, GByteArray *buf, int n)
         RISCVCPU *cpu = RISCV_CPU(cs);
         CPURISCVState *env = &cpu->env;
 
-        return gdb_get_regl(buf, env->priv);
+        /* Per RiscV debug spec v1.0.0 rc4 */
+        target_ulong vbit = (env->virt_enabled) ? BIT(2) : 0;
+
+        return gdb_get_regl(buf, env->priv | vbit);
 #endif
     }
     return 0;
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_virtual(CPUState *cs, uint8_t *mem_buf, int n)
         RISCVCPU *cpu = RISCV_CPU(cs);
         CPURISCVState *env = &cpu->env;
 
-        env->priv = ldtul_p(mem_buf) & 0x3;
-        if (env->priv == PRV_RESERVED) {
-            env->priv = PRV_S;
+        target_ulong new_priv = ldtul_p(mem_buf) & 0x3;
+        bool new_virt = 0;
+
+        if (new_priv == PRV_RESERVED) {
+            new_priv = PRV_S;
+        }
+
+        if (new_priv != PRV_M) {
+            new_virt = (ldtul_p(mem_buf) & BIT(2)) >> 2;
         }
+
+        if (riscv_has_ext(env, RVH) && new_virt != env->virt_enabled) {
+            riscv_cpu_swap_hypervisor_regs(env);
+        }
+
+        riscv_cpu_set_mode(env, new_priv, new_virt);
 #endif
         return sizeof(target_ulong);
     }
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

shcounterenw is defined in RVA22 as:

"For any hpmcounter that is not read-only zero, the corresponding bit in
hcounteren must be writable."

This is always true in TCG so let's claim support for it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 332 -> 346 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

shvstvala is defined in RVA22 as:

"vstval must be written in all cases described above for stval."

By "cases describe above" the doc refer to the description of sstvala:

"stval must be written with the faulting virtual address for load,
store, and instruction page-fault, access-fault, and misaligned
exceptions, and for breakpoint exceptions other than those caused by
execution of the EBREAK or C.EBREAK instructions. For
virtual-instruction and illegal-instruction exceptions, stval must be
written with the faulting instruction."

We already have sstvala, and our vstval follows the same rules as stval,
so we can claim to support shvstvala too.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 346 -> 356 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

shtvala is described in RVA22 as:

"htval must be written with the faulting guest physical address
in all circumstances permitted by the ISA."

This is the case since commit 3067553993, so claim support for shtvala.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 356 -> 364 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

shvstvecd is defined in RVA22 as:

"vstvec.MODE must be capable of holding the value 0 (Direct).
When vstvec.MODE=Direct, vstvec.BASE must be capable of holding any
valid four-byte-aligned address."

This is always true for TCG so let's claim support for it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 364 -> 374 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

shvsatpa is defined in RVA22 as:

"All translation modes supported in satp must be supported in vsatp."

This is always true in TCG so let's claim support for it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 374 -> 382 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

shgatpa is defined in RVA22 as:

"For each supported virtual memory scheme SvNN supported in satp, the
corresponding hgatp SvNNx4 mode must be supported. The hgatp mode Bare
must also be supported."

Claim support for shgatpa since this is always true for TCG.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 382 -> 390 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'sha' is the augmented hypervisor extension, defined in RVA22 as a set of
the following extensions:

- RVH
- Ssstateen
- Shcounterenw (always present)
- Shvstvala (always present)
- Shtvala (always present)
- Shvstvecd (always present)
- Shvsatpa (always present)
- Shgatpa (always present)

We can claim support for 'sha' by checking if we have RVH and ssstateen.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241218114026.1652352-10-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     | 1 +
 target/riscv/cpu.c         | 2 ++
 target/riscv/tcg/tcg-cpu.c | 8 ++++++++
 3 files changed, 11 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Do a cosmetic change in riscv_raise_exception() to change 'exception'
type from uint32_t to RISCVException, making it a bit clear that the
arg is directly correlated to the RISCVException enum.

As a side effect, change 'excp' type from int to RISCVException in
generate_exception() to guarantee that all callers of
riscv_raise_exception() will use the enum.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250106173734.412353-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h       | 3 ++-
 target/riscv/op_helper.c | 3 ++-
 target/riscv/translate.c | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
                           int *max_insns, vaddr pc, void *host_pc);
 
 G_NORETURN void riscv_raise_exception(CPURISCVState *env,
-                                      uint32_t exception, uintptr_t pc);
+                                      RISCVException exception,
+                                      uintptr_t pc);
 
 target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
 void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@
 
 /* Exceptions processing helpers */
 G_NORETURN void riscv_raise_exception(CPURISCVState *env,
-                                      uint32_t exception, uintptr_t pc)
+                                      RISCVException exception,
+                                      uintptr_t pc)
 {
     CPUState *cs = env_cpu(env);
     cs->exception_index = exception;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_update_pc(DisasContext *ctx, target_long diff)
     ctx->pc_save = ctx->base.pc_next + diff;
 }
 
-static void generate_exception(DisasContext *ctx, int excp)
+static void generate_exception(DisasContext *ctx, RISCVException excp)
 {
     gen_update_pc(ctx, 0);
     gen_helper_raise_exception(tcg_env, tcg_constant_i32(excp));
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

When using system mode we can get the CPU traps being taken via the
'riscv_trap' trace or the "-d int" qemu log. User mode does not a way of
logging/showing exceptions to users.

Add a trace in riscv_raise_exception() to allow qemu-riscv(32/64) users
to check all exceptions being thrown. This is particularly useful to
help identifying insns that are throwing SIGILLs.

As it is today we need to debug their binaries to identify where the
illegal insns are:

$ ~/work/qemu/build/qemu-riscv64 -cpu rv64 ./foo.out
Illegal instruction (core dumped)

After this change users can capture the trace and use EPC to pinpoint
the insn:

$ ~/work/qemu/build/qemu-riscv64 -cpu rv64 -trace riscv_exception ./foo.out
riscv_exception 8 (user_ecall) on epc 0x17cd2
riscv_exception 8 (user_ecall) on epc 0x17cda
riscv_exception 8 (user_ecall) on epc 0x17622
(...)
riscv_exception 2 (illegal_instruction) on epc 0x1053a
Illegal instruction (core dumped)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106173734.412353-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c  | 6 ++++++
 target/riscv/trace-events | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
+#include "trace.h"
 
 /* Exceptions processing helpers */
 G_NORETURN void riscv_raise_exception(CPURISCVState *env,
@@ -XXX,XX +XXX,XX @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
                                       uintptr_t pc)
 {
     CPUState *cs = env_cpu(env);
+
+    trace_riscv_exception(exception,
+                          riscv_cpu_get_trap_name(exception, false),
+                          env->pc);
+
     cs->exception_index = exception;
     cpu_loop_exit_restore(cs, pc);
 }
diff --git a/target/riscv/trace-events b/target/riscv/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/trace-events
+++ b/target/riscv/trace-events
@@ -XXX,XX +XXX,XX @@ pmpaddr_csr_write(uint64_t mhartid, uint32_t addr_index, uint64_t val) "hart %"
 
 mseccfg_csr_read(uint64_t mhartid, uint64_t val) "hart %" PRIu64 ": read mseccfg, val: 0x%" PRIx64
 mseccfg_csr_write(uint64_t mhartid, uint64_t val) "hart %" PRIu64 ": write mseccfg, val: 0x%" PRIx64
+
+# op_helper.c
+riscv_exception(uint32_t exception, const char *desc, uint64_t epc) "%u (%s) on epc 0x%"PRIx64""
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Zjpm extension is finally ratified. And it's much simplier compared to the experimental one.
The newer version doesn't allow to specify custom mask or base for pointer masking.
Instead it allows only certain options for masking top bits.

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106102346.1100149-2-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h           |  33 +---
 target/riscv/cpu_bits.h      |  87 ----------
 target/riscv/cpu.c           |  13 +-
 target/riscv/cpu_helper.c    |  52 ------
 target/riscv/csr.c           | 326 -----------------------------------
 target/riscv/machine.c       |  17 +-
 target/riscv/tcg/tcg-cpu.c   |   5 +-
 target/riscv/translate.c     |  28 +--
 target/riscv/vector_helper.c |   2 +-
 9 files changed, 19 insertions(+), 544 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState CPURISCVState;
 #define RVS RV('S')
 #define RVU RV('U')
 #define RVH RV('H')
-#define RVJ RV('J')
 #define RVG RV('G')
 #define RVB RV('B')
 
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* True if in debugger mode.  */
     bool debugger;
 
-    /*
-     * CSRs for PointerMasking extension
-     */
-    target_ulong mmte;
-    target_ulong mpmmask;
-    target_ulong mpmbase;
-    target_ulong spmmask;
-    target_ulong spmbase;
-    target_ulong upmmask;
-    target_ulong upmbase;
-
     uint64_t mstateen[SMSTATEEN_MAX_COUNT];
     uint64_t hstateen[SMSTATEEN_MAX_COUNT];
     uint64_t sstateen[SMSTATEEN_MAX_COUNT];
     uint64_t henvcfg;
 #endif
-    target_ulong cur_pmmask;
-    target_ulong cur_pmbase;
 
     /* Fields from here on are preserved across CPU reset. */
     QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, XL, 16, 2)
 /* If PointerMasking should be applied */
 FIELD(TB_FLAGS, PM_MASK_ENABLED, 18, 1)
 FIELD(TB_FLAGS, PM_BASE_ENABLED, 19, 1)
-FIELD(TB_FLAGS, VTA, 20, 1)
-FIELD(TB_FLAGS, VMA, 21, 1)
+FIELD(TB_FLAGS, VTA, 18, 1)
+FIELD(TB_FLAGS, VMA, 19, 1)
 /* Native debug itrigger */
-FIELD(TB_FLAGS, ITRIGGER, 22, 1)
+FIELD(TB_FLAGS, ITRIGGER, 20, 1)
 /* Virtual mode enabled */
-FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
-FIELD(TB_FLAGS, PRIV, 24, 2)
-FIELD(TB_FLAGS, AXL, 26, 2)
+FIELD(TB_FLAGS, VIRT_ENABLED, 21, 1)
+FIELD(TB_FLAGS, PRIV, 22, 2)
+FIELD(TB_FLAGS, AXL, 24, 2)
 /* zicfilp needs a TB flag to track indirect branches */
-FIELD(TB_FLAGS, FCFI_ENABLED, 28, 1)
-FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 29, 1)
+FIELD(TB_FLAGS, FCFI_ENABLED, 26, 1)
+FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 27, 1)
 /* zicfiss needs a TB flag so that correct TB is located based on tb flags */
-FIELD(TB_FLAGS, BCFI_ENABLED, 30, 1)
+FIELD(TB_FLAGS, BCFI_ENABLED, 28, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_get_vlmax(uint32_t vlenb, uint32_t vsew,
 void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *pflags);
 
-void riscv_cpu_update_mask(CPURISCVState *env);
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_MHPMCOUNTER30H  0xb9e
 #define CSR_MHPMCOUNTER31H  0xb9f
 
-/*
- * User PointerMasking registers
- * NB: actual CSR numbers might be changed in future
- */
-#define CSR_UMTE            0x4c0
-#define CSR_UPMMASK         0x4c1
-#define CSR_UPMBASE         0x4c2
-
-/*
- * Machine PointerMasking registers
- * NB: actual CSR numbers might be changed in future
- */
-#define CSR_MMTE            0x3c0
-#define CSR_MPMMASK         0x3c1
-#define CSR_MPMBASE         0x3c2
-
-/*
- * Supervisor PointerMaster registers
- * NB: actual CSR numbers might be changed in future
- */
-#define CSR_SMTE            0x1c0
-#define CSR_SPMMASK         0x1c1
-#define CSR_SPMBASE         0x1c2
-
-/*
- * Hypervisor PointerMaster registers
- * NB: actual CSR numbers might be changed in future
- */
-#define CSR_VSMTE           0x2c0
-#define CSR_VSPMMASK        0x2c1
-#define CSR_VSPMBASE        0x2c2
 #define CSR_SCOUNTOVF       0xda0
 
 /* Crypto Extension */
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
 #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
 
-/* General PointerMasking CSR bits */
-#define PM_ENABLE       0x00000001ULL
-#define PM_CURRENT      0x00000002ULL
-#define PM_INSN         0x00000004ULL
-
 /* Execution environment configuration bits */
 #define MENVCFG_FIOM                       BIT(0)
 #define MENVCFG_LPE                        BIT(2) /* zicfilp */
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
-/* Offsets for every pair of control bits per each priv level */
-#define XS_OFFSET    0ULL
-#define U_OFFSET     2ULL
-#define S_OFFSET     5ULL
-#define M_OFFSET     8ULL
-
-#define PM_XS_BITS   (EXT_STATUS_MASK << XS_OFFSET)
-#define U_PM_ENABLE  (PM_ENABLE  << U_OFFSET)
-#define U_PM_CURRENT (PM_CURRENT << U_OFFSET)
-#define U_PM_INSN    (PM_INSN    << U_OFFSET)
-#define S_PM_ENABLE  (PM_ENABLE  << S_OFFSET)
-#define S_PM_CURRENT (PM_CURRENT << S_OFFSET)
-#define S_PM_INSN    (PM_INSN    << S_OFFSET)
-#define M_PM_ENABLE  (PM_ENABLE  << M_OFFSET)
-#define M_PM_CURRENT (PM_CURRENT << M_OFFSET)
-#define M_PM_INSN    (PM_INSN    << M_OFFSET)
-
-/* mmte CSR bits */
-#define MMTE_PM_XS_BITS     PM_XS_BITS
-#define MMTE_U_PM_ENABLE    U_PM_ENABLE
-#define MMTE_U_PM_CURRENT   U_PM_CURRENT
-#define MMTE_U_PM_INSN      U_PM_INSN
-#define MMTE_S_PM_ENABLE    S_PM_ENABLE
-#define MMTE_S_PM_CURRENT   S_PM_CURRENT
-#define MMTE_S_PM_INSN      S_PM_INSN
-#define MMTE_M_PM_ENABLE    M_PM_ENABLE
-#define MMTE_M_PM_CURRENT   M_PM_CURRENT
-#define MMTE_M_PM_INSN      M_PM_INSN
-#define MMTE_MASK    (MMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | MMTE_U_PM_INSN | \
-                      MMTE_S_PM_ENABLE | MMTE_S_PM_CURRENT | MMTE_S_PM_INSN | \
-                      MMTE_M_PM_ENABLE | MMTE_M_PM_CURRENT | MMTE_M_PM_INSN | \
-                      MMTE_PM_XS_BITS)
-
-/* (v)smte CSR bits */
-#define SMTE_PM_XS_BITS     PM_XS_BITS
-#define SMTE_U_PM_ENABLE    U_PM_ENABLE
-#define SMTE_U_PM_CURRENT   U_PM_CURRENT
-#define SMTE_U_PM_INSN      U_PM_INSN
-#define SMTE_S_PM_ENABLE    S_PM_ENABLE
-#define SMTE_S_PM_CURRENT   S_PM_CURRENT
-#define SMTE_S_PM_INSN      S_PM_INSN
-#define SMTE_MASK    (SMTE_U_PM_ENABLE | SMTE_U_PM_CURRENT | SMTE_U_PM_INSN | \
-                      SMTE_S_PM_ENABLE | SMTE_S_PM_CURRENT | SMTE_S_PM_INSN | \
-                      SMTE_PM_XS_BITS)
-
-/* umte CSR bits */
-#define UMTE_U_PM_ENABLE    U_PM_ENABLE
-#define UMTE_U_PM_CURRENT   U_PM_CURRENT
-#define UMTE_U_PM_INSN      U_PM_INSN
-#define UMTE_MASK     (UMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | UMTE_U_PM_INSN)
-
 /* MISELECT, SISELECT, and VSISELECT bits (AIA) */
 #define ISELECT_IPRIO0                     0x30
 #define ISELECT_IPRIO15                    0x3f
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 /* RISC-V CPU definitions */
 static const char riscv_single_letter_exts[] = "IEMAFDQCBPVH";
 const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
-                              RVC, RVS, RVU, RVH, RVJ, RVG, RVB, 0};
+                              RVC, RVS, RVU, RVH, RVG, RVB, 0};
 
 /*
  * From vector_helper.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             CSR_MSCRATCH,
             CSR_SSCRATCH,
             CSR_SATP,
-            CSR_MMTE,
-            CSR_UPMBASE,
-            CSR_UPMMASK,
-            CSR_SPMBASE,
-            CSR_SPMMASK,
-            CSR_MPMBASE,
-            CSR_MPMMASK,
         };
 
         for (i = 0; i < ARRAY_SIZE(dump_csrs); ++i) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
         }
         i++;
     }
-    /* mmte is supposed to have pm.current hardwired to 1 */
-    env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
 
     /*
      * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
     env->ssp = 0;
 
     env->xl = riscv_cpu_mxl(env);
-    riscv_cpu_update_mask(env);
     cs->exception_index = RISCV_EXCP_NONE;
     env->load_res = -1;
     set_default_nan_mode(1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
     MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
     MISA_EXT_INFO(RVU, "u", "User-level instructions"),
     MISA_EXT_INFO(RVH, "h", "Hypervisor"),
-    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
     MISA_EXT_INFO(RVV, "v", "Vector operations"),
     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
     MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
     flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
-    if (env->cur_pmmask != 0) {
-        flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
-    }
-    if (env->cur_pmbase != 0) {
-        flags = FIELD_DP32(flags, TB_FLAGS, PM_BASE_ENABLED, 1);
-    }
 
     *pflags = flags;
 }
 
-void riscv_cpu_update_mask(CPURISCVState *env)
-{
-    target_ulong mask = 0, base = 0;
-    RISCVMXL xl = env->xl;
-    /*
-     * TODO: Current RVJ spec does not specify
-     * how the extension interacts with XLEN.
-     */
-#ifndef CONFIG_USER_ONLY
-    int mode = cpu_address_mode(env);
-    xl = cpu_get_xl(env, mode);
-    if (riscv_has_ext(env, RVJ)) {
-        switch (mode) {
-        case PRV_M:
-            if (env->mmte & M_PM_ENABLE) {
-                mask = env->mpmmask;
-                base = env->mpmbase;
-            }
-            break;
-        case PRV_S:
-            if (env->mmte & S_PM_ENABLE) {
-                mask = env->spmmask;
-                base = env->spmbase;
-            }
-            break;
-        case PRV_U:
-            if (env->mmte & U_PM_ENABLE) {
-                mask = env->upmmask;
-                base = env->upmbase;
-            }
-            break;
-        default:
-            g_assert_not_reached();
-        }
-    }
-#endif
-    if (xl == MXL_RV32) {
-        env->cur_pmmask = mask & UINT32_MAX;
-        env->cur_pmbase = base & UINT32_MAX;
-    } else {
-        env->cur_pmmask = mask;
-        env->cur_pmbase = base;
-    }
-}
-
 #ifndef CONFIG_USER_ONLY
 
 /*
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en)
     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
     env->priv = newpriv;
     env->xl = cpu_recompute_xl(env);
-    riscv_cpu_update_mask(env);
 
     /*
      * Clear the load reservation - otherwise a reservation placed in one
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException hgatp(CPURISCVState *env, int csrno)
     return hmode(env, csrno);
 }
 
-/* Checks if PointerMasking registers could be accessed */
-static RISCVException pointer_masking(CPURISCVState *env, int csrno)
-{
-    /* Check if j-ext is present */
-    if (riscv_has_ext(env, RVJ)) {
-        return RISCV_EXCP_NONE;
-    }
-    return RISCV_EXCP_ILLEGAL_INST;
-}
-
 static RISCVException aia_hmode(CPURISCVState *env, int csrno)
 {
     if (!riscv_cpu_cfg(env)->ext_ssaia) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         env->xl = cpu_recompute_xl(env);
     }
 
-    riscv_cpu_update_mask(env);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcontext(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-/*
- * Functions to access Pointer Masking feature registers
- * We have to check if current priv lvl could modify
- * csr in given mode
- */
-static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
-{
-    int csr_priv = get_field(csrno, 0x300);
-    int pm_current;
-
-    if (env->debugger) {
-        return false;
-    }
-    /*
-     * If priv lvls differ that means we're accessing csr from higher priv lvl,
-     * so allow the access
-     */
-    if (env->priv != csr_priv) {
-        return false;
-    }
-    switch (env->priv) {
-    case PRV_M:
-        pm_current = get_field(env->mmte, M_PM_CURRENT);
-        break;
-    case PRV_S:
-        pm_current = get_field(env->mmte, S_PM_CURRENT);
-        break;
-    case PRV_U:
-        pm_current = get_field(env->mmte, U_PM_CURRENT);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
-    return !pm_current;
-}
-
-static RISCVException read_mmte(CPURISCVState *env, int csrno,
-                                target_ulong *val)
-{
-    *val = env->mmte & MMTE_MASK;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_mmte(CPURISCVState *env, int csrno,
-                                 target_ulong val)
-{
-    uint64_t mstatus;
-    target_ulong wpri_val = val & MMTE_MASK;
-
-    if (val != wpri_val) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
-                      TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
-                      val, "vs expected 0x", wpri_val);
-    }
-    /* for machine mode pm.current is hardwired to 1 */
-    wpri_val |= MMTE_M_PM_CURRENT;
-
-    /* hardwiring pm.instruction bit to 0, since it's not supported yet */
-    wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
-    env->mmte = wpri_val | EXT_STATUS_DIRTY;
-    riscv_cpu_update_mask(env);
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_smte(CPURISCVState *env, int csrno,
-                                target_ulong *val)
-{
-    *val = env->mmte & SMTE_MASK;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_smte(CPURISCVState *env, int csrno,
-                                 target_ulong val)
-{
-    target_ulong wpri_val = val & SMTE_MASK;
-
-    if (val != wpri_val) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
-                      TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
-                      val, "vs expected 0x", wpri_val);
-    }
-
-    /* if pm.current==0 we can't modify current PM CSRs */
-    if (check_pm_current_disabled(env, csrno)) {
-        return RISCV_EXCP_NONE;
-    }
-
-    wpri_val |= (env->mmte & ~SMTE_MASK);
-    write_mmte(env, csrno, wpri_val);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_umte(CPURISCVState *env, int csrno,
-                                target_ulong *val)
-{
-    *val = env->mmte & UMTE_MASK;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_umte(CPURISCVState *env, int csrno,
-                                 target_ulong val)
-{
-    target_ulong wpri_val = val & UMTE_MASK;
-
-    if (val != wpri_val) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
-                      TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
-                      val, "vs expected 0x", wpri_val);
-    }
-
-    if (check_pm_current_disabled(env, csrno)) {
-        return RISCV_EXCP_NONE;
-    }
-
-    wpri_val |= (env->mmte & ~UMTE_MASK);
-    write_mmte(env, csrno, wpri_val);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-{
-    *val = env->mpmmask;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
-                                    target_ulong val)
-{
-    uint64_t mstatus;
-
-    env->mpmmask = val;
-    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
-        env->cur_pmmask = val;
-    }
-    env->mmte |= EXT_STATUS_DIRTY;
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_spmmask(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-{
-    *val = env->spmmask;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_spmmask(CPURISCVState *env, int csrno,
-                                    target_ulong val)
-{
-    uint64_t mstatus;
-
-    /* if pm.current==0 we can't modify current PM CSRs */
-    if (check_pm_current_disabled(env, csrno)) {
-        return RISCV_EXCP_NONE;
-    }
-    env->spmmask = val;
-    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
-        env->cur_pmmask = val;
-        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
-            env->cur_pmmask &= UINT32_MAX;
-        }
-    }
-    env->mmte |= EXT_STATUS_DIRTY;
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_upmmask(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-{
-    *val = env->upmmask;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_upmmask(CPURISCVState *env, int csrno,
-                                    target_ulong val)
-{
-    uint64_t mstatus;
-
-    /* if pm.current==0 we can't modify current PM CSRs */
-    if (check_pm_current_disabled(env, csrno)) {
-        return RISCV_EXCP_NONE;
-    }
-    env->upmmask = val;
-    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
-        env->cur_pmmask = val;
-        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
-            env->cur_pmmask &= UINT32_MAX;
-        }
-    }
-    env->mmte |= EXT_STATUS_DIRTY;
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-{
-    *val = env->mpmbase;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
-                                    target_ulong val)
-{
-    uint64_t mstatus;
-
-    env->mpmbase = val;
-    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
-        env->cur_pmbase = val;
-    }
-    env->mmte |= EXT_STATUS_DIRTY;
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_spmbase(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-{
-    *val = env->spmbase;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_spmbase(CPURISCVState *env, int csrno,
-                                    target_ulong val)
-{
-    uint64_t mstatus;
-
-    /* if pm.current==0 we can't modify current PM CSRs */
-    if (check_pm_current_disabled(env, csrno)) {
-        return RISCV_EXCP_NONE;
-    }
-    env->spmbase = val;
-    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
-        env->cur_pmbase = val;
-        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
-            env->cur_pmbase &= UINT32_MAX;
-        }
-    }
-    env->mmte |= EXT_STATUS_DIRTY;
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException read_upmbase(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-{
-    *val = env->upmbase;
-    return RISCV_EXCP_NONE;
-}
-
-static RISCVException write_upmbase(CPURISCVState *env, int csrno,
-                                    target_ulong val)
-{
-    uint64_t mstatus;
-
-    /* if pm.current==0 we can't modify current PM CSRs */
-    if (check_pm_current_disabled(env, csrno)) {
-        return RISCV_EXCP_NONE;
-    }
-    env->upmbase = val;
-    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
-        env->cur_pmbase = val;
-        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
-            env->cur_pmbase &= UINT32_MAX;
-        }
-    }
-    env->mmte |= EXT_STATUS_DIRTY;
-
-    /* Set XS and SD bits, since PM CSRs are dirty */
-    mstatus = env->mstatus | MSTATUS_XS;
-    write_mstatus(env, csrno, mstatus);
-    return RISCV_EXCP_NONE;
-}
-
 #endif
 
 /* Crypto Extension */
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_TINFO]     =  { "tinfo",    debug, read_tinfo,    write_ignore   },
     [CSR_MCONTEXT]  =  { "mcontext", debug, read_mcontext, write_mcontext },
 
-    /* User Pointer Masking */
-    [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
-    [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
-                         write_upmmask                                      },
-    [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
-                         write_upmbase                                      },
-    /* Machine Pointer Masking */
-    [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
-    [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
-                         write_mpmmask                                      },
-    [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
-                         write_mpmbase                                      },
-    /* Supervisor Pointer Masking */
-    [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
-    [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
-                         write_spmmask                                      },
-    [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
-                         write_spmbase                                      },
-
     /* Performance Counters */
     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vector = {
 
 static bool pointermasking_needed(void *opaque)
 {
-    RISCVCPU *cpu = opaque;
-    CPURISCVState *env = &cpu->env;
-
-    return riscv_has_ext(env, RVJ);
+    return false;
 }
 
 static const VMStateDescription vmstate_pointermasking = {
     .name = "cpu/pointer_masking",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .needed = pointermasking_needed,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINTTL(env.mmte, RISCVCPU),
-        VMSTATE_UINTTL(env.mpmmask, RISCVCPU),
-        VMSTATE_UINTTL(env.mpmbase, RISCVCPU),
-        VMSTATE_UINTTL(env.spmmask, RISCVCPU),
-        VMSTATE_UINTTL(env.spmbase, RISCVCPU),
-        VMSTATE_UINTTL(env.upmmask, RISCVCPU),
-        VMSTATE_UINTTL(env.upmbase, RISCVCPU),
 
         VMSTATE_END_OF_LIST()
     }
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_post_load(void *opaque, int version_id)
     CPURISCVState *env = &cpu->env;
 
     env->xl = cpu_recompute_xl(env);
-    riscv_cpu_update_mask(env);
     return 0;
 }
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
     MISA_CFG(RVS, true),
     MISA_CFG(RVU, true),
     MISA_CFG(RVH, true),
-    MISA_CFG(RVJ, false),
     MISA_CFG(RVV, false),
     MISA_CFG(RVG, false),
     MISA_CFG(RVB, false),
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
     CPURISCVState *env = &cpu->env;
     const RISCVCPUMultiExtConfig *prop;
 
-    /* Enable RVG, RVJ and RVV that are disabled by default */
-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
+    /* Enable RVG and RVV that are disabled by default */
+    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVV);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
         isa_ext_update_enabled(cpu, prop->offset, true);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
 static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
 static TCGv load_res;
 static TCGv load_val;
-/* globals for PM CSRs */
-static TCGv pm_mask;
-static TCGv pm_base;
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool vl_eq_vlmax;
     CPUState *cs;
     TCGv zero;
-    /* PointerMasking extension */
-    bool pm_mask_enabled;
-    bool pm_base_enabled;
     /* Ztso */
     bool ztso;
     /* Use icount trigger for native debug */
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_addi_tl(addr, src1, imm);
-    if (ctx->pm_mask_enabled) {
-        tcg_gen_andc_tl(addr, addr, pm_mask);
-    } else if (get_address_xl(ctx) == MXL_RV32) {
+    if (get_address_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
-    if (ctx->pm_base_enabled) {
-        tcg_gen_or_tl(addr, addr, pm_base);
-    }
 
     return addr;
 }
@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_add_tl(addr, src1, offs);
-    if (ctx->pm_mask_enabled) {
-        tcg_gen_andc_tl(addr, addr, pm_mask);
-    } else if (get_xl(ctx) == MXL_RV32) {
+    if (get_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
-    if (ctx->pm_base_enabled) {
-        tcg_gen_or_tl(addr, addr, pm_base);
-    }
+
     return addr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
     ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
-    ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
-    ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
     ctx->ztso = cpu->cfg.ext_ztso;
     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->bcfi_enabled = FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED);
@@ -XXX,XX +XXX,XX @@ void riscv_translate_init(void)
                              "load_res");
     load_val = tcg_global_mem_new(tcg_env, offsetof(CPURISCVState, load_val),
                              "load_val");
-    /* Assign PM CSRs to tcg globals */
-    pm_mask = tcg_global_mem_new(tcg_env, offsetof(CPURISCVState, cur_pmmask),
-                                 "pmmask");
-    pm_base = tcg_global_mem_new(tcg_env, offsetof(CPURISCVState, cur_pmbase),
-                                 "pmbase");
 }
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
 
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
-    return (addr & ~env->cur_pmmask) | env->cur_pmbase;
+    return addr;
 }
 
 /*
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106102346.1100149-3-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h      |  8 ++++++++
 target/riscv/cpu_bits.h |  4 ++++
 target/riscv/cpu_cfg.h  |  3 +++
 target/riscv/pmp.h      |  1 +
 target/riscv/csr.c      | 33 +++++++++++++++++++++++++++++++--
 target/riscv/pmp.c      | 14 +++++++++++---
 6 files changed, 58 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     EXT_STATUS_DIRTY,
 } RISCVExtStatus;
 
+/* Enum holds PMM field values for Zjpm v1.0 extension */
+typedef enum {
+    PMM_FIELD_DISABLED = 0,
+    PMM_FIELD_RESERVED = 1,
+    PMM_FIELD_PMLEN7   = 2,
+    PMM_FIELD_PMLEN16  = 3,
+} RISCVPmPmm;
+
 typedef struct riscv_cpu_implied_exts_rule {
 #ifndef CONFIG_USER_ONLY
     /*
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define HSTATUS_VTSR         0x00400000
 #define HSTATUS_HUKTE        0x01000000
 #define HSTATUS_VSXL         0x300000000
+#define HSTATUS_HUPMM        0x3000000000000
 
 #define HSTATUS32_WPRI       0xFF8FF87E
 #define HSTATUS64_WPRI       0xFFFFFFFFFF8FF87EULL
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBIE                       (3UL << 4)
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
+#define MENVCFG_PMM                        (3ULL << 32)
 #define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define SENVCFG_CBCFE                      MENVCFG_CBCFE
 #define SENVCFG_CBZE                       MENVCFG_CBZE
 #define SENVCFG_UKTE                       BIT(8)
+#define SENVCFG_PMM                        MENVCFG_PMM
 
 #define HENVCFG_FIOM                       MENVCFG_FIOM
 #define HENVCFG_LPE                        MENVCFG_LPE
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBIE                       MENVCFG_CBIE
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
+#define HENVCFG_PMM                        MENVCFG_PMM
 #define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_ssaia;
     bool ext_sscofpmf;
     bool ext_smepmp;
+    bool ext_ssnpm;
+    bool ext_smnpm;
+    bool ext_smmpm;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
     bool rvv_vl_half_avl;
diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     MSECCFG_USEED = 1 << 8,
     MSECCFG_SSEED = 1 << 9,
     MSECCFG_MLPE =  1 << 10,
+    MSECCFG_PMM = 3ULL << 32,
 } mseccfg_field_t;
 
 typedef struct {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException have_mseccfg(CPURISCVState *env, int csrno)
     if (riscv_cpu_cfg(env)->ext_zkr) {
         return RISCV_EXCP_NONE;
     }
+    if (riscv_cpu_cfg(env)->ext_smmpm) {
+        return RISCV_EXCP_NONE;
+    }
 
     return RISCV_EXCP_ILLEGAL_INST;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
         if (env_archcpu(env)->cfg.ext_zicfiss) {
             mask |= MENVCFG_SSE;
         }
+
+        /* Update PMM field only if the value is valid according to Zjpm v1.0 */
+        if (env_archcpu(env)->cfg.ext_smnpm &&
+            get_field(val, MENVCFG_PMM) != PMM_FIELD_RESERVED) {
+            mask |= MENVCFG_PMM;
+        }
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
 {
     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
     RISCVException ret;
+    /* Update PMM field only if the value is valid according to Zjpm v1.0 */
+    if (env_archcpu(env)->cfg.ext_ssnpm &&
+        riscv_cpu_mxl(env) == MXL_RV64 &&
+        get_field(val, SENVCFG_PMM) != PMM_FIELD_RESERVED) {
+        mask |= SENVCFG_PMM;
+    }
 
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
     if (ret != RISCV_EXCP_NONE) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
             get_field(env->menvcfg, MENVCFG_SSE)) {
             mask |= HENVCFG_SSE;
         }
+
+        /* Update PMM field only if the value is valid according to Zjpm v1.0 */
+        if (env_archcpu(env)->cfg.ext_ssnpm &&
+            get_field(val, HENVCFG_PMM) != PMM_FIELD_RESERVED) {
+            mask |= HENVCFG_PMM;
+        }
     }
 
     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
                                     target_ulong val)
 {
+    uint64_t mask = (target_ulong)-1;
     if (!env_archcpu(env)->cfg.ext_svukte) {
-        val = val & (~HSTATUS_HUKTE);
+        mask &= ~HSTATUS_HUKTE;
     }
-    env->hstatus = val;
+    /* Update PMM field only if the value is valid according to Zjpm v1.0 */
+    if (!env_archcpu(env)->cfg.ext_ssnpm ||
+        riscv_cpu_mxl(env) != MXL_RV64 ||
+        get_field(val, HSTATUS_HUPMM) == PMM_FIELD_RESERVED) {
+        mask &= ~HSTATUS_HUPMM;
+    }
+    env->hstatus = (env->hstatus & ~mask) | (val & mask);
+
     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
         qemu_log_mask(LOG_UNIMP,
                       "QEMU does not support mixed HSXLEN options.");
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 {
     int i;
+    uint64_t mask = MSECCFG_MMWP | MSECCFG_MML;
+    /* Update PMM field only if the value is valid according to Zjpm v1.0 */
+    if (riscv_cpu_cfg(env)->ext_smmpm &&
+        riscv_cpu_mxl(env) == MXL_RV64 &&
+        get_field(val, MSECCFG_PMM) != PMM_FIELD_RESERVED) {
+        mask |= MSECCFG_PMM;
+    }
 
     trace_mseccfg_csr_write(env->mhartid, val);
 
@@ -XXX,XX +XXX,XX @@ void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 
     if (riscv_cpu_cfg(env)->ext_smepmp) {
         /* Sticky bits */
-        val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
-        if ((val ^ env->mseccfg) & (MSECCFG_MMWP | MSECCFG_MML)) {
+        val |= (env->mseccfg & mask);
+        if ((val ^ env->mseccfg) & mask) {
             tlb_flush(env_cpu(env));
         }
     } else {
-        val &= ~(MSECCFG_MMWP | MSECCFG_MML | MSECCFG_RLB);
+        mask |= MSECCFG_RLB;
+        val &= ~(mask);
     }
 
     /* M-mode forward cfi to be enabled if cfi extension is implemented */
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106102346.1100149-4-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  5 +++
 target/riscv/cpu_helper.c | 78 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
+bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
+RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
+uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
+
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
                           target_ulong *ret_value);
+
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     *pflags = flags;
 }
 
+RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
+{
+#ifndef CONFIG_USER_ONLY
+    int priv_mode = cpu_address_mode(env);
+
+    if (get_field(env->mstatus, MSTATUS_MPRV) &&
+        get_field(env->mstatus, MSTATUS_MXR)) {
+        return PMM_FIELD_DISABLED;
+    }
+
+    /* Get current PMM field */
+    switch (priv_mode) {
+    case PRV_M:
+        if (riscv_cpu_cfg(env)->ext_smmpm) {
+            return get_field(env->mseccfg, MSECCFG_PMM);
+        }
+        break;
+    case PRV_S:
+        if (riscv_cpu_cfg(env)->ext_smnpm) {
+            if (get_field(env->mstatus, MSTATUS_MPV)) {
+                return get_field(env->henvcfg, HENVCFG_PMM);
+            } else {
+                return get_field(env->menvcfg, MENVCFG_PMM);
+            }
+        }
+        break;
+    case PRV_U:
+        if (riscv_has_ext(env, RVS)) {
+            if (riscv_cpu_cfg(env)->ext_ssnpm) {
+                return get_field(env->senvcfg, SENVCFG_PMM);
+            }
+        } else {
+            if (riscv_cpu_cfg(env)->ext_smnpm) {
+                return get_field(env->menvcfg, MENVCFG_PMM);
+            }
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return PMM_FIELD_DISABLED;
+#else
+    return PMM_FIELD_DISABLED;
+#endif
+}
+
+bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
+{
+#ifndef CONFIG_USER_ONLY
+    int satp_mode = 0;
+    int priv_mode = cpu_address_mode(env);
+
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        satp_mode = get_field(env->satp, SATP32_MODE);
+    } else {
+        satp_mode = get_field(env->satp, SATP64_MODE);
+    }
+
+    return ((satp_mode != VM_1_10_MBARE) && (priv_mode != PRV_M));
+#else
+    return false;
+#endif
+}
+
+uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm)
+{
+    switch (pmm) {
+    case PMM_FIELD_DISABLED:
+        return 0;
+    case PMM_FIELD_PMLEN7:
+        return 7;
+    case PMM_FIELD_PMLEN16:
+        return 16;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 #ifndef CONFIG_USER_ONLY
 
 /*
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20250106102346.1100149-5-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 3 +++
 target/riscv/cpu_helper.c | 3 +++
 target/riscv/translate.c  | 5 +++++
 3 files changed, 11 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, FCFI_ENABLED, 26, 1)
 FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 27, 1)
 /* zicfiss needs a TB flag so that correct TB is located based on tb flags */
 FIELD(TB_FLAGS, BCFI_ENABLED, 28, 1)
+/* If pointer masking should be applied and address sign extended */
+FIELD(TB_FLAGS, PM_PMM, 29, 2)
+FIELD(TB_FLAGS, PM_SIGNEXTEND, 31, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     RISCVCPU *cpu = env_archcpu(env);
     RISCVExtStatus fs, vs;
     uint32_t flags = 0;
+    bool pm_signext = riscv_cpu_virt_mem_enabled(env);
 
     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
     *cs_base = 0;
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
     flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
+    flags = FIELD_DP32(flags, TB_FLAGS, PM_PMM, riscv_pm_get_pmm(env));
+    flags = FIELD_DP32(flags, TB_FLAGS, PM_SIGNEXTEND, pm_signext);
 
     *pflags = flags;
 }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool vl_eq_vlmax;
     CPUState *cs;
     TCGv zero;
+    /* actual address width */
+    uint8_t addr_xl;
+    bool addr_signed;
     /* Ztso */
     bool ztso;
     /* Use icount trigger for native debug */
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
     ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
+    ctx->addr_xl = 0;
+    ctx->addr_signed = false;
     ctx->ztso = cpu->cfg.ext_ztso;
     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->bcfi_enabled = FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED);
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106102346.1100149-6-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c     | 22 ++++++++++++++++------
 target/riscv/vector_helper.c | 16 ++++++++++++++++
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_addi_tl(addr, src1, imm);
-    if (get_address_xl(ctx) == MXL_RV32) {
-        tcg_gen_ext32u_tl(addr, addr);
+    if (ctx->addr_signed) {
+        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
+    } else {
+        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
     }
 
     return addr;
@@ -XXX,XX +XXX,XX @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_add_tl(addr, src1, offs);
-    if (get_xl(ctx) == MXL_RV32) {
-        tcg_gen_ext32u_tl(addr, addr);
+    if (ctx->addr_signed) {
+        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
+    } else {
+        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
     }
 
     return addr;
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
     ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
-    ctx->addr_xl = 0;
-    ctx->addr_signed = false;
+    if (get_xl(ctx) == MXL_RV32) {
+        ctx->addr_xl = 32;
+        ctx->addr_signed = false;
+    } else {
+        int pm_pmm = FIELD_EX32(tb_flags, TB_FLAGS, PM_PMM);
+        ctx->addr_xl = 64 - riscv_pm_get_pmlen(pm_pmm);
+        ctx->addr_signed = FIELD_EX32(tb_flags, TB_FLAGS, PM_SIGNEXTEND);
+    }
     ctx->ztso = cpu->cfg.ext_ztso;
     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->bcfi_enabled = FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED);
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
 
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        return addr;
+    }
+    RISCVPmPmm pmm = riscv_pm_get_pmm(env);
+    if (pmm == PMM_FIELD_DISABLED) {
+        return addr;
+    }
+    int pmlen = riscv_pm_get_pmlen(pmm);
+    bool signext = riscv_cpu_virt_mem_enabled(env);
+    addr = addr << pmlen;
+    /* sign/zero extend masked address by N-1 bit */
+    if (signext) {
+        addr = (target_long)addr >> pmlen;
+    } else {
+        addr = addr >> pmlen;
+    }
     return addr;
 }
 
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106102346.1100149-7-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h           |  1 +
 target/riscv/internals.h     | 54 ++++++++++++++++++++++++++++++++++++
 target/riscv/cpu_helper.c    | 19 +++++++++++++
 target/riscv/op_helper.c     | 16 +++++------
 target/riscv/vector_helper.c | 21 --------------
 5 files changed, 82 insertions(+), 29 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
 bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
 RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
+RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env);
 uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
 
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@ static inline float16 check_nanbox_h(CPURISCVState *env, uint64_t f)
 /* Our implementation of CPUClass::has_work */
 bool riscv_cpu_has_work(CPUState *cs);
 
+/* Zjpm addr masking routine */
+static inline target_ulong adjust_addr_body(CPURISCVState *env,
+                                            target_ulong addr,
+                                            bool is_virt_addr)
+{
+    RISCVPmPmm pmm = PMM_FIELD_DISABLED;
+    uint32_t pmlen = 0;
+    bool signext = false;
+
+    /* do nothing for rv32 mode */
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        return addr;
+    }
+
+    /* get pmm field depending on whether addr is */
+    if (is_virt_addr) {
+        pmm = riscv_pm_get_virt_pmm(env);
+    } else {
+        pmm = riscv_pm_get_pmm(env);
+    }
+
+    /* if pointer masking is disabled, return original addr */
+    if (pmm == PMM_FIELD_DISABLED) {
+        return addr;
+    }
+
+    if (!is_virt_addr) {
+        signext = riscv_cpu_virt_mem_enabled(env);
+    }
+    addr = addr << pmlen;
+    pmlen = riscv_pm_get_pmlen(pmm);
+
+    /* sign/zero extend masked address by N-1 bit */
+    if (signext) {
+        addr = (target_long)addr >> pmlen;
+    } else {
+        addr = addr >> pmlen;
+    }
+
+    return addr;
+}
+
+static inline target_ulong adjust_addr(CPURISCVState *env,
+                                       target_ulong addr)
+{
+    return adjust_addr_body(env, addr, false);
+}
+
+static inline target_ulong adjust_addr_virt(CPURISCVState *env,
+                                            target_ulong addr)
+{
+    return adjust_addr_body(env, addr, true);
+}
+
 #endif
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 #endif
 }
 
+RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
+{
+#ifndef CONFIG_USER_ONLY
+    int priv_mode = cpu_address_mode(env);
+
+    if (priv_mode == PRV_U) {
+        return get_field(env->hstatus, HSTATUS_HUPMM);
+    } else {
+        if (get_field(env->hstatus, HSTATUS_SPVP)) {
+            return get_field(env->henvcfg, HENVCFG_PMM);
+        } else {
+            return get_field(env->senvcfg, SENVCFG_PMM);
+        }
+    }
+#else
+    return PMM_FIELD_DISABLED;
+#endif
+}
+
 bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
 {
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 
-    return cpu_ldb_mmu(env, addr, oi, ra);
+    return cpu_ldb_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
 
 target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 
-    return cpu_ldw_mmu(env, addr, oi, ra);
+    return cpu_ldw_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
 
 target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 
-    return cpu_ldl_mmu(env, addr, oi, ra);
+    return cpu_ldl_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
 
 target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
 
-    return cpu_ldq_mmu(env, addr, oi, ra);
+    return cpu_ldq_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
 
 void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 
-    cpu_stb_mmu(env, addr, val, oi, ra);
+    cpu_stb_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
 
 void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
 
-    cpu_stw_mmu(env, addr, val, oi, ra);
+    cpu_stw_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
 
 void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
 
-    cpu_stl_mmu(env, addr, val, oi, ra);
+    cpu_stl_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
 
 void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
@@ -XXX,XX +XXX,XX @@ void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
     int mmu_idx = check_access_hlsv(env, false, ra);
     MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
 
-    cpu_stq_mmu(env, addr, val, oi, ra);
+    cpu_stq_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
 
 /*
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
-static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
-{
-    if (riscv_cpu_mxl(env) == MXL_RV32) {
-        return addr;
-    }
-    RISCVPmPmm pmm = riscv_pm_get_pmm(env);
-    if (pmm == PMM_FIELD_DISABLED) {
-        return addr;
-    }
-    int pmlen = riscv_pm_get_pmlen(pmm);
-    bool signext = riscv_cpu_virt_mem_enabled(env);
-    addr = addr << pmlen;
-    /* sign/zero extend masked address by N-1 bit */
-    if (signext) {
-        addr = (target_long)addr >> pmlen;
-    } else {
-        addr = addr >> pmlen;
-    }
-    return addr;
-}
-
 /*
  * This function checks watchpoint before real load operation.
  *
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106102346.1100149-8-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
+    ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
+    ISA_EXT_DATA_ENTRY(smnpm, PRIV_VERSION_1_13_0, ext_smnpm),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, has_priv_1_11),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
     ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
+    ISA_EXT_DATA_ENTRY(ssnpm, PRIV_VERSION_1_13_0, ext_ssnpm),
     ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
     ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
     MULTI_EXT_CFG_BOOL("zvfhmin", ext_zvfhmin, false),
     MULTI_EXT_CFG_BOOL("sstc", ext_sstc, true),
+    MULTI_EXT_CFG_BOOL("ssnpm", ext_ssnpm, false),
 
     MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
+    MULTI_EXT_CFG_BOOL("smmpm", ext_smmpm, false),
+    MULTI_EXT_CFG_BOOL("smnpm", ext_smnpm, false),
     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
     MULTI_EXT_CFG_BOOL("ssaia", ext_ssaia, false),
     MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
-- 
2.48.1

From: Tommy Wu <tommy.wu@sifive.com>

The Smrnmi extension adds the 'mnscratch', 'mnepc', 'mncause',
'mnstatus' CSRs.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106054336.1878291-3-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h      |  7 ++++
 target/riscv/cpu_bits.h | 11 ++++++
 target/riscv/cpu.c      |  5 +++
 target/riscv/csr.c      | 82 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 105 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     uint64_t kvm_timer_state;
     uint64_t kvm_timer_frequency;
 #endif /* CONFIG_KVM */
+
+    /* RNMI */
+    target_ulong mnscratch;
+    target_ulong mnepc;
+    target_ulong mncause; /* mncause without bit XLEN-1 set to 1 */
+    target_ulong mnstatus;
+    target_ulong rnmip;
 };
 
 /*
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_PMPADDR14       0x3be
 #define CSR_PMPADDR15       0x3bf
 
+/* RNMI */
+#define CSR_MNSCRATCH       0x740
+#define CSR_MNEPC           0x741
+#define CSR_MNCAUSE         0x742
+#define CSR_MNSTATUS        0x744
+
 /* Debug/Trace Registers (shared with Debug Mode) */
 #define CSR_TSELECT         0x7a0
 #define CSR_TDATA1          0x7a1
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define SATP64_ASID         0x0FFFF00000000000ULL
 #define SATP64_PPN          0x00000FFFFFFFFFFFULL
 
+/* RNMI mnstatus CSR mask */
+#define MNSTATUS_NMIE       0x00000008
+#define MNSTATUS_MNPV       0x00000080
+#define MNSTATUS_MNPP       0x00001800
+
 /* VM modes (satp.mode) privileged ISA 1.10 */
 #define VM_1_10_MBARE       0
 #define VM_1_10_SV32        1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
         riscv_trigger_reset_hold(env);
     }
 
+    if (cpu->cfg.ext_smrnmi) {
+        env->rnmip = 0;
+        env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
+    }
+
     if (kvm_enabled()) {
         kvm_riscv_reset_vcpu(cpu);
     }
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException debug(CPURISCVState *env, int csrno)
 
     return RISCV_EXCP_ILLEGAL_INST;
 }
+
+static RISCVException rnmi(CPURISCVState *env, int csrno)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (cpu->cfg.ext_smrnmi) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return RISCV_EXCP_ILLEGAL_INST;
+}
 #endif
 
 static RISCVException seed(CPURISCVState *env, int csrno)
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcontext(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException read_mnscratch(CPURISCVState *env, int csrno,
+                                     target_ulong *val)
+{
+    *val = env->mnscratch;
+    return RISCV_EXCP_NONE;
+}
+
+static int write_mnscratch(CPURISCVState *env, int csrno, target_ulong val)
+{
+    env->mnscratch = val;
+    return RISCV_EXCP_NONE;
+}
+
+static int read_mnepc(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    *val = env->mnepc;
+    return RISCV_EXCP_NONE;
+}
+
+static int write_mnepc(CPURISCVState *env, int csrno, target_ulong val)
+{
+    env->mnepc = val;
+    return RISCV_EXCP_NONE;
+}
+
+static int read_mncause(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    *val = env->mncause;
+    return RISCV_EXCP_NONE;
+}
+
+static int write_mncause(CPURISCVState *env, int csrno, target_ulong val)
+{
+    env->mncause = val;
+    return RISCV_EXCP_NONE;
+}
+
+static int read_mnstatus(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    *val = env->mnstatus;
+    return RISCV_EXCP_NONE;
+}
+
+static int write_mnstatus(CPURISCVState *env, int csrno, target_ulong val)
+{
+    target_ulong mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
+
+    if (riscv_has_ext(env, RVH)) {
+        /* Flush tlb on mnstatus fields that affect VM. */
+        if ((val ^ env->mnstatus) & MNSTATUS_MNPV) {
+            tlb_flush(env_cpu(env));
+        }
+
+        mask |= MNSTATUS_MNPV;
+    }
+
+    /* mnstatus.mnie can only be cleared by hardware. */
+    env->mnstatus = (env->mnstatus & MNSTATUS_NMIE) | (val & mask);
+    return RISCV_EXCP_NONE;
+}
+
 #endif
 
 /* Crypto Extension */
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                         write_sstateen_1_3,
                         .min_priv_ver = PRIV_VERSION_1_12_0 },
 
+    /* RNMI */
+    [CSR_MNSCRATCH] = { "mnscratch", rnmi, read_mnscratch, write_mnscratch,
+                        .min_priv_ver = PRIV_VERSION_1_12_0               },
+    [CSR_MNEPC]     = { "mnepc",     rnmi, read_mnepc,     write_mnepc,
+                        .min_priv_ver = PRIV_VERSION_1_12_0               },
+    [CSR_MNCAUSE]   = { "mncause",   rnmi, read_mncause,   write_mncause,
+                        .min_priv_ver = PRIV_VERSION_1_12_0               },
+    [CSR_MNSTATUS]  = { "mnstatus",  rnmi, read_mnstatus,  write_mnstatus,
+                        .min_priv_ver = PRIV_VERSION_1_12_0               },
+
     /* Supervisor Trap Setup */
     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
                          NULL,                read_sstatus_i128              },
-- 
2.48.1

From: Tommy Wu <tommy.wu@sifive.com>

Because the RNMI interrupt trap handler address is implementation defined.
We add the 'rnmi-interrupt-vector' and 'rnmi-exception-vector' as the property
of the harts. It’s very easy for users to set the address based on their
expectation. This patch also adds the functionality to handle the RNMI signals.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106054336.1878291-4-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/riscv_hart.h |  4 ++
 target/riscv/cpu.h            |  3 ++
 target/riscv/cpu_bits.h       | 12 +++++
 hw/riscv/riscv_hart.c         | 41 ++++++++++++++++
 target/riscv/cpu.c            | 11 +++++
 target/riscv/cpu_helper.c     | 88 ++++++++++++++++++++++++++++++++---
 6 files changed, 152 insertions(+), 7 deletions(-)

diff --git a/include/hw/riscv/riscv_hart.h b/include/hw/riscv/riscv_hart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/riscv_hart.h
+++ b/include/hw/riscv/riscv_hart.h
@@ -XXX,XX +XXX,XX @@ struct RISCVHartArrayState {
     uint32_t hartid_base;
     char *cpu_type;
     uint64_t resetvec;
+    uint32_t num_rnmi_irqvec;
+    uint64_t *rnmi_irqvec;
+    uint32_t num_rnmi_excpvec;
+    uint64_t *rnmi_excpvec;
     RISCVCPU *harts;
 };
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     target_ulong mncause; /* mncause without bit XLEN-1 set to 1 */
     target_ulong mnstatus;
     target_ulong rnmip;
+    uint64_t rnmi_irqvec;
+    uint64_t rnmi_excpvec;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
 uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
                               uint64_t value);
+void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level);
 void riscv_cpu_interrupt(CPURISCVState *env);
 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
 void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 /* Default Reset Vector address */
 #define DEFAULT_RSTVEC      0x1000
 
+/* Default RNMI Interrupt Vector address */
+#define DEFAULT_RNMI_IRQVEC     0x0
+
+/* Default RNMI Exception Vector address */
+#define DEFAULT_RNMI_EXCPVEC    0x0
+
 /* Exception causes */
 typedef enum RISCVException {
     RISCV_EXCP_NONE = -1, /* sentinel value */
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 /* -1 is due to bit zero of hgeip and hgeie being ROZ. */
 #define IRQ_LOCAL_GUEST_MAX                (TARGET_LONG_BITS - 1)
 
+/* RNMI causes */
+#define RNMI_MAX                           16
+
 /* mip masks */
 #define MIP_USIP                           (1 << IRQ_U_SOFT)
 #define MIP_SSIP                           (1 << IRQ_S_SOFT)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MHPMEVENT_IDX_MASK                 0xFFFFF
 #define MHPMEVENT_SSCOF_RESVD              16
 
+/* RISC-V-specific interrupt pending bits. */
+#define CPU_INTERRUPT_RNMI                 CPU_INTERRUPT_TGT_EXT_0
+
 /* JVT CSR bits */
 #define JVT_MODE                           0x3F
 #define JVT_BASE                           (~0x3F)
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "hw/qdev-properties.h"
 #include "hw/riscv/riscv_hart.h"
+#include "qemu/error-report.h"
 
 static const Property riscv_harts_props[] = {
     DEFINE_PROP_UINT32("num-harts", RISCVHartArrayState, num_harts, 1),
@@ -XXX,XX +XXX,XX @@ static const Property riscv_harts_props[] = {
     DEFINE_PROP_STRING("cpu-type", RISCVHartArrayState, cpu_type),
     DEFINE_PROP_UINT64("resetvec", RISCVHartArrayState, resetvec,
                        DEFAULT_RSTVEC),
+
+    /*
+     * Smrnmi implementation-defined interrupt and exception trap handlers.
+     *
+     * When an RNMI interrupt is detected, the hart then enters M-mode and
+     * jumps to the address defined by "rnmi-interrupt-vector".
+     *
+     * When the hart encounters an exception while executing in M-mode with
+     * the mnstatus.NMIE bit clear, the hart then jumps to the address
+     * defined by "rnmi-exception-vector".
+     */
+    DEFINE_PROP_ARRAY("rnmi-interrupt-vector", RISCVHartArrayState,
+                      num_rnmi_irqvec, rnmi_irqvec, qdev_prop_uint64,
+                      uint64_t),
+    DEFINE_PROP_ARRAY("rnmi-exception-vector", RISCVHartArrayState,
+                      num_rnmi_excpvec, rnmi_excpvec, qdev_prop_uint64,
+                      uint64_t),
 };
 
 static void riscv_harts_cpu_reset(void *opaque)
@@ -XXX,XX +XXX,XX @@ static bool riscv_hart_realize(RISCVHartArrayState *s, int idx,
 {
     object_initialize_child(OBJECT(s), "harts[*]", &s->harts[idx], cpu_type);
     qdev_prop_set_uint64(DEVICE(&s->harts[idx]), "resetvec", s->resetvec);
+
+    if (s->harts[idx].cfg.ext_smrnmi) {
+        if (idx < s->num_rnmi_irqvec) {
+            qdev_prop_set_uint64(DEVICE(&s->harts[idx]),
+                                 "rnmi-interrupt-vector", s->rnmi_irqvec[idx]);
+        }
+
+        if (idx < s->num_rnmi_excpvec) {
+            qdev_prop_set_uint64(DEVICE(&s->harts[idx]),
+                                 "rnmi-exception-vector", s->rnmi_excpvec[idx]);
+        }
+    } else {
+        if (s->num_rnmi_irqvec > 0) {
+            warn_report_once("rnmi-interrupt-vector property is ignored "
+                             "because Smrnmi extension is not enabled.");
+        }
+
+        if (s->num_rnmi_excpvec > 0) {
+            warn_report_once("rnmi-exception-vector property is ignored "
+                             "because Smrnmi extension is not enabled.");
+        }
+    }
+
     s->harts[idx].env.mhartid = s->hartid_base + idx;
     qemu_register_reset(riscv_harts_cpu_reset, &s->harts[idx]);
     return qdev_realize(DEVICE(&s->harts[idx]), NULL, errp);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
         g_assert_not_reached();
     }
 }
+
+static void riscv_cpu_set_nmi(void *opaque, int irq, int level)
+{
+    riscv_cpu_set_rnmi(RISCV_CPU(opaque), irq, level);
+}
 #endif /* CONFIG_USER_ONLY */
 
 static bool riscv_cpu_is_dynamic(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_init(Object *obj)
 #ifndef CONFIG_USER_ONLY
     qdev_init_gpio_in(DEVICE(obj), riscv_cpu_set_irq,
                       IRQ_LOCAL_MAX + IRQ_LOCAL_GUEST_MAX);
+    qdev_init_gpio_in_named(DEVICE(cpu), riscv_cpu_set_nmi,
+                            "riscv.cpu.rnmi", RNMI_MAX);
 #endif /* CONFIG_USER_ONLY */
 
     general_user_opts = g_hash_table_new(g_str_hash, g_str_equal);
@@ -XXX,XX +XXX,XX @@ static const Property riscv_cpu_properties[] = {
 
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
+    DEFINE_PROP_UINT64("rnmi-interrupt-vector", RISCVCPU, env.rnmi_irqvec,
+                       DEFAULT_RNMI_IRQVEC),
+    DEFINE_PROP_UINT64("rnmi-exception-vector", RISCVCPU, env.rnmi_excpvec,
+                       DEFAULT_RNMI_EXCPVEC),
 #endif
 
     DEFINE_PROP_BOOL("short-isa-string", RISCVCPU, cfg.short_isa_string, false),
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
     uint64_t vsbits, irq_delegated;
     int virq;
 
+    /* Priority: RNMI > Other interrupt. */
+    if (riscv_cpu_cfg(env)->ext_smrnmi) {
+        /* If mnstatus.NMIE == 0, all interrupts are disabled. */
+        if (!get_field(env->mnstatus, MNSTATUS_NMIE)) {
+            return RISCV_EXCP_NONE;
+        }
+
+        if (env->rnmip) {
+            return ctz64(env->rnmip); /* since non-zero */
+        }
+    }
+
     /* Determine interrupt enable state of all privilege modes */
     if (env->virt_enabled) {
         mie = 1;
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
 
 bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
-    if (interrupt_request & CPU_INTERRUPT_HARD) {
+    uint32_t mask = CPU_INTERRUPT_HARD | CPU_INTERRUPT_RNMI;
+
+    if (interrupt_request & mask) {
         RISCVCPU *cpu = RISCV_CPU(cs);
         CPURISCVState *env = &cpu->env;
         int interruptno = riscv_cpu_local_irq_pending(env);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)
     env->geilen = geilen;
 }
 
+void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level)
+{
+    CPURISCVState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+    bool release_lock = false;
+
+    if (!bql_locked()) {
+        release_lock = true;
+        bql_lock();
+    }
+
+    if (level) {
+        env->rnmip |= 1 << irq;
+        cpu_interrupt(cs, CPU_INTERRUPT_RNMI);
+    } else {
+        env->rnmip &= ~(1 << irq);
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_RNMI);
+    }
+
+    if (release_lock) {
+        bql_unlock();
+    }
+}
+
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     bool write_gva = false;
     bool always_storeamo = (env->excp_uw2 & RISCV_UW2_ALWAYS_STORE_AMO);
     uint64_t s;
+    int mode;
 
     /*
      * cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     target_ulong htval = 0;
     target_ulong mtval2 = 0;
     int sxlen = 0;
-    int mxlen = 0;
+    int mxlen = 16 << riscv_cpu_mxl(env);
+    bool nnmi_excep = false;
+
+    if (cpu->cfg.ext_smrnmi && env->rnmip && async) {
+        env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
+        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV,
+                                  env->virt_enabled);
+        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPP,
+                                  env->priv);
+        env->mncause = cause | ((target_ulong)1U << (mxlen - 1));
+        env->mnepc = env->pc;
+        env->pc = env->rnmi_irqvec;
+
+        /* Trapping to M mode, virt is disabled */
+        riscv_cpu_set_mode(env, PRV_M, false);
+
+        return;
+    }
 
     if (!async) {
         /* set tval to badaddr for traps with address information */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                   __func__, env->mhartid, async, cause, env->pc, tval,
                   riscv_cpu_get_trap_name(cause, async));
 
-    if (env->priv <= PRV_S && cause < 64 &&
-        (((deleg >> cause) & 1) || s_injected || vs_injected)) {
+    mode = env->priv <= PRV_S && cause < 64 &&
+        (((deleg >> cause) & 1) || s_injected || vs_injected) ? PRV_S : PRV_M;
+
+    if (mode == PRV_S) {
         /* handle the trap in S-mode */
         /* save elp status */
         if (cpu_get_fcfien(env)) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                   ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
         riscv_cpu_set_mode(env, PRV_S, virt);
     } else {
+        /*
+         * If the hart encounters an exception while executing in M-mode
+         * with the mnstatus.NMIE bit clear, the exception is an RNMI exception.
+         */
+        nnmi_excep = cpu->cfg.ext_smrnmi &&
+                     !get_field(env->mnstatus, MNSTATUS_NMIE) &&
+                     !async;
+
         /* handle the trap in M-mode */
         /* save elp status */
         if (cpu_get_fcfien(env)) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         s = set_field(s, MSTATUS_MPP, env->priv);
         s = set_field(s, MSTATUS_MIE, 0);
         env->mstatus = s;
-        mxlen = 16 << riscv_cpu_mxl(env);
         env->mcause = cause | ((target_ulong)async << (mxlen - 1));
         env->mepc = env->pc;
         env->mtval = tval;
         env->mtval2 = mtval2;
         env->mtinst = tinst;
-        env->pc = (env->mtvec >> 2 << 2) +
-                  ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
+
+        /*
+         * For RNMI exception, program counter is set to the RNMI exception
+         * trap handler address.
+         */
+        if (nnmi_excep) {
+            env->pc = env->rnmi_excpvec;
+        } else {
+            env->pc = (env->mtvec >> 2 << 2) +
+                      ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
+        }
         riscv_cpu_set_mode(env, PRV_M, virt);
     }
 
-- 
2.48.1

From: Tommy Wu <tommy.wu@sifive.com>

This patch adds a new instruction 'mnret'. 'mnret' is an M-mode-only
instruction that uses the values in `mnepc` and `mnstatus` to return to the
program counter, privilege mode, and virtualization mode of the
interrupted context.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106054336.1878291-5-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                         |  1 +
 target/riscv/insn32.decode                    |  3 ++
 target/riscv/op_helper.c                      | 45 ++++++++++++++++---
 .../riscv/insn_trans/trans_privileged.c.inc   | 20 +++++++++
 4 files changed, 64 insertions(+), 5 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
 #ifndef CONFIG_USER_ONLY
 DEF_HELPER_1(sret, tl, env)
 DEF_HELPER_1(mret, tl, env)
+DEF_HELPER_1(mnret, tl, env)
 DEF_HELPER_1(wfi, void, env)
 DEF_HELPER_1(wrs_nto, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ wfi         0001000    00101 00000 000 00000 1110011
 sfence_vma  0001001    ..... ..... 000 00000 1110011 @sfence_vma
 sfence_vm   0001000    00100 ..... 000 00000 1110011 @sfence_vm
 
+# *** NMI ***
+mnret       0111000    00010 00000 000 00000 1110011
+
 # *** RV32I Base Instruction Set ***
 lui      ....................       ..... 0110111 @u
 {
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
     return retpc;
 }
 
-target_ulong helper_mret(CPURISCVState *env)
+static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
+                                  target_ulong prev_priv)
 {
     if (!(env->priv >= PRV_M)) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    target_ulong retpc = env->mepc;
     if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) {
         riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
     }
 
-    uint64_t mstatus = env->mstatus;
-    target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
-
     if (riscv_cpu_cfg(env)->pmp &&
         !pmp_get_num_rules(env) && (prev_priv != PRV_M)) {
         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
+}
+
+target_ulong helper_mret(CPURISCVState *env)
+{
+    target_ulong retpc = env->mepc;
+    uint64_t mstatus = env->mstatus;
+    target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
+
+    check_ret_from_m_mode(env, retpc, prev_priv);
 
     target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
                              (prev_priv != PRV_M);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
     return retpc;
 }
 
+target_ulong helper_mnret(CPURISCVState *env)
+{
+    target_ulong retpc = env->mnepc;
+    target_ulong prev_priv = get_field(env->mnstatus, MNSTATUS_MNPP);
+    target_ulong prev_virt;
+
+    check_ret_from_m_mode(env, retpc, prev_priv);
+
+    prev_virt = get_field(env->mnstatus, MNSTATUS_MNPV) &&
+                (prev_priv != PRV_M);
+    env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, true);
+
+    /*
+     * If MNRET changes the privilege mode to a mode
+     * less privileged than M, it also sets mstatus.MPRV to 0.
+     */
+    if (prev_priv < PRV_M) {
+        env->mstatus = set_field(env->mstatus, MSTATUS_MPRV, false);
+    }
+
+    if (riscv_has_ext(env, RVH) && prev_virt) {
+        riscv_cpu_swap_hypervisor_regs(env);
+    }
+
+    riscv_cpu_set_mode(env, prev_priv, prev_virt);
+
+    return retpc;
+}
+
 void helper_wfi(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#define REQUIRE_SMRNMI(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_smrnmi) { \
+        return false;                \
+    }                                \
+} while (0)
+
 static bool trans_ecall(DisasContext *ctx, arg_ecall *a)
 {
     /* always generates U-level ECALL, fixed in do_interrupt handler */
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 #endif
 }
 
+static bool trans_mnret(DisasContext *ctx, arg_mnret *a)
+{
+#ifndef CONFIG_USER_ONLY
+    REQUIRE_SMRNMI(ctx);
+    decode_save_opc(ctx, 0);
+    gen_helper_mnret(cpu_pc, tcg_env);
+    tcg_gen_exit_tb(NULL, 0); /* no chaining */
+    ctx->base.is_jmp = DISAS_NORETURN;
+    return true;
+#else
+    return false;
+#endif
+}
+
 static bool trans_wfi(DisasContext *ctx, arg_wfi *a)
 {
 #ifndef CONFIG_USER_ONLY
-- 
2.48.1

From: Tommy Wu <tommy.wu@sifive.com>

This adds the properties for ISA extension Smrnmi.

Also, when Smrnmi is present, the firmware (e.g., OpenSBI) must set
mnstatus.NMIE to 1 before enabling any interrupts. Otherwise, all
interrupts will be disabled. Since our current OpenSBI does not
support Smrnmi yet, let's disable Smrnmi for the 'max' type CPU for
now. We can re-enable it once OpenSBI includes proper support for it.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106054336.1878291-6-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         | 2 ++
 target/riscv/tcg/tcg-cpu.c | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
+    ISA_EXT_DATA_ENTRY(smrnmi, PRIV_VERSION_1_12_0, ext_smrnmi),
     ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
     ISA_EXT_DATA_ENTRY(smnpm, PRIV_VERSION_1_13_0, ext_smnpm),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
 
     MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
+    MULTI_EXT_CFG_BOOL("smrnmi", ext_smrnmi, false),
     MULTI_EXT_CFG_BOOL("smmpm", ext_smmpm, false),
     MULTI_EXT_CFG_BOOL("smnpm", ext_smnpm, false),
     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
     if (env->misa_mxl != MXL_RV32) {
         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_zcf), false);
     }
+
+    /*
+     * ext_smrnmi requires OpenSBI changes that our current
+     * image does not have. Disable it for now.
+     */
+    if (cpu->cfg.ext_smrnmi) {
+        isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smrnmi), false);
+        qemu_log("Smrnmi is disabled in the 'max' type CPU\n");
+    }
 }
 
 static bool riscv_cpu_has_max_extensions(Object *cpu_obj)
-- 
2.48.1

From: Frank Chang <frank.chang@sifive.com>

Zicfilp extension introduces the MNPELP (bit 9) in mnstatus.
The MNPELP field holds the previous ELP.

When a RNMI trap is delivered, the MNPELP is set to ELP and ELP set
to NO_LP_EXPECTED. Upon a mnret, if the mnstatus.MNPP holds the
value y, then ELP is set to the value of MNPELP if yLPE is 1;
otherwise, it is set to NO_LP_EXPECTED.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250106054336.1878291-7-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  1 +
 target/riscv/cpu_helper.c | 11 ++++++++++-
 target/riscv/op_helper.c  |  9 +++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 /* RNMI mnstatus CSR mask */
 #define MNSTATUS_NMIE       0x00000008
 #define MNSTATUS_MNPV       0x00000080
+#define MNSTATUS_MNPELP     0x00000200
 #define MNSTATUS_MNPP       0x00001800
 
 /* VM modes (satp.mode) privileged ISA 1.10 */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         env->mnepc = env->pc;
         env->pc = env->rnmi_irqvec;
 
+        if (cpu_get_fcfien(env)) {
+            env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, env->elp);
+        }
+
         /* Trapping to M mode, virt is disabled */
         riscv_cpu_set_mode(env, PRV_M, false);
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         /* handle the trap in M-mode */
         /* save elp status */
         if (cpu_get_fcfien(env)) {
-            env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, env->elp);
+            if (nnmi_excep) {
+                env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP,
+                                          env->elp);
+            } else {
+                env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, env->elp);
+            }
         }
 
         if (riscv_has_ext(env, RVH)) {
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
 
     riscv_cpu_set_mode(env, prev_priv, prev_virt);
 
+    /*
+     * If forward cfi enabled for new priv, restore elp status
+     * and clear mnpelp in mnstatus
+     */
+    if (cpu_get_fcfien(env)) {
+        env->elp = get_field(env->mnstatus, MNSTATUS_MNPELP);
+    }
+    env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, 0);
+
     return retpc;
 }
 
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Keep kvm_riscv_get_timebase_frequency() prototype aligned with
the other ones declared in "kvm_riscv.h", have it take a RISCVCPU
cpu as argument. Include "target/riscv/cpu-qom.h" which declares
the RISCVCPU typedef.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250112231344.34632-2-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm_riscv.h | 4 +++-
 hw/riscv/virt.c              | 2 +-
 target/riscv/kvm/kvm-cpu.c   | 4 ++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm/kvm_riscv.h b/target/riscv/kvm/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm_riscv.h
+++ b/target/riscv/kvm/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_KVM_RISCV_H
 #define QEMU_KVM_RISCV_H
 
+#include "target/riscv/cpu-qom.h"
+
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
 void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
 void riscv_kvm_aplic_request(void *opaque, int irq, int level);
 int kvm_riscv_sync_mpstate_to_kvm(RISCVCPU *cpu, int state);
 void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
-uint64_t kvm_riscv_get_timebase_frequency(CPUState *cs);
+uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu);
 
 #endif
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_add_subnode(ms->fdt, "/cpus");
     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "timebase-frequency",
                           kvm_enabled() ?
-                          kvm_riscv_get_timebase_frequency(first_cpu) :
+                          kvm_riscv_get_timebase_frequency(RISCV_CPU(first_cpu)) :
                           RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
-uint64_t kvm_riscv_get_timebase_frequency(CPUState *cs)
+uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu)
 {
     uint64_t reg;
 
-    KVM_RISCV_GET_TIMER(cs, frequency, reg);
+    KVM_RISCV_GET_TIMER(CPU(cpu), frequency, reg);
 
     return reg;
 }
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

virt_machine_init() creates the HARTs vCPUs, then later
virt_machine_done() calls create_fdt_sockets(), so the
latter has access to the first vCPU via:

RISCVVirtState {
    RISCVHartArrayState {
      RISCVCPU *harts;
      ...

} soc[VIRT_SOCKETS_MAX];
    ...

} s;

Directly use that instead of the &first_cpu global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250112231344.34632-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_add_subnode(ms->fdt, "/cpus");
     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "timebase-frequency",
                           kvm_enabled() ?
-                          kvm_riscv_get_timebase_frequency(RISCV_CPU(first_cpu)) :
+                          kvm_riscv_get_timebase_frequency(&s->soc->harts[0]) :
                           RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
     qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
-- 
2.48.1

From: Kaiwen Xue <kaiwenx@rivosinc.com>

This adds the properties for sxcsrind. Definitions of new registers and
implementations will come with future patches.

Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-1-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 2 ++
 target/riscv/cpu.c     | 2 ++
 2 files changed, 4 insertions(+)

From: Kaiwen Xue <kaiwenx@rivosinc.com>

Since xiselect and xireg also will be of use in sxcsrind, AIA should
have its own separated interface when those CSRs are accessed.

Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-2-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 165 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 139 insertions(+), 26 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
 #include "system/cpu-timers.h"
 #include "qemu/guest-random.h"
 #include "qapi/error.h"
+#include <stdbool.h>
 
 /* CSR function table public API */
 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_any32(CPURISCVState *env, int csrno)
     return any32(env, csrno);
 }
 
+static RISCVException csrind_or_aia_any(CPURISCVState *env, int csrno)
+{
+    if (!riscv_cpu_cfg(env)->ext_smaia && !riscv_cpu_cfg(env)->ext_smcsrind) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return any(env, csrno);
+}
+
 static RISCVException smode(CPURISCVState *env, int csrno)
 {
     if (riscv_has_ext(env, RVS)) {
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_smode32(CPURISCVState *env, int csrno)
     return smode32(env, csrno);
 }
 
+static bool csrind_extensions_present(CPURISCVState *env)
+{
+    return riscv_cpu_cfg(env)->ext_smcsrind || riscv_cpu_cfg(env)->ext_sscsrind;
+}
+
+static bool aia_extensions_present(CPURISCVState *env)
+{
+    return riscv_cpu_cfg(env)->ext_smaia || riscv_cpu_cfg(env)->ext_ssaia;
+}
+
+static bool csrind_or_aia_extensions_present(CPURISCVState *env)
+{
+    return csrind_extensions_present(env) || aia_extensions_present(env);
+}
+
+static RISCVException csrind_or_aia_smode(CPURISCVState *env, int csrno)
+{
+    if (!csrind_or_aia_extensions_present(env)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return smode(env, csrno);
+}
+
 static RISCVException hmode(CPURISCVState *env, int csrno)
 {
     if (riscv_has_ext(env, RVH)) {
@@ -XXX,XX +XXX,XX @@ static RISCVException hmode32(CPURISCVState *env, int csrno)
 
 }
 
+static RISCVException csrind_or_aia_hmode(CPURISCVState *env, int csrno)
+{
+    if (!csrind_or_aia_extensions_present(env)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return hmode(env, csrno);
+}
+
 static RISCVException umode(CPURISCVState *env, int csrno)
 {
     if (riscv_has_ext(env, RVU)) {
@@ -XXX,XX +XXX,XX @@ static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
     };
 }
 
+static int csrind_xlate_vs_csrno(CPURISCVState *env, int csrno)
+{
+    if (!env->virt_enabled) {
+        return csrno;
+    }
+
+    switch (csrno) {
+    case CSR_SISELECT:
+        return CSR_VSISELECT;
+    case CSR_SIREG:
+        return CSR_VSIREG;
+    default:
+        return csrno;
+    };
+}
+
 static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
                                    target_ulong *val, target_ulong new_val,
                                    target_ulong wr_mask)
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
     target_ulong *iselect;
 
     /* Translate CSR number for VS-mode */
-    csrno = aia_xlate_vs_csrno(env, csrno);
+    csrno = csrind_xlate_vs_csrno(env, csrno);
 
     /* Find the iselect CSR based on CSR number */
     switch (csrno) {
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static bool xiselect_aia_range(target_ulong isel)
+{
+    return (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) ||
+           (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST);
+}
+
 static int rmw_iprio(target_ulong xlen,
                      target_ulong iselect, uint8_t *iprio,
                      target_ulong *val, target_ulong new_val,
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
     return 0;
 }
 
-static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
-                                target_ulong *val, target_ulong new_val,
-                                target_ulong wr_mask)
+static RISCVException rmw_xireg_aia(CPURISCVState *env, int csrno,
+                         target_ulong isel, target_ulong *val,
+                         target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt, isel_reserved;
-    uint8_t *iprio;
+    bool virt = false, isel_reserved = false;
     int ret = -EINVAL;
-    target_ulong priv, isel, vgein;
-
-    /* Translate CSR number for VS-mode */
-    csrno = aia_xlate_vs_csrno(env, csrno);
+    uint8_t *iprio;
+    target_ulong priv, vgein;
 
-    /* Decode register details from CSR number */
-    virt = false;
-    isel_reserved = false;
+    /* VS-mode CSR number passed in has already been translated */
     switch (csrno) {
     case CSR_MIREG:
+        if (!riscv_cpu_cfg(env)->ext_smaia) {
+            goto done;
+        }
         iprio = env->miprio;
-        isel = env->miselect;
         priv = PRV_M;
         break;
     case CSR_SIREG:
-        if (env->priv == PRV_S && env->mvien & MIP_SEIP &&
+        if (!riscv_cpu_cfg(env)->ext_ssaia ||
+            (env->priv == PRV_S && env->mvien & MIP_SEIP &&
             env->siselect >= ISELECT_IMSIC_EIDELIVERY &&
-            env->siselect <= ISELECT_IMSIC_EIE63) {
+            env->siselect <= ISELECT_IMSIC_EIE63)) {
             goto done;
         }
         iprio = env->siprio;
-        isel = env->siselect;
         priv = PRV_S;
         break;
     case CSR_VSIREG:
+        if (!riscv_cpu_cfg(env)->ext_ssaia) {
+            goto done;
+        }
         iprio = env->hviprio;
-        isel = env->vsiselect;
         priv = PRV_S;
         virt = true;
         break;
     default:
-         goto done;
+        goto done;
     };
 
     /* Find the selected guest interrupt file */
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
     }
 
 done:
+    /*
+     * If AIA is not enabled, illegal instruction exception is always
+     * returned regardless of whether we are in VS-mode or not
+     */
     if (ret) {
         return (env->virt_enabled && virt && !isel_reserved) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
+                                target_ulong *val, target_ulong new_val,
+                                target_ulong wr_mask)
+{
+    bool virt = false;
+    int ret = -EINVAL;
+    target_ulong isel;
+
+    /* Translate CSR number for VS-mode */
+    csrno = csrind_xlate_vs_csrno(env, csrno);
+
+    /* Decode register details from CSR number */
+    switch (csrno) {
+    case CSR_MIREG:
+        isel = env->miselect;
+        break;
+    case CSR_SIREG:
+        isel = env->siselect;
+        break;
+    case CSR_VSIREG:
+        isel = env->vsiselect;
+        virt = true;
+        break;
+    default:
+         goto done;
+    };
+
+    if (xiselect_aia_range(isel)) {
+        return rmw_xireg_aia(env, csrno, isel, val, new_val, wr_mask);
+    }
+
+done:
+    if (ret) {
+        return (env->virt_enabled && virt) ?
+               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+    }
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
 
     /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
-    [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
-    [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
+    [CSR_MISELECT] = { "miselect", csrind_or_aia_any,   NULL, NULL,
+                       rmw_xiselect                                    },
+    [CSR_MIREG]    = { "mireg",    csrind_or_aia_any,   NULL, NULL,
+                       rmw_xireg                                       },
 
     /* Machine-Level Interrupts (AIA) */
     [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
 
     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
-    [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
-    [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
+    [CSR_SISELECT]   = { "siselect",   csrind_or_aia_smode, NULL, NULL,
+                         rmw_xiselect                                       },
+    [CSR_SIREG]      = { "sireg",      csrind_or_aia_smode, NULL, NULL,
+                         rmw_xireg                                          },
 
     /* Supervisor-Level Interrupts (AIA) */
     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     /*
      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
      */
-    [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
-                          rmw_xiselect                                     },
-    [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
+    [CSR_VSISELECT]   = { "vsiselect",   csrind_or_aia_hmode, NULL, NULL,
+                          rmw_xiselect                                      },
+    [CSR_VSIREG]      = { "vsireg",      csrind_or_aia_hmode, NULL, NULL,
+                          rmw_xireg                                         },
 
     /* VS-Level Interrupts (H-extension with AIA) */
     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

As per the ratified AIA spec v1.0, three stateen bits control AIA CSR
access.

Bit 60 controls the indirect CSRs
Bit 59 controls the most AIA CSR state
Bit 58 controls the IMSIC state such as stopei and vstopei

Enable the corresponding bits in [m|h]stateen and enable corresponding
checks in the CSR accessor functions.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-3-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 85 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 84 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException smode32(CPURISCVState *env, int csrno)
 
 static RISCVException aia_smode(CPURISCVState *env, int csrno)
 {
+    int ret;
+
     if (!riscv_cpu_cfg(env)->ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
+    if (csrno == CSR_STOPEI) {
+        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_IMSIC);
+    } else {
+        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
+    }
+
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     return smode(env, csrno);
 }
 
 static RISCVException aia_smode32(CPURISCVState *env, int csrno)
 {
+    int ret;
+
     if (!riscv_cpu_cfg(env)->ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     return smode32(env, csrno);
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException hgatp(CPURISCVState *env, int csrno)
 
 static RISCVException aia_hmode(CPURISCVState *env, int csrno)
 {
+    int ret;
+
     if (!riscv_cpu_cfg(env)->ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
      }
 
-     return hmode(env, csrno);
+    if (csrno == CSR_VSTOPEI) {
+        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_IMSIC);
+    } else {
+        ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
+    }
+
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    return hmode(env, csrno);
 }
 
 static RISCVException aia_hmode32(CPURISCVState *env, int csrno)
 {
+    int ret;
+
+    if (!riscv_cpu_cfg(env)->ext_ssaia) {
+        return RISCV_EXCP_ILLEGAL_INST;
+     }
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     if (!riscv_cpu_cfg(env)->ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
                                    target_ulong wr_mask)
 {
     target_ulong *iselect;
+    int ret;
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
 
     /* Translate CSR number for VS-mode */
     csrno = csrind_xlate_vs_csrno(env, csrno);
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
     int ret = -EINVAL;
     target_ulong isel;
 
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     /* Translate CSR number for VS-mode */
     csrno = csrind_xlate_vs_csrno(env, csrno);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
         wr_mask |= SMSTATEEN0_P1P13;
     }
 
+    if (riscv_cpu_cfg(env)->ext_smaia) {
+        wr_mask |= SMSTATEEN0_SVSLCT;
+    }
+
+    /*
+     * As per the AIA specification, SMSTATEEN0_IMSIC is valid only if IMSIC is
+     * implemented. However, that information is with MachineState and we can't
+     * figure that out in csr.c. Just enable if Smaia is available.
+     */
+    if (riscv_cpu_cfg(env)->ext_smaia) {
+        wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
+    }
+
     return write_mstateen(env, csrno, wr_mask, new_val);
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
         wr_mask |= SMSTATEEN0_FCSR;
     }
 
+    if (riscv_cpu_cfg(env)->ext_ssaia) {
+        wr_mask |= SMSTATEEN0_SVSLCT;
+    }
+
+    /*
+     * As per the AIA specification, SMSTATEEN0_IMSIC is valid only if IMSIC is
+     * implemented. However, that information is with MachineState and we can't
+     * figure that out in csr.c. Just enable if Ssaia is available.
+     */
+    if (riscv_cpu_cfg(env)->ext_ssaia) {
+        wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
+    }
+
     return write_hstateen(env, csrno, wr_mask, new_val);
 }
 
-- 
2.48.1

From: Kaiwen Xue <kaiwenx@rivosinc.com>

This adds the indirect access registers required by sscsrind/smcsrind
and the operations on them. Note that xiselect and xireg are used for
both AIA and sxcsrind, and the behavior of accessing them depends on
whether each extension is enabled and the value stored in xiselect.

Co-developed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-4-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h |  28 +++++++-
 target/riscv/csr.c      | 144 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 166 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_MISELECT        0x350
 #define CSR_MIREG           0x351
 
+/* Machine Indirect Register Alias */
+#define CSR_MIREG2          0x352
+#define CSR_MIREG3          0x353
+#define CSR_MIREG4          0x355
+#define CSR_MIREG5          0x356
+#define CSR_MIREG6          0x357
+
 /* Machine-Level Interrupts (AIA) */
 #define CSR_MTOPEI          0x35c
 #define CSR_MTOPI           0xfb0
@@ -XXX,XX +XXX,XX @@
 #define CSR_SISELECT        0x150
 #define CSR_SIREG           0x151
 
+/* Supervisor Indirect Register Alias */
+#define CSR_SIREG2          0x152
+#define CSR_SIREG3          0x153
+#define CSR_SIREG4          0x155
+#define CSR_SIREG5          0x156
+#define CSR_SIREG6          0x157
+
 /* Supervisor-Level Interrupts (AIA) */
 #define CSR_STOPEI          0x15c
 #define CSR_STOPI           0xdb0
@@ -XXX,XX +XXX,XX @@
 #define CSR_VSISELECT       0x250
 #define CSR_VSIREG          0x251
 
+/* Virtual Supervisor Indirect Alias */
+#define CSR_VSIREG2         0x252
+#define CSR_VSIREG3         0x253
+#define CSR_VSIREG4         0x255
+#define CSR_VSIREG5         0x256
+#define CSR_VSIREG6         0x257
+
 /* VS-Level Interrupts (H-extension with AIA) */
 #define CSR_VSTOPEI         0x25c
 #define CSR_VSTOPI          0xeb0
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define ISELECT_IMSIC_EIE63                0xff
 #define ISELECT_IMSIC_FIRST                ISELECT_IMSIC_EIDELIVERY
 #define ISELECT_IMSIC_LAST                 ISELECT_IMSIC_EIE63
-#define ISELECT_MASK                       0x1ff
+#define ISELECT_MASK_AIA                   0x1ff
+
+/* MISELECT, SISELECT, and VSISELECT bits (AIA) */
+#define ISELECT_MASK_SXCSRIND              0xfff
 
 /* Dummy [M|S|VS]ISELECT value for emulating [M|S|VS]TOPEI CSRs */
-#define ISELECT_IMSIC_TOPEI                (ISELECT_MASK + 1)
+#define ISELECT_IMSIC_TOPEI                (ISELECT_MASK_AIA + 1)
 
 /* IMSIC bits (AIA) */
 #define IMSIC_TOPEI_IID_SHIFT              16
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_any32(CPURISCVState *env, int csrno)
     return any32(env, csrno);
 }
 
+static RISCVException csrind_any(CPURISCVState *env, int csrno)
+{
+    if (!riscv_cpu_cfg(env)->ext_smcsrind) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException csrind_or_aia_any(CPURISCVState *env, int csrno)
 {
     if (!riscv_cpu_cfg(env)->ext_smaia && !riscv_cpu_cfg(env)->ext_smcsrind) {
@@ -XXX,XX +XXX,XX @@ static bool csrind_or_aia_extensions_present(CPURISCVState *env)
     return csrind_extensions_present(env) || aia_extensions_present(env);
 }
 
+static RISCVException csrind_smode(CPURISCVState *env, int csrno)
+{
+    if (!csrind_extensions_present(env)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return smode(env, csrno);
+}
+
 static RISCVException csrind_or_aia_smode(CPURISCVState *env, int csrno)
 {
     if (!csrind_or_aia_extensions_present(env)) {
@@ -XXX,XX +XXX,XX @@ static RISCVException hmode32(CPURISCVState *env, int csrno)
 
 }
 
+static RISCVException csrind_hmode(CPURISCVState *env, int csrno)
+{
+    if (!csrind_extensions_present(env)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return hmode(env, csrno);
+}
+
 static RISCVException csrind_or_aia_hmode(CPURISCVState *env, int csrno)
 {
     if (!csrind_or_aia_extensions_present(env)) {
@@ -XXX,XX +XXX,XX @@ static int csrind_xlate_vs_csrno(CPURISCVState *env, int csrno)
     case CSR_SISELECT:
         return CSR_VSISELECT;
     case CSR_SIREG:
-        return CSR_VSIREG;
+    case CSR_SIREG2:
+    case CSR_SIREG3:
+    case CSR_SIREG4:
+    case CSR_SIREG5:
+    case CSR_SIREG6:
+        return CSR_VSIREG + (csrno - CSR_SIREG);
     default:
         return csrno;
     };
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
         *val = *iselect;
     }
 
-    wr_mask &= ISELECT_MASK;
+    if (riscv_cpu_cfg(env)->ext_smcsrind || riscv_cpu_cfg(env)->ext_sscsrind) {
+        wr_mask &= ISELECT_MASK_SXCSRIND;
+    } else {
+        wr_mask &= ISELECT_MASK_AIA;
+    }
+
     if (wr_mask) {
         *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
     }
@@ -XXX,XX +XXX,XX @@ done:
     return RISCV_EXCP_NONE;
 }
 
+/*
+ * rmw_xireg_csrind: Perform indirect access to xireg and xireg2-xireg6
+ *
+ * Perform indirect access to xireg and xireg2-xireg6.
+ * This is a generic interface for all xireg CSRs. Apart from AIA, all other
+ * extension using csrind should be implemented here.
+ */
+static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
+                              target_ulong isel, target_ulong *val,
+                              target_ulong new_val, target_ulong wr_mask)
+{
+    return -EINVAL;
+}
+
+static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
+                      target_ulong new_val, target_ulong wr_mask)
+{
+    bool virt = false;
+    int ret = -EINVAL;
+    target_ulong isel;
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    /* Translate CSR number for VS-mode */
+    csrno = csrind_xlate_vs_csrno(env, csrno);
+
+    if (CSR_MIREG <= csrno && csrno <= CSR_MIREG6 &&
+        csrno != CSR_MIREG4 - 1) {
+        isel = env->miselect;
+    } else if (CSR_SIREG <= csrno && csrno <= CSR_SIREG6 &&
+               csrno != CSR_SIREG4 - 1) {
+        isel = env->siselect;
+    } else if (CSR_VSIREG <= csrno && csrno <= CSR_VSIREG6 &&
+               csrno != CSR_VSIREG4 - 1) {
+        isel = env->vsiselect;
+        virt = true;
+    } else {
+        goto done;
+    }
+
+    return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
+
+done:
+    return (env->virt_enabled && virt) ?
+            RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+}
+
 static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
                                 target_ulong *val, target_ulong new_val,
                                 target_ulong wr_mask)
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
          goto done;
     };
 
+    /*
+     * Use the xiselect range to determine actual op on xireg.
+     *
+     * Since we only checked the existence of AIA or Indirect Access in the
+     * predicate, we should check the existence of the exact extension when
+     * we get to a specific range and return illegal instruction exception even
+     * in VS-mode.
+     */
     if (xiselect_aia_range(isel)) {
         return rmw_xireg_aia(env, csrno, isel, val, new_val, wr_mask);
+    } else if (riscv_cpu_cfg(env)->ext_smcsrind ||
+               riscv_cpu_cfg(env)->ext_sscsrind) {
+        return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
+    } else {
+        return RISCV_EXCP_ILLEGAL_INST;
     }
 
 done:
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
         wr_mask |= SMSTATEEN0_P1P13;
     }
 
-    if (riscv_cpu_cfg(env)->ext_smaia) {
+    if (riscv_cpu_cfg(env)->ext_smaia || riscv_cpu_cfg(env)->ext_smcsrind) {
         wr_mask |= SMSTATEEN0_SVSLCT;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
         wr_mask |= SMSTATEEN0_FCSR;
     }
 
-    if (riscv_cpu_cfg(env)->ext_ssaia) {
+    if (riscv_cpu_cfg(env)->ext_ssaia || riscv_cpu_cfg(env)->ext_sscsrind) {
         wr_mask |= SMSTATEEN0_SVSLCT;
     }
 
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MIREG]    = { "mireg",    csrind_or_aia_any,   NULL, NULL,
                        rmw_xireg                                       },
 
+    /* Machine Indirect Register Alias */
+    [CSR_MIREG2]   = { "mireg2", csrind_any, NULL, NULL, rmw_xiregi,
+                       .min_priv_ver = PRIV_VERSION_1_12_0          },
+    [CSR_MIREG3]   = { "mireg3", csrind_any, NULL, NULL, rmw_xiregi,
+                       .min_priv_ver = PRIV_VERSION_1_12_0          },
+    [CSR_MIREG4]   = { "mireg4", csrind_any, NULL, NULL, rmw_xiregi,
+                       .min_priv_ver = PRIV_VERSION_1_12_0          },
+    [CSR_MIREG5]   = { "mireg5", csrind_any, NULL, NULL, rmw_xiregi,
+                       .min_priv_ver = PRIV_VERSION_1_12_0          },
+    [CSR_MIREG6]   = { "mireg6", csrind_any, NULL, NULL, rmw_xiregi,
+                       .min_priv_ver = PRIV_VERSION_1_12_0          },
+
     /* Machine-Level Interrupts (AIA) */
     [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
     [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_SIREG]      = { "sireg",      csrind_or_aia_smode, NULL, NULL,
                          rmw_xireg                                          },
 
+    /* Supervisor Indirect Register Alias */
+    [CSR_SIREG2]      = { "sireg2", csrind_smode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_SIREG3]      = { "sireg3", csrind_smode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_SIREG4]      = { "sireg4", csrind_smode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_SIREG5]      = { "sireg5", csrind_smode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_SIREG6]      = { "sireg6", csrind_smode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+
     /* Supervisor-Level Interrupts (AIA) */
     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
     [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_VSIREG]      = { "vsireg",      csrind_or_aia_hmode, NULL, NULL,
                           rmw_xireg                                         },
 
+    /* Virtual Supervisor Indirect Alias */
+    [CSR_VSIREG2]     = { "vsireg2", csrind_hmode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSIREG3]     = { "vsireg3", csrind_hmode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSIREG4]     = { "vsireg4", csrind_hmode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSIREG5]     = { "vsireg5", csrind_hmode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSIREG6]     = { "vsireg6", csrind_hmode, NULL, NULL, rmw_xiregi,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+
     /* VS-Level Interrupts (H-extension with AIA) */
     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

This adds the properties for counter delegation ISA extensions
(Smcdeleg/Ssccfg). Definitions of new registers and and implementation
will come in the next set of patches.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-5-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 2 ++
 target/riscv/cpu.c     | 2 ++
 2 files changed, 4 insertions(+)

From: Kaiwen Xue <kaiwenx@rivosinc.com>

This adds definitions for counter delegation, including the new
scountinhibit register and the mstateen.CD bit.

Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-6-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h      | 1 +
 target/riscv/cpu_bits.h | 8 +++++++-
 target/riscv/machine.c  | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     uint32_t scounteren;
     uint32_t mcounteren;
 
+    uint32_t scountinhibit;
     uint32_t mcountinhibit;
 
     /* PMU cycle & instret privilege mode filtering */
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_SSTATEEN2       0x10E
 #define CSR_SSTATEEN3       0x10F
 
+/* Supervisor Counter Delegation */
+#define CSR_SCOUNTINHIBIT   0x120
+
 /* Supervisor Trap Handling */
 #define CSR_SSCRATCH        0x140
 #define CSR_SEPC            0x141
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
 #define MENVCFG_PMM                        (3ULL << 32)
+#define MENVCFG_CDE                        (1ULL << 60)
 #define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define ISELECT_IMSIC_LAST                 ISELECT_IMSIC_EIE63
 #define ISELECT_MASK_AIA                   0x1ff
 
-/* MISELECT, SISELECT, and VSISELECT bits (AIA) */
+/* [M|S|VS]SELCT value for Indirect CSR Access Extension */
+#define ISELECT_CD_FIRST                   0x40
+#define ISELECT_CD_LAST                    0x5f
 #define ISELECT_MASK_SXCSRIND              0xfff
 
 /* Dummy [M|S|VS]ISELECT value for emulating [M|S|VS]TOPEI CSRs */
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_UINTTL(env.siselect, RISCVCPU),
         VMSTATE_UINT32(env.scounteren, RISCVCPU),
         VMSTATE_UINT32(env.mcounteren, RISCVCPU),
+        VMSTATE_UINT32(env.scountinhibit, RISCVCPU),
         VMSTATE_UINT32(env.mcountinhibit, RISCVCPU),
         VMSTATE_STRUCT_ARRAY(env.pmu_ctrs, RISCVCPU, RV_MAX_MHPMCOUNTERS, 0,
                              vmstate_pmu_ctr_state, PMUCTRState),
-- 
2.48.1

From: Kaiwen Xue <kaiwenx@rivosinc.com>

This adds checks in ops performed on xireg and xireg2-xireg6 so that the
counter delegation function will receive a valid xiselect value with the
proper extensions enabled.

Co-developed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-7-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static bool xiselect_aia_range(target_ulong isel)
            (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST);
 }
 
+static bool xiselect_cd_range(target_ulong isel)
+{
+    return (ISELECT_CD_FIRST <= isel && isel <= ISELECT_CD_LAST);
+}
+
 static int rmw_iprio(target_ulong xlen,
                      target_ulong iselect, uint8_t *iprio,
                      target_ulong *val, target_ulong new_val,
@@ -XXX,XX +XXX,XX @@ done:
     return RISCV_EXCP_NONE;
 }
 
+static int rmw_xireg_cd(CPURISCVState *env, int csrno,
+                        target_ulong isel, target_ulong *val,
+                        target_ulong new_val, target_ulong wr_mask)
+{
+    if (!riscv_cpu_cfg(env)->ext_smcdeleg) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+    /* TODO: Implement the functionality later */
+    return RISCV_EXCP_NONE;
+}
+
 /*
  * rmw_xireg_csrind: Perform indirect access to xireg and xireg2-xireg6
  *
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
                               target_ulong isel, target_ulong *val,
                               target_ulong new_val, target_ulong wr_mask)
 {
-    return -EINVAL;
+    int ret = -EINVAL;
+    bool virt = csrno == CSR_VSIREG ? true : false;
+
+    if (xiselect_cd_range(isel)) {
+        ret = rmw_xireg_cd(env, csrno, isel, val, new_val, wr_mask);
+    } else {
+        /*
+         * As per the specification, access to unimplented region is undefined
+         * but recommendation is to raise illegal instruction exception.
+         */
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (ret) {
+        return (env->virt_enabled && virt) ?
+               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return RISCV_EXCP_NONE;
 }
 
 static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
-- 
2.48.1

From: Kaiwen Xue <kaiwenx@rivosinc.com>

The Smcdeleg/Ssccfg adds the support for counter delegation via
S*indcsr and Ssccfg.

It also adds a new shadow CSR scountinhibit and menvcfg enable bit (CDE)
to enable this extension and scountovf virtualization.

Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Co-developed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-8-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 304 +++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 292 insertions(+), 12 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_smode32(CPURISCVState *env, int csrno)
     return smode32(env, csrno);
 }
 
+static RISCVException scountinhibit_pred(CPURISCVState *env, int csrno)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_ssccfg || !cpu->cfg.ext_smcdeleg) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (env->virt_enabled) {
+        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+    }
+
+    return smode(env, csrno);
+}
+
 static bool csrind_extensions_present(CPURISCVState *env)
 {
     return riscv_cpu_cfg(env)->ext_smcsrind || riscv_cpu_cfg(env)->ext_sscsrind;
@@ -XXX,XX +XXX,XX @@ done:
     return result;
 }
 
-static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
-                                        target_ulong val)
+static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, target_ulong val,
+                                          uint32_t ctr_idx)
 {
-    int ctr_idx = csrno - CSR_MCYCLE;
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
     uint64_t mhpmctr_val = val;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
-                                         target_ulong val)
+static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
+                                          uint32_t ctr_idx)
 {
-    int ctr_idx = csrno - CSR_MCYCLEH;
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
     uint64_t mhpmctr_val = counter->mhpmcounter_val;
     uint64_t mhpmctrh_val = val;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
+{
+    int ctr_idx = csrno - CSR_MCYCLE;
+
+    return riscv_pmu_write_ctr(env, val, ctr_idx);
+}
+
+static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
+{
+    int ctr_idx = csrno - CSR_MCYCLEH;
+
+    return riscv_pmu_write_ctrh(env, val, ctr_idx);
+}
+
 RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
                                          bool upper_half, uint32_t ctr_idx)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
     return riscv_pmu_read_ctr(env, val, true, ctr_index);
 }
 
+static int rmw_cd_mhpmcounter(CPURISCVState *env, int ctr_idx,
+                              target_ulong *val, target_ulong new_val,
+                              target_ulong wr_mask)
+{
+    if (wr_mask != 0 && wr_mask != -1) {
+        return -EINVAL;
+    }
+
+    if (!wr_mask && val) {
+        riscv_pmu_read_ctr(env, val, false, ctr_idx);
+    } else if (wr_mask) {
+        riscv_pmu_write_ctr(env, new_val, ctr_idx);
+    } else {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int rmw_cd_mhpmcounterh(CPURISCVState *env, int ctr_idx,
+                               target_ulong *val, target_ulong new_val,
+                               target_ulong wr_mask)
+{
+    if (wr_mask != 0 && wr_mask != -1) {
+        return -EINVAL;
+    }
+
+    if (!wr_mask && val) {
+        riscv_pmu_read_ctr(env, val, true, ctr_idx);
+    } else if (wr_mask) {
+        riscv_pmu_write_ctrh(env, new_val, ctr_idx);
+    } else {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int rmw_cd_mhpmevent(CPURISCVState *env, int evt_index,
+                            target_ulong *val, target_ulong new_val,
+                            target_ulong wr_mask)
+{
+    uint64_t mhpmevt_val = new_val;
+
+    if (wr_mask != 0 && wr_mask != -1) {
+        return -EINVAL;
+    }
+
+    if (!wr_mask && val) {
+        *val = env->mhpmevent_val[evt_index];
+        if (riscv_cpu_cfg(env)->ext_sscofpmf) {
+            *val &= ~MHPMEVENT_BIT_MINH;
+        }
+    } else if (wr_mask) {
+        wr_mask &= ~MHPMEVENT_BIT_MINH;
+        mhpmevt_val = (new_val & wr_mask) |
+                      (env->mhpmevent_val[evt_index] & ~wr_mask);
+        if (riscv_cpu_mxl(env) == MXL_RV32) {
+            mhpmevt_val = mhpmevt_val |
+                          ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
+        }
+        env->mhpmevent_val[evt_index] = mhpmevt_val;
+        riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
+    } else {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int rmw_cd_mhpmeventh(CPURISCVState *env, int evt_index,
+                             target_ulong *val, target_ulong new_val,
+                             target_ulong wr_mask)
+{
+    uint64_t mhpmevth_val;
+    uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
+
+    if (wr_mask != 0 && wr_mask != -1) {
+        return -EINVAL;
+    }
+
+    if (!wr_mask && val) {
+        *val = env->mhpmeventh_val[evt_index];
+        if (riscv_cpu_cfg(env)->ext_sscofpmf) {
+            *val &= ~MHPMEVENTH_BIT_MINH;
+        }
+    } else if (wr_mask) {
+        wr_mask &= ~MHPMEVENTH_BIT_MINH;
+        env->mhpmeventh_val[evt_index] =
+            (new_val & wr_mask) | (env->mhpmeventh_val[evt_index] & ~wr_mask);
+        mhpmevth_val = env->mhpmeventh_val[evt_index];
+        mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
+        riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
+    } else {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, target_ulong *val,
+                            target_ulong new_val, target_ulong wr_mask)
+{
+    switch (cfg_index) {
+    case 0:             /* CYCLECFG */
+        if (wr_mask) {
+            wr_mask &= ~MCYCLECFG_BIT_MINH;
+            env->mcyclecfg = (new_val & wr_mask) | (env->mcyclecfg & ~wr_mask);
+        } else {
+            *val = env->mcyclecfg &= ~MHPMEVENTH_BIT_MINH;
+        }
+        break;
+    case 2:             /* INSTRETCFG */
+        if (wr_mask) {
+            wr_mask &= ~MINSTRETCFG_BIT_MINH;
+            env->minstretcfg = (new_val & wr_mask) |
+                               (env->minstretcfg & ~wr_mask);
+        } else {
+            *val = env->minstretcfg &= ~MHPMEVENTH_BIT_MINH;
+        }
+        break;
+    default:
+        return -EINVAL;
+    }
+    return 0;
+}
+
+static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, target_ulong *val,
+                            target_ulong new_val, target_ulong wr_mask)
+{
+
+    if (riscv_cpu_mxl(env) != MXL_RV32) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    switch (cfg_index) {
+    case 0:         /* CYCLECFGH */
+        if (wr_mask) {
+            wr_mask &= ~MCYCLECFGH_BIT_MINH;
+            env->mcyclecfgh = (new_val & wr_mask) |
+                              (env->mcyclecfgh & ~wr_mask);
+        } else {
+            *val = env->mcyclecfgh;
+        }
+        break;
+    case 2:          /* INSTRETCFGH */
+        if (wr_mask) {
+            wr_mask &= ~MINSTRETCFGH_BIT_MINH;
+            env->minstretcfgh = (new_val & wr_mask) |
+                                (env->minstretcfgh & ~wr_mask);
+        } else {
+            *val = env->minstretcfgh;
+        }
+        break;
+    default:
+        return -EINVAL;
+    }
+    return 0;
+}
+
+
 static RISCVException read_scountovf(CPURISCVState *env, int csrno,
                                      target_ulong *val)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_scountovf(CPURISCVState *env, int csrno,
     target_ulong *mhpm_evt_val;
     uint64_t of_bit_mask;
 
+    /* Virtualize scountovf for counter delegation */
+    if (riscv_cpu_cfg(env)->ext_sscofpmf &&
+        riscv_cpu_cfg(env)->ext_ssccfg &&
+        get_field(env->menvcfg, MENVCFG_CDE) &&
+        env->virt_enabled) {
+        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+    }
+
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         mhpm_evt_val = env->mhpmeventh_val;
         of_bit_mask = MHPMEVENTH_BIT_OF;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_cd(CPURISCVState *env, int csrno,
                         target_ulong isel, target_ulong *val,
                         target_ulong new_val, target_ulong wr_mask)
 {
-    if (!riscv_cpu_cfg(env)->ext_smcdeleg) {
-        return RISCV_EXCP_ILLEGAL_INST;
+    int ret = -EINVAL;
+    int ctr_index = isel - ISELECT_CD_FIRST;
+    int isel_hpm_start = ISELECT_CD_FIRST + 3;
+
+    if (!riscv_cpu_cfg(env)->ext_smcdeleg || !riscv_cpu_cfg(env)->ext_ssccfg) {
+        ret = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
     }
-    /* TODO: Implement the functionality later */
-    return RISCV_EXCP_NONE;
+
+    /* Invalid siselect value for reserved */
+    if (ctr_index == 1) {
+        goto done;
+    }
+
+    /* sireg4 and sireg5 provides access RV32 only CSRs */
+    if (((csrno == CSR_SIREG5) || (csrno == CSR_SIREG4)) &&
+        (riscv_cpu_mxl(env) != MXL_RV32)) {
+        ret = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    }
+
+    /* Check Sscofpmf dependancy */
+    if (!riscv_cpu_cfg(env)->ext_sscofpmf && csrno == CSR_SIREG5 &&
+        (isel_hpm_start <= isel && isel <= ISELECT_CD_LAST)) {
+        goto done;
+    }
+
+    /* Check smcntrpmf dependancy */
+    if (!riscv_cpu_cfg(env)->ext_smcntrpmf &&
+        (csrno == CSR_SIREG2 || csrno == CSR_SIREG5) &&
+        (ISELECT_CD_FIRST <= isel && isel < isel_hpm_start)) {
+        goto done;
+    }
+
+    if (!get_field(env->mcounteren, BIT(ctr_index)) ||
+        !get_field(env->menvcfg, MENVCFG_CDE)) {
+        goto done;
+    }
+
+    switch (csrno) {
+    case CSR_SIREG:
+        ret = rmw_cd_mhpmcounter(env, ctr_index, val, new_val, wr_mask);
+        break;
+    case CSR_SIREG4:
+        ret = rmw_cd_mhpmcounterh(env, ctr_index, val, new_val, wr_mask);
+        break;
+    case CSR_SIREG2:
+        if (ctr_index <= 2) {
+            ret = rmw_cd_ctr_cfg(env, ctr_index, val, new_val, wr_mask);
+        } else {
+            ret = rmw_cd_mhpmevent(env, ctr_index, val, new_val, wr_mask);
+        }
+        break;
+    case CSR_SIREG5:
+        if (ctr_index <= 2) {
+            ret = rmw_cd_ctr_cfgh(env, ctr_index, val, new_val, wr_mask);
+        } else {
+            ret = rmw_cd_mhpmeventh(env, ctr_index, val, new_val, wr_mask);
+        }
+        break;
+    default:
+        goto done;
+    }
+
+done:
+    return ret;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
+                                         target_ulong *val)
+{
+    /* S-mode can only access the bits delegated by M-mode */
+    *val = env->mcountinhibit & env->mcounteren;
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_scountinhibit(CPURISCVState *env, int csrno,
+                                          target_ulong val)
+{
+    write_mcountinhibit(env, csrno, val & env->mcounteren);
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
                                       target_ulong *val)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
                                     target_ulong val)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
-    uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
+    uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
+                    MENVCFG_CBZE | MENVCFG_CDE;
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
+                (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
                 (cfg->ext_svadu ? MENVCFG_ADUE : 0);
 
         if (env_archcpu(env)->cfg.ext_zicfilp) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
+                    (cfg->ext_svadu ? MENVCFG_ADUE : 0) |
+                    (cfg->ext_smcdeleg ? MENVCFG_CDE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MNSTATUS]  = { "mnstatus",  rnmi, read_mnstatus,  write_mnstatus,
                         .min_priv_ver = PRIV_VERSION_1_12_0               },
 
+    /* Supervisor Counter Delegation */
+    [CSR_SCOUNTINHIBIT] = {"scountinhibit", scountinhibit_pred,
+                            read_scountinhibit, write_scountinhibit,
+                           .min_priv_ver = PRIV_VERSION_1_12_0 },
+
     /* Supervisor Trap Setup */
     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
                          NULL,                read_sstatus_i128              },
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

The dependant ISA features are enabled at the end of cpu_realize
in finalize_features. Thus, PMU init should be invoked after that
only. Move the init invocation to riscv_tcg_cpu_finalize_features.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-9-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
         error_propagate(errp, local_err);
         return;
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.pmu_mask) {
+        riscv_pmu_init(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+
+        if (cpu->cfg.ext_sscofpmf) {
+            cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                          riscv_pmu_timer_cb, cpu);
+        }
+    }
+#endif
 }
 
 void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
@@ -XXX,XX +XXX,XX @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
 
 #ifndef CONFIG_USER_ONLY
     CPURISCVState *env = &cpu->env;
-    Error *local_err = NULL;
 
     tcg_cflags_set(CPU(cs), CF_PCREL);
 
@@ -XXX,XX +XXX,XX @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
         riscv_timer_init(cpu);
     }
 
-    if (cpu->cfg.pmu_mask) {
-        riscv_pmu_init(cpu, &local_err);
-        if (local_err != NULL) {
-            error_propagate(errp, local_err);
-            return false;
-        }
-
-        if (cpu->cfg.ext_sscofpmf) {
-            cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                          riscv_pmu_timer_cb, cpu);
-        }
-    }
-
     /* With H-Ext, VSSIP, VSTIP, VSEIP and SGEIP are hardwired to one. */
     if (riscv_has_ext(env, RVH)) {
         env->mideleg = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP | MIP_SGEIP;
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

The counter delegation/configuration extensions depend on the following
extensions.

1. Smcdeleg - To enable counter delegation from M to S
2. S[m|s]csrind - To enable indirect access CSRs

Add an implied rule so that these extensions are enabled by default
if the sscfg extension is enabled.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-10-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUImpliedExtsRule ZVKSG_IMPLIED = {
     },
 };
 
+static RISCVCPUImpliedExtsRule SSCFG_IMPLIED = {
+    .ext = CPU_CFG_OFFSET(ext_ssccfg),
+    .implied_multi_exts = {
+        CPU_CFG_OFFSET(ext_smcsrind), CPU_CFG_OFFSET(ext_sscsrind),
+        CPU_CFG_OFFSET(ext_smcdeleg),
+
+        RISCV_IMPLIED_EXTS_RULE_END
+    },
+};
+
 RISCVCPUImpliedExtsRule *riscv_misa_ext_implied_rules[] = {
     &RVA_IMPLIED, &RVD_IMPLIED, &RVF_IMPLIED,
     &RVM_IMPLIED, &RVV_IMPLIED, NULL
@@ -XXX,XX +XXX,XX @@ RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[] = {
     &ZVE64X_IMPLIED, &ZVFBFMIN_IMPLIED, &ZVFBFWMA_IMPLIED,
     &ZVFH_IMPLIED, &ZVFHMIN_IMPLIED, &ZVKN_IMPLIED,
     &ZVKNC_IMPLIED, &ZVKNG_IMPLIED, &ZVKNHB_IMPLIED,
-    &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED,
+    &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED, &SSCFG_IMPLIED,
     NULL
 };
 
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

Add configuration options so that they can be enabled/disabld from
qemu commandline.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250110-counter_delegation-v5-11-e83d797ae294@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     /* Defaults for standard extensions */
     MULTI_EXT_CFG_BOOL("sscofpmf", ext_sscofpmf, false),
     MULTI_EXT_CFG_BOOL("smcntrpmf", ext_smcntrpmf, false),
+    MULTI_EXT_CFG_BOOL("smcsrind", ext_smcsrind, false),
+    MULTI_EXT_CFG_BOOL("smcdeleg", ext_smcdeleg, false),
+    MULTI_EXT_CFG_BOOL("sscsrind", ext_sscsrind, false),
+    MULTI_EXT_CFG_BOOL("ssccfg", ext_ssccfg, false),
     MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true),
     MULTI_EXT_CFG_BOOL("zicfilp", ext_zicfilp, false),
     MULTI_EXT_CFG_BOOL("zicfiss", ext_zicfiss, false),
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

With the current implementation, if we had the following scenario:
- Set bit x in menvcfg
- Set bit x in henvcfg
- Clear bit x in menvcfg
then, the internal variable env->henvcfg would still contain bit x due
to both a wrong menvcfg mask used in write_henvcfg() as well as a
missing update of henvcfg upon menvcfg update.
This can lead to some wrong interpretation of the context. In order to
update henvcfg upon menvcfg writing, call write_henvcfg() after writing
menvcfg. Clearing henvcfg upon writing the new value is also needed in
write_henvcfg() as well as clearing henvcfg upper part when writing it
with write_henvcfgh().

From: Clément Léger <cleger@rivosinc.com>

Add ext_ssdbltrp in RISCVCPUConfig and implement MSTATUS.SDT,
{H|M}ENVCFG.DTE and modify the availability of MTVAL2 based on the
presence of the Ssdbltrp ISA extension.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-3-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  1 +
 target/riscv/cpu_bits.h   |  6 ++++
 target/riscv/cpu_cfg.h    |  1 +
 target/riscv/cpu_helper.c | 17 ++++++++++
 target/riscv/csr.c        | 71 ++++++++++++++++++++++++++++++++-------
 5 files changed, 84 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
 int riscv_env_mmu_index(CPURISCVState *env, bool ifetch);
 bool cpu_get_fcfien(CPURISCVState *env);
 bool cpu_get_bcfien(CPURISCVState *env);
+bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt);
 G_NORETURN void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
                                                MMUAccessType access_type,
                                                int mmu_idx, uintptr_t retaddr);
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define MSTATUS_TW          0x00200000 /* since: priv-1.10 */
 #define MSTATUS_TSR         0x00400000 /* since: priv-1.10 */
 #define MSTATUS_SPELP       0x00800000 /* zicfilp */
+#define MSTATUS_SDT         0x01000000
 #define MSTATUS_MPELP       0x020000000000 /* zicfilp */
 #define MSTATUS_GVA         0x4000000000ULL
 #define MSTATUS_MPV         0x8000000000ULL
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define SSTATUS_SUM         0x00040000 /* since: priv-1.10 */
 #define SSTATUS_MXR         0x00080000
 #define SSTATUS_SPELP       MSTATUS_SPELP   /* zicfilp */
+#define SSTATUS_SDT         MSTATUS_SDT
 
 #define SSTATUS64_UXL       0x0000000300000000ULL
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
 #define MENVCFG_PMM                        (3ULL << 32)
+#define MENVCFG_DTE                        (1ULL << 59)
 #define MENVCFG_CDE                        (1ULL << 60)
 #define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
 
 /* For RV32 */
+#define MENVCFGH_DTE                       BIT(27)
 #define MENVCFGH_ADUE                      BIT(29)
 #define MENVCFGH_PBMTE                     BIT(30)
 #define MENVCFGH_STCE                      BIT(31)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
 #define HENVCFG_PMM                        MENVCFG_PMM
+#define HENVCFG_DTE                        MENVCFG_DTE
 #define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
 
 /* For RV32 */
+#define HENVCFGH_DTE                        MENVCFGH_DTE
 #define HENVCFGH_ADUE                       MENVCFGH_ADUE
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smcntrpmf;
     bool ext_smcsrind;
     bool ext_sscsrind;
+    bool ext_ssdbltrp;
     bool ext_svadu;
     bool ext_svinval;
     bool ext_svnapot;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool cpu_get_bcfien(CPURISCVState *env)
     }
 }
 
+bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt)
+{
+#ifdef CONFIG_USER_ONLY
+    return false;
+#else
+    if (virt) {
+        return (env->henvcfg & HENVCFG_DTE) != 0;
+    } else {
+        return (env->menvcfg & MENVCFG_DTE) != 0;
+    }
+#endif
+}
+
 void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *pflags)
 {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
 
     g_assert(riscv_has_ext(env, RVH));
 
+    if (riscv_env_smode_dbltrp_enabled(env, current_virt)) {
+        mstatus_mask |= MSTATUS_SDT;
+    }
+
     if (current_virt) {
         /* Current V=1 and we are about to change to V=0 */
         env->vsstatus = env->mstatus & mstatus_mask;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_hmode32(CPURISCVState *env, int csrno)
     return hmode32(env, csrno);
 }
 
+static RISCVException dbltrp_hmode(CPURISCVState *env, int csrno)
+{
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return hmode(env, csrno);
+}
+
 static RISCVException pmp(CPURISCVState *env, int csrno)
 {
     if (riscv_cpu_cfg(env)->pmp) {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         mask |= MSTATUS_VS;
     }
 
+    if (riscv_env_smode_dbltrp_enabled(env, env->virt_enabled)) {
+        mask |= MSTATUS_SDT;
+        if ((val & MSTATUS_SDT) != 0) {
+            val &= ~MSTATUS_SIE;
+        }
+    }
+
     if (xl != MXL_RV32 || env->debugger) {
         if (riscv_has_ext(env, RVH)) {
             mask |= MSTATUS_MPV | MSTATUS_GVA;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
                 (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
-                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
+                (cfg->ext_svadu ? MENVCFG_ADUE : 0) |
+                (cfg->ext_ssdbltrp ? MENVCFG_DTE : 0);
 
         if (env_archcpu(env)->cfg.ext_zicfilp) {
             mask |= MENVCFG_LPE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
         if (env_archcpu(env)->cfg.ext_smnpm &&
             get_field(val, MENVCFG_PMM) != PMM_FIELD_RESERVED) {
             mask |= MENVCFG_PMM;
+	}
+
+        if ((val & MENVCFG_DTE) == 0) {
+            env->mstatus &= ~MSTATUS_SDT;
         }
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
                     (cfg->ext_svadu ? MENVCFG_ADUE : 0) |
-                    (cfg->ext_smcdeleg ? MENVCFG_CDE : 0);
+                    (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
+                    (cfg->ext_ssdbltrp ? MENVCFG_DTE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
+    if ((valh & MENVCFG_DTE) == 0) {
+        env->mstatus &= ~MSTATUS_SDT;
+    }
+
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
     write_henvcfgh(env, CSR_HENVCFGH, env->henvcfg >> 32);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
      * henvcfg.pbmte is read_only 0 when menvcfg.pbmte = 0
      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
      * henvcfg.adue is read_only 0 when menvcfg.adue = 0
+     * henvcfg.dte is read_only 0 when menvcfg.dte = 0
      */
-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-                           env->menvcfg);
+    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
+                             HENVCFG_DTE) | env->menvcfg);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
+        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
+                                HENVCFG_DTE);
 
         if (env_archcpu(env)->cfg.ext_zicfilp) {
             mask |= HENVCFG_LPE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     env->henvcfg = val & mask;
+    if ((env->henvcfg & HENVCFG_DTE) == 0) {
+        env->vsstatus &= ~MSTATUS_SDT;
+    }
 
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-                            env->menvcfg)) >> 32;
+    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
+                              HENVCFG_DTE) | env->menvcfg)) >> 32;
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-                                    HENVCFG_ADUE);
+                                    HENVCFG_ADUE | HENVCFG_DTE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
-
     env->henvcfg = (env->henvcfg & 0xFFFFFFFF) | (valh & mask);
+    if ((env->henvcfg & HENVCFG_DTE) == 0) {
+        env->vsstatus &= ~MSTATUS_SDT;
+    }
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
     if (env->xl != MXL_RV32 || env->debugger) {
         mask |= SSTATUS64_UXL;
     }
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        mask |= SSTATUS_SDT;
+    }
 
     if (env_archcpu(env)->cfg.ext_zicfilp) {
         mask |= SSTATUS_SPELP;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
     if (env_archcpu(env)->cfg.ext_zicfilp) {
         mask |= SSTATUS_SPELP;
     }
-
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        mask |= SSTATUS_SDT;
+    }
     /* TODO: Use SXL not MXL. */
     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
     if (env_archcpu(env)->cfg.ext_zicfilp) {
         mask |= SSTATUS_SPELP;
     }
-
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        mask |= SSTATUS_SDT;
+    }
     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
     return write_mstatus(env, CSR_MSTATUS, newval);
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
     if ((val & VSSTATUS64_UXL) == 0) {
         mask &= ~VSSTATUS64_UXL;
     }
+    if ((env->henvcfg & HENVCFG_DTE)) {
+        if ((val & SSTATUS_SDT) != 0) {
+            val &= ~SSTATUS_SIE;
+        }
+    } else {
+        val &= ~SSTATUS_SDT;
+    }
     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
 
-    [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
+    [CSR_MTVAL2]      = { "mtval2", dbltrp_hmode, read_mtval2, write_mtval2,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

When the Ssdbltrp extension is enabled, SSTATUS.SDT field is cleared
when executing sret. When executing mret/mnret, SSTATUS.SDT is cleared
when returning to U, VS or VU and VSSTATUS.SDT is cleared when returning
to VU from HS.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-4-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
                         get_field(mstatus, MSTATUS_SPIE));
     mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
     mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
+
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        if (riscv_has_ext(env, RVH)) {
+            target_ulong prev_vu = get_field(env->hstatus, HSTATUS_SPV) &&
+                                   prev_priv == PRV_U;
+            /* Returning to VU from HS, vsstatus.sdt = 0 */
+            if (!env->virt_enabled && prev_vu) {
+                env->vsstatus = set_field(env->vsstatus, MSTATUS_SDT, 0);
+            }
+        }
+        mstatus = set_field(mstatus, MSTATUS_SDT, 0);
+    }
     if (env->priv_ver >= PRIV_VERSION_1_12_0) {
         mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
     }
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
         target_ulong hstatus = env->hstatus;
 
         prev_virt = get_field(hstatus, HSTATUS_SPV);
-
         hstatus = set_field(hstatus, HSTATUS_SPV, 0);
 
         env->hstatus = hstatus;
@@ -XXX,XX +XXX,XX @@ static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
 }
+static target_ulong ssdbltrp_mxret(CPURISCVState *env, target_ulong mstatus,
+                                   target_ulong prev_priv,
+                                   target_ulong prev_virt)
+{
+    /* If returning to U, VS or VU, sstatus.sdt = 0 */
+    if (prev_priv == PRV_U || (prev_virt &&
+        (prev_priv == PRV_S || prev_priv == PRV_U))) {
+        mstatus = set_field(mstatus, MSTATUS_SDT, 0);
+        /* If returning to VU, vsstatus.sdt = 0 */
+        if (prev_virt && prev_priv == PRV_U) {
+            env->vsstatus = set_field(env->vsstatus, MSTATUS_SDT, 0);
+        }
+    }
+
+    return mstatus;
+}
 
 target_ulong helper_mret(CPURISCVState *env)
 {
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
     mstatus = set_field(mstatus, MSTATUS_MPP,
                         riscv_has_ext(env, RVU) ? PRV_U : PRV_M);
     mstatus = set_field(mstatus, MSTATUS_MPV, 0);
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        mstatus = ssdbltrp_mxret(env, mstatus, prev_priv, prev_virt);
+    }
     if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) {
         mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
     }
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
     if (prev_priv < PRV_M) {
         env->mstatus = set_field(env->mstatus, MSTATUS_MPRV, false);
     }
+    if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
+        env->mstatus = ssdbltrp_mxret(env, env->mstatus, prev_priv, prev_virt);
+    }
 
     if (riscv_has_ext(env, RVH) && prev_virt) {
         riscv_cpu_swap_hypervisor_regs(env);
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

When the Ssdbltrp ISA extension is enabled, if a trap happens in S-mode
while SSTATUS.SDT isn't cleared, generate a double trap exception to
M-mode.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-5-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  1 +
 target/riscv/cpu.c        |  2 +-
 target/riscv/cpu_helper.c | 42 ++++++++++++++++++++++++++++++++++-----
 3 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
+    RISCV_EXCP_DOUBLE_TRAP = 0x10,
     RISCV_EXCP_SW_CHECK = 0x12, /* since: priv-1.13.0 */
     RISCV_EXCP_HW_ERR = 0x13, /* since: priv-1.13.0 */
     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char * const riscv_excp_names[] = {
     "load_page_fault",
     "reserved",
     "store_page_fault",
-    "reserved",
+    "double_trap",
     "reserved",
     "reserved",
     "reserved",
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     bool virt = env->virt_enabled;
     bool write_gva = false;
     bool always_storeamo = (env->excp_uw2 & RISCV_UW2_ALWAYS_STORE_AMO);
+    bool vsmode_exc;
     uint64_t s;
     int mode;
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         !(env->mip & (1ULL << cause));
     bool vs_injected = env->hvip & (1ULL << cause) & env->hvien &&
         !(env->mip & (1ULL << cause));
+    bool smode_double_trap = false;
+    uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
     target_ulong tval = 0;
     target_ulong tinst = 0;
     target_ulong htval = 0;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     mode = env->priv <= PRV_S && cause < 64 &&
         (((deleg >> cause) & 1) || s_injected || vs_injected) ? PRV_S : PRV_M;
 
+    vsmode_exc = env->virt_enabled && (((hdeleg >> cause) & 1) || vs_injected);
+    /*
+     * Check double trap condition only if already in S-mode and targeting
+     * S-mode
+     */
+    if (cpu->cfg.ext_ssdbltrp && env->priv == PRV_S && mode == PRV_S) {
+        bool dte = (env->menvcfg & MENVCFG_DTE) != 0;
+        bool sdt = (env->mstatus & MSTATUS_SDT) != 0;
+        /* In VS or HS */
+        if (riscv_has_ext(env, RVH)) {
+            if (vsmode_exc) {
+                /* VS -> VS, use henvcfg instead of menvcfg*/
+                dte = (env->henvcfg & HENVCFG_DTE) != 0;
+            } else if (env->virt_enabled) {
+                /* VS -> HS, use mstatus_hs */
+                sdt = (env->mstatus_hs & MSTATUS_SDT) != 0;
+            }
+        }
+        smode_double_trap = dte && sdt;
+        if (smode_double_trap) {
+            mode = PRV_M;
+        }
+    }
+
     if (mode == PRV_S) {
         /* handle the trap in S-mode */
         /* save elp status */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         }
 
         if (riscv_has_ext(env, RVH)) {
-            uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
-
-            if (env->virt_enabled &&
-                (((hdeleg >> cause) & 1) || vs_injected)) {
+            if (vsmode_exc) {
                 /* Trap to VS mode */
                 /*
                  * See if we need to adjust cause. Yes if its VS mode interrupt
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         s = set_field(s, MSTATUS_SPIE, get_field(s, MSTATUS_SIE));
         s = set_field(s, MSTATUS_SPP, env->priv);
         s = set_field(s, MSTATUS_SIE, 0);
+        if (riscv_env_smode_dbltrp_enabled(env, virt)) {
+            s = set_field(s, MSTATUS_SDT, 1);
+        }
         env->mstatus = s;
         sxlen = 16 << riscv_cpu_sxl(env);
         env->scause = cause | ((target_ulong)async << (sxlen - 1));
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         s = set_field(s, MSTATUS_MIE, 0);
         env->mstatus = s;
         env->mcause = cause | ((target_ulong)async << (mxlen - 1));
+        if (smode_double_trap) {
+            env->mtval2 = env->mcause;
+            env->mcause = RISCV_EXCP_DOUBLE_TRAP;
+        } else {
+            env->mtval2 = mtval2;
+        }
         env->mepc = env->pc;
         env->mtval = tval;
-        env->mtval2 = mtval2;
         env->mtinst = tinst;
 
         /*
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

Add the switch to enable the Ssdbltrp ISA extension.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-6-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

From: Clément Léger <cleger@rivosinc.com>

Add `ext_smdbltrp`in RISCVCPUConfig and implement MSTATUS.MDT behavior.
Also set MDT to 1 at reset according to the specification.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-7-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h |  1 +
 target/riscv/cpu_cfg.h  |  1 +
 target/riscv/cpu.c      |  3 +++
 target/riscv/csr.c      | 13 +++++++++++++
 4 files changed, 18 insertions(+)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define MSTATUS_MPELP       0x020000000000 /* zicfilp */
 #define MSTATUS_GVA         0x4000000000ULL
 #define MSTATUS_MPV         0x8000000000ULL
+#define MSTATUS_MDT         0x40000000000ULL /* Smdbltrp extension */
 
 #define MSTATUS64_UXL       0x0000000300000000ULL
 #define MSTATUS64_SXL       0x0000000C00000000ULL
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smcsrind;
     bool ext_sscsrind;
     bool ext_ssdbltrp;
+    bool ext_smdbltrp;
     bool ext_svadu;
     bool ext_svinval;
     bool ext_svnapot;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
             env->mstatus_hs = set_field(env->mstatus_hs,
                                         MSTATUS64_UXL, env->misa_mxl);
         }
+        if (riscv_cpu_cfg(env)->ext_smdbltrp) {
+            env->mstatus = set_field(env->mstatus, MSTATUS_MDT, 1);
+        }
     }
     env->mcause = 0;
     env->miclaim = MIP_SGEIP;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         }
     }
 
+    if (riscv_cpu_cfg(env)->ext_smdbltrp) {
+        mask |= MSTATUS_MDT;
+        if ((val & MSTATUS_MDT) != 0) {
+            val &= ~MSTATUS_MIE;
+        }
+    }
+
     if (xl != MXL_RV32 || env->debugger) {
         if (riscv_has_ext(env, RVH)) {
             mask |= MSTATUS_MPV | MSTATUS_GVA;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
     uint64_t valh = (uint64_t)val << 32;
     uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
 
+    if (riscv_cpu_cfg(env)->ext_smdbltrp) {
+        mask |= MSTATUS_MDT;
+        if ((valh & MSTATUS_MDT) != 0) {
+            mask |= MSTATUS_MIE;
+        }
+    }
     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 
     return RISCV_EXCP_NONE;
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

When the Ssdbltrp extension is enabled, SSTATUS.MDT field is cleared
when executing sret if executed in M-mode. When executing mret/mnret,
SSTATUS.MDT is cleared.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-8-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

From: Clément Léger <cleger@rivosinc.com>

When the Smsdbltrp ISA extension is enabled, if a trap happens while
MSTATUS.MDT is already set, it will trigger an abort or an NMI is the
Smrnmi extension is available.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250110125441.3208676-9-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 57 ++++++++++++++++++++++++++++-----------
 1 file changed, 41 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static target_ulong promote_load_fault(target_ulong orig_cause)
     /* if no promotion, return original cause */
     return orig_cause;
 }
+
+static void riscv_do_nmi(CPURISCVState *env, target_ulong cause, bool virt)
+{
+    env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
+    env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV, virt);
+    env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPP, env->priv);
+    env->mncause = cause;
+    env->mnepc = env->pc;
+    env->pc = env->rnmi_irqvec;
+
+    if (cpu_get_fcfien(env)) {
+        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, env->elp);
+    }
+
+    /* Trapping to M mode, virt is disabled */
+    riscv_cpu_set_mode(env, PRV_M, false);
+}
+
 /*
  * Handle Traps
  *
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     bool nnmi_excep = false;
 
     if (cpu->cfg.ext_smrnmi && env->rnmip && async) {
-        env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
-        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV,
-                                  env->virt_enabled);
-        env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPP,
-                                  env->priv);
-        env->mncause = cause | ((target_ulong)1U << (mxlen - 1));
-        env->mnepc = env->pc;
-        env->pc = env->rnmi_irqvec;
-
-        if (cpu_get_fcfien(env)) {
-            env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPELP, env->elp);
-        }
-
-        /* Trapping to M mode, virt is disabled */
-        riscv_cpu_set_mode(env, PRV_M, false);
-
+        riscv_do_nmi(env, cause | ((target_ulong)1U << (mxlen - 1)),
+                     env->virt_enabled);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
             /* Trapping to M mode, virt is disabled */
             virt = false;
         }
+        /*
+         * If the hart encounters an exception while executing in M-mode,
+         * with the mnstatus.NMIE bit clear, the program counter is set to
+         * the RNMI exception trap handler address.
+         */
+        nnmi_excep = cpu->cfg.ext_smrnmi &&
+                     !get_field(env->mnstatus, MNSTATUS_NMIE) &&
+                     !async;
 
         s = env->mstatus;
         s = set_field(s, MSTATUS_MPIE, get_field(s, MSTATUS_MIE));
         s = set_field(s, MSTATUS_MPP, env->priv);
         s = set_field(s, MSTATUS_MIE, 0);
+        if (cpu->cfg.ext_smdbltrp) {
+            if (env->mstatus & MSTATUS_MDT) {
+                assert(env->priv == PRV_M);
+                if (!cpu->cfg.ext_smrnmi || nnmi_excep) {
+                    cpu_abort(CPU(cpu), "M-mode double trap\n");
+                } else {
+                    riscv_do_nmi(env, cause, false);
+                    return;
+                }
+            }
+
+            s = set_field(s, MSTATUS_MDT, 1);
+        }
         env->mstatus = s;
         env->mcause = cause | ((target_ulong)async << (mxlen - 1));
         if (smode_double_trap) {
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

Add the switch to enable the Smdbltrp ISA extension and disable it for
the max cpu. Indeed, OpenSBI when Smdbltrp is present, M-mode double
trap is enabled by default and MSTATUS.MDT needs to be cleared to avoid
taking a double trap. OpenSBI does not currently support it so disable
it for the max cpu to avoid breaking regression tests.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250116131539.2475785-1-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         |  2 ++
 target/riscv/tcg/tcg-cpu.c | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(smcdeleg, PRIV_VERSION_1_13_0, ext_smcdeleg),
     ISA_EXT_DATA_ENTRY(smcntrpmf, PRIV_VERSION_1_12_0, ext_smcntrpmf),
     ISA_EXT_DATA_ENTRY(smcsrind, PRIV_VERSION_1_13_0, ext_smcsrind),
+    ISA_EXT_DATA_ENTRY(smdbltrp, PRIV_VERSION_1_13_0, ext_smdbltrp),
     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
     ISA_EXT_DATA_ENTRY(smrnmi, PRIV_VERSION_1_12_0, ext_smrnmi),
     ISA_EXT_DATA_ENTRY(smmpm, PRIV_VERSION_1_13_0, ext_smmpm),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("ssnpm", ext_ssnpm, false),
 
     MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
+    MULTI_EXT_CFG_BOOL("smdbltrp", ext_smdbltrp, false),
     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
     MULTI_EXT_CFG_BOOL("smrnmi", ext_smrnmi, false),
     MULTI_EXT_CFG_BOOL("smmpm", ext_smmpm, false),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smrnmi), false);
         qemu_log("Smrnmi is disabled in the 'max' type CPU\n");
     }
+
+    /*
+     * ext_smdbltrp requires the firmware to clear MSTATUS.MDT on startup to
+     * avoid generating a double trap. OpenSBI does not currently support it,
+     * disable it for now.
+     */
+    if (cpu->cfg.ext_smdbltrp) {
+        isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smdbltrp), false);
+        qemu_log("Smdbltrp is disabled in the 'max' type CPU\n");
+    }
 }
 
 static bool riscv_cpu_has_max_extensions(Object *cpu_obj)
-- 
2.48.1

From: Jason Chien <jason.chien@sifive.com>

This commit introduces a translation tag to avoid invalidating an entry
that should not be invalidated when IOMMU executes invalidation commands.
E.g. IOTINVAL.VMA with GV=0, AV=0, PSCV=1 invalidates both a mapping
of single stage translation and a mapping of nested translation with
the same PSCID, but only the former one should be invalidated.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241108110147.11178-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.c | 205 ++++++++++++++++++++++++++++++-----------
 1 file changed, 153 insertions(+), 52 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUContext {
     uint64_t msiptp;            /* MSI redirection page table pointer */
 };
 
+typedef enum RISCVIOMMUTransTag {
+    RISCV_IOMMU_TRANS_TAG_BY,  /* Bypass */
+    RISCV_IOMMU_TRANS_TAG_SS,  /* Single Stage */
+    RISCV_IOMMU_TRANS_TAG_VG,  /* G-stage only */
+    RISCV_IOMMU_TRANS_TAG_VN,  /* Nested translation */
+} RISCVIOMMUTransTag;
+
 /* Address translation cache entry */
 struct RISCVIOMMUEntry {
+    RISCVIOMMUTransTag tag;     /* Translation Tag */
     uint64_t iova:44;           /* IOVA Page Number */
     uint64_t pscid:20;          /* Process Soft-Context identifier */
     uint64_t phys:44;           /* Physical Page Number */
@@ -XXX,XX +XXX,XX @@ static gboolean riscv_iommu_iot_equal(gconstpointer v1, gconstpointer v2)
     RISCVIOMMUEntry *t1 = (RISCVIOMMUEntry *) v1;
     RISCVIOMMUEntry *t2 = (RISCVIOMMUEntry *) v2;
     return t1->gscid == t2->gscid && t1->pscid == t2->pscid &&
-           t1->iova == t2->iova;
+           t1->iova == t2->iova && t1->tag == t2->tag;
 }
 
 static guint riscv_iommu_iot_hash(gconstpointer v)
@@ -XXX,XX +XXX,XX @@ static guint riscv_iommu_iot_hash(gconstpointer v)
     return (guint)t->iova;
 }
 
-/* GV: 1 PSCV: 1 AV: 1 */
+/* GV: 0 AV: 0 PSCV: 0 GVMA: 0 */
+/* GV: 0 AV: 0 GVMA: 1 */
+static
+void riscv_iommu_iot_inval_all(gpointer key, gpointer value, gpointer data)
+{
+    RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
+    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
+    if (iot->tag == arg->tag) {
+        iot->perm = IOMMU_NONE;
+    }
+}
+
+/* GV: 0 AV: 0 PSCV: 1 GVMA: 0 */
+static
+void riscv_iommu_iot_inval_pscid(gpointer key, gpointer value, gpointer data)
+{
+    RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
+    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
+    if (iot->tag == arg->tag &&
+        iot->pscid == arg->pscid) {
+        iot->perm = IOMMU_NONE;
+    }
+}
+
+/* GV: 0 AV: 1 PSCV: 0 GVMA: 0 */
+static
+void riscv_iommu_iot_inval_iova(gpointer key, gpointer value, gpointer data)
+{
+    RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
+    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
+    if (iot->tag == arg->tag &&
+        iot->iova == arg->iova) {
+        iot->perm = IOMMU_NONE;
+    }
+}
+
+/* GV: 0 AV: 1 PSCV: 1 GVMA: 0 */
 static void riscv_iommu_iot_inval_pscid_iova(gpointer key, gpointer value,
                                              gpointer data)
 {
     RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
     RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
-    if (iot->gscid == arg->gscid &&
+    if (iot->tag == arg->tag &&
         iot->pscid == arg->pscid &&
         iot->iova == arg->iova) {
         iot->perm = IOMMU_NONE;
     }
 }
 
-/* GV: 1 PSCV: 1 AV: 0 */
-static void riscv_iommu_iot_inval_pscid(gpointer key, gpointer value,
-                                        gpointer data)
+/* GV: 1 AV: 0 PSCV: 0 GVMA: 0 */
+/* GV: 1 AV: 0 GVMA: 1 */
+static
+void riscv_iommu_iot_inval_gscid(gpointer key, gpointer value, gpointer data)
 {
     RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
     RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
-    if (iot->gscid == arg->gscid &&
-        iot->pscid == arg->pscid) {
+    if (iot->tag == arg->tag &&
+        iot->gscid == arg->gscid) {
         iot->perm = IOMMU_NONE;
     }
 }
 
-/* GV: 1 GVMA: 1 */
-static void riscv_iommu_iot_inval_gscid_gpa(gpointer key, gpointer value,
-                                            gpointer data)
+/* GV: 1 AV: 0 PSCV: 1 GVMA: 0 */
+static void riscv_iommu_iot_inval_gscid_pscid(gpointer key, gpointer value,
+                                              gpointer data)
 {
     RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
     RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
-    if (iot->gscid == arg->gscid) {
-        /* simplified cache, no GPA matching */
+    if (iot->tag == arg->tag &&
+        iot->gscid == arg->gscid &&
+        iot->pscid == arg->pscid) {
         iot->perm = IOMMU_NONE;
     }
 }
 
-/* GV: 1 GVMA: 0 */
-static void riscv_iommu_iot_inval_gscid(gpointer key, gpointer value,
-                                        gpointer data)
+/* GV: 1 AV: 1 PSCV: 0 GVMA: 0 */
+/* GV: 1 AV: 1 GVMA: 1 */
+static void riscv_iommu_iot_inval_gscid_iova(gpointer key, gpointer value,
+                                             gpointer data)
 {
     RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
     RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
-    if (iot->gscid == arg->gscid) {
+    if (iot->tag == arg->tag &&
+        iot->gscid == arg->gscid &&
+        iot->iova == arg->iova) {
         iot->perm = IOMMU_NONE;
     }
 }
 
-/* GV: 0 */
-static void riscv_iommu_iot_inval_all(gpointer key, gpointer value,
-                                      gpointer data)
+/* GV: 1 AV: 1 PSCV: 1 GVMA: 0 */
+static void riscv_iommu_iot_inval_gscid_pscid_iova(gpointer key, gpointer value,
+                                                   gpointer data)
 {
     RISCVIOMMUEntry *iot = (RISCVIOMMUEntry *) value;
-    iot->perm = IOMMU_NONE;
+    RISCVIOMMUEntry *arg = (RISCVIOMMUEntry *) data;
+    if (iot->tag == arg->tag &&
+        iot->gscid == arg->gscid &&
+        iot->pscid == arg->pscid &&
+        iot->iova == arg->iova) {
+        iot->perm = IOMMU_NONE;
+    }
 }
 
 /* caller should keep ref-count for iot_cache object */
 static RISCVIOMMUEntry *riscv_iommu_iot_lookup(RISCVIOMMUContext *ctx,
-    GHashTable *iot_cache, hwaddr iova)
+    GHashTable *iot_cache, hwaddr iova, RISCVIOMMUTransTag transtag)
 {
     RISCVIOMMUEntry key = {
+        .tag   = transtag,
         .gscid = get_field(ctx->gatp, RISCV_IOMMU_DC_IOHGATP_GSCID),
         .pscid = get_field(ctx->ta, RISCV_IOMMU_DC_TA_PSCID),
         .iova  = PPN_DOWN(iova),
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_iot_update(RISCVIOMMUState *s,
 }
 
 static void riscv_iommu_iot_inval(RISCVIOMMUState *s, GHFunc func,
-    uint32_t gscid, uint32_t pscid, hwaddr iova)
+    uint32_t gscid, uint32_t pscid, hwaddr iova, RISCVIOMMUTransTag transtag)
 {
     GHashTable *iot_cache;
     RISCVIOMMUEntry key = {
+        .tag = transtag,
         .gscid = gscid,
         .pscid = pscid,
         .iova  = PPN_DOWN(iova),
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_iot_inval(RISCVIOMMUState *s, GHFunc func,
     g_hash_table_unref(iot_cache);
 }
 
+static RISCVIOMMUTransTag riscv_iommu_get_transtag(RISCVIOMMUContext *ctx)
+{
+    uint64_t satp = get_field(ctx->satp, RISCV_IOMMU_ATP_MODE_FIELD);
+    uint64_t gatp = get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD);
+
+    if (satp == RISCV_IOMMU_DC_FSC_MODE_BARE) {
+        return (gatp == RISCV_IOMMU_DC_IOHGATP_MODE_BARE) ?
+            RISCV_IOMMU_TRANS_TAG_BY : RISCV_IOMMU_TRANS_TAG_VG;
+    } else {
+        return (gatp == RISCV_IOMMU_DC_IOHGATP_MODE_BARE) ?
+            RISCV_IOMMU_TRANS_TAG_SS : RISCV_IOMMU_TRANS_TAG_VN;
+    }
+}
+
 static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
     IOMMUTLBEntry *iotlb, bool enable_cache)
 {
+    RISCVIOMMUTransTag transtag = riscv_iommu_get_transtag(ctx);
     RISCVIOMMUEntry *iot;
     IOMMUAccessFlags perm;
     bool enable_pid;
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
         }
     }
 
-    iot = riscv_iommu_iot_lookup(ctx, iot_cache, iotlb->iova);
+    iot = riscv_iommu_iot_lookup(ctx, iot_cache, iotlb->iova, transtag);
     perm = iot ? iot->perm : IOMMU_NONE;
     if (perm != IOMMU_NONE) {
         iotlb->translated_addr = PPN_PHYS(iot->phys);
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
         iot->gscid = get_field(ctx->gatp, RISCV_IOMMU_DC_IOHGATP_GSCID);
         iot->pscid = get_field(ctx->ta, RISCV_IOMMU_DC_TA_PSCID);
         iot->perm = iotlb->perm;
+        iot->tag = transtag;
         riscv_iommu_iot_update(s, iot_cache, iot);
     }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_process_cq_tail(RISCVIOMMUState *s)
 
         case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IOTINVAL_FUNC_GVMA,
                              RISCV_IOMMU_CMD_IOTINVAL_OPCODE):
-            if (cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV) {
+        {
+            bool gv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV);
+            bool av = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV);
+            bool pscv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV);
+            uint32_t gscid = get_field(cmd.dword0,
+                                       RISCV_IOMMU_CMD_IOTINVAL_GSCID);
+            uint32_t pscid = get_field(cmd.dword0,
+                                       RISCV_IOMMU_CMD_IOTINVAL_PSCID);
+            hwaddr iova = (cmd.dword1 << 2) & TARGET_PAGE_MASK;
+
+            if (pscv) {
                 /* illegal command arguments IOTINVAL.GVMA & PSCV == 1 */
                 goto cmd_ill;
-            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV)) {
-                /* invalidate all cache mappings */
-                func = riscv_iommu_iot_inval_all;
-            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV)) {
-                /* invalidate cache matching GSCID */
-                func = riscv_iommu_iot_inval_gscid;
-            } else {
-                /* invalidate cache matching GSCID and ADDR (GPA) */
-                func = riscv_iommu_iot_inval_gscid_gpa;
             }
-            riscv_iommu_iot_inval(s, func,
-                get_field(cmd.dword0, RISCV_IOMMU_CMD_IOTINVAL_GSCID), 0,
-                cmd.dword1 << 2 & TARGET_PAGE_MASK);
+
+            func = riscv_iommu_iot_inval_all;
+
+            if (gv) {
+                func = (av) ? riscv_iommu_iot_inval_gscid_iova :
+                              riscv_iommu_iot_inval_gscid;
+            }
+
+            riscv_iommu_iot_inval(
+                s, func, gscid, pscid, iova, RISCV_IOMMU_TRANS_TAG_VG);
+
+            riscv_iommu_iot_inval(
+                s, func, gscid, pscid, iova, RISCV_IOMMU_TRANS_TAG_VN);
             break;
+        }
 
         case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IOTINVAL_FUNC_VMA,
                              RISCV_IOMMU_CMD_IOTINVAL_OPCODE):
-            if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV)) {
-                /* invalidate all cache mappings, simplified model */
-                func = riscv_iommu_iot_inval_all;
-            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV)) {
-                /* invalidate cache matching GSCID, simplified model */
-                func = riscv_iommu_iot_inval_gscid;
-            } else if (!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV)) {
-                /* invalidate cache matching GSCID and PSCID */
-                func = riscv_iommu_iot_inval_pscid;
+        {
+            bool gv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_GV);
+            bool av = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_AV);
+            bool pscv = !!(cmd.dword0 & RISCV_IOMMU_CMD_IOTINVAL_PSCV);
+            uint32_t gscid = get_field(cmd.dword0,
+                                       RISCV_IOMMU_CMD_IOTINVAL_GSCID);
+            uint32_t pscid = get_field(cmd.dword0,
+                                       RISCV_IOMMU_CMD_IOTINVAL_PSCID);
+            hwaddr iova = (cmd.dword1 << 2) & TARGET_PAGE_MASK;
+            RISCVIOMMUTransTag transtag;
+
+            if (gv) {
+                transtag = RISCV_IOMMU_TRANS_TAG_VN;
+                if (pscv) {
+                    func = (av) ? riscv_iommu_iot_inval_gscid_pscid_iova :
+                                  riscv_iommu_iot_inval_gscid_pscid;
+                } else {
+                    func = (av) ? riscv_iommu_iot_inval_gscid_iova :
+                                  riscv_iommu_iot_inval_gscid;
+                }
             } else {
-                /* invalidate cache matching GSCID and PSCID and ADDR (IOVA) */
-                func = riscv_iommu_iot_inval_pscid_iova;
+                transtag = RISCV_IOMMU_TRANS_TAG_SS;
+                if (pscv) {
+                    func = (av) ? riscv_iommu_iot_inval_pscid_iova :
+                                  riscv_iommu_iot_inval_pscid;
+                } else {
+                    func = (av) ? riscv_iommu_iot_inval_iova :
+                                  riscv_iommu_iot_inval_all;
+                }
             }
-            riscv_iommu_iot_inval(s, func,
-                get_field(cmd.dword0, RISCV_IOMMU_CMD_IOTINVAL_GSCID),
-                get_field(cmd.dword0, RISCV_IOMMU_CMD_IOTINVAL_PSCID),
-                cmd.dword1 << 2 & TARGET_PAGE_MASK);
+
+            riscv_iommu_iot_inval(s, func, gscid, pscid, iova, transtag);
             break;
+        }
 
         case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IODIR_FUNC_INVAL_DDT,
                              RISCV_IOMMU_CMD_IODIR_OPCODE):
-- 
2.48.1

From: Alexey Baturo <baturo.alexey@gmail.com>

The Zjpm v1.0 spec states there should be Supm and Sspm extensions that
are used in profile specification. Enabling Supm extension enables both
Ssnpm and Smnpm, while Sspm enables only Smnpm.

Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250113194410.1307494-1-baturo.alexey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h |  2 ++
 target/riscv/cpu.c     | 23 +++++++++++++++++++++++
 2 files changed, 25 insertions(+)

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250116223609.81594-1-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 15 +++------------
 hw/char/trace-events |  4 ++++
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/tswap.h"
 #include "system/dma.h"
 #include "system/runstate.h"
-
-#define RISCV_DEBUG_HTIF 0
-#define HTIF_DEBUG(fmt, ...)                                                   \
-    do {                                                                       \
-        if (RISCV_DEBUG_HTIF) {                                                \
-            qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\
-        }                                                                      \
-    } while (0)
+#include "trace.h"
 
 #define HTIF_DEV_SHIFT          56
 #define HTIF_CMD_SHIFT          48
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
     uint64_t payload = val_written & 0xFFFFFFFFFFFFULL;
     int resp = 0;
 
-    HTIF_DEBUG("mtohost write: device: %d cmd: %d what: %02" PRIx64
-        " -payload: %016" PRIx64 "\n", device, cmd, payload & 0xFF, payload);
+    trace_htif_uart_write_to_host(device, cmd, payload);
 
     /*
      * Currently, there is a fixed mapping of devices:
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
         }
     } else {
         qemu_log("HTIF unknown device or command\n");
-        HTIF_DEBUG("device: %d cmd: %d what: %02" PRIx64
-            " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload);
+        trace_htif_uart_unknown_device_command(device, cmd, payload);
     }
     /*
      * Latest bbl does not set fromhost to 0 if there is a value in tohost.
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ stm32f2xx_usart_read(char *id, unsigned size, uint64_t ofs, uint64_t val) " %s s
 stm32f2xx_usart_write(char *id, unsigned size, uint64_t ofs, uint64_t val) "%s size %d ofs 0x%02" PRIx64 " <- 0x%02" PRIx64
 stm32f2xx_usart_drop(char *id) " %s dropping the chars"
 stm32f2xx_usart_receive(char *id, uint8_t chr) " %s receiving '%c'"
+
+# riscv_htif.c
+htif_uart_write_to_host(uint8_t device, uint8_t cmd, uint64_t payload) "device: %u cmd: %02u payload: %016" PRIx64
+htif_uart_unknown_device_command(uint8_t device, uint8_t cmd, uint64_t payload) "device: %u cmd: %02u payload: %016" PRIx64
-- 
2.48.1