Series comparison

-[PULL 00/34] riscv-to-apply queue
+[PULL v2 00/45] riscv-to-apply queue
-The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
+The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:
-  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
+  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240308-1
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911
-for you to fetch changes up to 301876597112218c1e465ecc2b2fef6b27d5c27b:
+for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:
-  target/riscv: fix ACPI MCFG table (2024-03-08 21:00:37 +1000)
+  target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)
 ----------------------------------------------------------------
-RISC-V PR for 9.0
+First RISC-V PR for 8.2
-* Update $ra with current $pc in trans_cm_jalt
+ * Remove 'host' CPU from TCG
-* Enable SPCR for SCPI virt machine
+ * riscv_htif Fixup printing on big endian hosts
-* Allow large kernels to boot by moving the initrd further away in RAM
+ * Add zmmul isa string
-* Sync hwprobe keys with kernel
+ * Add smepmp isa string
-* Named features riscv,isa, 'svade' rework
+ * Fix page_check_range use in fault-only-first
-* FIX xATP_MODE validation
+ * Use existing lookup tables for MixColumns
-* Add missing include guard in pmu.h
+ * Add RISC-V vector cryptographic instruction set support
-* Add SRAT and SLIT ACPI tables
+ * Implement WARL behaviour for mcountinhibit/mcounteren
-* libqos fixes and add a riscv machine
+ * Add Zihintntl extension ISA string to DTS
-* Add Ztso extension
+ * Fix zfa fleq.d and fltq.d
-* Use 'zfa' instead of 'Zfa'
+ * Fix upper/lower mtime write calculation
-* Update KVM exts to Linux 6.8
+ * Make rtc variable names consistent
-* move ratified/frozen exts to non-experimental
+ * Use abi type for linux-user target_ucontext
-* Ensure mcountinhibit, mcounteren, scounteren, hcounteren are 32-bit
+ * Add RISC-V KVM AIA Support
-* mark_vs_dirty() before loads and stores
+ * Fix riscv,pmu DT node path in the virt machine
-* Remove 'is_store' bool from load/store fns
+ * Update CSR bits name for svadu extension
-* Fix shift count overflow
+ * Mark zicond non-experimental
-* Fix setipnum_le write emulation for APLIC MSI-mode
+ * Fix satp_mode_finalize() when satp_mode.supported = 0
-* Fix in_clrip[x] read emulation
+ * Fix non-KVM --enable-debug build
-* Fix privilege mode of G-stage translation for debugging
+ * Add new extensions to hwprobe
-* Fix ACPI MCFG table for virt machine
+ * Use accelerated helper for AES64KS1I
  * Allocate itrigger timers only once
  * Respect mseccfg.RLB for pmpaddrX changes
  * Align the AIA model to v1.0 ratified spec
  * Don't read the CSR in riscv_csrrw_do64
 ----------------------------------------------------------------
-Alexandre Ghiti (1):
+Akihiko Odaki (1):
-      hw: riscv: Allow large kernels to boot by moving the initrd further away in RAM
+      target/riscv: Allocate itrigger timers only once
-Andrew Jones (3):
+Ard Biesheuvel (2):
-      target/riscv: Reset henvcfg to zero
+      target/riscv: Use existing lookup tables for MixColumns
-      target/riscv: Gate hardware A/D PTE bit updating
+      target/riscv: Use accelerated helper for AES64KS1I
       target/riscv: Promote svade to a normal extension
-Anup Patel (2):
+Conor Dooley (1):
-      hw/intc/riscv_aplic: Fix setipnum_le write emulation for APLIC MSI-mode
+      hw/riscv: virt: Fix riscv,pmu DT node path
       hw/intc/riscv_aplic: Fix in_clrip[x] read emulation
-Christoph Müllner (4):
+Daniel Henrique Barboza (6):
-      linux-user/riscv: Add Zicboz extensions to hwprobe
+      target/riscv/cpu.c: do not run 'host' CPU with TCG
-      linux-user/riscv: Sync hwprobe keys with Linux
+      target/riscv/cpu.c: add zmmul isa string
-      linux-user/riscv: Add Ztso extension to hwprobe
+      target/riscv/cpu.c: add smepmp isa string
-      tests: riscv64: Use 'zfa' instead of 'Zfa'
+      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
       hw/riscv/virt.c: fix non-KVM --enable-debug build
       hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-Daniel Henrique Barboza (12):
+Dickon Hood (2):
-      target/riscv/tcg: set 'mmu' with 'satp' in cpu_set_profile()
+      target/riscv: Refactor translation of vector-widening instruction
-      target/riscv: add riscv,isa to named features
+      target/riscv: Add Zvbb ISA extension support
       target/riscv: add remaining named features
       hw/riscv/virt.c: create '/soc/pci@...' fdt node earlier
       hw/riscv/virt.c: add virtio-iommu-pci hotplug support
       hw/riscv/virt.c: make aclint compatible with 'qtest' accel
       tests/libqos: add riscv/virt machine nodes
       linux-headers: Update to Linux v6.8-rc6
       target/riscv/kvm: update KVM exts to Linux 6.8
       target/riscv: move ratified/frozen exts to non-experimental
       trans_rvv.c.inc: mark_vs_dirty() before loads and stores
       trans_rvv.c.inc: remove 'is_store' bool from load/store fns
-Frank Chang (1):
+Jason Chien (3):
-      target/riscv: Add missing include guard in pmu.h
+      target/riscv: Add Zihintntl extension ISA string to DTS
       hw/intc: Fix upper/lower mtime write calculation
       hw/intc: Make rtc variable names consistent
-Haibo Xu (1):
+Kiran Ostrolenk (4):
-      hw/riscv/virt-acpi-build.c: Add SRAT and SLIT ACPI tables
+      target/riscv: Refactor some of the generic vector functionality
       target/riscv: Refactor vector-vector translation macro
       target/riscv: Refactor some of the generic vector functionality
       target/riscv: Add Zvknh ISA extension support
-Hiroaki Yamamoto (1):
+LIU Zhiwei (3):
-      target/riscv: Fix privilege mode of G-stage translation for debugging
+      target/riscv: Fix page_check_range use in fault-only-first
       target/riscv: Fix zfa fleq.d and fltq.d
       linux-user/riscv: Use abi type for target_ucontext
-Ilya Chugin (1):
+Lawrence Hunter (2):
-      target/riscv: fix ACPI MCFG table
+      target/riscv: Add Zvbc ISA extension support
       target/riscv: Add Zvksh ISA extension support
-Irina Ryapolova (2):
+Leon Schuermann (1):
-      target/riscv: FIX xATP_MODE validation
+      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
       target/riscv: UPDATE xATP write CSR
-Jason Chien (1):
+Max Chou (3):
-      target/riscv: Update $ra with current $pc in trans_cm_jalt()
+      crypto: Create sm4_subword
       crypto: Add SM4 constant parameter CK
       target/riscv: Add Zvksed ISA extension support
-Palmer Dabbelt (1):
+Nazar Kazakov (4):
-      RISC-V: Add support for Ztso
+      target/riscv: Remove redundant "cpu_vl == 0" checks
       target/riscv: Move vector translation checks
       target/riscv: Add Zvkned ISA extension support
       target/riscv: Add Zvkg ISA extension support
-Sia Jee Heng (2):
+Nikita Shubin (1):
-      hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location
+      target/riscv: don't read CSR in riscv_csrrw_do64
       hw/riscv/virt-acpi-build.c: Generate SPCR table
-Vadim Shakirov (1):
+Rob Bradford (1):
-      target/riscv: mcountinhibit, mcounteren, scounteren, hcounteren is 32-bit
+      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
-demin.han (1):
+Robbin Ehn (1):
-      target/riscv: Fix shift count overflow
+      linux-user/riscv: Add new extensions to hwprobe
- include/hw/acpi/acpi-defs.h                    |  33 ++++++
+Thomas Huth (2):
- include/hw/acpi/aml-build.h                    |   4 +
+      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
- include/standard-headers/drm/drm_fourcc.h      |  10 +-
+      hw/char/riscv_htif: Fix the console syscall on big endian hosts
  include/standard-headers/linux/ethtool.h       |  41 +++++---
  include/standard-headers/linux/virtio_config.h |   8 +-
  include/standard-headers/linux/virtio_pci.h    |  68 ++++++++++++
  include/standard-headers/linux/virtio_pmem.h   |   7 ++
  linux-headers/asm-generic/unistd.h             |  15 ++-
  linux-headers/asm-mips/mman.h                  |   2 +-
  linux-headers/asm-mips/unistd_n32.h            |   5 +
  linux-headers/asm-mips/unistd_n64.h            |   5 +
  linux-headers/asm-mips/unistd_o32.h            |   5 +
  linux-headers/asm-powerpc/unistd_32.h          |   5 +
  linux-headers/asm-powerpc/unistd_64.h          |   5 +
  linux-headers/asm-riscv/kvm.h                  |  40 +++++++
  linux-headers/asm-s390/unistd_32.h             |   5 +
  linux-headers/asm-s390/unistd_64.h             |   5 +
  linux-headers/asm-x86/kvm.h                    |   3 +
  linux-headers/asm-x86/unistd_32.h              |   5 +
  linux-headers/asm-x86/unistd_64.h              |   5 +
  linux-headers/asm-x86/unistd_x32.h             |   5 +
  linux-headers/linux/iommufd.h                  |  79 ++++++++++++++
  linux-headers/linux/kvm.h                      | 140 +++++++++----------------
  linux-headers/linux/userfaultfd.h              |  29 ++++-
  linux-headers/linux/vfio.h                     |   1 +
  target/riscv/cpu.h                             |   8 +-
  target/riscv/cpu_cfg.h                         |  13 ++-
  target/riscv/pmu.h                             |   5 +
  hw/acpi/aml-build.c                            |  53 ++++++++++
  hw/arm/virt-acpi-build.c                       |  68 +++++-------
  hw/intc/riscv_aplic.c                          |  37 +++++--
  hw/riscv/boot.c                                |  12 +--
  hw/riscv/virt-acpi-build.c                     | 103 +++++++++++++++++-
  hw/riscv/virt.c                                |  97 ++++++++++++-----
  linux-user/syscall.c                           | 104 ++++++++++++++++--
  target/riscv/cpu.c                             |  94 +++++++++++------
  target/riscv/cpu_helper.c                      |  21 +++-
  target/riscv/csr.c                             |  58 +++++-----
  target/riscv/kvm/kvm-cpu.c                     |  29 +++++
  target/riscv/machine.c                         |  16 +--
  target/riscv/tcg/tcg-cpu.c                     |  34 +++---
  target/riscv/translate.c                       |   3 +
  target/riscv/vector_helper.c                   |   5 +-
  tests/qtest/libqos/riscv-virt-machine.c        | 137 ++++++++++++++++++++++++
  target/riscv/insn_trans/trans_rva.c.inc        |  11 +-
  target/riscv/insn_trans/trans_rvi.c.inc        |  16 ++-
  target/riscv/insn_trans/trans_rvv.c.inc        |  97 +++++++++--------
  target/riscv/insn_trans/trans_rvzce.c.inc      |   6 +-
  tests/qtest/libqos/meson.build                 |   1 +
  tests/tcg/riscv64/Makefile.target              |   2 +-
 files changed, 1213 insertions(+), 347 deletions(-)
  create mode 100644 tests/qtest/libqos/riscv-virt-machine.c
+Tommy Wu (1):
+      target/riscv: Align the AIA model to v1.0 ratified spec
+Vineet Gupta (1):
+      riscv: zicond: make non-experimental
+Weiwei Li (1):
+      target/riscv: Update CSR bits name for svadu extension
+Yong-Xuan Wang (5):
+      target/riscv: support the AIA device emulation with KVM enabled
+      target/riscv: check the in-kernel irqchip support
+      target/riscv: Create an KVM AIA irqchip
+      target/riscv: update APLIC and IMSIC to support KVM AIA
+      target/riscv: select KVM AIA in riscv virt machine
+ include/crypto/aes.h                      |   7 +
+ include/crypto/sm4.h                      |   9 +
+ target/riscv/cpu_bits.h                   |   8 +-
+ target/riscv/cpu_cfg.h                    |   9 +
+ target/riscv/debug.h                      |   3 +-
+ target/riscv/helper.h                     |  98 +++
+ target/riscv/kvm_riscv.h                  |   5 +
+ target/riscv/vector_internals.h           | 228 +++++++
+ target/riscv/insn32.decode                |  58 ++
+ crypto/aes.c                              |   4 +-
+ crypto/sm4.c                              |  10 +
+ hw/char/riscv_htif.c                      |  12 +-
+ hw/intc/riscv_aclint.c                    |  11 +-
+ hw/intc/riscv_aplic.c                     |  52 +-
+ hw/intc/riscv_imsic.c                     |  25 +-
+ hw/riscv/virt.c                           | 374 ++++++------
+ linux-user/riscv/signal.c                 |   4 +-
+ linux-user/syscall.c                      |  14 +-
+ target/arm/tcg/crypto_helper.c            |  10 +-
+ target/riscv/cpu.c                        |  83 ++-
+ target/riscv/cpu_helper.c                 |   6 +-
+ target/riscv/crypto_helper.c              |  51 +-
+ target/riscv/csr.c                        |  54 +-
+ target/riscv/debug.c                      |  15 +-
+ target/riscv/kvm.c                        | 201 ++++++-
+ target/riscv/pmp.c                        |   4 +
+ target/riscv/translate.c                  |   1 +
+ target/riscv/vcrypto_helper.c             | 970 ++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c              | 245 +-------
+ target/riscv/vector_internals.c           |  81 +++
+ target/riscv/insn_trans/trans_rvv.c.inc   | 171 +++---
+ target/riscv/insn_trans/trans_rvvk.c.inc  | 606 +++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfa.c.inc |   4 +-
+ target/riscv/meson.build                  |   4 +-
+files changed, 2785 insertions(+), 652 deletions(-)
+ create mode 100644 target/riscv/vector_internals.h
+ create mode 100644 target/riscv/vcrypto_helper.c
+ create mode 100644 target/riscv/vector_internals.c
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

-[PULL 26/34] target/riscv: move ratified/frozen exts to non-experimental
+[PULL v2 01/45] target/riscv/cpu.c: do not run 'host' CPU with TCG
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-smaia and ssaia were ratified in August 25th 2023 [1].
+The 'host' CPU is available in a CONFIG_KVM build and it's currently
 available for all accels, but is a KVM only CPU. This means that in a
 RISC-V KVM capable host we can do things like this:
-zvfh and zvfhmin were ratified in August 2nd 2023 [2].
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
 qemu-system-riscv64: H extension requires priv spec 1.12.0
-zfbfmin and zvfbf(min|wma) are frozen and moved to public review since
+This CPU does not have a priv spec because we don't filter its extensions
-Dec 16th 2023 [3].
+via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
 with the 'host' CPU.
-zaamo and zalrsc are both marked as "Frozen" since January 24th 2024
+We don't have a way to filter the 'host' CPU out of the available CPU
-[4].
+options (-cpu help) if the build includes both KVM and TCG. What we can
 do is to error out during riscv_cpu_realize_tcg() if the user chooses
 the 'host' CPU with accel=tcg:
-[1] https://jira.riscv.org/browse/RVS-438
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
-[2] https://jira.riscv.org/browse/RVS-871
+qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration
 [3] https://jira.riscv.org/browse/RVS-704
 [4] https://jira.riscv.org/browse/RVS-1995
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20240301144053.265964-1-dbarboza@ventanamicro.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 22 +++++++++-------------
+ target/riscv/cpu.c | 5 +++++
-file changed, 9 insertions(+), 13 deletions(-)
+file changed, 5 insertions(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
-     MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
+     CPURISCVState *env = &cpu->env;
-     MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
+     Error *local_err = NULL;
-     MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
-+    MULTI_EXT_CFG_BOOL("zaamo", ext_zaamo, false),
++    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
-+    MULTI_EXT_CFG_BOOL("zalrsc", ext_zalrsc, false),
++        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
-     MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
++        return;
-     MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
++    }
-+    MULTI_EXT_CFG_BOOL("zfbfmin", ext_zfbfmin, false),
++
-     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
+     riscv_cpu_validate_misa_mxl(cpu, &local_err);
-     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
+     if (local_err != NULL) {
-     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
+         error_propagate(errp, local_err);
      MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
      MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
 +    MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
 +    MULTI_EXT_CFG_BOOL("zvfbfwma", ext_zvfbfwma, false),
 +    MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
 +    MULTI_EXT_CFG_BOOL("zvfhmin", ext_zvfhmin, false),
      MULTI_EXT_CFG_BOOL("sstc", ext_sstc, true),
 +    MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
      MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
      MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
 +    MULTI_EXT_CFG_BOOL("ssaia", ext_ssaia, false),
      MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
      MULTI_EXT_CFG_BOOL("svadu", ext_svadu, true),
      MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[] = {
  /* These are experimental so mark with 'x-' */
  const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
 -    MULTI_EXT_CFG_BOOL("x-smaia", ext_smaia, false),
 -    MULTI_EXT_CFG_BOOL("x-ssaia", ext_ssaia, false),
 -
 -    MULTI_EXT_CFG_BOOL("x-zaamo", ext_zaamo, false),
 -    MULTI_EXT_CFG_BOOL("x-zalrsc", ext_zalrsc, false),
 -
 -    MULTI_EXT_CFG_BOOL("x-zvfh", ext_zvfh, false),
 -    MULTI_EXT_CFG_BOOL("x-zvfhmin", ext_zvfhmin, false),
 -
 -    MULTI_EXT_CFG_BOOL("x-zfbfmin", ext_zfbfmin, false),
 -    MULTI_EXT_CFG_BOOL("x-zvfbfmin", ext_zvfbfmin, false),
 -    MULTI_EXT_CFG_BOOL("x-zvfbfwma", ext_zvfbfwma, false),
 -
      DEFINE_PROP_END_OF_LIST(),
  };
 --
-.44.0
+.41.0

-[PULL 15/34] target/riscv: Add missing include guard in pmu.h
+[PULL v2 02/45] hw/char/riscv_htif: Fix printing of console characters on big endian hosts
-From: Frank Chang <frank.chang@sifive.com>
+From: Thomas Huth <thuth@redhat.com>
-Add missing include guard in pmu.h to avoid the problem of double
+The character that should be printed is stored in the 64 bit "payload"
-inclusion.
+variable. The code currently tries to print it by taking the address
 of the variable and passing this pointer to qemu_chr_fe_write(). However,
 this only works on little endian hosts where the least significant bits
 are stored on the lowest address. To do this in a portable way, we have
 to store the value in an uint8_t variable instead.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Fixes: 5033606780 ("RISC-V HTIF Console")
-Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230721094720.902454-2-thuth@redhat.com>
 Message-ID: <20240220110907.10479-1-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmu.h | 5 +++++
+ hw/char/riscv_htif.c | 3 ++-
-file changed, 5 insertions(+)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/pmu.h b/target/riscv/pmu.h
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmu.h
+--- a/hw/char/riscv_htif.c
-+++ b/target/riscv/pmu.h
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-  * this program.  If not, see <http://www.gnu.org/licenses/>.
+             s->tohost = 0; /* clear to indicate we read */
-  */
+             return;
+         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-+#ifndef RISCV_PMU_H
+-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
-+#define RISCV_PMU_H
++            uint8_t ch = (uint8_t)payload;
-+
++            qemu_chr_fe_write(&s->chr, &ch, 1);
- #include "cpu.h"
+             resp = 0x100 | (uint8_t)payload;
- #include "qapi/error.h"
+         } else {
+             qemu_log("HTIF device %d: unknown command\n", device);
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
  void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name);
  int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
                            uint32_t ctr_idx);
 +
 +#endif /* RISCV_PMU_H */
 --
-.44.0
+.41.0

-New patch
+[PULL v2 03/45] hw/char/riscv_htif: Fix the console syscall on big endian hosts
+From: Thomas Huth <thuth@redhat.com>
+Values that have been read via cpu_physical_memory_read() from the
+guest's memory have to be swapped in case the host endianess differs
+from the guest.
+Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-Id: <20230721094720.902454-3-thuth@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/char/riscv_htif.c | 9 +++++----
+file changed, 5 insertions(+), 4 deletions(-)
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/riscv_htif.c
++++ b/hw/char/riscv_htif.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/timer.h"
+ #include "qemu/error-report.h"
+ #include "exec/address-spaces.h"
++#include "exec/tswap.h"
+ #include "sysemu/dma.h"
+ #define RISCV_DEBUG_HTIF 0
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
+             } else {
+                 uint64_t syscall[8];
+                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
+-                if (syscall[0] == PK_SYS_WRITE &&
+-                    syscall[1] == HTIF_DEV_CONSOLE &&
+-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
++                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
++                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
++                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
+                     uint8_t ch;
+-                    cpu_physical_memory_read(syscall[2], &ch, 1);
++                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
+                     qemu_chr_fe_write(&s->chr, &ch, 1);
+                     resp = 0x100 | (uint8_t)payload;
+                 } else {
+--
+.41.0

-[PULL 25/34] target/riscv/kvm: update KVM exts to Linux 6.8
+[PULL v2 04/45] target/riscv/cpu.c: add zmmul isa string
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The last KVM extensions added were back in 6.6. Sync them to Linux 6.8.
+zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
 Add a riscv,isa string for it.
+Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-ID: <20240304134732.386590-3-dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 29 +++++++++++++++++++++++++++++
+ target/riscv/cpu.c | 1 +
-file changed, 29 insertions(+)
+file changed, 1 insertion(+)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     KVM_EXT_CFG("zicbom", ext_zicbom, KVM_RISCV_ISA_EXT_ZICBOM),
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
-     KVM_EXT_CFG("zicboz", ext_zicboz, KVM_RISCV_ISA_EXT_ZICBOZ),
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     KVM_EXT_CFG("zicntr", ext_zicntr, KVM_RISCV_ISA_EXT_ZICNTR),
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-+    KVM_EXT_CFG("zicond", ext_zicond, KVM_RISCV_ISA_EXT_ZICOND),
++    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
-     KVM_EXT_CFG("zicsr", ext_zicsr, KVM_RISCV_ISA_EXT_ZICSR),
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-     KVM_EXT_CFG("zifencei", ext_zifencei, KVM_RISCV_ISA_EXT_ZIFENCEI),
+     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
-+    KVM_EXT_CFG("zihintntl", ext_zihintntl, KVM_RISCV_ISA_EXT_ZIHINTNTL),
+     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
      KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
      KVM_EXT_CFG("zihpm", ext_zihpm, KVM_RISCV_ISA_EXT_ZIHPM),
 +    KVM_EXT_CFG("zfa", ext_zfa, KVM_RISCV_ISA_EXT_ZFA),
 +    KVM_EXT_CFG("zfh", ext_zfh, KVM_RISCV_ISA_EXT_ZFH),
 +    KVM_EXT_CFG("zfhmin", ext_zfhmin, KVM_RISCV_ISA_EXT_ZFHMIN),
      KVM_EXT_CFG("zba", ext_zba, KVM_RISCV_ISA_EXT_ZBA),
      KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
 +    KVM_EXT_CFG("zbc", ext_zbc, KVM_RISCV_ISA_EXT_ZBC),
 +    KVM_EXT_CFG("zbkb", ext_zbkb, KVM_RISCV_ISA_EXT_ZBKB),
 +    KVM_EXT_CFG("zbkc", ext_zbkc, KVM_RISCV_ISA_EXT_ZBKC),
 +    KVM_EXT_CFG("zbkx", ext_zbkx, KVM_RISCV_ISA_EXT_ZBKX),
      KVM_EXT_CFG("zbs", ext_zbs, KVM_RISCV_ISA_EXT_ZBS),
 +    KVM_EXT_CFG("zknd", ext_zknd, KVM_RISCV_ISA_EXT_ZKND),
 +    KVM_EXT_CFG("zkne", ext_zkne, KVM_RISCV_ISA_EXT_ZKNE),
 +    KVM_EXT_CFG("zknh", ext_zknh, KVM_RISCV_ISA_EXT_ZKNH),
 +    KVM_EXT_CFG("zkr", ext_zkr, KVM_RISCV_ISA_EXT_ZKR),
 +    KVM_EXT_CFG("zksed", ext_zksed, KVM_RISCV_ISA_EXT_ZKSED),
 +    KVM_EXT_CFG("zksh", ext_zksh, KVM_RISCV_ISA_EXT_ZKSH),
 +    KVM_EXT_CFG("zkt", ext_zkt, KVM_RISCV_ISA_EXT_ZKT),
 +    KVM_EXT_CFG("zvbb", ext_zvbb, KVM_RISCV_ISA_EXT_ZVBB),
 +    KVM_EXT_CFG("zvbc", ext_zvbc, KVM_RISCV_ISA_EXT_ZVBC),
 +    KVM_EXT_CFG("zvfh", ext_zvfh, KVM_RISCV_ISA_EXT_ZVFH),
 +    KVM_EXT_CFG("zvfhmin", ext_zvfhmin, KVM_RISCV_ISA_EXT_ZVFHMIN),
 +    KVM_EXT_CFG("zvkb", ext_zvkb, KVM_RISCV_ISA_EXT_ZVKB),
 +    KVM_EXT_CFG("zvkg", ext_zvkg, KVM_RISCV_ISA_EXT_ZVKG),
 +    KVM_EXT_CFG("zvkned", ext_zvkned, KVM_RISCV_ISA_EXT_ZVKNED),
 +    KVM_EXT_CFG("zvknha", ext_zvknha, KVM_RISCV_ISA_EXT_ZVKNHA),
 +    KVM_EXT_CFG("zvknhb", ext_zvknhb, KVM_RISCV_ISA_EXT_ZVKNHB),
 +    KVM_EXT_CFG("zvksed", ext_zvksed, KVM_RISCV_ISA_EXT_ZVKSED),
 +    KVM_EXT_CFG("zvksh", ext_zvksh, KVM_RISCV_ISA_EXT_ZVKSH),
 +    KVM_EXT_CFG("zvkt", ext_zvkt, KVM_RISCV_ISA_EXT_ZVKT),
 +    KVM_EXT_CFG("smstateen", ext_smstateen, KVM_RISCV_ISA_EXT_SMSTATEEN),
      KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
      KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
      KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
 --
-.44.0
+.41.0

-[PULL 07/34] target/riscv/tcg: set 'mmu' with 'satp' in cpu_set_profile()
+[PULL v2 05/45] target/riscv/cpu.c: add smepmp isa string
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Recent changes in options handling removed the 'mmu' default the bare
+The cpu->cfg.epmp extension is still experimental, but it already has a
-CPUs had, meaning that we must enable 'mmu' by hand when using the
+'smepmp' riscv,isa string. Add it.
 rva22s64 profile CPU.
 Given that this profile is setting a satp mode, it already implies that
 we need a 'mmu'. Enable the 'mmu' in this case.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20240215223955.969568-2-dbarboza@ventanamicro.com>
+Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 1 +
+ target/riscv/cpu.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
- #ifndef CONFIG_USER_ONLY
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-     if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+        object_property_set_bool(obj, "mmu", true, NULL);
++    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
-         const char *satp_prop = satp_mode_str(profile->satp_mode,
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-                                               riscv_cpu_is_32bit(cpu));
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
-         object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
 --
-.44.0
+.41.0

-[PULL 30/34] target/riscv: Fix shift count overflow
+[PULL v2 06/45] target/riscv: Fix page_check_range use in fault-only-first
-From: "demin.han" <demin.han@starfivetech.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-The result of (8 - 3 - vlmul) is negative when vlmul >= 6,
+Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
-and results in wrong vill.
+integer return value to bool type. However, it wrongly converted the use
 of the API in riscv fault-only-first, where page_check_range < = 0, should
 be converted to !page_check_range.
-Signed-off-by: demin.han <demin.han@starfivetech.com>
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-ID: <20240225174114.5298-1-demin.han@starfivetech.com>
+Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c | 5 ++---
+ target/riscv/vector_helper.c | 2 +-
-file changed, 2 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
-     target_ulong reserved = s2 &
+                                          cpu_mmu_index(env, false));
-                             MAKE_64BIT_MASK(R_VTYPE_RESERVED_SHIFT,
+                 if (host) {
-                                             xlen - 1 - R_VTYPE_RESERVED_SHIFT);
+ #ifdef CONFIG_USER_ONLY
-+    uint16_t vlen = cpu->cfg.vlenb << 3;
+-                    if (page_check_range(addr, offset, PAGE_READ)) {
-     int8_t lmul;
++                    if (!page_check_range(addr, offset, PAGE_READ)) {
+                         vl = i;
-     if (vlmul & 4) {
+                         goto ProbeSuccess;
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+                     }
           * VLEN * LMUL >= SEW
           * VLEN >> (8 - lmul) >= sew
           * (vlenb << 3) >> (8 - lmul) >= sew
 -         * vlenb >> (8 - 3 - lmul) >= sew
           */
 -        if (vlmul == 4 ||
 -            cpu->cfg.vlenb >> (8 - 3 - vlmul) < sew) {
 +        if (vlmul == 4 || (vlen >> (8 - vlmul)) < sew) {
              vill = true;
          }
      }
 --
-.44.0
+.41.0

-[PULL 05/34] linux-user/riscv: Add Zicboz extensions to hwprobe
+[PULL v2 07/45] target/riscv: Use existing lookup tables for MixColumns
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Ard Biesheuvel <ardb@kernel.org>
-Upstream Linux recently added RISC-V Zicboz support to the hwprobe API.
+The AES MixColumns and InvMixColumns operations are relatively
-This patch introduces this for QEMU's user space emulator.
+expensive 4x4 matrix multiplications in GF(2^8), which is why C
 implementations usually rely on precomputed lookup tables rather than
 performing the calculations on demand.
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Given that we already carry those tables in QEMU, we can just grab the
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+right value in the implementation of the RISC-V AES32 instructions. Note
-Message-ID: <20240207115926.887816-2-christoph.muellner@vrull.eu>
+that the tables in question are permuted according to the respective
 Sbox, so we can omit the Sbox lookup as well in this case.
 Cc: Richard Henderson <richard.henderson@linaro.org>
 Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
 Cc: Zewen Ye <lustrew@foxmail.com>
 Cc: Weiwei Li <liweiwei@iscas.ac.cn>
 Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- linux-user/syscall.c | 3 +++
+ include/crypto/aes.h         |  7 +++++++
-file changed, 3 insertions(+)
+ crypto/aes.c                 |  4 ++--
  target/riscv/crypto_helper.c | 34 ++++------------------------------
 files changed, 13 insertions(+), 32 deletions(-)
-diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+diff --git a/include/crypto/aes.h b/include/crypto/aes.h
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/syscall.c
+--- a/include/crypto/aes.h
-+++ b/linux-user/syscall.c
++++ b/include/crypto/aes.h
-@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
+@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
- #define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
+ extern const uint8_t AES_sbox[256];
- #define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
+ extern const uint8_t AES_isbox[256];
- #define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
-+#define     RISCV_HWPROBE_EXT_ZICBOZ   (1 << 6)
++/*
++AES_Te0[x] = S [x].[02, 01, 01, 03];
- #define RISCV_HWPROBE_KEY_CPUPERF_0     5
++AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
- #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
++*/
-@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
++
-                      RISCV_HWPROBE_EXT_ZBB : 0;
++extern const uint32_t AES_Te0[256], AES_Td0[256];
-             value |= cfg->ext_zbs ?
++
-                      RISCV_HWPROBE_EXT_ZBS : 0;
+ #endif
-+            value |= cfg->ext_zicboz ?
+diff --git a/crypto/aes.c b/crypto/aes.c
-+                     RISCV_HWPROBE_EXT_ZICBOZ : 0;
+index XXXXXXX..XXXXXXX 100644
-             __put_user(value, &pair->value);
+--- a/crypto/aes.c
-             break;
++++ b/crypto/aes.c
-         case RISCV_HWPROBE_KEY_CPUPERF_0:
+@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
  AES_Td4[x] = Si[x].[01, 01, 01, 01];
  */
 -static const uint32_t AES_Te0[256] = {
 +const uint32_t AES_Te0[256] = {
 xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
 xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
 x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
 xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
  };
 -static const uint32_t AES_Td0[256] = {
 +const uint32_t AES_Td0[256] = {
 x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
 x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
 x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
 diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/crypto_helper.c
 +++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "crypto/aes-round.h"
  #include "crypto/sm4.h"
 -#define AES_XTIME(a) \
 -    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
 -
 -#define AES_GFMUL(a, b) (( \
 -    (((b) & 0x1) ? (a) : 0) ^ \
 -    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
 -    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
 -    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
 -
 -static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
 -{
 -    uint32_t u;
 -
 -    if (fwd) {
 -        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
 -            (AES_GFMUL(x, 2) << 0);
 -    } else {
 -        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
 -            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
 -    }
 -    return u;
 -}
 -
  #define sext32_xlen(x) (target_ulong)(int32_t)(x)
  static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                             bool enc, bool mix)
  {
      uint8_t si = rs2 >> shamt;
 -    uint8_t so;
      uint32_t mixed;
      target_ulong res;
      if (enc) {
 -        so = AES_sbox[si];
          if (mix) {
 -            mixed = aes_mixcolumn_byte(so, true);
 +            mixed = be32_to_cpu(AES_Te0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_sbox[si];
          }
      } else {
 -        so = AES_isbox[si];
          if (mix) {
 -            mixed = aes_mixcolumn_byte(so, false);
 +            mixed = be32_to_cpu(AES_Td0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_isbox[si];
          }
      }
      mixed = rol32(mixed, shamt);
 --
-.44.0
+.41.0

-New patch
+[PULL v2 08/45] target/riscv: Refactor some of the generic vector functionality
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Take some functions/macros out of `vector_helper` and put them in a new
+module called `vector_internals`. This ensures they can be used by both
+vector and vector-crypto helpers (latter implemented in proceeding
+commits).
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c    | 201 +-------------------------------
+ target/riscv/vector_internals.c |  81 +++++++++++++
+ target/riscv/meson.build        |   1 +
+files changed, 265 insertions(+), 200 deletions(-)
+ create mode 100644 target/riscv/vector_internals.h
+ create mode 100644 target/riscv/vector_internals.c
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/riscv/vector_internals.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * RISC-V Vector Extension Internals
++ *
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
++#define TARGET_RISCV_VECTOR_INTERNALS_H
++
++#include "qemu/osdep.h"
++#include "qemu/bitops.h"
++#include "cpu.h"
++#include "tcg/tcg-gvec-desc.h"
++#include "internals.h"
++
++static inline uint32_t vext_nf(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, NF);
++}
++
++/*
++ * Note that vector data is stored in host-endian 64-bit chunks,
++ * so addressing units smaller than that needs a host-endian fixup.
++ */
++#if HOST_BIG_ENDIAN
++#define H1(x)   ((x) ^ 7)
++#define H1_2(x) ((x) ^ 6)
++#define H1_4(x) ((x) ^ 4)
++#define H2(x)   ((x) ^ 3)
++#define H4(x)   ((x) ^ 1)
++#define H8(x)   ((x))
++#else
++#define H1(x)   (x)
++#define H1_2(x) (x)
++#define H1_4(x) (x)
++#define H2(x)   (x)
++#define H4(x)   (x)
++#define H8(x)   (x)
++#endif
++
++/*
++ * Encode LMUL to lmul as following:
++ *     LMUL    vlmul    lmul
++ *      1       000       0
++ *      2       001       1
++ *      4       010       2
++ *      8       011       3
++ *      -       100       -
++ *     1/8      101      -3
++ *     1/4      110      -2
++ *     1/2      111      -1
++ */
++static inline int32_t vext_lmul(uint32_t desc)
++{
++    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
++}
++
++static inline uint32_t vext_vm(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VM);
++}
++
++static inline uint32_t vext_vma(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VMA);
++}
++
++static inline uint32_t vext_vta(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VTA);
++}
++
++static inline uint32_t vext_vta_all_1s(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
++}
++
++/*
++ * Earlier designs (pre-0.9) had a varying number of bits
++ * per mask value (MLEN). In the 0.9 design, MLEN=1.
++ * (Section 4.5)
++ */
++static inline int vext_elem_mask(void *v0, int index)
++{
++    int idx = index / 64;
++    int pos = index  % 64;
++    return (((uint64_t *)v0)[idx] >> pos) & 1;
++}
++
++/*
++ * Get number of total elements, including prestart, body and tail elements.
++ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
++ * are held in the same vector register.
++ */
++static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
++                                            uint32_t esz)
++{
++    uint32_t vlenb = simd_maxsz(desc);
++    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
++    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
++                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
++    return (vlenb << emul) / esz;
++}
++
++/* set agnostic elements to 1s */
++void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
++                       uint32_t tot);
++
++/* expand macro args before macro */
++#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
++
++/* (TD, T1, T2, TX1, TX2) */
++#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
++#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
++#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
++#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
++
++/* operation of two vector elements */
++typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
++
++#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
++static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
++{                                                               \
++    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
++    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
++    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
++}
++
++void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivv2_fn *fn, uint32_t esz);
++
++/* generate the helpers for OPIVV */
++#define GEN_VEXT_VV(NAME, ESZ)                            \
++void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
++                  void *vs2, CPURISCVState *env,          \
++                  uint32_t desc)                          \
++{                                                         \
++    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
++               do_##NAME, ESZ);                           \
++}
++
++typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
++
++/*
++ * (T1)s1 gives the real operator type.
++ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
++ */
++#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
++static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
++{                                                                   \
++    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
++    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
++}
++
++void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivx2_fn fn, uint32_t esz);
++
++/* generate the helpers for OPIVX */
++#define GEN_VEXT_VX(NAME, ESZ)                            \
++void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
++                  void *vs2, CPURISCVState *env,          \
++                  uint32_t desc)                          \
++{                                                         \
++    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
++               do_##NAME, ESZ);                           \
++}
++
++#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "fpu/softfloat.h"
+ #include "tcg/tcg-gvec-desc.h"
+ #include "internals.h"
++#include "vector_internals.h"
+ #include <math.h>
+ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+     return vl;
+ }
+-/*
+- * Note that vector data is stored in host-endian 64-bit chunks,
+- * so addressing units smaller than that needs a host-endian fixup.
+- */
+-#if HOST_BIG_ENDIAN
+-#define H1(x)   ((x) ^ 7)
+-#define H1_2(x) ((x) ^ 6)
+-#define H1_4(x) ((x) ^ 4)
+-#define H2(x)   ((x) ^ 3)
+-#define H4(x)   ((x) ^ 1)
+-#define H8(x)   ((x))
+-#else
+-#define H1(x)   (x)
+-#define H1_2(x) (x)
+-#define H1_4(x) (x)
+-#define H2(x)   (x)
+-#define H4(x)   (x)
+-#define H8(x)   (x)
+-#endif
+-
+-static inline uint32_t vext_nf(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, NF);
+-}
+-
+-static inline uint32_t vext_vm(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VM);
+-}
+-
+-/*
+- * Encode LMUL to lmul as following:
+- *     LMUL    vlmul    lmul
+- *      1       000       0
+- *      2       001       1
+- *      4       010       2
+- *      8       011       3
+- *      -       100       -
+- *     1/8      101      -3
+- *     1/4      110      -2
+- *     1/2      111      -1
+- */
+-static inline int32_t vext_lmul(uint32_t desc)
+-{
+-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+-}
+-
+-static inline uint32_t vext_vta(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+-}
+-
+-static inline uint32_t vext_vma(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+-}
+-
+-static inline uint32_t vext_vta_all_1s(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+-}
+-
+ /*
+  * Get the maximum number of elements can be operated.
+  *
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
+     return scale < 0 ? vlenb >> -scale : vlenb << scale;
+ }
+-/*
+- * Get number of total elements, including prestart, body and tail elements.
+- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+- * are held in the same vector register.
+- */
+-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+-                                            uint32_t esz)
+-{
+-    uint32_t vlenb = simd_maxsz(desc);
+-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+-    return (vlenb << emul) / esz;
+-}
+-
+ static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
+ {
+     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
+@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
+     }
+ }
+-/* set agnostic elements to 1s */
+-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+-                              uint32_t tot)
+-{
+-    if (is_agnostic == 0) {
+-        /* policy undisturbed */
+-        return;
+-    }
+-    if (tot - cnt == 0) {
+-        return;
+-    }
+-    memset(base + cnt, -1, tot - cnt);
+-}
+-
+ static inline void vext_set_elem_mask(void *v0, int index,
+                                       uint8_t value)
+ {
+@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
+     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
+ }
+-/*
+- * Earlier designs (pre-0.9) had a varying number of bits
+- * per mask value (MLEN). In the 0.9 design, MLEN=1.
+- * (Section 4.5)
+- */
+-static inline int vext_elem_mask(void *v0, int index)
+-{
+-    int idx = index / 64;
+-    int pos = index  % 64;
+-    return (((uint64_t *)v0)[idx] >> pos) & 1;
+-}
+-
+ /* elements operations for load and store */
+ typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
+                                uint32_t idx, void *vd, uintptr_t retaddr);
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
+  * Vector Integer Arithmetic Instructions
+  */
+-/* expand macro args before macro */
+-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+-
+ /* (TD, T1, T2, TX1, TX2) */
+ #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
+ #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
+ #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
+ #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
+-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+ #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
+ #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
+ #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
+-/* operation of two vector elements */
+-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+-
+-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+-{                                                               \
+-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+-}
+ #define DO_SUB(N, M) (N - M)
+ #define DO_RSUB(N, M) (M - N)
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
+ RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
+ RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
+-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+-                       CPURISCVState *env, uint32_t desc,
+-                       opivv2_fn *fn, uint32_t esz)
+-{
+-    uint32_t vm = vext_vm(desc);
+-    uint32_t vl = env->vl;
+-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+-    uint32_t vta = vext_vta(desc);
+-    uint32_t vma = vext_vma(desc);
+-    uint32_t i;
+-
+-    for (i = env->vstart; i < vl; i++) {
+-        if (!vm && !vext_elem_mask(v0, i)) {
+-            /* set masked-off elements to 1s */
+-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+-            continue;
+-        }
+-        fn(vd, vs1, vs2, i);
+-    }
+-    env->vstart = 0;
+-    /* set tail elements to 1s */
+-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+-}
+-
+-/* generate the helpers for OPIVV */
+-#define GEN_VEXT_VV(NAME, ESZ)                            \
+-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+-                  void *vs2, CPURISCVState *env,          \
+-                  uint32_t desc)                          \
+-{                                                         \
+-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+-               do_##NAME, ESZ);                           \
+-}
+-
+ GEN_VEXT_VV(vadd_vv_b, 1)
+ GEN_VEXT_VV(vadd_vv_h, 2)
+ GEN_VEXT_VV(vadd_vv_w, 4)
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
+ GEN_VEXT_VV(vsub_vv_w, 4)
+ GEN_VEXT_VV(vsub_vv_d, 8)
+-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+-
+-/*
+- * (T1)s1 gives the real operator type.
+- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+- */
+-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+-{                                                                   \
+-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+-}
+ RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
+ RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
+ RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
+ RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
+-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+-                       CPURISCVState *env, uint32_t desc,
+-                       opivx2_fn fn, uint32_t esz)
+-{
+-    uint32_t vm = vext_vm(desc);
+-    uint32_t vl = env->vl;
+-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+-    uint32_t vta = vext_vta(desc);
+-    uint32_t vma = vext_vma(desc);
+-    uint32_t i;
+-
+-    for (i = env->vstart; i < vl; i++) {
+-        if (!vm && !vext_elem_mask(v0, i)) {
+-            /* set masked-off elements to 1s */
+-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+-            continue;
+-        }
+-        fn(vd, s1, vs2, i);
+-    }
+-    env->vstart = 0;
+-    /* set tail elements to 1s */
+-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+-}
+-
+-/* generate the helpers for OPIVX */
+-#define GEN_VEXT_VX(NAME, ESZ)                            \
+-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+-                  void *vs2, CPURISCVState *env,          \
+-                  uint32_t desc)                          \
+-{                                                         \
+-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+-               do_##NAME, ESZ);                           \
+-}
+-
+ GEN_VEXT_VX(vadd_vx_b, 1)
+ GEN_VEXT_VX(vadd_vx_h, 2)
+ GEN_VEXT_VX(vadd_vx_w, 4)
+diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/riscv/vector_internals.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * RISC-V Vector Extension Internals
++ *
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "vector_internals.h"
++
++/* set agnostic elements to 1s */
++void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
++                       uint32_t tot)
++{
++    if (is_agnostic == 0) {
++        /* policy undisturbed */
++        return;
++    }
++    if (tot - cnt == 0) {
++        return ;
++    }
++    memset(base + cnt, -1, tot - cnt);
++}
++
++void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivv2_fn *fn, uint32_t esz)
++{
++    uint32_t vm = vext_vm(desc);
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
++    uint32_t vta = vext_vta(desc);
++    uint32_t vma = vext_vma(desc);
++    uint32_t i;
++
++    for (i = env->vstart; i < vl; i++) {
++        if (!vm && !vext_elem_mask(v0, i)) {
++            /* set masked-off elements to 1s */
++            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
++            continue;
++        }
++        fn(vd, vs1, vs2, i);
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
++}
++
++void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivx2_fn fn, uint32_t esz)
++{
++    uint32_t vm = vext_vm(desc);
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
++    uint32_t vta = vext_vta(desc);
++    uint32_t vma = vext_vma(desc);
++    uint32_t i;
++
++    for (i = env->vstart; i < vl; i++) {
++        if (!vm && !vext_elem_mask(v0, i)) {
++            /* set masked-off elements to 1s */
++            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
++            continue;
++        }
++        fn(vd, s1, vs2, i);
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
++}
+diff --git a/target/riscv/meson.build b/target/riscv/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/meson.build
++++ b/target/riscv/meson.build
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
+   'gdbstub.c',
+   'op_helper.c',
+   'vector_helper.c',
++  'vector_internals.c',
+   'bitmanip_helper.c',
+   'translate.c',
+   'm128_helper.c',
+--
+.41.0

-New patch
+[PULL v2 09/45] target/riscv: Refactor vector-vector translation macro
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
+function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
+used in proceeding vector-crypto commits.
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
+file changed, 32 insertions(+), 30 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
+@@ -XXX,XX +XXX,XX @@ GEN_OPIWX_WIDEN_TRANS(vwadd_wx)
+ GEN_OPIWX_WIDEN_TRANS(vwsubu_wx)
+ GEN_OPIWX_WIDEN_TRANS(vwsub_wx)
++static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
++                        gen_helper_gvec_4_ptr *fn, DisasContext *s)
++{
++    uint32_t data = 0;
++    TCGLabel *over = gen_new_label();
++    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++    tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++
++    data = FIELD_DP32(data, VDATA, VM, vm);
++    data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
++    data = FIELD_DP32(data, VDATA, VTA, s->vta);
++    data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
++    data = FIELD_DP32(data, VDATA, VMA, s->vma);
++    tcg_gen_gvec_4_ptr(vreg_ofs(s, vd), vreg_ofs(s, 0), vreg_ofs(s, vs1),
++                       vreg_ofs(s, vs2), cpu_env, s->cfg_ptr->vlen / 8,
++                       s->cfg_ptr->vlen / 8, data, fn);
++    mark_vs_dirty(s);
++    gen_set_label(over);
++    return true;
++}
++
+ /* Vector Integer Add-with-Carry / Subtract-with-Borrow Instructions */
+ /* OPIVV without GVEC IR */
+-#define GEN_OPIVV_TRANS(NAME, CHECK)                               \
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+-{                                                                  \
+-    if (CHECK(s, a)) {                                             \
+-        uint32_t data = 0;                                         \
+-        static gen_helper_gvec_4_ptr * const fns[4] = {            \
+-            gen_helper_##NAME##_b, gen_helper_##NAME##_h,          \
+-            gen_helper_##NAME##_w, gen_helper_##NAME##_d,          \
+-        };                                                         \
+-        TCGLabel *over = gen_new_label();                          \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+-        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+-                                                                   \
+-        data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+-        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+-        data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+-        data =                                                     \
+-            FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
+-        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
+-        tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
+-                           vreg_ofs(s, a->rs1),                    \
+-                           vreg_ofs(s, a->rs2), cpu_env,           \
+-                           s->cfg_ptr->vlen / 8,                   \
+-                           s->cfg_ptr->vlen / 8, data,             \
+-                           fns[s->sew]);                           \
+-        mark_vs_dirty(s);                                          \
+-        gen_set_label(over);                                       \
+-        return true;                                               \
+-    }                                                              \
+-    return false;                                                  \
++#define GEN_OPIVV_TRANS(NAME, CHECK)                                     \
++static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
++{                                                                        \
++    if (CHECK(s, a)) {                                                   \
++        static gen_helper_gvec_4_ptr * const fns[4] = {                  \
++            gen_helper_##NAME##_b, gen_helper_##NAME##_h,                \
++            gen_helper_##NAME##_w, gen_helper_##NAME##_d,                \
++        };                                                               \
++        return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s);\
++    }                                                                    \
++    return false;                                                        \
+ }
+ /*
+--
+.41.0

-[PULL 28/34] trans_rvv.c.inc: mark_vs_dirty() before loads and stores
+[PULL v2 10/45] target/riscv: Remove redundant "cpu_vl == 0" checks
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-While discussing a problem with how we're (not) setting vstart_eq_zero
+Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.
 Richard had the following to say w.r.t the conditional mark_vs_dirty()
 calls on load/store functions [1]:
-"I think it's required to have stores set dirty unconditionally, before
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-the operation.
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Consider a store that traps on the 2nd element, leaving vstart = 2, and
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-exiting to the main loop via exception. The exception enters the kernel
+Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
 page fault handler. The kernel may need to fault in the page for the
 process, and in the meantime task switch.
 If vs dirty is not already set, the kernel won't know to save vector
 state on task switch."
 Do a mark_vs_dirty() before both loads and stores.
 [1] https://lore.kernel.org/qemu-riscv/72c7503b-0f43-44b8-aa82-fbafed2aac0c@linaro.org/
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240306171932.549549-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 23 ++++++++---------------
+ target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
-file changed, 8 insertions(+), 15 deletions(-)
+file changed, 1 insertion(+), 30 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
 @@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
-         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
+     TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
          return false;
      }
-+    mark_vs_dirty(s);
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-     fn(dest, mask, base, tcg_env, desc);
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
-     if (!is_store && s->ztso) {
+@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
-         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
+     uint32_t data = 0;
-     }
+     TCGLabel *over = gen_new_label();
--    if (!is_store) {
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
--        mark_vs_dirty(s);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
--    }
--
+     dest = tcg_temp_new_ptr();
-     gen_set_label(over);
+@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
-     return true;
+     uint32_t data = 0;
- }
-@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
+     TCGLabel *over = gen_new_label();
-     tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-     tcg_gen_addi_ptr(mask, tcg_env, vreg_ofs(s, 0));
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
--    fn(dest, mask, base, stride, tcg_env, desc);
+     dest = tcg_temp_new_ptr();
-+    mark_vs_dirty(s);
+@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
+     if (checkfn(s, a)) {
--    if (!is_store) {
+         uint32_t data = 0;
--        mark_vs_dirty(s);
+         TCGLabel *over = gen_new_label();
--    }
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+    fn(dest, mask, base, stride, tcg_env, desc);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-     gen_set_label(over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
-     return true;
+@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
-@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
+     if (opiwv_widen_check(s, a)) {
-     tcg_gen_addi_ptr(index, tcg_env, vreg_ofs(s, vs2));
+         uint32_t data = 0;
-     tcg_gen_addi_ptr(mask, tcg_env, vreg_ofs(s, 0));
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
--    fn(dest, mask, base, index, tcg_env, desc);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+    mark_vs_dirty(s);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
--    if (!is_store) {
+@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
--        mark_vs_dirty(s);
+ {
--    }
+     uint32_t data = 0;
-+    fn(dest, mask, base, index, tcg_env, desc);
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-     gen_set_label(over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-     return true;
-@@ -XXX,XX +XXX,XX @@ static bool ldst_whole_trans(uint32_t vd, uint32_t rs1, uint32_t nf,
+     data = FIELD_DP32(data, VDATA, VM, vm);
-     base = get_gpr(s, rs1, EXT_NONE);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
-     tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
+             gen_helper_##NAME##_w,                                 \
+         };                                                         \
-+    mark_vs_dirty(s);
+         TCGLabel *over = gen_new_label();                          \
-+
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
-     fn(dest, base, tcg_env, desc);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
--    if (!is_store) {
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
--        mark_vs_dirty(s);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
--    }
+                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
-     gen_set_label(over);
+             };
+             TCGLabel *over = gen_new_label();
-     return true;
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
          vext_check_ss(s, a->rd, 0, 1)) {
          TCGv s1;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                  gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      TCGv_i64 t1;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
          };                                                       \
          TCGLabel *over = gen_new_label();                        \
          gen_set_rm(s, RISCV_FRM_DYN);                            \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                   \
          data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
          gen_set_rm_chkfrm(s, rm);
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                  gen_helper_vmv_v_x_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
          uint32_t data = 0;                                         \
          gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
          TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
          require_vm(a->vm, a->rd)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
          TCGv s1;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
          TCGv_i64 t1;
          TCGLabel *over = gen_new_label();
 -        /* if vl == 0 or vstart >= vl, skip vector register write back */
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
 +        /* if vstart >= vl, skip vector register write back */
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
      uint32_t data = 0;
      gen_helper_gvec_3_ptr *fn;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      static gen_helper_gvec_3_ptr * const fns[6][4] = {
 --
-.44.0
+.41.0

-[PULL 21/34] RISC-V: Add support for Ztso
+[PULL v2 11/45] target/riscv: Add Zvbc ISA extension support
-From: Palmer Dabbelt <palmer@rivosinc.com>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-The Ztso extension is already ratified, this adds it as a CPU property
+This commit adds support for the Zvbc vector-crypto extension, which
-and adds various fences throughout the port in order to allow TSO
+consists of the following instructions:
-targets to function on weaker hosts.  We need no fences for AMOs as
-they're already SC, the places we need barriers are described.
+* vclmulh.[vx,vv]
-These fences are placed in the RISC-V backend rather than TCG as is
+* vclmul.[vx,vv]
-planned for x86-on-arm64 because RISC-V allows heterogeneous (and
-likely soon dynamic) hart memory models.
+Translation functions are defined in
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+`target/riscv/vcrypto_helper.c`.
-Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Message-ID: <20240207122256.902627-2-christoph.muellner@vrull.eu>
+Co-authored-by: Max Chou <max.chou@sifive.com>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 [max.chou@sifive.com: Exposed x-zvbc property]
 Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h                  |  1 +
+ target/riscv/cpu_cfg.h                   |  1 +
- target/riscv/cpu.c                      |  2 ++
+ target/riscv/helper.h                    |  6 +++
- target/riscv/translate.c                |  3 +++
+ target/riscv/insn32.decode               |  6 +++
- target/riscv/insn_trans/trans_rva.c.inc | 11 ++++++++---
+ target/riscv/cpu.c                       |  9 ++++
- target/riscv/insn_trans/trans_rvi.c.inc | 16 ++++++++++++++--
+ target/riscv/translate.c                 |  1 +
- target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++++
+ target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
-files changed, 48 insertions(+), 5 deletions(-)
+ target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
  target/riscv/meson.build                 |  3 +-
 files changed, 146 insertions(+), 1 deletion(-)
  create mode 100644 target/riscv/vcrypto_helper.c
  create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zihintntl;
+     bool ext_zve32f;
-     bool ext_zihintpause;
+     bool ext_zve64f;
-     bool ext_zihpm;
+     bool ext_zve64d;
-+    bool ext_ztso;
++    bool ext_zvbc;
-     bool ext_smstateen;
+     bool ext_zmmul;
-     bool ext_sstc;
+     bool ext_zvfbfmin;
-     bool ext_svadu;
+     bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
 +
 +/* Vector crypto functions */
 +DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
  # *** Zvfbfwma Standard Extension ***
  vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
  vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
 +
 +# *** Zvbc vector crypto extension ***
 +vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 +vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 +vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 +vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
      ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
      ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
-+    ISA_EXT_DATA_ENTRY(ztso, PRIV_VERSION_1_12_0, ext_ztso),
++    ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
      ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
      ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
      ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     MULTI_EXT_CFG_BOOL("zksed", ext_zksed, false),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-     MULTI_EXT_CFG_BOOL("zksh", ext_zksh, false),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     MULTI_EXT_CFG_BOOL("zkt", ext_zkt, false),
+         return;
-+    MULTI_EXT_CFG_BOOL("ztso", ext_ztso, false),
+     }
-     MULTI_EXT_CFG_BOOL("zdinx", ext_zdinx, false),
++    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-     MULTI_EXT_CFG_BOOL("zfinx", ext_zfinx, false),
++        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zk) {
          cpu->cfg.ext_zkn = true;
          cpu->cfg.ext_zkr = true;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
      DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 +    /* Vector cryptography extensions */
 +    DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
-     /* PointerMasking extension */
+ #include "insn_trans/trans_rvzfa.c.inc"
-     bool pm_mask_enabled;
+ #include "insn_trans/trans_rvzfh.c.inc"
-     bool pm_base_enabled;
+ #include "insn_trans/trans_rvk.c.inc"
-+    /* Ztso */
++#include "insn_trans/trans_rvvk.c.inc"
-+    bool ztso;
+ #include "insn_trans/trans_privileged.c.inc"
-     /* Use icount trigger for native debug */
+ #include "insn_trans/trans_svinval.c.inc"
-     bool itrigger;
+ #include "insn_trans/trans_rvbf16.c.inc"
-     /* FRM is known to contain a valid value. */
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+new file mode 100644
-     ctx->cs = cs;
+index XXXXXXX..XXXXXXX
-     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
+--- /dev/null
-     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
++++ b/target/riscv/vcrypto_helper.c
-+    ctx->ztso = cpu->cfg.ext_ztso;
+@@ -XXX,XX +XXX,XX @@
-     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
++/*
-     ctx->zero = tcg_constant_tl(0);
++ * RISC-V Vector Crypto Extension Helpers for QEMU.
-     ctx->virt_inst_excp = false;
++ *
-diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
++ * Copyright (C) 2023 SiFive, Inc.
-index XXXXXXX..XXXXXXX 100644
++ * Written by Codethink Ltd and SiFive.
---- a/target/riscv/insn_trans/trans_rva.c.inc
++ *
-+++ b/target/riscv/insn_trans/trans_rva.c.inc
++ * This program is free software; you can redistribute it and/or modify it
-@@ -XXX,XX +XXX,XX @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
++ * under the terms and conditions of the GNU General Public License,
-         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
++ * version 2 or later, as published by the Free Software Foundation.
-     }
++ *
-     tcg_gen_qemu_ld_tl(load_val, src1, ctx->mem_idx, mop);
++ * This program is distributed in the hope it will be useful, but WITHOUT
--    if (a->aq) {
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+    /*
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+     * TSO defines AMOs as acquire+release-RCsc, but does not define LR/SC as
++ * more details.
-+     * AMOs.  Instead treat them like loads.
++ *
-+     */
++ * You should have received a copy of the GNU General Public License along with
-+    if (a->aq || ctx->ztso) {
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
-         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
++ */
-     }
++
++#include "qemu/osdep.h"
-@@ -XXX,XX +XXX,XX @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
++#include "qemu/host-utils.h"
-     gen_set_label(l1);
++#include "qemu/bitops.h"
-     /*
++#include "cpu.h"
-      * Address comparison failure.  However, we still need to
++#include "exec/memop.h"
--     * provide the memory barrier implied by AQ/RL.
++#include "exec/exec-all.h"
-+     * provide the memory barrier implied by AQ/RL/TSO.
++#include "exec/helper-proto.h"
-      */
++#include "internals.h"
--    tcg_gen_mb(TCG_MO_ALL + a->aq * TCG_BAR_LDAQ + a->rl * TCG_BAR_STRL);
++#include "vector_internals.h"
-+    TCGBar bar_strl = (ctx->ztso || a->rl) ? TCG_BAR_STRL : 0;
++
-+    tcg_gen_mb(TCG_MO_ALL + a->aq * TCG_BAR_LDAQ + bar_strl);
++static uint64_t clmul64(uint64_t y, uint64_t x)
-     gen_set_gpr(ctx, a->rd, tcg_constant_tl(1));
++{
++    uint64_t result = 0;
-     gen_set_label(l2);
++    for (int j = 63; j >= 0; j--) {
-diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
++        if ((y >> j) & 1) {
-index XXXXXXX..XXXXXXX 100644
++            result ^= (x << j);
---- a/target/riscv/insn_trans/trans_rvi.c.inc
++        }
-+++ b/target/riscv/insn_trans/trans_rvi.c.inc
++    }
-@@ -XXX,XX +XXX,XX @@ static bool gen_load_i128(DisasContext *ctx, arg_lb *a, MemOp memop)
++    return result;
++}
- static bool gen_load(DisasContext *ctx, arg_lb *a, MemOp memop)
++
- {
++static uint64_t clmulh64(uint64_t y, uint64_t x)
-+    bool out;
++{
-+
++    uint64_t result = 0;
-     decode_save_opc(ctx);
++    for (int j = 63; j >= 1; j--) {
-     if (get_xl(ctx) == MXL_RV128) {
++        if ((y >> j) & 1) {
--        return gen_load_i128(ctx, a, memop);
++            result ^= (x >> (64 - j));
-+        out = gen_load_i128(ctx, a, memop);
++        }
-     } else {
++    }
--        return gen_load_tl(ctx, a, memop);
++    return result;
-+        out = gen_load_tl(ctx, a, memop);
++}
-+    }
++
-+
++RVVCALL(OPIVV2, vclmul_vv, OP_UUU_D, H8, H8, H8, clmul64)
-+    if (ctx->ztso) {
++GEN_VEXT_VV(vclmul_vv, 8)
-+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
++RVVCALL(OPIVX2, vclmul_vx, OP_UUU_D, H8, H8, clmul64)
-     }
++GEN_VEXT_VX(vclmul_vx, 8)
-+
++RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
-+    return out;
++GEN_VEXT_VV(vclmulh_vv, 8)
- }
++RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
++GEN_VEXT_VX(vclmulh_vx, 8)
- static bool trans_lb(DisasContext *ctx, arg_lb *a)
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop)
+new file mode 100644
-     TCGv addr = get_address(ctx, a->rs1, a->imm);
+index XXXXXXX..XXXXXXX
-     TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
+--- /dev/null
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
-+    if (ctx->ztso) {
+@@ -XXX,XX +XXX,XX @@
-+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
++/*
-+    }
++ * RISC-V translation routines for the vector crypto extension.
-+
++ *
-     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
++ * Copyright (C) 2023 SiFive, Inc.
-     return true;
++ * Written by Codethink Ltd and SiFive.
- }
++ *
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
++ * This program is free software; you can redistribute it and/or modify it
-index XXXXXXX..XXXXXXX 100644
++ * under the terms and conditions of the GNU General Public License,
---- a/target/riscv/insn_trans/trans_rvv.c.inc
++ * version 2 or later, as published by the Free Software Foundation.
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
++ *
-@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
++ * This program is distributed in the hope it will be useful, but WITHOUT
-     tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-     tcg_gen_addi_ptr(mask, tcg_env, vreg_ofs(s, 0));
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
-+    /*
++ *
-+     * According to the specification
++ * You should have received a copy of the GNU General Public License along with
-+     *
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+     *   Additionally, if the Ztso extension is implemented, then vector memory
++ */
-+     *   instructions in the V extension and Zve family of extensions follow
++
-+     *   RVTSO at the instruction level.  The Ztso extension does not
++/*
-+     *   strengthen the ordering of intra-instruction element accesses.
++ * Zvbc
-+     *
++ */
-+     * as a result neither ordered nor unordered accesses from the V
++
-+     * instructions need ordering within the loop but we do still need barriers
++#define GEN_VV_MASKED_TRANS(NAME, CHECK)                     \
-+     * around the loop.
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+     */
++    {                                                        \
-+    if (is_store && s->ztso) {
++        if (CHECK(s, a)) {                                   \
-+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
++            return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, \
-+    }
++                               gen_helper_##NAME, s);        \
-+
++        }                                                    \
-     fn(dest, mask, base, tcg_env, desc);
++        return false;                                        \
++    }
-+    if (!is_store && s->ztso) {
++
-+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
++static bool vclmul_vv_check(DisasContext *s, arg_rmrr *a)
-+    }
++{
-+
++    return opivv_check(s, a) &&
-     if (!is_store) {
++           s->cfg_ptr->ext_zvbc == true &&
-         mark_vs_dirty(s);
++           s->sew == MO_64;
-     }
++}
 +
 +GEN_VV_MASKED_TRANS(vclmul_vv, vclmul_vv_check)
 +GEN_VV_MASKED_TRANS(vclmulh_vv, vclmul_vv_check)
 +
 +#define GEN_VX_MASKED_TRANS(NAME, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
 +    {                                                        \
 +        if (CHECK(s, a)) {                                   \
 +            return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, \
 +                               gen_helper_##NAME, s);        \
 +        }                                                    \
 +        return false;                                        \
 +    }
 +
 +static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return opivx_check(s, a) &&
 +           s->cfg_ptr->ext_zvbc == true &&
 +           s->sew == MO_64;
 +}
 +
 +GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 +GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
    'translate.c',
    'm128_helper.c',
    'crypto_helper.c',
 -  'zce_helper.c'
 +  'zce_helper.c',
 +  'vcrypto_helper.c'
  ))
  riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 --
-.44.0
+.41.0

-[PULL 29/34] trans_rvv.c.inc: remove 'is_store' bool from load/store fns
+[PULL v2 12/45] target/riscv: Move vector translation checks
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-After the 'mark_vs_dirty' changes from the previous patch the 'is_store'
+Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
-bool is unused in some load/store functions that were changed. Remove it.
+and into the corresponding macros. This enables the functions to be
 reused in proceeding commits without check duplication.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Message-ID: <20240306171932.549549-3-dbarboza@ventanamicro.com>
+Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 58 ++++++++++++-------------
+ target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
-file changed, 29 insertions(+), 29 deletions(-)
+file changed, 12 insertions(+), 16 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef void gen_helper_ldst_stride(TCGv_ptr, TCGv_ptr, TCGv,
+@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
+               gen_helper_gvec_4_ptr *fn)
  static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
                                uint32_t data, gen_helper_ldst_stride *fn,
 -                              DisasContext *s, bool is_store)
 +                              DisasContext *s)
  {
-     TCGv_ptr dest, mask;
+     TCGLabel *over = gen_new_label();
-     TCGv base, stride;
+-    if (!opivv_check(s, a)) {
-@@ -XXX,XX +XXX,XX @@ static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
+-        return false;
-     data = FIELD_DP32(data, VDATA, NF, a->nf);
+-    }
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
-     data = FIELD_DP32(data, VDATA, VMA, s->vma);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
--    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s, false);
-+    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
      };                                                             \
 +    if (!opivv_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
  }
- static bool ld_stride_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
+@@ -XXX,XX +XXX,XX @@ static inline bool
-@@ -XXX,XX +XXX,XX @@ static bool st_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
+ do_opivx_gvec(DisasContext *s, arg_rmrr *a, GVecGen2sFn *gvec_fn,
-         return false;
+               gen_helper_opivx *fn)
-     }
+ {
+-    if (!opivx_check(s, a)) {
--    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s, true);
+-        return false;
-+    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s);
+-    }
 -
      if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
          TCGv_i64 src1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
      };                                                             \
 +    if (!opivx_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
  }
- static bool st_stride_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
+@@ -XXX,XX +XXX,XX @@ static inline bool
-@@ -XXX,XX +XXX,XX @@ typedef void gen_helper_ldst_index(TCGv_ptr, TCGv_ptr, TCGv,
+ do_opivi_gvec(DisasContext *s, arg_rmrr *a, GVecGen2iFn *gvec_fn,
+               gen_helper_opivx *fn, imm_mode_t imm_mode)
  static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
                               uint32_t data, gen_helper_ldst_index *fn,
 -                             DisasContext *s, bool is_store)
 +                             DisasContext *s)
  {
-     TCGv_ptr dest, mask, index;
+-    if (!opivx_check(s, a)) {
-     TCGv base;
+-        return false;
-@@ -XXX,XX +XXX,XX @@ static bool ld_index_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
+-    }
-     data = FIELD_DP32(data, VDATA, NF, a->nf);
+-
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
-     data = FIELD_DP32(data, VDATA, VMA, s->vma);
+         gvec_fn(s->sew, vreg_ofs(s, a->rd), vreg_ofs(s, a->rs2),
--    return ldst_index_trans(a->rd, a->rs1, a->rs2, data, fn, s, false);
+                 extract_imm(s, a->rs1, imm_mode), MAXSZ(s), MAXSZ(s));
-+    return ldst_index_trans(a->rd, a->rs1, a->rs2, data, fn, s);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##OPIVX##_b, gen_helper_##OPIVX##_h,            \
          gen_helper_##OPIVX##_w, gen_helper_##OPIVX##_d,            \
      };                                                             \
 +    if (!opivx_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF,                 \
                           fns[s->sew], IMM_MODE);                   \
  }
+@@ -XXX,XX +XXX,XX @@ static inline bool
- static bool ld_index_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
+ do_opivx_gvec_shift(DisasContext *s, arg_rmrr *a, GVecGen2sFn32 *gvec_fn,
-@@ -XXX,XX +XXX,XX @@ static bool st_index_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
+                     gen_helper_opivx *fn)
-     data = FIELD_DP32(data, VDATA, VM, a->vm);
+ {
-     data = FIELD_DP32(data, VDATA, LMUL, emul);
+-    if (!opivx_check(s, a)) {
-     data = FIELD_DP32(data, VDATA, NF, a->nf);
+-        return false;
--    return ldst_index_trans(a->rd, a->rs1, a->rs2, data, fn, s, true);
+-    }
-+    return ldst_index_trans(a->rd, a->rs1, a->rs2, data, fn, s);
+-
      if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
          TCGv_i32 src1 = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,                     \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,                     \
      };                                                                    \
 -                                                                          \
 +    if (!opivx_check(s, a)) {                                             \
 +        return false;                                                     \
 +    }                                                                     \
      return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);    \
  }
- static bool st_index_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
-@@ -XXX,XX +XXX,XX @@ typedef void gen_helper_ldst_whole(TCGv_ptr, TCGv, TCGv_env, TCGv_i32);
- static bool ldst_whole_trans(uint32_t vd, uint32_t rs1, uint32_t nf,
-                              uint32_t width, gen_helper_ldst_whole *fn,
--                             DisasContext *s, bool is_store)
-+                             DisasContext *s)
- {
-     uint32_t evl = s->cfg_ptr->vlenb * nf / width;
-     TCGLabel *over = gen_new_label();
-@@ -XXX,XX +XXX,XX @@ static bool ldst_whole_trans(uint32_t vd, uint32_t rs1, uint32_t nf,
-  * load and store whole register instructions ignore vtype and vl setting.
-  * Thus, we don't need to check vill bit. (Section 7.9)
-  */
--#define GEN_LDST_WHOLE_TRANS(NAME, ARG_NF, WIDTH, IS_STORE)               \
-+#define GEN_LDST_WHOLE_TRANS(NAME, ARG_NF, WIDTH)               \
- static bool trans_##NAME(DisasContext *s, arg_##NAME * a)                 \
- {                                                                         \
-     if (require_rvv(s) &&                                                 \
-         QEMU_IS_ALIGNED(a->rd, ARG_NF)) {                                 \
-         return ldst_whole_trans(a->rd, a->rs1, ARG_NF, WIDTH,             \
--                                gen_helper_##NAME, s, IS_STORE);          \
-+                                gen_helper_##NAME, s);                    \
-     }                                                                     \
-     return false;                                                         \
- }
--GEN_LDST_WHOLE_TRANS(vl1re8_v,  1, 1, false)
--GEN_LDST_WHOLE_TRANS(vl1re16_v, 1, 2, false)
--GEN_LDST_WHOLE_TRANS(vl1re32_v, 1, 4, false)
--GEN_LDST_WHOLE_TRANS(vl1re64_v, 1, 8, false)
--GEN_LDST_WHOLE_TRANS(vl2re8_v,  2, 1, false)
--GEN_LDST_WHOLE_TRANS(vl2re16_v, 2, 2, false)
--GEN_LDST_WHOLE_TRANS(vl2re32_v, 2, 4, false)
--GEN_LDST_WHOLE_TRANS(vl2re64_v, 2, 8, false)
--GEN_LDST_WHOLE_TRANS(vl4re8_v,  4, 1, false)
--GEN_LDST_WHOLE_TRANS(vl4re16_v, 4, 2, false)
--GEN_LDST_WHOLE_TRANS(vl4re32_v, 4, 4, false)
--GEN_LDST_WHOLE_TRANS(vl4re64_v, 4, 8, false)
--GEN_LDST_WHOLE_TRANS(vl8re8_v,  8, 1, false)
--GEN_LDST_WHOLE_TRANS(vl8re16_v, 8, 2, false)
--GEN_LDST_WHOLE_TRANS(vl8re32_v, 8, 4, false)
--GEN_LDST_WHOLE_TRANS(vl8re64_v, 8, 8, false)
-+GEN_LDST_WHOLE_TRANS(vl1re8_v,  1, 1)
-+GEN_LDST_WHOLE_TRANS(vl1re16_v, 1, 2)
-+GEN_LDST_WHOLE_TRANS(vl1re32_v, 1, 4)
-+GEN_LDST_WHOLE_TRANS(vl1re64_v, 1, 8)
-+GEN_LDST_WHOLE_TRANS(vl2re8_v,  2, 1)
-+GEN_LDST_WHOLE_TRANS(vl2re16_v, 2, 2)
-+GEN_LDST_WHOLE_TRANS(vl2re32_v, 2, 4)
-+GEN_LDST_WHOLE_TRANS(vl2re64_v, 2, 8)
-+GEN_LDST_WHOLE_TRANS(vl4re8_v,  4, 1)
-+GEN_LDST_WHOLE_TRANS(vl4re16_v, 4, 2)
-+GEN_LDST_WHOLE_TRANS(vl4re32_v, 4, 4)
-+GEN_LDST_WHOLE_TRANS(vl4re64_v, 4, 8)
-+GEN_LDST_WHOLE_TRANS(vl8re8_v,  8, 1)
-+GEN_LDST_WHOLE_TRANS(vl8re16_v, 8, 2)
-+GEN_LDST_WHOLE_TRANS(vl8re32_v, 8, 4)
-+GEN_LDST_WHOLE_TRANS(vl8re64_v, 8, 8)
- /*
-  * The vector whole register store instructions are encoded similar to
-  * unmasked unit-stride store of elements with EEW=8.
-  */
--GEN_LDST_WHOLE_TRANS(vs1r_v, 1, 1, true)
--GEN_LDST_WHOLE_TRANS(vs2r_v, 2, 1, true)
--GEN_LDST_WHOLE_TRANS(vs4r_v, 4, 1, true)
--GEN_LDST_WHOLE_TRANS(vs8r_v, 8, 1, true)
-+GEN_LDST_WHOLE_TRANS(vs1r_v, 1, 1)
-+GEN_LDST_WHOLE_TRANS(vs2r_v, 2, 1)
-+GEN_LDST_WHOLE_TRANS(vs4r_v, 4, 1)
-+GEN_LDST_WHOLE_TRANS(vs8r_v, 8, 1)
- /*
-  *** Vector Integer Arithmetic Instructions
 --
-.44.0
+.41.0

-[PULL 02/34] hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location
+[PULL v2 13/45] target/riscv: Refactor translation of vector-widening instruction
-From: Sia Jee Heng <jeeheng.sia@starfivetech.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-RISC-V should also generate the SPCR in a manner similar to ARM.
+Zvbb (implemented in later commit) has a widening instruction, which
-Therefore, instead of replicating the code, relocate this function
+requires an extra check on the enabled extensions.  Refactor
-to the common AML build.
+GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
 it.
-Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
+Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-ID: <20240129021440.17640-2-jeeheng.sia@starfivetech.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-[ Changes by AF:
+Signed-off-by: Max Chou <max.chou@sifive.com>
- - Add missing Language SPCR entry
+Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
 ]
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/acpi/acpi-defs.h | 33 ++++++++++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
- include/hw/acpi/aml-build.h |  4 +++
+file changed, 23 insertions(+), 29 deletions(-)
  hw/acpi/aml-build.c         | 53 +++++++++++++++++++++++++++++
  hw/arm/virt-acpi-build.c    | 68 +++++++++++++++----------------------
 files changed, 117 insertions(+), 41 deletions(-)
-diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/acpi/acpi-defs.h
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/include/hw/acpi/acpi-defs.h
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef struct AcpiFadtData {
+@@ -XXX,XX +XXX,XX @@ static bool opivx_widen_check(DisasContext *s, arg_rmrr *a)
-     unsigned *xdsdt_tbl_offset;
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
  } AcpiFadtData;
 +typedef struct AcpiGas {
 +    uint8_t id;                /* Address space ID */
 +    uint8_t width;             /* Register bit width */
 +    uint8_t offset;            /* Register bit offset */
 +    uint8_t size;              /* Access size */
 +    uint64_t addr;             /* Address */
 +} AcpiGas;
 +
 +/* SPCR (Serial Port Console Redirection table) */
 +typedef struct AcpiSpcrData {
 +    uint8_t interface_type;
 +    uint8_t reserved[3];
 +    struct AcpiGas base_addr;
 +    uint8_t interrupt_type;
 +    uint8_t pc_interrupt;
 +    uint32_t interrupt;        /* Global system interrupt */
 +    uint8_t baud_rate;
 +    uint8_t parity;
 +    uint8_t stop_bits;
 +    uint8_t flow_control;
 +    uint8_t terminal_type;
 +    uint8_t language;
 +    uint8_t reserved1;
 +    uint16_t pci_device_id;    /* Must be 0xffff if not PCI device */
 +    uint16_t pci_vendor_id;    /* Must be 0xffff if not PCI device */
 +    uint8_t pci_bus;
 +    uint8_t pci_device;
 +    uint8_t pci_function;
 +    uint32_t pci_flags;
 +    uint8_t pci_segment;
 +    uint32_t reserved2;
 +} AcpiSpcrData;
 +
  #define ACPI_FADT_ARM_PSCI_COMPLIANT  (1 << 0)
  #define ACPI_FADT_ARM_PSCI_USE_HVC    (1 << 1)
 diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/acpi/aml-build.h
 +++ b/include/hw/acpi/aml-build.h
@@ -XXX,XX +XXX,XX @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const AcpiFadtData *f,
  void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog,
                  const char *oem_id, const char *oem_table_id);
 +
 +void build_spcr(GArray *table_data, BIOSLinker *linker,
 +                const AcpiSpcrData *f, const uint8_t rev,
 +                const char *oem_id, const char *oem_table_id);
  #endif
 diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/acpi/aml-build.c
 +++ b/hw/acpi/aml-build.c
@@ -XXX,XX +XXX,XX @@ static void build_processor_hierarchy_node(GArray *tbl, uint32_t flags,
      }
  }
-+void build_spcr(GArray *table_data, BIOSLinker *linker,
+-static bool do_opivx_widen(DisasContext *s, arg_rmrr *a,
-+                const AcpiSpcrData *f, const uint8_t rev,
+-                           gen_helper_opivx *fn)
-+                const char *oem_id, const char *oem_table_id)
+-{
-+{
+-    if (opivx_widen_check(s, a)) {
-+    AcpiTable table = { .sig = "SPCR", .rev = rev, .oem_id = oem_id,
+-        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fn, s);
-+                        .oem_table_id = oem_table_id };
+-    }
-+
+-    return false;
-+    acpi_table_begin(&table, table_data);
+-}
 +    /* Interface type */
 +    build_append_int_noprefix(table_data, f->interface_type, 1);
 +    /* Reserved */
 +    build_append_int_noprefix(table_data, 0, 3);
 +    /* Base Address */
 +    build_append_gas(table_data, f->base_addr.id, f->base_addr.width,
 +                     f->base_addr.offset, f->base_addr.size,
 +                     f->base_addr.addr);
 +    /* Interrupt type */
 +    build_append_int_noprefix(table_data, f->interrupt_type, 1);
 +    /* IRQ */
 +    build_append_int_noprefix(table_data, f->pc_interrupt, 1);
 +    /* Global System Interrupt */
 +    build_append_int_noprefix(table_data, f->interrupt, 4);
 +    /* Baud Rate */
 +    build_append_int_noprefix(table_data, f->baud_rate, 1);
 +    /* Parity */
 +    build_append_int_noprefix(table_data, f->parity, 1);
 +    /* Stop Bits */
 +    build_append_int_noprefix(table_data, f->stop_bits, 1);
 +    /* Flow Control */
 +    build_append_int_noprefix(table_data, f->flow_control, 1);
 +    /* Language */
 +    build_append_int_noprefix(table_data, f->language, 1);
 +    /* Terminal Type */
 +    build_append_int_noprefix(table_data, f->terminal_type, 1);
 +    /* PCI Device ID  */
 +    build_append_int_noprefix(table_data, f->pci_device_id, 2);
 +    /* PCI Vendor ID */
 +    build_append_int_noprefix(table_data, f->pci_vendor_id, 2);
 +    /* PCI Bus Number */
 +    build_append_int_noprefix(table_data, f->pci_bus, 1);
 +    /* PCI Device Number */
 +    build_append_int_noprefix(table_data, f->pci_device, 1);
 +    /* PCI Function Number */
 +    build_append_int_noprefix(table_data, f->pci_function, 1);
 +    /* PCI Flags */
 +    build_append_int_noprefix(table_data, f->pci_flags, 4);
 +    /* PCI Segment */
 +    build_append_int_noprefix(table_data, f->pci_segment, 1);
 +    /* Reserved */
 +    build_append_int_noprefix(table_data, 0, 4);
 +
 +    acpi_table_end(linker, &table);
 +}
  /*
   * ACPI spec, Revision 6.3
   * 5.2.29 Processor Properties Topology Table (PPTT)
 diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt-acpi-build.c
 +++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
   * Rev: 1.07
   */
  static void
 -build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 +spcr_setup(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
  {
 -    AcpiTable table = { .sig = "SPCR", .rev = 2, .oem_id = vms->oem_id,
 -                        .oem_table_id = vms->oem_table_id };
 -
--    acpi_table_begin(&table, table_data);
+-#define GEN_OPIVX_WIDEN_TRANS(NAME) \
--
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
--    /* Interface Type */
+-{                                                            \
--    build_append_int_noprefix(table_data, 3, 1); /* ARM PL011 UART */
+-    static gen_helper_opivx * const fns[3] = {               \
--    build_append_int_noprefix(table_data, 0, 3); /* Reserved */
+-        gen_helper_##NAME##_b,                               \
--    /* Base Address */
+-        gen_helper_##NAME##_h,                               \
--    build_append_gas(table_data, AML_AS_SYSTEM_MEMORY, 32, 0, 3,
+-        gen_helper_##NAME##_w                                \
--                     vms->memmap[VIRT_UART].base);
+-    };                                                       \
--    /* Interrupt Type */
+-    return do_opivx_widen(s, a, fns[s->sew]);                \
--    build_append_int_noprefix(table_data,
++#define GEN_OPIVX_WIDEN_TRANS(NAME, CHECK) \
--        (1 << 3) /* Bit[3] ARMH GIC interrupt */, 1);
++static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
--    build_append_int_noprefix(table_data, 0, 1); /* IRQ */
++{                                                                         \
--    /* Global System Interrupt */
++    if (CHECK(s, a)) {                                                    \
--    build_append_int_noprefix(table_data,
++        static gen_helper_opivx * const fns[3] = {                        \
--                              vms->irqmap[VIRT_UART] + ARM_SPI_BASE, 4);
++            gen_helper_##NAME##_b,                                        \
--    build_append_int_noprefix(table_data, 3 /* 9600 */, 1); /* Baud Rate */
++            gen_helper_##NAME##_h,                                        \
--    build_append_int_noprefix(table_data, 0 /* No Parity */, 1); /* Parity */
++            gen_helper_##NAME##_w                                         \
--    /* Stop Bits */
++        };                                                                \
--    build_append_int_noprefix(table_data, 1 /* 1 Stop bit */, 1);
++        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s); \
--    /* Flow Control */
++    }                                                                     \
--    build_append_int_noprefix(table_data,
++    return false;                                                         \
 -        (1 << 1) /* RTS/CTS hardware flow control */, 1);
 -    /* Terminal Type */
 -    build_append_int_noprefix(table_data, 0 /* VT100 */, 1);
 -    build_append_int_noprefix(table_data, 0, 1); /* Language */
 -    /* PCI Device ID  */
 -    build_append_int_noprefix(table_data, 0xffff /* not a PCI device*/, 2);
 -    /* PCI Vendor ID */
 -    build_append_int_noprefix(table_data, 0xffff /* not a PCI device*/, 2);
 -    build_append_int_noprefix(table_data, 0, 1); /* PCI Bus Number */
 -    build_append_int_noprefix(table_data, 0, 1); /* PCI Device Number */
 -    build_append_int_noprefix(table_data, 0, 1); /* PCI Function Number */
 -    build_append_int_noprefix(table_data, 0, 4); /* PCI Flags */
 -    build_append_int_noprefix(table_data, 0, 1); /* PCI Segment */
 -    build_append_int_noprefix(table_data, 0, 4); /* Reserved */
 +    AcpiSpcrData serial = {
 +        .interface_type = 3,       /* ARM PL011 UART */
 +        .base_addr.id = AML_AS_SYSTEM_MEMORY,
 +        .base_addr.width = 32,
 +        .base_addr.offset = 0,
 +        .base_addr.size = 3,
 +        .base_addr.addr = vms->memmap[VIRT_UART].base,
 +        .interrupt_type = (1 << 3),/* Bit[3] ARMH GIC interrupt*/
 +        .pc_interrupt = 0,         /* IRQ */
 +        .interrupt = (vms->irqmap[VIRT_UART] + ARM_SPI_BASE),
 +        .baud_rate = 3,            /* 9600 */
 +        .parity = 0,               /* No Parity */
 +        .stop_bits = 1,            /* 1 Stop bit */
 +        .flow_control = 1 << 1,    /* RTS/CTS hardware flow control */
 +        .terminal_type = 0,        /* VT100 */
 +        .language = 0,             /* Language */
 +        .pci_device_id = 0xffff,   /* not a PCI device*/
 +        .pci_vendor_id = 0xffff,   /* not a PCI device*/
 +        .pci_bus = 0,
 +        .pci_device = 0,
 +        .pci_function = 0,
 +        .pci_flags = 0,
 +        .pci_segment = 0,
 +    };
 -    acpi_table_end(linker, &table);
 +    build_spcr(table_data, linker, &serial, 2, vms->oem_id, vms->oem_table_id);
  }
- /*
+-GEN_OPIVX_WIDEN_TRANS(vwaddu_vx)
-@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
+-GEN_OPIVX_WIDEN_TRANS(vwadd_vx)
-     }
+-GEN_OPIVX_WIDEN_TRANS(vwsubu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwsub_vx)
-     acpi_add_table(table_offsets, tables_blob);
++GEN_OPIVX_WIDEN_TRANS(vwaddu_vx, opivx_widen_check)
--    build_spcr(tables_blob, tables->linker, vms);
++GEN_OPIVX_WIDEN_TRANS(vwadd_vx, opivx_widen_check)
-+    spcr_setup(tables_blob, tables->linker, vms);
++GEN_OPIVX_WIDEN_TRANS(vwsubu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsub_vx, opivx_widen_check)
-     acpi_add_table(table_offsets, tables_blob);
-     build_dbg2(tables_blob, tables->linker, vms);
+ /* WIDEN OPIVV with WIDEN */
  static bool opiwv_widen_check(DisasContext *s, arg_rmrr *a)
@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vrem_vx, opivx_check)
  GEN_OPIVV_WIDEN_TRANS(vwmul_vv, opivv_widen_check)
  GEN_OPIVV_WIDEN_TRANS(vwmulu_vv, opivv_widen_check)
  GEN_OPIVV_WIDEN_TRANS(vwmulsu_vv, opivv_widen_check)
 -GEN_OPIVX_WIDEN_TRANS(vwmul_vx)
 -GEN_OPIVX_WIDEN_TRANS(vwmulu_vx)
 -GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx)
 +GEN_OPIVX_WIDEN_TRANS(vwmul_vx, opivx_widen_check)
 +GEN_OPIVX_WIDEN_TRANS(vwmulu_vx, opivx_widen_check)
 +GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx, opivx_widen_check)
  /* Vector Single-Width Integer Multiply-Add Instructions */
  GEN_OPIVV_TRANS(vmacc_vv, opivv_check)
@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vnmsub_vx, opivx_check)
  GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_widen_check)
  GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_widen_check)
  GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_widen_check)
 -GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx)
 -GEN_OPIVX_WIDEN_TRANS(vwmacc_vx)
 -GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx)
 -GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx)
 +GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_widen_check)
 +GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_widen_check)
 +GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_widen_check)
 +GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_widen_check)
  /* Vector Integer Merge and Move Instructions */
  static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
 --
-.44.0
+.41.0

-New patch
+[PULL v2 14/45] target/riscv: Refactor some of the generic vector functionality
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Move some macros out of `vector_helper` and into `vector_internals`.
+This ensures they can be used by both vector and vector-crypto helpers
+(latter implemented in proceeding commits).
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c    | 42 ------------------------------
+files changed, 46 insertions(+), 42 deletions(-)
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_internals.h
++++ b/target/riscv/vector_internals.h
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+ /* expand macro args before macro */
+ #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
++/* (TD, T2, TX2) */
++#define OP_UU_B uint8_t, uint8_t, uint8_t
++#define OP_UU_H uint16_t, uint16_t, uint16_t
++#define OP_UU_W uint32_t, uint32_t, uint32_t
++#define OP_UU_D uint64_t, uint64_t, uint64_t
++
+ /* (TD, T1, T2, TX1, TX2) */
+ #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+ #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+ #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+ #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
++#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
++static void do_##NAME(void *vd, void *vs2, int i)      \
++{                                                      \
++    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
++    *((TD *)vd + HD(i)) = OP(s2);                      \
++}
++
++#define GEN_VEXT_V(NAME, ESZ)                          \
++void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
++                  CPURISCVState *env, uint32_t desc)   \
++{                                                      \
++    uint32_t vm = vext_vm(desc);                       \
++    uint32_t vl = env->vl;                             \
++    uint32_t total_elems =                             \
++        vext_get_total_elems(env, desc, ESZ);          \
++    uint32_t vta = vext_vta(desc);                     \
++    uint32_t vma = vext_vma(desc);                     \
++    uint32_t i;                                        \
++                                                       \
++    for (i = env->vstart; i < vl; i++) {               \
++        if (!vm && !vext_elem_mask(v0, i)) {           \
++            /* set masked-off elements to 1s */        \
++            vext_set_elems_1s(vd, vma, i * ESZ,        \
++                              (i + 1) * ESZ);          \
++            continue;                                  \
++        }                                              \
++        do_##NAME(vd, vs2, i);                         \
++    }                                                  \
++    env->vstart = 0;                                   \
++    /* set tail elements to 1s */                      \
++    vext_set_elems_1s(vd, vta, vl * ESZ,               \
++                      total_elems * ESZ);              \
++}
++
+ /* operation of two vector elements */
+ typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                do_##NAME, ESZ);                           \
+ }
++/* Three of the widening shortening macros: */
++/* (TD, T1, T2, TX1, TX2) */
++#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
++#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
++#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
++
+ #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
+ #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
+-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+ #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
+ #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
+ #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
+ GEN_VEXT_VF(vfwnmsac_vf_w, 8)
+ /* Vector Floating-Point Square-Root Instruction */
+-/* (TD, T2, TX2) */
+-#define OP_UU_H uint16_t, uint16_t, uint16_t
+-#define OP_UU_W uint32_t, uint32_t, uint32_t
+-#define OP_UU_D uint64_t, uint64_t, uint64_t
+-
+ #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+ static void do_##NAME(void *vd, void *vs2, int i,      \
+                       CPURISCVState *env)              \
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
+ GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
+ /* Vector Floating-Point Classify Instruction */
+-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+-static void do_##NAME(void *vd, void *vs2, int i)      \
+-{                                                      \
+-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+-    *((TD *)vd + HD(i)) = OP(s2);                      \
+-}
+-
+-#define GEN_VEXT_V(NAME, ESZ)                          \
+-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+-                  CPURISCVState *env, uint32_t desc)   \
+-{                                                      \
+-    uint32_t vm = vext_vm(desc);                       \
+-    uint32_t vl = env->vl;                             \
+-    uint32_t total_elems =                             \
+-        vext_get_total_elems(env, desc, ESZ);          \
+-    uint32_t vta = vext_vta(desc);                     \
+-    uint32_t vma = vext_vma(desc);                     \
+-    uint32_t i;                                        \
+-                                                       \
+-    for (i = env->vstart; i < vl; i++) {               \
+-        if (!vm && !vext_elem_mask(v0, i)) {           \
+-            /* set masked-off elements to 1s */        \
+-            vext_set_elems_1s(vd, vma, i * ESZ,        \
+-                              (i + 1) * ESZ);          \
+-            continue;                                  \
+-        }                                              \
+-        do_##NAME(vd, vs2, i);                         \
+-    }                                                  \
+-    env->vstart = 0;                                   \
+-    /* set tail elements to 1s */                      \
+-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+-                      total_elems * ESZ);              \
+-}
+-
+ target_ulong fclass_h(uint64_t frs1)
+ {
+     float16 f = frs1;
+--
+.41.0

-[PULL 20/34] tests/libqos: add riscv/virt machine nodes
+[PULL v2 15/45] target/riscv: Add Zvbb ISA extension support
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-Add a RISC-V 'virt' machine to the graph. This implementation is a
+This commit adds support for the Zvbb vector-crypto extension, which
-modified copy of the existing arm machine in arm-virt-machine.c
+consists of the following instructions:
-It contains a virtio-mmio and a generic-pcihost controller. The
+* vrol.[vv,vx]
-generic-pcihost controller hardcodes assumptions from the ARM 'virt'
+* vror.[vv,vx,vi]
-machine, like ecam and pio_base addresses, so we'll add an extra step to
+* vbrev8.v
-set its parameters after creating it.
+* vrev8.v
 * vandn.[vv,vx]
 * vbrev.v
 * vclz.v
 * vctz.v
 * vcpop.v
 * vwsll.[vv,vx,vi]
-Our command line is incremented with 'aclint' parameters to allow the
+Translation functions are defined in
-machine to run MSI tests.
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
-Acked-by: Thomas Huth <thuth@redhat.com>
+Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Message-ID: <20240217192607.32565-7-dbarboza@ventanamicro.com>
+[max.chou@sifive.com: Fix imm mode of vror.vi]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvbb property]
 Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- tests/qtest/libqos/riscv-virt-machine.c | 137 ++++++++++++++++++++++++
+ target/riscv/cpu_cfg.h                   |   1 +
- tests/qtest/libqos/meson.build          |   1 +
+ target/riscv/helper.h                    |  62 +++++++++
-files changed, 138 insertions(+)
+ target/riscv/insn32.decode               |  20 +++
- create mode 100644 tests/qtest/libqos/riscv-virt-machine.c
+ target/riscv/cpu.c                       |  12 ++
  target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 files changed, 397 insertions(+)
-diff --git a/tests/qtest/libqos/riscv-virt-machine.c b/tests/qtest/libqos/riscv-virt-machine.c
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/riscv/cpu_cfg.h
---- /dev/null
++++ b/target/riscv/cpu_cfg.h
-+++ b/tests/qtest/libqos/riscv-virt-machine.c
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve32f;
      bool ext_zve64f;
      bool ext_zve64d;
 +    bool ext_zvbb;
      bool ext_zvbc;
      bool ext_zmmul;
      bool ext_zvfbfmin;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
 @@ -XXX,XX +XXX,XX @@
+ %imm_u    12:s20                 !function=ex_shift_12
+ %imm_bs   30:2                   !function=ex_shift_3
+ %imm_rnum 20:4
++%imm_z6   26:1 15:5
+ # Argument sets:
+ &empty
+@@ -XXX,XX +XXX,XX @@
+ @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
+ @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
+ @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
++@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
+ @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
+ @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
+ @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
+@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
+ vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
+ vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
+ vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
++
++# *** Zvbb vector crypto extension ***
++vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
++vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
++vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
++vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
++vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
++vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
++vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
++vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
++vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
++vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
++vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
++vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
++vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
++vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
++vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
++vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
+     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
+     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
++    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
+     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+         return;
+     }
++    /*
++     * In principle Zve*x would also suffice here, were they supported
++     * in qemu
++     */
++    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
++        error_setg(errp,
++                   "Vector crypto extensions require V or Zve* extensions");
++        return;
++    }
++
+     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
+         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
+         return;
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
+     /* Vector cryptography extensions */
++    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+     DEFINE_PROP_END_OF_LIST(),
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vcrypto_helper.c
++++ b/target/riscv/vcrypto_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/host-utils.h"
+ #include "qemu/bitops.h"
++#include "qemu/bswap.h"
+ #include "cpu.h"
+ #include "exec/memop.h"
+ #include "exec/exec-all.h"
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
+ GEN_VEXT_VV(vclmulh_vv, 8)
+ RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
+ GEN_VEXT_VX(vclmulh_vx, 8)
++
++RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
++RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
++RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
++RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
++GEN_VEXT_VV(vror_vv_b, 1)
++GEN_VEXT_VV(vror_vv_h, 2)
++GEN_VEXT_VV(vror_vv_w, 4)
++GEN_VEXT_VV(vror_vv_d, 8)
++
++RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
++RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
++RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
++RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
++GEN_VEXT_VX(vror_vx_b, 1)
++GEN_VEXT_VX(vror_vx_h, 2)
++GEN_VEXT_VX(vror_vx_w, 4)
++GEN_VEXT_VX(vror_vx_d, 8)
++
++RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
++RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
++RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
++RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
++GEN_VEXT_VV(vrol_vv_b, 1)
++GEN_VEXT_VV(vrol_vv_h, 2)
++GEN_VEXT_VV(vrol_vv_w, 4)
++GEN_VEXT_VV(vrol_vv_d, 8)
++
++RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
++RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
++RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
++RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
++GEN_VEXT_VX(vrol_vx_b, 1)
++GEN_VEXT_VX(vrol_vx_h, 2)
++GEN_VEXT_VX(vrol_vx_w, 4)
++GEN_VEXT_VX(vrol_vx_d, 8)
++
++static uint64_t brev8(uint64_t val)
++{
++    val = ((val & 0x5555555555555555ull) << 1) |
++          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
++    val = ((val & 0x3333333333333333ull) << 2) |
++          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
++    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
++          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
++
++    return val;
++}
++
++RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
++RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
++RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
++RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
++GEN_VEXT_V(vbrev8_v_b, 1)
++GEN_VEXT_V(vbrev8_v_h, 2)
++GEN_VEXT_V(vbrev8_v_w, 4)
++GEN_VEXT_V(vbrev8_v_d, 8)
++
++#define DO_IDENTITY(a) (a)
++RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
++RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
++RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
++RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
++GEN_VEXT_V(vrev8_v_b, 1)
++GEN_VEXT_V(vrev8_v_h, 2)
++GEN_VEXT_V(vrev8_v_w, 4)
++GEN_VEXT_V(vrev8_v_d, 8)
++
++#define DO_ANDN(a, b) ((a) & ~(b))
++RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
++RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
++RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
++RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
++GEN_VEXT_VV(vandn_vv_b, 1)
++GEN_VEXT_VV(vandn_vv_h, 2)
++GEN_VEXT_VV(vandn_vv_w, 4)
++GEN_VEXT_VV(vandn_vv_d, 8)
++
++RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
++RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
++RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
++RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
++GEN_VEXT_VX(vandn_vx_b, 1)
++GEN_VEXT_VX(vandn_vx_h, 2)
++GEN_VEXT_VX(vandn_vx_w, 4)
++GEN_VEXT_VX(vandn_vx_d, 8)
++
++RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
++RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
++RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
++RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
++GEN_VEXT_V(vbrev_v_b, 1)
++GEN_VEXT_V(vbrev_v_h, 2)
++GEN_VEXT_V(vbrev_v_w, 4)
++GEN_VEXT_V(vbrev_v_d, 8)
++
++RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
++RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
++RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
++RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
++GEN_VEXT_V(vclz_v_b, 1)
++GEN_VEXT_V(vclz_v_h, 2)
++GEN_VEXT_V(vclz_v_w, 4)
++GEN_VEXT_V(vclz_v_d, 8)
++
++RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
++RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
++RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
++RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
++GEN_VEXT_V(vctz_v_b, 1)
++GEN_VEXT_V(vctz_v_h, 2)
++GEN_VEXT_V(vctz_v_w, 4)
++GEN_VEXT_V(vctz_v_d, 8)
++
++RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
++RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
++RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
++RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
++GEN_VEXT_V(vcpop_v_b, 1)
++GEN_VEXT_V(vcpop_v_h, 2)
++GEN_VEXT_V(vcpop_v_w, 4)
++GEN_VEXT_V(vcpop_v_d, 8)
++
++#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
++RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
++RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
++RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
++GEN_VEXT_VV(vwsll_vv_b, 2)
++GEN_VEXT_VV(vwsll_vv_h, 4)
++GEN_VEXT_VV(vwsll_vv_w, 8)
++
++RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
++RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
++RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
++GEN_VEXT_VX(vwsll_vx_b, 2)
++GEN_VEXT_VX(vwsll_vx_h, 4)
++GEN_VEXT_VX(vwsll_vx_w, 8)
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvvk.c.inc
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
+ GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
+ GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
++
 +/*
-+ * libqos driver framework for risc-v
++ * Zvbb
 + *
 + * Initial version based on arm-virt-machine.c
 + *
 + * Copyright (c) 2024 Ventana Micro
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License version 2.1 as published by the Free Software Foundation.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>
 + */
 +
-+#include "qemu/osdep.h"
++#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
-+#include "../libqtest.h"
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
-+#include "qemu/module.h"
++    {                                                                   \
-+#include "libqos-malloc.h"
++        if (CHECK(s, a)) {                                              \
-+#include "qgraph.h"
++            static gen_helper_opivx *const fns[4] = {                   \
-+#include "virtio-mmio.h"
++                gen_helper_##OPIVX##_b,                                 \
-+#include "generic-pcihost.h"
++                gen_helper_##OPIVX##_h,                                 \
-+#include "hw/pci/pci_regs.h"
++                gen_helper_##OPIVX##_w,                                 \
-+
++                gen_helper_##OPIVX##_d,                                 \
-+#define RISCV_PAGE_SIZE            4096
++            };                                                          \
-+
++            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
-+/* VIRT_DRAM */
++                                 IMM_MODE);                             \
-+#define RISCV_VIRT_RAM_ADDR        0x80000000
++        }                                                               \
-+#define RISCV_VIRT_RAM_SIZE        0x20000000
++        return false;                                                   \
-+
++    }
-+/*
++
-+ * VIRT_VIRTIO. BASE_ADDR  points to the last
++#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
-+ * virtio_mmio device.
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
-+ */
++    {                                                                    \
-+#define VIRTIO_MMIO_BASE_ADDR      0x10008000
++        if (CHECK(s, a)) {                                               \
-+#define VIRTIO_MMIO_SIZE           0x00001000
++            static gen_helper_gvec_4_ptr *const fns[4] = {               \
-+
++                gen_helper_##NAME##_b,                                   \
-+/* VIRT_PCIE_PIO  */
++                gen_helper_##NAME##_h,                                   \
-+#define RISCV_GPEX_PIO_BASE        0x3000000
++                gen_helper_##NAME##_w,                                   \
-+#define RISCV_BUS_PIO_LIMIT        0x10000
++                gen_helper_##NAME##_d,                                   \
-+
++            };                                                           \
-+/* VIRT_PCIE_MMIO */
++            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
-+#define RISCV_BUS_MMIO_ALLOC_PTR   0x40000000
++        }                                                                \
-+#define RISCV_BUS_MMIO_LIMIT       0x80000000
++        return false;                                                    \
-+
++    }
-+/* VIRT_PCIE_ECAM */
++
-+#define RISCV_ECAM_ALLOC_PTR   0x30000000
++#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
-+
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
-+typedef struct QVirtMachine QVirtMachine;
++    {                                                            \
-+
++        if (CHECK(s, a)) {                                       \
-+struct QVirtMachine {
++            static gen_helper_opivx *const fns[4] = {            \
-+    QOSGraphObject obj;
++                gen_helper_##NAME##_b,                           \
-+    QGuestAllocator alloc;
++                gen_helper_##NAME##_h,                           \
-+    QVirtioMMIODevice virtio_mmio;
++                gen_helper_##NAME##_w,                           \
-+    QGenericPCIHost bridge;
++                gen_helper_##NAME##_d,                           \
-+};
++            };                                                   \
-+
++            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
-+static void virt_destructor(QOSGraphObject *obj)
++                                       fns[s->sew]);             \
 +        }                                                        \
 +        return false;                                            \
 +    }
 +
 +static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
 +{
-+    QVirtMachine *machine = (QVirtMachine *) obj;
++    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +    alloc_destroy(&machine->alloc);
 +}
 +
-+static void *virt_get_driver(void *object, const char *interface)
++static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
 +{
-+    QVirtMachine *machine = object;
++    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +    if (!g_strcmp0(interface, "memory")) {
 +        return &machine->alloc;
 +    }
 +
 +    fprintf(stderr, "%s not present in riscv/virtio\n", interface);
 +    g_assert_not_reached();
 +}
 +
-+static QOSGraphObject *virt_get_device(void *obj, const char *device)
++/* vrol.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
 +
 +/* vror.v[vxi] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
 +GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
 +
 +#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_opivx *const fns[4] = {                    \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +/* vandn.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
 +GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
 +
 +#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
 +    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
 +    {                                                                      \
 +        if (CHECK(s, a)) {                                                 \
 +            uint32_t data = 0;                                             \
 +            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
 +                gen_helper_##NAME##_b,                                     \
 +                gen_helper_##NAME##_h,                                     \
 +                gen_helper_##NAME##_w,                                     \
 +                gen_helper_##NAME##_d,                                     \
 +            };                                                             \
 +            TCGLabel *over = gen_new_label();                              \
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
 +                                                                           \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
 +                               vreg_ofs(s, a->rs2), cpu_env,               \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
 +                               data, fns[s->sew]);                         \
 +            mark_vs_dirty(s);                                              \
 +            gen_set_label(over);                                           \
 +            return true;                                                   \
 +        }                                                                  \
 +        return false;                                                      \
 +    }
 +
 +static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
 +{
-+    QVirtMachine *machine = obj;
++    return s->cfg_ptr->ext_zvbb == true &&
-+    if (!g_strcmp0(device, "generic-pcihost")) {
++           require_rvv(s) &&
-+        return &machine->bridge.obj;
++           vext_check_isa_ill(s) &&
-+    } else if (!g_strcmp0(device, "virtio-mmio")) {
++           vext_check_ss(s, a->rd, a->rs2, a->vm);
 +        return &machine->virtio_mmio.obj;
 +    }
 +
 +    fprintf(stderr, "%s not present in riscv/virt\n", device);
 +    g_assert_not_reached();
 +}
 +
-+static void riscv_config_qpci_bus(QGenericPCIBus *qpci)
++GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
 +
 +static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
 +{
-+    qpci->gpex_pio_base = RISCV_GPEX_PIO_BASE;
++    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
 +    qpci->bus.pio_limit = RISCV_BUS_PIO_LIMIT;
 +
 +    qpci->bus.mmio_alloc_ptr = RISCV_BUS_MMIO_ALLOC_PTR;
 +    qpci->bus.mmio_limit = RISCV_BUS_MMIO_LIMIT;
 +
 +    qpci->ecam_alloc_ptr = RISCV_ECAM_ALLOC_PTR;
 +}
 +
-+static void *qos_create_machine_riscv_virt(QTestState *qts)
++static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 +{
-+    QVirtMachine *machine = g_new0(QVirtMachine, 1);
++    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
 +
 +    alloc_init(&machine->alloc, 0,
 +               RISCV_VIRT_RAM_ADDR,
 +               RISCV_VIRT_RAM_ADDR + RISCV_VIRT_RAM_SIZE,
 +               RISCV_PAGE_SIZE);
 +    qvirtio_mmio_init_device(&machine->virtio_mmio, qts, VIRTIO_MMIO_BASE_ADDR,
 +                              VIRTIO_MMIO_SIZE);
 +
 +    qos_create_generic_pcihost(&machine->bridge, qts, &machine->alloc);
 +    riscv_config_qpci_bus(&machine->bridge.pci);
 +
 +    machine->obj.get_device = virt_get_device;
 +    machine->obj.get_driver = virt_get_driver;
 +    machine->obj.destructor = virt_destructor;
 +    return machine;
 +}
 +
-+static void virt_machine_register_nodes(void)
++/* OPIVI without GVEC IR */
-+{
++#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
-+    qos_node_create_machine_args("riscv32/virt", qos_create_machine_riscv_virt,
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
-+                                 "aclint=on,aia=aplic-imsic");
++    {                                                                        \
-+    qos_node_contains("riscv32/virt", "virtio-mmio", NULL);
++        if (CHECK(s, a)) {                                                   \
-+    qos_node_contains("riscv32/virt", "generic-pcihost", NULL);
++            static gen_helper_opivx *const fns[3] = {                        \
-+
++                gen_helper_##OPIVX##_b,                                      \
-+    qos_node_create_machine_args("riscv64/virt", qos_create_machine_riscv_virt,
++                gen_helper_##OPIVX##_h,                                      \
-+                                 "aclint=on,aia=aplic-imsic");
++                gen_helper_##OPIVX##_w,                                      \
-+    qos_node_contains("riscv64/virt", "virtio-mmio", NULL);
++            };                                                               \
-+    qos_node_contains("riscv64/virt", "generic-pcihost", NULL);
++            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
-+}
++                               IMM_MODE);                                    \
-+
++        }                                                                    \
-+libqos_init(virt_machine_register_nodes);
++        return false;                                                        \
-diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
++    }
-index XXXXXXX..XXXXXXX 100644
++
---- a/tests/qtest/libqos/meson.build
++GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
-+++ b/tests/qtest/libqos/meson.build
++GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
-@@ -XXX,XX +XXX,XX @@ libqos_srcs = files(
++GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
          'arm-xilinx-zynq-a9-machine.c',
          'ppc64_pseries-machine.c',
          'x86_64_pc-machine.c',
 +        'riscv-virt-machine.c',
  )
  if have_virtfs
 --
-.44.0
+.41.0

-New patch
+[PULL v2 16/45] target/riscv: Add Zvkned ISA extension support
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+This commit adds support for the Zvkned vector-crypto extension, which
+consists of the following instructions:
+* vaesef.[vv,vs]
+* vaesdf.[vv,vs]
+* vaesdm.[vv,vs]
+* vaesz.vs
+* vaesem.[vv,vs]
+* vaeskf1.vi
+* vaeskf2.vi
+Translation functions are defined in
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
+`target/riscv/vcrypto_helper.c`.
+Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
+[max.chou@sifive.com: Replaced vstart checking by TCG op]
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
+property]
+[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
+egs checking by helper function]
+[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
+Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h                   |   1 +
+ target/riscv/helper.h                    |  14 ++
+ target/riscv/insn32.decode               |  14 ++
+ target/riscv/cpu.c                       |   4 +-
+ target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
+files changed, 381 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zve64d;
+     bool ext_zvbb;
+     bool ext_zvbc;
++    bool ext_zvkned;
+     bool ext_zmmul;
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
++
++DEF_HELPER_2(egs_check, void, i32, env)
++
++DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
++DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@
+ @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
+ @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
+ @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
++@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
+ @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
+ @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
+ @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
+@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+ vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+ vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+ vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
++
++# *** Zvkned vector crypto extension ***
++vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
++vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
++vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
++vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
++vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
++vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
++vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
++vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
++vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
++vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
++vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
++    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+      * In principle Zve*x would also suffice here, were they supported
+      * in qemu
+      */
+-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+         error_setg(errp,
+                    "Vector crypto extensions require V or Zve* extensions");
+         return;
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     /* Vector cryptography extensions */
+     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
++    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vcrypto_helper.c
++++ b/target/riscv/vcrypto_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bitops.h"
+ #include "qemu/bswap.h"
+ #include "cpu.h"
++#include "crypto/aes.h"
++#include "crypto/aes-round.h"
+ #include "exec/memop.h"
+ #include "exec/exec-all.h"
+ #include "exec/helper-proto.h"
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+ GEN_VEXT_VX(vwsll_vx_b, 2)
+ GEN_VEXT_VX(vwsll_vx_h, 4)
+ GEN_VEXT_VX(vwsll_vx_w, 8)
++
++void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
++{
++    uint32_t vl = env->vl;
++    uint32_t vstart = env->vstart;
++
++    if (vl % egs != 0 || vstart % egs != 0) {
++        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
++    }
++}
++
++static inline void xor_round_key(AESState *round_state, AESState *round_key)
++{
++    round_state->v = round_state->v ^ round_key->v;
++}
++
++#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
++    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
++                      uint32_t desc)                                      \
++    {                                                                     \
++        uint32_t vl = env->vl;                                            \
++        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
++        uint32_t vta = vext_vta(desc);                                    \
++                                                                          \
++        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
++            AESState round_key;                                           \
++            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
++            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
++            AESState round_state;                                         \
++            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
++            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
++            __VA_ARGS__;                                                  \
++            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
++            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
++        }                                                                 \
++        env->vstart = 0;                                                  \
++        /* set tail elements to 1s */                                     \
++        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
++    }
++
++#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
++    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
++                      uint32_t desc)                                      \
++    {                                                                     \
++        uint32_t vl = env->vl;                                            \
++        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
++        uint32_t vta = vext_vta(desc);                                    \
++                                                                          \
++        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
++            AESState round_key;                                           \
++            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
++            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
++            AESState round_state;                                         \
++            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
++            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
++            __VA_ARGS__;                                                  \
++            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
++            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
++        }                                                                 \
++        env->vstart = 0;                                                  \
++        /* set tail elements to 1s */                                     \
++        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
++    }
++
++GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
++                                                &round_state,
++                                                &round_key,
++                                                false);)
++GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
++                                                &round_state,
++                                                &round_key,
++                                                false);)
++GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
++                                                  &round_state,
++                                                  &round_key,
++                                                  false);)
++GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
++                                                  &round_state,
++                                                  &round_key,
++                                                  false);)
++GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
++                                                   &round_state,
++                                                   &round_key,
++                                                   false);)
++GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
++                                                   &round_state,
++                                                   &round_key,
++                                                   false);)
++GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
++                                                      &round_state,
++                                                      &round_key,
++                                                      false);)
++GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
++                                                      &round_state,
++                                                      &round_key,
++                                                      false);)
++GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
++
++void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
++                        CPURISCVState *env, uint32_t desc)
++{
++    uint32_t *vd = vd_vptr;
++    uint32_t *vs2 = vs2_vptr;
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
++    uint32_t vta = vext_vta(desc);
++
++    uimm &= 0b1111;
++    if (uimm > 10 || uimm == 0) {
++        uimm ^= 0b1000;
++    }
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        uint32_t rk[8], tmp;
++        static const uint32_t rcon[] = {
++            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
++            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
++        };
++
++        rk[0] = vs2[i * 4 + H4(0)];
++        rk[1] = vs2[i * 4 + H4(1)];
++        rk[2] = vs2[i * 4 + H4(2)];
++        rk[3] = vs2[i * 4 + H4(3)];
++        tmp = ror32(rk[3], 8);
++
++        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
++                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
++                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
++                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
++                      ^ rcon[uimm - 1];
++        rk[5] = rk[1] ^ rk[4];
++        rk[6] = rk[2] ^ rk[5];
++        rk[7] = rk[3] ^ rk[6];
++
++        vd[i * 4 + H4(0)] = rk[4];
++        vd[i * 4 + H4(1)] = rk[5];
++        vd[i * 4 + H4(2)] = rk[6];
++        vd[i * 4 + H4(3)] = rk[7];
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
++}
++
++void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
++                        CPURISCVState *env, uint32_t desc)
++{
++    uint32_t *vd = vd_vptr;
++    uint32_t *vs2 = vs2_vptr;
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
++    uint32_t vta = vext_vta(desc);
++
++    uimm &= 0b1111;
++    if (uimm > 14 || uimm < 2) {
++        uimm ^= 0b1000;
++    }
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        uint32_t rk[12], tmp;
++        static const uint32_t rcon[] = {
++            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
++            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
++        };
++
++        rk[0] = vd[i * 4 + H4(0)];
++        rk[1] = vd[i * 4 + H4(1)];
++        rk[2] = vd[i * 4 + H4(2)];
++        rk[3] = vd[i * 4 + H4(3)];
++        rk[4] = vs2[i * 4 + H4(0)];
++        rk[5] = vs2[i * 4 + H4(1)];
++        rk[6] = vs2[i * 4 + H4(2)];
++        rk[7] = vs2[i * 4 + H4(3)];
++
++        if (uimm % 2 == 0) {
++            tmp = ror32(rk[7], 8);
++            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
++                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
++                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
++                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
++                          ^ rcon[(uimm - 1) / 2];
++        } else {
++            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
++                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
++                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
++                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
++        }
++        rk[9] = rk[1] ^ rk[8];
++        rk[10] = rk[2] ^ rk[9];
++        rk[11] = rk[3] ^ rk[10];
++
++        vd[i * 4 + H4(0)] = rk[8];
++        vd[i * 4 + H4(1)] = rk[9];
++        vd[i * 4 + H4(2)] = rk[10];
++        vd[i * 4 + H4(3)] = rk[11];
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
++}
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvvk.c.inc
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+ GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+ GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+ GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
++
++/*
++ * Zvkned
++ */
++
++#define ZVKNED_EGS 4
++
++#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
++    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
++    {                                                                         \
++        if (CHECK(s, a)) {                                                    \
++            TCGv_ptr rd_v, rs2_v;                                             \
++            TCGv_i32 desc, egs;                                               \
++            uint32_t data = 0;                                                \
++            TCGLabel *over = gen_new_label();                                 \
++                                                                              \
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
++                /* save opcode for unwinding in case we throw an exception */ \
++                decode_save_opc(s);                                           \
++                egs = tcg_constant_i32(EGS);                                  \
++                gen_helper_egs_check(egs, cpu_env);                           \
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
++            }                                                                 \
++                                                                              \
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
++            rd_v = tcg_temp_new_ptr();                                        \
++            rs2_v = tcg_temp_new_ptr();                                       \
++            desc = tcg_constant_i32(                                          \
++                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
++            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
++            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
++            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
++            mark_vs_dirty(s);                                                 \
++            gen_set_label(over);                                              \
++            return true;                                                      \
++        }                                                                     \
++        return false;                                                         \
++    }
++
++static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul) &&
++           s->sew == MO_32;
++}
++
++static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
++{
++    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
++    return !is_overlapped(vd, op_size, vs2, 1);
++}
++
++static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return vaes_check_overlap(s, a->rd, a->rs2) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           require_align(a->rd, s->lmul) &&
++           s->sew == MO_32;
++}
++
++GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
++
++#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
++    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
++    {                                                                         \
++        if (CHECK(s, a)) {                                                    \
++            TCGv_ptr rd_v, rs2_v;                                             \
++            TCGv_i32 uimm_v, desc, egs;                                       \
++            uint32_t data = 0;                                                \
++            TCGLabel *over = gen_new_label();                                 \
++                                                                              \
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
++                /* save opcode for unwinding in case we throw an exception */ \
++                decode_save_opc(s);                                           \
++                egs = tcg_constant_i32(EGS);                                  \
++                gen_helper_egs_check(egs, cpu_env);                           \
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
++            }                                                                 \
++                                                                              \
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
++                                                                              \
++            rd_v = tcg_temp_new_ptr();                                        \
++            rs2_v = tcg_temp_new_ptr();                                       \
++            uimm_v = tcg_constant_i32(a->rs1);                                \
++            desc = tcg_constant_i32(                                          \
++                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
++            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
++            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
++            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
++            mark_vs_dirty(s);                                                 \
++            gen_set_label(over);                                              \
++            return true;                                                      \
++        }                                                                     \
++        return false;                                                         \
++    }
++
++static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->sew == MO_32 &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul);
++}
++
++static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->sew == MO_32 &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul);
++}
++
++GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
++GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+--
+.41.0

-[PULL 08/34] target/riscv: add riscv,isa to named features
+[PULL v2 17/45] target/riscv: Add Zvknh ISA extension support
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Further discussions after the introduction of rva22 support in QEMU
+This commit adds support for the Zvknh vector-crypto extension, which
-revealed that what we've been calling 'named features' are actually
+consists of the following instructions:
 regular extensions, with their respective riscv,isa DTs. This is
 clarified in [1]. [2] is a bug tracker asking for the profile spec to be
 less cryptic about it.
-As far as QEMU goes we understand extensions as something that the user
+* vsha2ms.vv
-can enable/disable in the command line. This isn't the case for named
+* vsha2c[hl].vv
 features, so we'll have to reach a middle ground.
-We'll keep our existing nomenclature 'named features' to refer to any
+Translation functions are defined in
-extension that the user can't control in the command line. We'll also do
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-the following:
+`target/riscv/vcrypto_helper.c`.
-- 'svade' and 'zic64b' flags are renamed to 'ext_svade' and
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-  'ext_zic64b'. 'ext_svade' and 'ext_zic64b' now have riscv,isa strings and
+Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-  priv_spec versions;
+[max.chou@sifive.com: Replaced vstart checking by TCG op]
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-- skip name feature check in cpu_bump_multi_ext_priv_ver(). Now that
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-  named features have a riscv,isa and an entry in isa_edata_arr[] we
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-  don't need to gate the call to cpu_cfg_ext_get_min_version() anymore.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-[1] https://github.com/riscv/riscv-profiles/issues/121
+[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
-[2] https://github.com/riscv/riscv-profiles/issues/142
+[max.chou@sifive.com: Replaced SEW selection to happened during
+translation]
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240215223955.969568-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h     |  6 ++++--
+ target/riscv/cpu_cfg.h                   |   2 +
- target/riscv/cpu.c         | 17 +++++++++++++----
+ target/riscv/helper.h                    |   6 +
- target/riscv/tcg/tcg-cpu.c | 16 ++++++----------
+ target/riscv/insn32.decode               |   5 +
-files changed, 23 insertions(+), 16 deletions(-)
+ target/riscv/cpu.c                       |  13 +-
  target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 files changed, 390 insertions(+), 3 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_smepmp;
+     bool ext_zvbb;
-     bool rvv_ta_all_1s;
+     bool ext_zvbc;
-     bool rvv_ma_all_1s;
+     bool ext_zvkned;
--    bool svade;
++    bool ext_zvknha;
--    bool zic64b;
++    bool ext_zvknhb;
+     bool ext_zmmul;
-     uint32_t mvendorid;
+     bool ext_zvfbfmin;
-     uint64_t marchid;
+     bool ext_zvfbfwma;
-     uint64_t mimpid;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
-+    /* Named features  */
+--- a/target/riscv/helper.h
-+    bool ext_svade;
++++ b/target/riscv/helper.h
-+    bool ext_zic64b;
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
-+
+ DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
-     /* Vendor-specific custom extensions */
+ DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
-     bool ext_xtheadba;
+ DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
-     bool ext_xtheadbb;
++
 +DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
  vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
  vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvknh vector crypto extension ***
 +vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_option_set(const char *optname)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-  * instead.
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
-  */
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
- const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-+    ISA_EXT_DATA_ENTRY(zic64b, PRIV_VERSION_1_12_0, ext_zic64b),
++    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-     ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
++    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-     ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-     ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
+      * In principle Zve*x would also suffice here, were they supported
-     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
+      * in qemu
-+    ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
+      */
-     ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
+-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
-     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
-     ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
++        !cpu->cfg.ext_zve32f) {
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+         error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
      }
 -    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
 -        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
 +        error_setg(
 +            errp,
 +            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
          return;
      }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 +    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
 +    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
      DEFINE_PROP_END_OF_LIST(),
  };
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      /* set tail elements to 1s */
      vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
  }
 +
 +static inline uint32_t sig0_sha256(uint32_t x)
 +{
 +    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
 +}
 +
 +static inline uint32_t sig1_sha256(uint32_t x)
 +{
 +    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
 +}
 +
 +static inline uint64_t sig0_sha512(uint64_t x)
 +{
 +    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
 +}
 +
 +static inline uint64_t sig1_sha512(uint64_t x)
 +{
 +    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
 +}
 +
 +static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
 +{
 +    uint32_t res[4];
 +    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
 +             vd[H4(0)];
 +    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
 +             vd[H4(1)];
 +    res[2] =
 +        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
 +    res[3] =
 +        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
 +    vd[H4(3)] = res[3];
 +    vd[H4(2)] = res[2];
 +    vd[H4(1)] = res[1];
 +    vd[H4(0)] = res[0];
 +}
 +
 +static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
 +{
 +    uint64_t res[4];
 +    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
 +    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
 +    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
 +    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
 +    vd[3] = res[3];
 +    vd[2] = res[2];
 +    vd[1] = res[1];
 +    vd[0] = res[0];
 +}
 +
 +void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                        uint32_t desc)
 +{
 +    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
 +    uint32_t esz = sew == MO_32 ? 4 : 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        if (sew == MO_32) {
 +            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
 +                        ((uint32_t *)vs2) + i * 4);
 +        } else {
 +            /* If not 32 then SEW should be 64 */
 +            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
 +                        ((uint64_t *)vs2) + i * 4);
 +        }
 +    }
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint64_t sum0_64(uint64_t x)
 +{
 +    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
 +}
 +
 +static inline uint32_t sum0_32(uint32_t x)
 +{
 +    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
 +}
 +
 +static inline uint64_t sum1_64(uint64_t x)
 +{
 +    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
 +}
 +
 +static inline uint32_t sum1_32(uint32_t x)
 +{
 +    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
 +}
 +
 +#define ch(x, y, z) ((x & y) ^ ((~x) & z))
 +
 +#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
 +
 +static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
 +{
 +    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
 +    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
 +    uint64_t W0 = vs1[0], W1 = vs1[1];
 +    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
 +    uint64_t T2 = sum0_64(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
 +    T2 = sum0_64(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[0] = f;
 +    vd[1] = e;
 +    vd[2] = b;
 +    vd[3] = a;
 +}
 +
 +static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
 +{
 +    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
 +    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
 +    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
 +    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
 +    uint32_t T2 = sum0_32(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
 +    T2 = sum0_32(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[H4(0)] = f;
 +    vd[H4(1)] = e;
 +    vd[H4(2)] = b;
 +    vd[H4(3)] = a;
 +}
 +
 +void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  ((uint32_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  ((uint64_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  (((uint32_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  (((uint64_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
  GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
  GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
 +
 +/*
-+ * 'Named features' is the name we give to extensions that we
++ * Zvknh
 + * don't want to expose to users. They are either immutable
 + * (always enabled/disable) or they'll vary depending on
 + * the resulting CPU state. They have riscv,isa strings
 + * and priv_ver like regular extensions.
 + */
- const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
++
--    MULTI_EXT_CFG_BOOL("svade", svade, true),
++#define ZVKNH_EGS 4
--    MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
++
-+    MULTI_EXT_CFG_BOOL("svade", ext_svade, true),
++#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
-+    MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
++    {                                                                         \
-     DEFINE_PROP_END_OF_LIST(),
++        if (CHECK(s, a)) {                                                    \
- };
++            uint32_t data = 0;                                                \
-@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
++            TCGLabel *over = gen_new_label();                                 \
-         CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
++            TCGv_i32 egs;                                                     \
++                                                                              \
-         /* mandatory named features for this profile */
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
--        CPU_CFG_OFFSET(zic64b),
++                /* save opcode for unwinding in case we throw an exception */ \
-+        CPU_CFG_OFFSET(ext_zic64b),
++                decode_save_opc(s);                                           \
++                egs = tcg_constant_i32(EGS);                                  \
-         RISCV_PROFILE_EXT_LIST_END
++                gen_helper_egs_check(egs, cpu_env);                           \
-     }
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
-@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22S64 = {
++            }                                                                 \
-         CPU_CFG_OFFSET(ext_svinval),
++                                                                              \
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
-         /* rva22s64 named features */
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
--        CPU_CFG_OFFSET(svade),
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
-+        CPU_CFG_OFFSET(ext_svade),
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
-         RISCV_PROFILE_EXT_LIST_END
++                                                                              \
-     }
++            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
++                               vreg_ofs(s, a->rs2), cpu_env,                  \
-index XXXXXXX..XXXXXXX 100644
++                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
---- a/target/riscv/tcg/tcg-cpu.c
++                               data, gen_helper_##NAME);                      \
-+++ b/target/riscv/tcg/tcg-cpu.c
++                                                                              \
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
++            mark_vs_dirty(s);                                                 \
- static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
++            gen_set_label(over);                                              \
- {
++            return true;                                                      \
-     switch (feat_offset) {
++        }                                                                     \
--    case CPU_CFG_OFFSET(zic64b):
++        return false;                                                         \
-+    case CPU_CFG_OFFSET(ext_zic64b):
++    }
-         cpu->cfg.cbom_blocksize = 64;
++
-         cpu->cfg.cbop_blocksize = 64;
++static bool vsha_check_sew(DisasContext *s)
-         cpu->cfg.cboz_blocksize = 64;
++{
-         break;
++    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
--    case CPU_CFG_OFFSET(svade):
++           (s->cfg_ptr->ext_zvknhb == true &&
-+    case CPU_CFG_OFFSET(ext_svade):
++            (s->sew == MO_32 || s->sew == MO_64));
-         cpu->cfg.ext_svadu = false;
++}
-         break;
++
-     default:
++static bool vsha_check(DisasContext *s, arg_rmrr *a)
-@@ -XXX,XX +XXX,XX @@ static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
++{
-         return;
++    int egw_bytes = ZVKNH_EGS << s->sew;
-     }
++    int mult = 1 << MAX(s->lmul, 0);
++    return opivv_check(s, a) &&
--    if (cpu_cfg_offset_is_named_feat(ext_offset)) {
++           vsha_check_sew(s) &&
--        return;
++           MAXSZ(s) >= egw_bytes &&
--    }
++           !is_overlapped(a->rd, mult, a->rs1, mult) &&
--
++           !is_overlapped(a->rd, mult, a->rs2, mult) &&
-     ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
++           s->lmul >= 0;
++}
-     if (env->priv_ver < ext_priv_ver) {
++
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
++GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
++
- static void riscv_cpu_update_named_features(RISCVCPU *cpu)
++static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
- {
++{
--    cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
++    if (vsha_check(s, a)) {
--                      cpu->cfg.cbop_blocksize == 64 &&
++        uint32_t data = 0;
--                      cpu->cfg.cboz_blocksize == 64;
++        TCGLabel *over = gen_new_label();
-+    cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
++        TCGv_i32 egs;
-+                          cpu->cfg.cbop_blocksize == 64 &&
++
-+                          cpu->cfg.cboz_blocksize == 64;
++        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
++            /* save opcode for unwinding in case we throw an exception */
--    cpu->cfg.svade = !cpu->cfg.ext_svadu;
++            decode_save_opc(s);
-+    cpu->cfg.ext_svade = !cpu->cfg.ext_svadu;
++            egs = tcg_constant_i32(ZVKNH_EGS);
- }
++            gen_helper_egs_check(egs, cpu_env);
++            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
- static void riscv_cpu_validate_g(RISCVCPU *cpu)
++        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +
 +        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
 +            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
 +            s->cfg_ptr->vlen / 8, data,
 +            s->sew == MO_32 ?
 +                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 +
 +static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
 +{
 +    if (vsha_check(s, a)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
 +        TCGv_i32 egs;
 +
 +        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
 +            /* save opcode for unwinding in case we throw an exception */
 +            decode_save_opc(s);
 +            egs = tcg_constant_i32(ZVKNH_EGS);
 +            gen_helper_egs_check(egs, cpu_env);
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +
 +        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
 +            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
 +            s->cfg_ptr->vlen / 8, data,
 +            s->sew == MO_32 ?
 +                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 --
-.44.0
+.41.0

-[PULL 09/34] target/riscv: add remaining named features
+[PULL v2 18/45] target/riscv: Add Zvksh ISA extension support
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-The RVA22U64 and RVA22S64 profiles mandates certain extensions that,
+This commit adds support for the Zvksh vector-crypto extension, which
-until now, we were implying that they were available.
+consists of the following instructions:
-We can't do this anymore since named features also has a riscv,isa
+* vsm3me.vv
-entry. Let's add them to riscv_cpu_named_features[].
+* vsm3c.vi
-Instead of adding one bool for each named feature that we'll always
+Translation functions are defined in
-implement, i.e. can't be turned off, add a 'ext_always_enabled' bool in
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-cpu->cfg. This bool will be set to 'true' in TCG accel init, and all
+`target/riscv/vcrypto_helper.c`.
-named features will point to it. This also means that KVM won't see
-these features as always enable, which is our intention.
+Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+[max.chou@sifive.com: Replaced vstart checking by TCG op]
-If any accelerator adds support to disable one of these features, we'll
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-have to promote them to regular extensions and allow users to disable it
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-via command line.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-After this patch, here's the riscv,isa from a buildroot using the
+[max.chou@sifive.com: Exposed x-zvksh property]
-'rva22s64' CPU:
+Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
  # cat /proc/device-tree/cpus/cpu@0/riscv,isa
 rv64imafdc_zic64b_zicbom_zicbop_zicboz_ziccamoa_ziccif_zicclsm_ziccrse_
 zicntr_zicsr_zifencei_zihintpause_zihpm_za64rs_zfhmin_zca_zcd_zba_zbb_
 zbs_zkt_ssccptr_sscounterenw_sstvala_sstvecd_svade_svinval_svpbmt#
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20240215223955.969568-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h     |  6 ++++++
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/cpu.c         | 42 +++++++++++++++++++++++++++++++-------
+ target/riscv/helper.h                    |   3 +
- target/riscv/tcg/tcg-cpu.c |  2 ++
+ target/riscv/insn32.decode               |   4 +
-files changed, 43 insertions(+), 7 deletions(-)
+ target/riscv/cpu.c                       |   6 +-
  target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 files changed, 177 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svade;
+     bool ext_zvkned;
-     bool ext_zic64b;
+     bool ext_zvknha;
+     bool ext_zvknhb;
-+    /*
++    bool ext_zvksh;
-+     * Always 'true' boolean for named features
+     bool ext_zmmul;
-+     * TCG always implement/can't be disabled.
+     bool ext_zvfbfmin;
-+     */
+     bool ext_zvfbfwma;
-+    bool ext_always_enabled;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-+
+index XXXXXXX..XXXXXXX 100644
-     /* Vendor-specific custom extensions */
+--- a/target/riscv/helper.h
-     bool ext_xtheadba;
++++ b/target/riscv/helper.h
-     bool ext_xtheadbb;
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvksh vector crypto extension ***
 +vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-     ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
+     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-     ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
+     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-+    ISA_EXT_DATA_ENTRY(ziccamoa, PRIV_VERSION_1_11_0, ext_always_enabled),
++    ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
-+    ISA_EXT_DATA_ENTRY(ziccif, PRIV_VERSION_1_11_0, ext_always_enabled),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-+    ISA_EXT_DATA_ENTRY(zicclsm, PRIV_VERSION_1_11_0, ext_always_enabled),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-+    ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, ext_always_enabled),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr),
+      * In principle Zve*x would also suffice here, were they supported
-     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_zicsr),
+      * in qemu
-@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+      */
-     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
-     ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
+-        !cpu->cfg.ext_zve32f) {
-     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
-+    ISA_EXT_DATA_ENTRY(za64rs, PRIV_VERSION_1_12_0, ext_always_enabled),
++         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
-     ISA_EXT_DATA_ENTRY(zaamo, PRIV_VERSION_1_12_0, ext_zaamo),
+         error_setg(errp,
-     ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
+                    "Vector crypto extensions require V or Zve* extensions");
-     ISA_EXT_DATA_ENTRY(zalrsc, PRIV_VERSION_1_12_0, ext_zalrsc),
+         return;
-@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
+     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
-     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
+     DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
-     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
+     DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
-+    ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, ext_always_enabled),
++    DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
-     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
 +    ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, ext_always_enabled),
      ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
 +    ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, ext_always_enabled),
 +    ISA_EXT_DATA_ENTRY(sstvecd, PRIV_VERSION_1_12_0, ext_always_enabled),
      ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
      ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
      ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
      DEFINE_PROP_END_OF_LIST(),
  };
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
-+#define ALWAYS_ENABLED_FEATURE(_name) \
+index XXXXXXX..XXXXXXX 100644
-+    {.name = _name, \
+--- a/target/riscv/vcrypto_helper.c
-+     .offset = CPU_CFG_OFFSET(ext_always_enabled), \
++++ b/target/riscv/vcrypto_helper.c
-+     .enabled = true}
+@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
-+
+     vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
- /*
+     env->vstart = 0;
-  * 'Named features' is the name we give to extensions that we
+ }
-  * don't want to expose to users. They are either immutable
++
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
++static inline uint32_t p1(uint32_t x)
-     MULTI_EXT_CFG_BOOL("svade", ext_svade, true),
++{
-     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
++    return x ^ rol32(x, 15) ^ rol32(x, 23);
++}
-+    /*
++
-+     * cache-related extensions that are always enabled
++static inline uint32_t zvksh_w(uint32_t m16, uint32_t m9, uint32_t m3,
-+     * in TCG since QEMU RISC-V does not have a cache
++                               uint32_t m13, uint32_t m6)
-+     * model.
++{
-+     */
++    return p1(m16 ^ m9 ^ rol32(m3, 15)) ^ rol32(m13, 7) ^ m6;
-+    ALWAYS_ENABLED_FEATURE("za64rs"),
++}
-+    ALWAYS_ENABLED_FEATURE("ziccif"),
++
-+    ALWAYS_ENABLED_FEATURE("ziccrse"),
++void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
-+    ALWAYS_ENABLED_FEATURE("ziccamoa"),
++                       CPURISCVState *env, uint32_t desc)
-+    ALWAYS_ENABLED_FEATURE("zicclsm"),
++{
-+    ALWAYS_ENABLED_FEATURE("ssccptr"),
++    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
-+
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-+    /* Other named features that TCG always implements */
++    uint32_t vta = vext_vta(desc);
-+    ALWAYS_ENABLED_FEATURE("sstvecd"),
++    uint32_t *vd = vd_vptr;
-+    ALWAYS_ENABLED_FEATURE("sstvala"),
++    uint32_t *vs1 = vs1_vptr;
-+    ALWAYS_ENABLED_FEATURE("sscounterenw"),
++    uint32_t *vs2 = vs2_vptr;
 +
-     DEFINE_PROP_END_OF_LIST(),
++    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
- };
++        uint32_t w[24];
++        for (int j = 0; j < 8; j++) {
-@@ -XXX,XX +XXX,XX @@ static const PropertyInfo prop_marchid = {
++            w[j] = bswap32(vs1[H4((i * 8) + j)]);
- };
++            w[j + 8] = bswap32(vs2[H4((i * 8) + j)]);
++        }
- /*
++        for (int j = 0; j < 8; j++) {
-- * RVA22U64 defines some 'named features' or 'synthetic extensions'
++            w[j + 16] =
-- * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
++                zvksh_w(w[j], w[j + 7], w[j + 13], w[j + 3], w[j + 10]);
-- * and Zicclsm. We do not implement caching in QEMU so we'll consider
++        }
-- * all these named features as always enabled.
++        for (int j = 0; j < 8; j++) {
-- *
++            vd[(i * 8) + j] = bswap32(w[H4(j + 16)]);
-- * There's no riscv,isa update for them (nor for zic64b, despite it
++        }
-- * having a cfg offset) at this moment.
++    }
-+ * RVA22U64 defines some 'named features' that are cache
++    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
-+ * related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
++    env->vstart = 0;
-+ * and Zicclsm. They are always implemented in TCG and
++}
-+ * doesn't need to be manually enabled by the profile.
++
-  */
++static inline uint32_t ff1(uint32_t x, uint32_t y, uint32_t z)
- static RISCVCPUProfile RVA22U64 = {
++{
-     .parent = NULL,
++    return x ^ y ^ z;
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
++}
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/riscv/tcg/tcg-cpu.c
++static inline uint32_t ff2(uint32_t x, uint32_t y, uint32_t z)
-+++ b/target/riscv/tcg/tcg-cpu.c
++{
-@@ -XXX,XX +XXX,XX @@ static void riscv_tcg_cpu_instance_init(CPUState *cs)
++    return (x & y) | (x & z) | (y & z);
-     RISCVCPU *cpu = RISCV_CPU(cs);
++}
-     Object *obj = OBJECT(cpu);
++
++static inline uint32_t ff_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
-+    cpu->cfg.ext_always_enabled = true;
++{
-+
++    return (j <= 15) ? ff1(x, y, z) : ff2(x, y, z);
-     misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
++}
-     multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
++
-     riscv_cpu_add_user_properties(obj);
++static inline uint32_t gg1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t gg2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (~x & z);
 +}
 +
 +static inline uint32_t gg_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? gg1(x, y, z) : gg2(x, y, z);
 +}
 +
 +static inline uint32_t t_j(uint32_t j)
 +{
 +    return (j <= 15) ? 0x79cc4519 : 0x7a879d8a;
 +}
 +
 +static inline uint32_t p_0(uint32_t x)
 +{
 +    return x ^ rol32(x, 9) ^ rol32(x, 17);
 +}
 +
 +static void sm3c(uint32_t *vd, uint32_t *vs1, uint32_t *vs2, uint32_t uimm)
 +{
 +    uint32_t x0, x1;
 +    uint32_t j;
 +    uint32_t ss1, ss2, tt1, tt2;
 +    x0 = vs2[0] ^ vs2[4];
 +    x1 = vs2[1] ^ vs2[5];
 +    j = 2 * uimm;
 +    ss1 = rol32(rol32(vs1[0], 12) + vs1[4] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vs1[0], 12);
 +    tt1 = ff_j(vs1[0], vs1[1], vs1[2], j) + vs1[3] + ss2 + x0;
 +    tt2 = gg_j(vs1[4], vs1[5], vs1[6], j) + vs1[7] + ss1 + vs2[0];
 +    vs1[3] = vs1[2];
 +    vd[3] = rol32(vs1[1], 9);
 +    vs1[1] = vs1[0];
 +    vd[1] = tt1;
 +    vs1[7] = vs1[6];
 +    vd[7] = rol32(vs1[5], 19);
 +    vs1[5] = vs1[4];
 +    vd[5] = p_0(tt2);
 +    j = 2 * uimm + 1;
 +    ss1 = rol32(rol32(vd[1], 12) + vd[5] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vd[1], 12);
 +    tt1 = ff_j(vd[1], vs1[1], vd[3], j) + vs1[3] + ss2 + x1;
 +    tt2 = gg_j(vd[5], vs1[5], vd[7], j) + vs1[7] + ss1 + vs2[1];
 +    vd[2] = rol32(vs1[1], 9);
 +    vd[0] = tt1;
 +    vd[6] = rol32(vs1[5], 19);
 +    vd[4] = p_0(tt2);
 +}
 +
 +void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t v1[8], v2[8], v3[8];
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        for (int k = 0; k < 8; k++) {
 +            v2[k] = bswap32(vd[H4(i * 8 + k)]);
 +            v3[k] = bswap32(vs2[H4(i * 8 + k)]);
 +        }
 +        sm3c(v1, v2, v3, uimm);
 +        for (int k = 0; k < 8; k++) {
 +            vd[i * 8 + k] = bswap32(v1[H4(k)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
      }
      return false;
  }
 +
 +/*
 + * Zvksh
 + */
 +
 +#define ZVKSH_EGS 8
 +
 +static inline bool vsm3_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKSH_EGS << s->sew;
 +    int mult = 1 << MAX(s->lmul, 0);
 +    return s->cfg_ptr->ext_zvksh == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           !is_overlapped(a->rd, mult, a->rs2, mult) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static inline bool vsm3me_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm);
 +}
 +
 +static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
 +GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 --
-.44.0
+.41.0

-New patch
+[PULL v2 19/45] target/riscv: Add Zvkg ISA extension support
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 This commit adds support for the Zvkg vector-crypto extension, which
 consists of the following instructions:
 * vgmul.vv
 * vghsh.vv
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvkg property]
 [max.chou@sifive.com: Replaced uint by int for cross win32 build]
 Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h                   |  1 +
  target/riscv/helper.h                    |  3 +
  target/riscv/insn32.decode               |  4 ++
  target/riscv/cpu.c                       |  6 +-
  target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 files changed, 114 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64d;
      bool ext_zvbb;
      bool ext_zvbc;
 +    bool ext_zvkg;
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 +
 +DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvksh vector crypto extension ***
  vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvkg vector crypto extension ***
 +vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
      ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
 +    ISA_EXT_DATA_ENTRY(zvkg, PRIV_VERSION_1_12_0, ext_zvkg),
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* Vector cryptography extensions */
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +    DEFINE_PROP_BOOL("x-zvkg", RISCVCPU, cfg.ext_zvkg, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
 +
 +void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs1 = vs1_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t X[2] = {vs1[i * 2 + 0], vs1[i * 2 + 1]};
 +        uint64_t Z[2] = {0, 0};
 +
 +        uint64_t S[2] = {brev8(Y[0] ^ X[0]), brev8(Y[1] ^ X[1])};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((S[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t Z[2] = {0, 0};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((Y[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
  GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
  GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 +
 +/*
 + * Zvkg
 + */
 +
 +#define ZVKG_EGS 4
 +
 +static bool vgmul_check(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           vext_check_isa_ill(s) &&
 +           require_rvv(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vgmul_vv, vgmul_check, ZVKG_EGS)
 +
 +static bool vghsh_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           opivv_check(s, a) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 --
 .41.0

-[PULL 33/34] target/riscv: Fix privilege mode of G-stage translation for debugging
+[PULL v2 20/45] crypto: Create sm4_subword
-From: Hiroaki Yamamoto <hrak1529@gmail.com>
+From: Max Chou <max.chou@sifive.com>
-G-stage translation should be considered to be user-level access in
+Allows sharing of sm4_subword between different targets.
 riscv_cpu_get_phys_page_debug(), as already done in riscv_cpu_tlb_fill().
-This fixes a bug that prevents gdb from reading memory while the VM is
+Signed-off-by: Max Chou <max.chou@sifive.com>
-running in VS-mode.
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Hiroaki Yamamoto <hrak1529@gmail.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
 Message-ID: <20240228081028.35081-1-hrak1529@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 2 +-
+ include/crypto/sm4.h           |  8 ++++++++
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/tcg/crypto_helper.c | 10 ++--------
 files changed, 10 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/include/crypto/sm4.h
-+++ b/target/riscv/cpu_helper.c
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
+@@ -XXX,XX +XXX,XX @@
-     if (env->virt_enabled) {
+ extern const uint8_t sm4_sbox[256];
-         if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
--                                 0, mmu_idx, false, true, true)) {
++static inline uint32_t sm4_subword(uint32_t word)
-+                                 0, MMUIdx_U, false, true, true)) {
++{
-             return -1;
++    return sm4_sbox[word & 0xff] |
-         }
++           sm4_sbox[(word >> 8) & 0xff] << 8 |
 +           sm4_sbox[(word >> 16) & 0xff] << 16 |
 +           sm4_sbox[(word >> 24) & 0xff] << 24;
 +}
 +
  #endif
 diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/crypto_helper.c
 +++ b/target/arm/tcg/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
              CR_ST_WORD(d, (i + 3) % 4) ^
              CR_ST_WORD(n, i);
 -        t = sm4_sbox[t & 0xff] |
 -            sm4_sbox[(t >> 8) & 0xff] << 8 |
 -            sm4_sbox[(t >> 16) & 0xff] << 16 |
 -            sm4_sbox[(t >> 24) & 0xff] << 24;
 +        t = sm4_subword(t);
          CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
                              rol32(t, 24);
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
              CR_ST_WORD(d, (i + 3) % 4) ^
              CR_ST_WORD(m, i);
 -        t = sm4_sbox[t & 0xff] |
 -            sm4_sbox[(t >> 8) & 0xff] << 8 |
 -            sm4_sbox[(t >> 16) & 0xff] << 16 |
 -            sm4_sbox[(t >> 24) & 0xff] << 24;
 +        t = sm4_subword(t);
          CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
      }
 --
-.44.0
+.41.0

-New patch
+[PULL v2 21/45] crypto: Add SM4 constant parameter CK
+From: Max Chou <max.chou@sifive.com>
+Adds sm4_ck constant for use in sm4 cryptography across different targets.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ include/crypto/sm4.h |  1 +
+ crypto/sm4.c         | 10 ++++++++++
+files changed, 11 insertions(+)
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/crypto/sm4.h
++++ b/include/crypto/sm4.h
+@@ -XXX,XX +XXX,XX @@
+ #define QEMU_SM4_H
+ extern const uint8_t sm4_sbox[256];
++extern const uint32_t sm4_ck[32];
+ static inline uint32_t sm4_subword(uint32_t word)
+ {
+diff --git a/crypto/sm4.c b/crypto/sm4.c
+index XXXXXXX..XXXXXXX 100644
+--- a/crypto/sm4.c
++++ b/crypto/sm4.c
+@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
+x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
+ };
++uint32_t const sm4_ck[] = {
++    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
++    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
++    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
++    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
++    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
++    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
++    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
++    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
++};
+--
+.41.0

-New patch
+[PULL v2 22/45] target/riscv: Add Zvksed ISA extension support
+From: Max Chou <max.chou@sifive.com>
 This commit adds support for the Zvksed vector-crypto extension, which
 consists of the following instructions:
 * vsm4k.vi
 * vsm4r.[vv,vs]
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 [lawrence.hunter@codethink.co.uk: Moved SM4 functions from
 crypto_helper.c to vcrypto_helper.c]
 [nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
 use macros, and minor style changes]
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h                   |   1 +
  target/riscv/helper.h                    |   4 +
  target/riscv/insn32.decode               |   5 +
  target/riscv/cpu.c                       |   5 +-
  target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 files changed, 184 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 +    bool ext_zvksed;
      bool ext_zvksh;
      bool ext_zmmul;
      bool ext_zvfbfmin;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
  DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
 +DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvkg vector crypto extension ***
  vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 +
 +# *** Zvksed vector crypto extension ***
 +vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
 +    ISA_EXT_DATA_ENTRY(zvksed, PRIV_VERSION_1_12_0, ext_zvksed),
      ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * in qemu
       */
      if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 -         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed || cpu->cfg.ext_zvksh) &&
 +        !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 +    DEFINE_PROP_BOOL("x-zvksed", RISCVCPU, cfg.ext_zvksed, false),
      DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "crypto/aes.h"
  #include "crypto/aes-round.h"
 +#include "crypto/sm4.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
      vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
      env->vstart = 0;
  }
 +
 +void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t rnd = uimm5 & 0x7;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            tmp[j] = rk[j];
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            uint32_t b, s;
 +            b = tmp[j + 1] ^ tmp[j + 2] ^ tmp[j + 3] ^ sm4_ck[rnd * 4 + j];
 +
 +            s = sm4_subword(b);
 +
 +            tmp[j + 4] = tmp[j] ^ (s ^ rol32(s, 13) ^ rol32(s, 23));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +static void do_sm4_round(uint32_t *rk, uint32_t *buf)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t s, b;
 +
 +    for (uint32_t j = egs; j < egs * 2; ++j) {
 +        b = buf[j - 3] ^ buf[j - 2] ^ buf[j - 1] ^ rk[j - 4];
 +
 +        s = sm4_subword(b);
 +
 +        buf[j] = buf[j - 4] ^ (s ^ rol32(s, 2) ^ rol32(s, 10) ^ rol32(s, 18) ^
 +                               rol32(s, 24));
 +    }
 +}
 +
 +void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            rk[j] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vghsh_check(DisasContext *s, arg_rmrr *a)
  }
  GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 +
 +/*
 + * Zvksed
 + */
 +
 +#define ZVKSED_EGS 4
 +
 +static bool zvksed_check(DisasContext *s)
 +{
 +    int egw_bytes = ZVKSED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvksed == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static bool vsm4k_vi_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vsm4k_vi, vsm4k_vi_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vv_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vv, vsm4r_vv_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vs_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
 +           require_align(a->rd, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vs, vsm4r_vs_check, ZVKSED_EGS)
 --
 .41.0

-[PULL 14/34] target/riscv: UPDATE xATP write CSR
+[PULL v2 23/45] target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
-From: Irina Ryapolova <irina.ryapolova@syntacore.com>
+From: Rob Bradford <rbradford@rivosinc.com>
-Added xATP_MODE validation for vsatp/hgatp CSRs.
+These are WARL fields - zero out the bits for unavailable counters and
-The xATP register is an SXLEN-bit read/write WARL register, so
+special case the TM bit in mcountinhibit which is hardwired to zero.
-the legal value must be returned (See riscv-privileged-20211203, SATP/VSATP/HGATP CSRs).
+This patch achieves this by modifying the value written so that any use
 of the field will see the correctly masked bits.
-Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
+Tested by modifying OpenSBI to write max value to these CSRs and upon
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+subsequent read the appropriate number of bits for number of PMUs is
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+enabled and the TM bit is zero in mcountinhibit.
-Message-ID: <20240109145923.37893-2-irina.ryapolova@syntacore.com>
 Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 52 ++++++++++++++++++++++++++--------------------
+ target/riscv/csr.c | 11 +++++++++--
-file changed, 29 insertions(+), 23 deletions(-)
+file changed, 9 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static bool validate_vm(CPURISCVState *env, target_ulong vm)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
-     return get_field(mode_supported, (1 << vm));
+ {
- }
+     int cidx;
+     PMUCTRState *counter;
-+static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
++    RISCVCPU *cpu = env_archcpu(env);
-+                                  target_ulong val)
-+{
+-    env->mcountinhibit = val;
-+    target_ulong mask;
++    /* WARL register - disable unavailable counters; TM bit is always 0 */
-+    bool vm;
++    env->mcountinhibit =
-+    if (riscv_cpu_mxl(env) == MXL_RV32) {
++        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
-+        vm = validate_vm(env, get_field(val, SATP32_MODE));
-+        mask = (val ^ old_xatp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
+     /* Check if any other counter is also monitoring cycles/instructions */
-+    } else {
+     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
-+        vm = validate_vm(env, get_field(val, SATP64_MODE));
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
-+        mask = (val ^ old_xatp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
+ static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
-+    }
+                                        target_ulong val)
  {
 -    env->mcounteren = val;
 +    RISCVCPU *cpu = env_archcpu(env);
 +
-+    if (vm && mask) {
++    /* WARL register - disable unavailable counters */
-+        /*
++    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
-+         * The ISA defines SATP.MODE=Bare as "no translation", but we still
++                             COUNTEREN_IR);
 +         * pass these through QEMU's TLB emulation as it improves
 +         * performance.  Flushing the TLB on SATP writes with paging
 +         * enabled avoids leaking those invalid cached mappings.
 +         */
 +        tlb_flush(env_cpu(env));
 +        return val;
 +    }
 +    return old_xatp;
 +}
 +
  static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
                                   target_ulong val)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
  static RISCVException write_satp(CPURISCVState *env, int csrno,
                                   target_ulong val)
  {
 -    target_ulong mask;
 -    bool vm;
 -
      if (!riscv_cpu_cfg(env)->mmu) {
          return RISCV_EXCP_NONE;
      }
 -    if (riscv_cpu_mxl(env) == MXL_RV32) {
 -        vm = validate_vm(env, get_field(val, SATP32_MODE));
 -        mask = (val ^ env->satp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
 -    } else {
 -        vm = validate_vm(env, get_field(val, SATP64_MODE));
 -        mask = (val ^ env->satp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
 -    }
 -
 -    if (vm && mask) {
 -        /*
 -         * The ISA defines SATP.MODE=Bare as "no translation", but we still
 -         * pass these through QEMU's TLB emulation as it improves
 -         * performance.  Flushing the TLB on SATP writes with paging
 -         * enabled avoids leaking those invalid cached mappings.
 -         */
 -        tlb_flush(env_cpu(env));
 -        env->satp = val;
 -    }
 +    env->satp = legalize_xatp(env, env->satp, val);
      return RISCV_EXCP_NONE;
  }
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_hgatp(CPURISCVState *env, int csrno,
- static RISCVException write_hgatp(CPURISCVState *env, int csrno,
-                                   target_ulong val)
- {
--    env->hgatp = val;
-+    env->hgatp = legalize_xatp(env, env->hgatp, val);
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_vsatp(CPURISCVState *env, int csrno,
- static RISCVException write_vsatp(CPURISCVState *env, int csrno,
-                                   target_ulong val)
- {
--    env->vsatp = val;
-+    env->vsatp = legalize_xatp(env, env->vsatp, val);
-     return RISCV_EXCP_NONE;
- }
 --
-.44.0
+.41.0

-New patch
+[PULL v2 24/45] target/riscv: Add Zihintntl extension ISA string to DTS
+From: Jason Chien <jason.chien@sifive.com>
+RVA23 Profiles states:
+The RVA23 profiles are intended to be used for 64-bit application
+processors that will run rich OS stacks from standard binary OS
+distributions and with a substantial number of third-party binary user
+applications that will be supported over a considerable length of time
+in the field.
+The chapter 4 of the unprivileged spec introduces the Zihintntl extension
+and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
+purpose is to enable application and operating system portability across
+different implementations. Thus the DTS should contain the Zihintntl ISA
+string in order to pass to software.
+The unprivileged spec states:
+Like any HINTs, these instructions may be freely ignored. Hence, although
+they are described in terms of cache-based memory hierarchies, they do not
+mandate the provision of caches.
+These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
+which QEMU already supports, and QEMU does not emulate cache. Therefore
+these instructions can be considered as a no-op, and we only need to add
+a new property for the Zihintntl extension.
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h | 1 +
+ target/riscv/cpu.c     | 2 ++
+files changed, 3 insertions(+)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_icbom;
+     bool ext_icboz;
+     bool ext_zicond;
++    bool ext_zihintntl;
+     bool ext_zihintpause;
+     bool ext_smstateen;
+     bool ext_sstc;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
++    ISA_EXT_DATA_ENTRY(zihintntl, PRIV_VERSION_1_10_0, ext_zihintntl),
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
+     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
+     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
++    DEFINE_PROP_BOOL("Zihintntl", RISCVCPU, cfg.ext_zihintntl, true),
+     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
+     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+     DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
+--
+.41.0

-New patch
+[PULL v2 25/45] target/riscv: Fix zfa fleq.d and fltq.d
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
+However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
+helper function.
+Fixes: a47842d ("riscv: Add support for the Zfa extension")
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
++++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
+@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
++    gen_helper_fleq_d(dest, cpu_env, src1, src2);
+     gen_set_gpr(ctx, a->rd, dest);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
++    gen_helper_fltq_d(dest, cpu_env, src1, src2);
+     gen_set_gpr(ctx, a->rd, dest);
+     return true;
+ }
+--
+.41.0

-New patch
+[PULL v2 26/45] hw/intc: Fix upper/lower mtime write calculation
+From: Jason Chien <jason.chien@sifive.com>
+When writing the upper mtime, we should keep the original lower mtime
+whose value is given by cpu_riscv_read_rtc() instead of
+cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/intc/riscv_aclint.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_aclint.c
++++ b/hw/intc/riscv_aclint.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
+         return;
+     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
+         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
++        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
+         if (addr == mtimer->time_base) {
+             if (size == 4) {
+                 /* time_lo for RV32/RV64 */
+-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
++                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
+             } else {
+                 /* time for RV64 */
+                 mtimer->time_delta = value - rtc_r;
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
+         } else {
+             if (size == 4) {
+                 /* time_hi for RV32/RV64 */
+-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
++                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
+             } else {
+                 qemu_log_mask(LOG_GUEST_ERROR,
+                               "aclint-mtimer: invalid time_hi write: %08x",
+--
+.41.0

-[PULL 01/34] target/riscv: Update $ra with current $pc in trans_cm_jalt()
+[PULL v2 27/45] hw/intc: Make rtc variable names consistent
 From: Jason Chien <jason.chien@sifive.com>
-The original implementation sets $pc to the address read from the jump
+The variables whose values are given by cpu_riscv_read_rtc() should be named
-vector table first and links $ra with the address of the next instruction
+"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
-after the updated $pc. After jumping to the updated $pc and executing the
+should be named "rtc_r".
 next ret instruction, the program jumps to $ra, which is in the same
 function currently executing, which results in an infinite loop.
 This commit stores the jump address in a temporary, updates $ra with the
 current $pc, and copies the temporary to $pc.
 Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
 Message-ID: <20240207081820.28559-1-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvzce.c.inc | 6 +++++-
+ hw/intc/riscv_aclint.c | 6 +++---
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvzce.c.inc
+--- a/hw/intc/riscv_aclint.c
-+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
- {
+     uint64_t next;
-     REQUIRE_ZCMT(ctx);
+     uint64_t diff;
-+    TCGv addr = tcg_temp_new();
+-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
-+
++    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
-     /*
-      * Update pc to current for the non-unwinding exception
+     /* Compute the relative hartid w.r.t the socket */
-      * that might come from cpu_ld*_code() in the helper.
+     hartid = hartid - mtimer->hartid_base;
-      */
-     gen_update_pc(ctx, 0);
+     mtimer->timecmp[hartid] = value;
--    gen_helper_cm_jalt(cpu_pc, tcg_env, tcg_constant_i32(a->index));
+-    if (mtimer->timecmp[hartid] <= rtc_r) {
-+    gen_helper_cm_jalt(addr, tcg_env, tcg_constant_i32(a->index));
++    if (mtimer->timecmp[hartid] <= rtc) {
+         /*
-     /* c.jt vs c.jalt depends on the index. */
+          * If we're setting an MTIMECMP value in the "past",
-     if (a->index >= 32) {
+          * immediately raise the timer interrupt
-@@ -XXX,XX +XXX,XX @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
-         gen_set_gpr(ctx, xRA, succ_pc);
-     }
+     /* otherwise, set up the future timer interrupt */
+     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-+    tcg_gen_mov_tl(cpu_pc, addr);
+-    diff = mtimer->timecmp[hartid] - rtc_r;
-+
++    diff = mtimer->timecmp[hartid] - rtc;
-     tcg_gen_lookup_and_goto_ptr();
+     /* back to ns (note args switched in muldiv64) */
-     ctx->base.is_jmp = DISAS_NORETURN;
+     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
-     return true;
 --
-.44.0
+.41.0

-[PULL 34/34] target/riscv: fix ACPI MCFG table
+[PULL v2 28/45] linux-user/riscv: Use abi type for target_ucontext
-From: Ilya Chugin <danger_mail@list.ru>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-MCFG segments should point to PCI configuration range, not BAR MMIO.
+We should not use types dependend on host arch for target_ucontext.
 This bug is found when run rv32 applications.
-Signed-off-by: Ilya Chugin <danger_mail@list.ru>
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Fixes: 55ecd83b36 ("hw/riscv/virt-acpi-build.c: Add IO controllers and devices")
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
 Message-ID: <180d236d-c8e4-411a-b4d2-632eb82092fa@list.ru>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 4 ++--
+ linux-user/riscv/signal.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/linux-user/riscv/signal.c
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/linux-user/riscv/signal.c
-@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
+@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
-     acpi_add_table(table_offsets, tables_blob);
+ }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
-     {
-         AcpiMcfgInfo mcfg = {
+ struct target_ucontext {
--           .base = s->memmap[VIRT_PCIE_MMIO].base,
+-    unsigned long uc_flags;
--           .size = s->memmap[VIRT_PCIE_MMIO].size,
+-    struct target_ucontext *uc_link;
-+           .base = s->memmap[VIRT_PCIE_ECAM].base,
++    abi_ulong uc_flags;
-+           .size = s->memmap[VIRT_PCIE_ECAM].size,
++    abi_ptr uc_link;
-         };
+     target_stack_t uc_stack;
-         build_mcfg(tables_blob, tables->linker, &mcfg, s->oem_id,
+     target_sigset_t uc_sigmask;
-                    s->oem_table_id);
+     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
 --
-.44.0
+.41.0

-[PULL 18/34] hw/riscv/virt.c: add virtio-iommu-pci hotplug support
+[PULL v2 29/45] target/riscv: support the AIA device emulation with KVM enabled
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-We want to add a RISC-V 'virt' libqos machine to increase our test
+In this patch, we create the APLIC and IMSIC FDT helper functions and
-coverage. Some of the tests will try to plug a virtio-iommu-pci
+remove M mode AIA devices when using KVM acceleration.
 device into the board and do some tests with it.
-Enable virtio-iommu-pci in the 'virt' machine.
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20240217192607.32565-5-dbarboza@ventanamicro.com>
+Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 36 +++++++++++++++++++++++++++++++++++-
+ hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
-file changed, 35 insertions(+), 1 deletion(-)
+file changed, 137 insertions(+), 153 deletions(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
- #include "hw/display/ramfb.h"
+     return ret;
  #include "hw/acpi/aml-build.h"
  #include "qapi/qapi-visit-common.h"
 +#include "hw/virtio/virtio-iommu.h"
  /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
  static bool virt_use_kvm_aia(RISCVVirtState *s)
@@ -XXX,XX +XXX,XX @@ static void create_fdt_fw_cfg(RISCVVirtState *s, const MemMapEntry *memmap)
      qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
  }
-+static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
+-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 -                             uint32_t *phandle, uint32_t *intc_phandles,
 -                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
 +                                 uint32_t *intc_phandles, uint32_t msi_phandle,
 +                                 bool m_mode, uint32_t imsic_guest_bits)
  {
      int cpu, socket;
      char *imsic_name;
      MachineState *ms = MACHINE(s);
      int socket_count = riscv_socket_count(ms);
 -    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
 +    uint32_t imsic_max_hart_per_socket;
      uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 -    *msi_m_phandle = (*phandle)++;
 -    *msi_s_phandle = (*phandle)++;
      imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
      imsic_regs = g_new0(uint32_t, socket_count * 4);
 -    /* M-level IMSIC node */
      for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
          imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    imsic_max_hart_per_socket = 0;
 -    for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_M].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
 -        imsic_regs[socket * 4 + 0] = 0;
 -        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
 -        imsic_regs[socket * 4 + 2] = 0;
 -        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
 -        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
 -            imsic_max_hart_per_socket = s->soc[socket].num_harts;
 -        }
 -    }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_M].base);
 -    qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 -    if (socket_count > 1) {
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 -    }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
 -
 -    g_free(imsic_name);
 -    /* S-level IMSIC node */
 -    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
 -        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 -    }
 -    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
      imsic_max_hart_per_socket = 0;
      for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_S].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
          imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                       s->soc[socket].num_harts;
          imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
              imsic_max_hart_per_socket = s->soc[socket].num_harts;
          }
      }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_S].base);
 +
 +    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
      qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 +    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 +                          FDT_IMSIC_INT_CELLS);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
      qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 +                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
      qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 +                     socket_count * sizeof(uint32_t) * 4);
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 +                     VIRT_IRQCHIP_NUM_MSIS);
 +
      if (imsic_guest_bits) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
 -            imsic_guest_bits);
 +                              imsic_guest_bits);
      }
 +
      if (socket_count > 1) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 +                              imsic_num_bits(imsic_max_hart_per_socket));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 +                              imsic_num_bits(socket_count));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 +                              IMSIC_MMIO_GROUP_MIN_SHIFT);
      }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
 -    g_free(imsic_name);
 +    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 +    g_free(imsic_name);
      g_free(imsic_regs);
      g_free(imsic_cells);
  }
 -static void create_fdt_socket_aplic(RISCVVirtState *s,
 -                                    const MemMapEntry *memmap, int socket,
 -                                    uint32_t msi_m_phandle,
 -                                    uint32_t msi_s_phandle,
 -                                    uint32_t *phandle,
 -                                    uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 +                             uint32_t *phandle, uint32_t *intc_phandles,
 +                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +{
-+    const char compat[] = "virtio,pci-iommu\0pci1af4,1057";
++    *msi_m_phandle = (*phandle)++;
-+    void *fdt = MACHINE(s)->fdt;
++    *msi_s_phandle = (*phandle)++;
-+    uint32_t iommu_phandle;
++
-+    g_autofree char *iommu_node = NULL;
++    if (!kvm_enabled()) {
-+    g_autofree char *pci_node = NULL;
++        /* M-level IMSIC node */
-+
++        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
-+    pci_node = g_strdup_printf("/soc/pci@%lx",
++                             *msi_m_phandle, true, 0);
-+                               (long) virt_memmap[VIRT_PCIE_ECAM].base);
++    }
-+    iommu_node = g_strdup_printf("%s/virtio_iommu@%x,%x", pci_node,
++
-+                                 PCI_SLOT(bdf), PCI_FUNC(bdf));
++    /* S-level IMSIC node */
-+    iommu_phandle = qemu_fdt_alloc_phandle(fdt);
++    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
-+
++                         *msi_s_phandle, false,
-+    qemu_fdt_add_subnode(fdt, iommu_node);
++                         imsic_num_bits(s->aia_guests + 1));
 +
 +    qemu_fdt_setprop(fdt, iommu_node, "compatible", compat, sizeof(compat));
 +    qemu_fdt_setprop_sized_cells(fdt, iommu_node, "reg",
 +                                 1, bdf << 8, 1, 0, 1, 0,
 +                                 1, 0, 1, 0);
 +    qemu_fdt_setprop_cell(fdt, iommu_node, "#iommu-cells", 1);
 +    qemu_fdt_setprop_cell(fdt, iommu_node, "phandle", iommu_phandle);
 +
 +    qemu_fdt_setprop_cells(fdt, pci_node, "iommu-map",
 +                           0, iommu_phandle, 0, bdf,
 +                           bdf + 1, iommu_phandle, bdf + 1, 0xffff - bdf);
 +}
 +
- static void finalize_fdt(RISCVVirtState *s)
++static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 +                                 unsigned long aplic_addr, uint32_t aplic_size,
 +                                 uint32_t msi_phandle,
 +                                 uint32_t *intc_phandles,
 +                                 uint32_t aplic_phandle,
 +                                 uint32_t aplic_child_phandle,
 +                                 bool m_mode)
  {
-     uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
+     int cpu;
-@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
+     char *aplic_name;
- {
+     uint32_t *aplic_cells;
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
+-    unsigned long aplic_addr;
+     MachineState *ms = MACHINE(s);
--    if (device_is_dynamic_sysbus(mc, dev)) {
+-    uint32_t aplic_m_phandle, aplic_s_phandle;
-+    if (device_is_dynamic_sysbus(mc, dev) ||
-+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
+-    aplic_m_phandle = (*phandle)++;
-         return HOTPLUG_HANDLER(machine);
+-    aplic_s_phandle = (*phandle)++;
-     }
+     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
-     return NULL;
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+-    /* M-level APLIC node */
-                                      SYS_BUS_DEVICE(dev));
+     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    aplic_addr = memmap[VIRT_APLIC_M].base +
 -                 (memmap[VIRT_APLIC_M].size * socket);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
      qemu_fdt_add_subnode(ms->fdt, aplic_name);
      qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
      qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 +                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
      qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 +
      if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
          qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +                         aplic_cells,
 +                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
      } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_m_phandle);
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
 +
      qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
 +                           0x0, aplic_addr, 0x0, aplic_size);
      qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 -        aplic_s_phandle);
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 -        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
 +                          VIRT_IRQCHIP_NUM_SOURCES);
 +
 +    if (aplic_child_phandle) {
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 +                              aplic_child_phandle);
 +        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 +                               aplic_child_phandle, 0x1,
 +                               VIRT_IRQCHIP_NUM_SOURCES);
 +    }
 +
      riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
 +
      g_free(aplic_name);
 +    g_free(aplic_cells);
 +}
 -    /* S-level APLIC node */
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 -        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +static void create_fdt_socket_aplic(RISCVVirtState *s,
 +                                    const MemMapEntry *memmap, int socket,
 +                                    uint32_t msi_m_phandle,
 +                                    uint32_t msi_s_phandle,
 +                                    uint32_t *phandle,
 +                                    uint32_t *intc_phandles,
 +                                    uint32_t *aplic_phandles)
 +{
 +    char *aplic_name;
 +    unsigned long aplic_addr;
 +    MachineState *ms = MACHINE(s);
 +    uint32_t aplic_m_phandle, aplic_s_phandle;
 +
 +    aplic_m_phandle = (*phandle)++;
 +    aplic_s_phandle = (*phandle)++;
 +
 +    if (!kvm_enabled()) {
 +        /* M-level APLIC node */
 +        aplic_addr = memmap[VIRT_APLIC_M].base +
 +                     (memmap[VIRT_APLIC_M].size * socket);
 +        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
 +                             msi_m_phandle, intc_phandles,
 +                             aplic_m_phandle, aplic_s_phandle,
 +                             true);
      }
 +
 +    /* S-level APLIC node */
      aplic_addr = memmap[VIRT_APLIC_S].base +
                   (memmap[VIRT_APLIC_S].size * socket);
 +    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
 +                         msi_s_phandle, intc_phandles,
 +                         aplic_s_phandle, 0,
 +                         false);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 -    qemu_fdt_add_subnode(ms->fdt, aplic_name);
 -    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 -    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
 -        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 -    } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_s_phandle);
 -    }
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
      if (!socket) {
          platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      g_free(aplic_name);
 -    g_free(aplic_cells);
      aplic_phandles[socket] = aplic_s_phandle;
  }
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
      int i;
      hwaddr addr;
      uint32_t guest_bits;
 -    DeviceState *aplic_m;
 -    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
 +    DeviceState *aplic_s = NULL;
 +    DeviceState *aplic_m = NULL;
 +    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
      if (msimode) {
 -        /* Per-socket M-level IMSICs */
 -        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        for (i = 0; i < hart_count; i++) {
 -            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 -                               base_hartid + i, true, 1,
 -                               VIRT_IRQCHIP_NUM_MSIS);
 +        if (!kvm_enabled()) {
 +            /* Per-socket M-level IMSICs */
 +            addr = memmap[VIRT_IMSIC_M].base +
 +                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +            for (i = 0; i < hart_count; i++) {
 +                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 +                                   base_hartid + i, true, 1,
 +                                   VIRT_IRQCHIP_NUM_MSIS);
 +            }
          }
-     }
-+
+         /* Per-socket S-level IMSICs */
-+    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
-+        create_fdt_virtio_iommu(s, pci_get_bdf(PCI_DEVICE(dev)));
+         }
-+    }
+     }
 -    /* Per-socket M-level APLIC */
 -    aplic_m = riscv_aplic_create(
 -        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
 -        memmap[VIRT_APLIC_M].size,
 -        (msimode) ? 0 : base_hartid,
 -        (msimode) ? 0 : hart_count,
 -        VIRT_IRQCHIP_NUM_SOURCES,
 -        VIRT_IRQCHIP_NUM_PRIO_BITS,
 -        msimode, true, NULL);
 -
 -    if (aplic_m) {
 -        /* Per-socket S-level APLIC */
 -        riscv_aplic_create(
 -            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
 -            memmap[VIRT_APLIC_S].size,
 -            (msimode) ? 0 : base_hartid,
 -            (msimode) ? 0 : hart_count,
 -            VIRT_IRQCHIP_NUM_SOURCES,
 -            VIRT_IRQCHIP_NUM_PRIO_BITS,
 -            msimode, false, aplic_m);
 +    if (!kvm_enabled()) {
 +        /* Per-socket M-level APLIC */
 +        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
 +                                     socket * memmap[VIRT_APLIC_M].size,
 +                                     memmap[VIRT_APLIC_M].size,
 +                                     (msimode) ? 0 : base_hartid,
 +                                     (msimode) ? 0 : hart_count,
 +                                     VIRT_IRQCHIP_NUM_SOURCES,
 +                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                     msimode, true, NULL);
      }
 -    return aplic_m;
 +    /* Per-socket S-level APLIC */
 +    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
 +                                 socket * memmap[VIRT_APLIC_S].size,
 +                                 memmap[VIRT_APLIC_S].size,
 +                                 (msimode) ? 0 : base_hartid,
 +                                 (msimode) ? 0 : hart_count,
 +                                 VIRT_IRQCHIP_NUM_SOURCES,
 +                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                 msimode, false, aplic_m);
 +
 +    return kvm_enabled() ? aplic_s : aplic_m;
  }
- static void virt_machine_class_init(ObjectClass *oc, void *data)
+ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
 --
-.44.0
+.41.0

-[PULL 03/34] hw/riscv/virt-acpi-build.c: Generate SPCR table
+[PULL v2 30/45] target/riscv: check the in-kernel irqchip support
-From: Sia Jee Heng <jeeheng.sia@starfivetech.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Generate Serial Port Console Redirection Table (SPCR) for RISC-V
+We check the in-kernel irqchip support when using KVM acceleration.
 virtual machine.
-Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
 Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20240129021440.17640-3-jeeheng.sia@starfivetech.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 39 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/kvm.c | 10 +++++++++-
-file changed, 39 insertions(+)
+file changed, 9 insertions(+), 1 deletion(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/kvm.c
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
-     aml_append(scope, dev);
  int kvm_arch_irqchip_create(KVMState *s)
  {
 -    return 0;
 +    if (kvm_kernel_irqchip_split()) {
 +        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
 +        exit(1);
 +    }
 +
 +    /*
 +     * We can create the VAIA using the newer device control API.
 +     */
 +    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
  }
-+/*
+ int kvm_arch_process_async_events(CPUState *cs)
 + * Serial Port Console Redirection Table (SPCR)
 + * Rev: 1.07
 + */
 +
 +static void
 +spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
 +{
 +    AcpiSpcrData serial = {
 +        .interface_type = 0,       /* 16550 compatible */
 +        .base_addr.id = AML_AS_SYSTEM_MEMORY,
 +        .base_addr.width = 32,
 +        .base_addr.offset = 0,
 +        .base_addr.size = 1,
 +        .base_addr.addr = s->memmap[VIRT_UART0].base,
 +        .interrupt_type = (1 << 4),/* Bit[4] RISC-V PLIC/APLIC */
 +        .pc_interrupt = 0,
 +        .interrupt = UART0_IRQ,
 +        .baud_rate = 7,            /* 15200 */
 +        .parity = 0,
 +        .stop_bits = 1,
 +        .flow_control = 0,
 +        .terminal_type = 3,        /* ANSI */
 +        .language = 0,             /* Language */
 +        .pci_device_id = 0xffff,   /* not a PCI device*/
 +        .pci_vendor_id = 0xffff,   /* not a PCI device*/
 +        .pci_bus = 0,
 +        .pci_device = 0,
 +        .pci_function = 0,
 +        .pci_flags = 0,
 +        .pci_segment = 0,
 +    };
 +
 +    build_spcr(table_data, linker, &serial, 2, s->oem_id, s->oem_table_id);
 +}
 +
  /* RHCT Node[N] starts at offset 56 */
  #define RHCT_NODE_ARRAY_OFFSET 56
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
      acpi_add_table(table_offsets, tables_blob);
      build_rhct(tables_blob, tables->linker, s);
 +    acpi_add_table(table_offsets, tables_blob);
 +    spcr_setup(tables_blob, tables->linker, s);
 +
      acpi_add_table(table_offsets, tables_blob);
      {
          AcpiMcfgInfo mcfg = {
 --
-.44.0
+.41.0

-[PULL 16/34] hw/riscv/virt-acpi-build.c: Add SRAT and SLIT ACPI tables
+[PULL v2 31/45] target/riscv: Create an KVM AIA irqchip
-From: Haibo Xu <haibo1.xu@intel.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Enable ACPI NUMA support by adding the following 2 ACPI tables:
+We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
-SRAT: provides the association for memory/Harts and Proximity Domains
+the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
-SLIT: provides the relative distance between Proximity Domains
+We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
 parameter is passed along with --accel in QEMU command-line.
 ) "riscv-aia=emul": IMSIC is emulated by hypervisor
 ) "riscv-aia=hwaccel": use hardware guest IMSIC
 ) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                      otherwise we fallback to software emulation.
-The SRAT RINTC Affinity Structure definition[1] was based on the recently
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-approved ACPI CodeFirst ECR[2].
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [1] https://github.com/riscv-non-isa/riscv-acpi/issues/25
 [2] https://mantis.uefi.org/mantis/view.php?id=2433
 Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20240129094200.3581037-1-haibo1.xu@intel.com>
+Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 60 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/kvm_riscv.h |   4 +
-file changed, 60 insertions(+)
+ target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 files changed, 190 insertions(+)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/target/riscv/kvm_riscv.h
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/target/riscv/kvm_riscv.h
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@
-     acpi_table_end(linker, &table);
+ void kvm_riscv_init_user_properties(Object *cpu_obj);
  void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
  void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
 +void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
 +                          uint64_t aia_irq_num, uint64_t aia_msi_num,
 +                          uint64_t aplic_base, uint64_t imsic_base,
 +                          uint64_t guest_num);
  #endif
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "hw/boards.h"
  #include "hw/irq.h"
 +#include "hw/intc/riscv_imsic.h"
  #include "qemu/log.h"
  #include "hw/loader.h"
  #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
  #include "chardev/char-fe.h"
  #include "migration/migration.h"
  #include "sysemu/runstate.h"
 +#include "hw/riscv/numa.h"
  static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                   uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
      return true;
  }
-+/*
++static int aia_mode;
-+ * ACPI spec, Revision 6.5+
++
-+ * 5.2.16 System Resource Affinity Table (SRAT)
++static const char *kvm_aia_mode_str(uint64_t mode)
-+ * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/25
++{
-+ *      https://drive.google.com/file/d/1YTdDx2IPm5IeZjAW932EYU-tUtgS08tX/view
++    switch (mode) {
-+ */
++    case KVM_DEV_RISCV_AIA_MODE_EMUL:
-+static void
++        return "emul";
-+build_srat(GArray *table_data, BIOSLinker *linker, RISCVVirtState *vms)
++    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
-+{
++        return "hwaccel";
-+    int i;
++    case KVM_DEV_RISCV_AIA_MODE_AUTO:
-+    uint64_t mem_base;
++    default:
-+    MachineClass *mc = MACHINE_GET_CLASS(vms);
++        return "auto";
-+    MachineState *ms = MACHINE(vms);
++    };
-+    const CPUArchIdList *cpu_list = mc->possible_cpu_arch_ids(ms);
++}
-+    AcpiTable table = { .sig = "SRAT", .rev = 3, .oem_id = vms->oem_id,
++
-+                        .oem_table_id = vms->oem_table_id };
++static char *riscv_get_kvm_aia(Object *obj, Error **errp)
-+
++{
-+    acpi_table_begin(&table, table_data);
++    return g_strdup(kvm_aia_mode_str(aia_mode));
-+    build_append_int_noprefix(table_data, 1, 4); /* Reserved */
++}
-+    build_append_int_noprefix(table_data, 0, 8); /* Reserved */
++
-+
++static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
-+    for (i = 0; i < cpu_list->len; ++i) {
++{
-+        uint32_t nodeid = cpu_list->cpus[i].props.node_id;
++    if (!strcmp(val, "emul")) {
-+        /*
++        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
-+         * 5.2.16.8 RINTC Affinity Structure
++    } else if (!strcmp(val, "hwaccel")) {
-+         */
++        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
-+        build_append_int_noprefix(table_data, 7, 1);      /* Type */
++    } else if (!strcmp(val, "auto")) {
-+        build_append_int_noprefix(table_data, 20, 1);     /* Length */
++        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
-+        build_append_int_noprefix(table_data, 0, 2);        /* Reserved */
++    } else {
-+        build_append_int_noprefix(table_data, nodeid, 4); /* Proximity Domain */
++        error_setg(errp, "Invalid KVM AIA mode");
-+        build_append_int_noprefix(table_data, i, 4); /* ACPI Processor UID */
++        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
-+        /* Flags, Table 5-70 */
++    }
-+        build_append_int_noprefix(table_data, 1 /* Flags: Enabled */, 4);
++}
-+        build_append_int_noprefix(table_data, 0, 4); /* Clock Domain */
++
-+    }
+ void kvm_arch_accel_class_init(ObjectClass *oc)
-+
+ {
-+    mem_base = vms->memmap[VIRT_DRAM].base;
++    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
-+    for (i = 0; i < ms->numa_state->num_nodes; ++i) {
++                                  riscv_set_kvm_aia);
-+        if (ms->numa_state->nodes[i].node_mem > 0) {
++    object_class_property_set_description(oc, "riscv-aia",
-+            build_srat_memory(table_data, mem_base,
++                                          "Set KVM AIA mode. Valid values are "
-+                              ms->numa_state->nodes[i].node_mem, i,
++                                          "emul, hwaccel, and auto. Default "
-+                              MEM_AFFINITY_ENABLED);
++                                          "is auto.");
-+            mem_base += ms->numa_state->nodes[i].node_mem;
++    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
 +                                    "auto");
 +}
 +
 +void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
 +                          uint64_t aia_irq_num, uint64_t aia_msi_num,
 +                          uint64_t aplic_base, uint64_t imsic_base,
 +                          uint64_t guest_num)
 +{
 +    int ret, i;
 +    int aia_fd = -1;
 +    uint64_t default_aia_mode;
 +    uint64_t socket_count = riscv_socket_count(machine);
 +    uint64_t max_hart_per_socket = 0;
 +    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
 +    uint64_t socket_bits, hart_bits, guest_bits;
 +
 +    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
 +
 +    if (aia_fd < 0) {
 +        error_report("Unable to create in-kernel irqchip");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                            &default_aia_mode, false, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to get current KVM AIA mode");
 +        exit(1);
 +    }
 +    qemu_log("KVM AIA: default mode is %s\n",
 +             kvm_aia_mode_str(default_aia_mode));
 +
 +    if (default_aia_mode != aia_mode) {
 +        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                                &aia_mode, true, NULL);
 +        if (ret < 0)
 +            warn_report("KVM AIA: failed to set KVM AIA mode");
 +        else
 +            qemu_log("KVM AIA: set current mode to %s\n",
 +                     kvm_aia_mode_str(aia_mode));
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
 +                            &aia_irq_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of input irq lines");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
 +                            &aia_msi_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of msi");
 +        exit(1);
 +    }
 +
 +    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
 +                            &socket_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
 +                            &group_shift, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_shift");
 +        exit(1);
 +    }
 +
 +    guest_bits = guest_num == 0 ? 0 :
 +                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
 +                            &guest_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set guest_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 +                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
 +                            &aplic_base, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set the base address of APLIC");
 +        exit(1);
 +    }
 +
 +    for (socket = 0; socket < socket_count; socket++) {
 +        socket_imsic_base = imsic_base + socket * (1U << group_shift);
 +        hart_count = riscv_socket_hart_count(machine, socket);
 +        base_hart = riscv_socket_first_hartid(machine, socket);
 +
 +        if (max_hart_per_socket < hart_count) {
 +            max_hart_per_socket = hart_count;
 +        }
-+    }
++
-+
++        for (i = 0; i < hart_count; i++) {
-+    acpi_table_end(linker, &table);
++            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
-+}
++            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
-+
++                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
- static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
++                                    &imsic_addr, true, NULL);
- {
++            if (ret < 0) {
-     GArray *table_offsets;
++                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
-     unsigned dsdt, xsdt;
++                exit(1);
-     GArray *tables_blob = tables->table_data;
++            }
 +    MachineState *ms = MACHINE(s);
      table_offsets = g_array_new(false, true,
                                  sizeof(uint32_t));
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
                     s->oem_table_id);
      }
 +    if (ms->numa_state->num_nodes > 0) {
 +        acpi_add_table(table_offsets, tables_blob);
 +        build_srat(tables_blob, tables->linker, s);
 +        if (ms->numa_state->have_numa_distance) {
 +            acpi_add_table(table_offsets, tables_blob);
 +            build_slit(tables_blob, tables->linker, ms, s->oem_id,
 +                       s->oem_table_id);
 +        }
 +    }
 +
-     /* XSDT is pointed to by RSDP */
++    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
-     xsdt = tables_blob->len;
++    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-     build_xsdt(tables_blob, tables->linker, table_offsets, s->oem_id,
++                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
 +                            &hart_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set hart_bits");
 +        exit(1);
 +    }
 +
 +    if (kvm_has_gsi_routing()) {
 +        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
 +            /* KVM AIA only has one APLIC instance */
 +            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
 +        }
 +        kvm_gsi_routing_allowed = true;
 +        kvm_irqchip_commit_routes(kvm_state);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
 +                            KVM_DEV_RISCV_AIA_CTRL_INIT,
 +                            NULL, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: initialized fail");
 +        exit(1);
 +    }
 +
 +    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
  }
 --
-.44.0
+.41.0

-[PULL 31/34] hw/intc/riscv_aplic: Fix setipnum_le write emulation for APLIC MSI-mode
+[PULL v2 32/45] target/riscv: update APLIC and IMSIC to support KVM AIA
-From: Anup Patel <apatel@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The writes to setipnum_le register in APLIC MSI-mode have special
+KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
-consideration for level-triggered interrupts as-per section "4.9.2
+APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
-Special consideration for level-sensitive interrupt sources" of the
+mmio operations of APLIC when using KVM AIA and send wired interrupt
-RISC-V AIA specification.
+signal via KVM_IRQ_LINE API.
 After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
 when the IMSICs receive mmio write requests.
-Particularly, the below text from the RISC-V specification defines
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-the behaviour of writes to setipnum_le for level-triggered interrupts:
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
 "A second option is for the interrupt service routine to write the
 APLIC’s source identity number for the interrupt to the domain’s
 setipnum register just before exiting. This will cause the interrupt’s
 pending bit to be set to one again if the source is still asserting
 an interrupt, but not if the source is not asserting an interrupt."
 Fix setipnum_le write emulation for APLIC MSI-mode by implementing
 the above behaviour in riscv_aplic_set_pending() function.
 Fixes: e8f79343cfc8 ("hw/intc: Add RISC-V AIA APLIC device emulation")
 Signed-off-by: Anup Patel <apatel@ventanamicro.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20240306095722.463296-2-apatel@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/riscv_aplic.c | 20 ++++++++++++++++----
+ hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
-file changed, 16 insertions(+), 4 deletions(-)
+ hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 files changed, 61 insertions(+), 20 deletions(-)
 diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_aplic.c
 +++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
+@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "target/riscv/cpu.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "migration/vmstate.h"
  #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
  #define APLIC_IDC_CLAIMI               0x1c
 +/*
 + * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
 + * APLIC Wired.
 + */
 +static bool is_kvm_aia(bool msimode)
 +{
 +    return kvm_irqchip_in_kernel() && msimode;
 +}
 +
  static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                              uint32_t word)
  {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
      return topi;
  }
 +static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 +{
 +    kvm_set_irq(kvm_state, irq, !!level);
 +}
 +
  static void riscv_aplic_request(void *opaque, int irq, int level)
  {
      bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      uint32_t i;
      RISCVAPLICState *aplic = RISCV_APLIC(dev);
 -    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 -    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->state = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->target = g_new0(uint32_t, aplic->num_irqs);
 -    if (!aplic->msimode) {
 -        for (i = 0; i < aplic->num_irqs; i++) {
 -            aplic->target[i] = 1;
 +    if (!is_kvm_aia(aplic->msimode)) {
 +        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 +        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->state = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->target = g_new0(uint32_t, aplic->num_irqs);
 +        if (!aplic->msimode) {
 +            for (i = 0; i < aplic->num_irqs; i++) {
 +                aplic->target[i] = 1;
 +            }
          }
 -    }
 -    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 -    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 -    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 +        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 +        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 +        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 -    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
 -                          TYPE_RISCV_APLIC, aplic->aperture_size);
 -    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
 +                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
 +        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +    }
      /*
       * Only root APLICs have hardware IRQ lines. All non-root APLICs
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        if (is_kvm_aia(aplic->msimode)) {
 +            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
 +        } else {
 +            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        }
      }
-     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
+     /* Create output IRQ lines for non-MSI mode */
--    if ((sm == APLIC_SOURCECFG_SM_INACTIVE) ||
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
--        ((!aplic->msimode || (aplic->msimode && !pending)) &&
+     qdev_prop_set_bit(dev, "mmode", mmode);
--         ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
--          (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)))) {
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+    if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
+-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
-         return;
++
 +    if (!is_kvm_aia(msimode)) {
 +        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +    }
      if (parent) {
          riscv_aplic_add_child(parent, dev);
 diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_imsic.c
 +++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
  #include "target/riscv/cpu.h"
  #include "target/riscv/cpu_bits.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "migration/vmstate.h"
  #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
          goto err;
      }
-+    if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
++#if defined(CONFIG_KVM)
-+        (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
++    if (kvm_irqchip_in_kernel()) {
-+        if (!aplic->msimode || (aplic->msimode && !pending)) {
++        struct kvm_msi msi;
-+            return;
++
-+        }
++        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
-+        if ((aplic->state[irq] & APLIC_ISTATE_INPUT) &&
++        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
-+            (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
++        msi.data = le32_to_cpu(value);
-+            return;
++
-+        }
++        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
-+        if (!(aplic->state[irq] & APLIC_ISTATE_INPUT) &&
++
-+            (sm == APLIC_SOURCECFG_SM_LEVEL_HIGH)) {
++        return;
 +            return;
 +        }
 +    }
++#endif
 +
-     riscv_aplic_set_pending_raw(aplic, irq, pending);
+     /* Writes only supported for MSI little-endian registers */
- }
+     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
+     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
      CPUState *cpu = cpu_by_arch_id(imsic->hartid);
      CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 -    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 -    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 -    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 -    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +    if (!kvm_irqchip_in_kernel()) {
 +        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 +        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 +        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 +        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +    }
      memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                            imsic, TYPE_RISCV_IMSIC,
 --
-.44.0
+.41.0

-[PULL 19/34] hw/riscv/virt.c: make aclint compatible with 'qtest' accel
+[PULL v2 33/45] target/riscv: select KVM AIA in riscv virt machine
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The 'virt' machine makes assumptions on the Advanced Core-Local
+Select KVM AIA when the host kernel has in-kernel AIA chip support.
-Interruptor, or aclint, based on 'tcg_enabled()' conditionals.  This
+Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
-will impact MSI related tests support when adding a RISC-V 'virt' libqos
+devices to KVM APLIC.
 machine. The accelerator used in that case, 'qtest', isn't being
 accounted for and we'll error out if we try to enable aclint.
-Create a new virt_aclint_allowed() helper to gate the aclint code
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-considering both TCG and 'qtest' accelerators. The error message is
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-left untouched, mentioning TCG only, because we don't expect the
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-regular user to be aware of 'qtest'.
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
 We want to add 'qtest' support for aclint only, leaving the TCG specific
 bits out of it. This is done by changing the current format we use
 today:
 if (tcg_enabled()) {
    if (s->have_aclint) { - aclint logic - }
    else { - non-aclint, TCG logic - }
 }
 into:
 if (virt_aclint_allowed() && s->have_aclint) {
  - aclint logic -
 } else if (tcg_enabled()) {
  - non-aclint, TCG logic -
 }
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240217192607.32565-6-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 52 +++++++++++++++++++++++++------------------------
+ hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
-file changed, 27 insertions(+), 25 deletions(-)
+file changed, 63 insertions(+), 31 deletions(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
 @@ -XXX,XX +XXX,XX @@
- #include "sysemu/tcg.h"
+ #include "hw/riscv/virt.h"
- #include "sysemu/kvm.h"
+ #include "hw/riscv/boot.h"
- #include "sysemu/tpm.h"
+ #include "hw/riscv/numa.h"
-+#include "sysemu/qtest.h"
++#include "kvm_riscv.h"
- #include "hw/pci/pci.h"
+ #include "hw/intc/riscv_aclint.h"
- #include "hw/pci-host/gpex.h"
+ #include "hw/intc/riscv_aplic.h"
- #include "hw/display/ramfb.h"
+ #include "hw/intc/riscv_imsic.h"
-@@ -XXX,XX +XXX,XX @@ static bool virt_use_kvm_aia(RISCVVirtState *s)
+@@ -XXX,XX +XXX,XX @@
-     return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+ #error "Can't accommodate all IMSIC groups in address space"
- }
+ #endif
-+static bool virt_aclint_allowed(void)
++/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 +static bool virt_use_kvm_aia(RISCVVirtState *s)
 +{
-+    return tcg_enabled() || qtest_enabled();
++    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +}
 +
  static const MemMapEntry virt_memmap[] = {
      [VIRT_DEBUG] =        {        0x0,         0x100 },
      [VIRT_MROM] =         {     0x1000,        0xf000 },
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+                                  uint32_t *intc_phandles,
+                                  uint32_t aplic_phandle,
+                                  uint32_t aplic_child_phandle,
+-                                 bool m_mode)
++                                 bool m_mode, int num_harts)
+ {
+     int cpu;
+     char *aplic_name;
+     uint32_t *aplic_cells;
+     MachineState *ms = MACHINE(s);
+-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
++    aplic_cells = g_new0(uint32_t, num_harts * 2);
+-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
++    for (cpu = 0; cpu < num_harts; cpu++) {
+         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
+     }
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
+-                         aplic_cells,
+-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
++                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
+     } else {
+         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
+     }
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                     uint32_t msi_s_phandle,
+                                     uint32_t *phandle,
+                                     uint32_t *intc_phandles,
+-                                    uint32_t *aplic_phandles)
++                                    uint32_t *aplic_phandles,
++                                    int num_harts)
+ {
+     char *aplic_name;
+     unsigned long aplic_addr;
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
+         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+                              msi_m_phandle, intc_phandles,
+                              aplic_m_phandle, aplic_s_phandle,
+-                             true);
++                             true, num_harts);
+     }
+     /* S-level APLIC node */
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
+     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+                          msi_s_phandle, intc_phandles,
+                          aplic_s_phandle, 0,
+-                         false);
++                         false, num_harts);
+     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 @@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+         *msi_pcie_phandle = msi_s_phandle;
-         create_fdt_socket_memory(s, memmap, socket);
+     }
--        if (tcg_enabled()) {
+-    phandle_pos = ms->smp.cpus;
--            if (s->have_aclint) {
+-    for (socket = (socket_count - 1); socket >= 0; socket--) {
--                create_fdt_socket_aclint(s, memmap, socket,
+-        phandle_pos -= s->soc[socket].num_harts;
--                    &intc_phandles[phandle_pos]);
+-
--            } else {
+-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
--                create_fdt_socket_clint(s, memmap, socket,
+-            create_fdt_socket_plic(s, memmap, socket, phandle,
--                    &intc_phandles[phandle_pos]);
+-                &intc_phandles[phandle_pos], xplic_phandles);
--            }
+-        } else {
-+        if (virt_aclint_allowed() && s->have_aclint) {
+-            create_fdt_socket_aplic(s, memmap, socket,
-+            create_fdt_socket_aclint(s, memmap, socket,
+-                msi_m_phandle, msi_s_phandle, phandle,
-+                                     &intc_phandles[phandle_pos]);
+-                &intc_phandles[phandle_pos], xplic_phandles);
-+        } else if (tcg_enabled()) {
++    /* KVM AIA only has one APLIC instance */
-+            create_fdt_socket_clint(s, memmap, socket,
++    if (virt_use_kvm_aia(s)) {
-+                                    &intc_phandles[phandle_pos]);
++        create_fdt_socket_aplic(s, memmap, 0,
 +                                msi_m_phandle, msi_s_phandle, phandle,
 +                                &intc_phandles[0], xplic_phandles,
 +                                ms->smp.cpus);
 +    } else {
 +        phandle_pos = ms->smp.cpus;
 +        for (socket = (socket_count - 1); socket >= 0; socket--) {
 +            phandle_pos -= s->soc[socket].num_harts;
 +
 +            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +                create_fdt_socket_plic(s, memmap, socket, phandle,
 +                                       &intc_phandles[phandle_pos],
 +                                       xplic_phandles);
 +            } else {
 +                create_fdt_socket_aplic(s, memmap, socket,
 +                                        msi_m_phandle, msi_s_phandle, phandle,
 +                                        &intc_phandles[phandle_pos],
 +                                        xplic_phandles,
 +                                        s->soc[socket].num_harts);
 +            }
          }
      }
+     g_free(intc_phandles);
+-    for (socket = 0; socket < socket_count; socket++) {
+-        if (socket == 0) {
+-            *irq_mmio_phandle = xplic_phandles[socket];
+-            *irq_virtio_phandle = xplic_phandles[socket];
+-            *irq_pcie_phandle = xplic_phandles[socket];
+-        }
+-        if (socket == 1) {
+-            *irq_virtio_phandle = xplic_phandles[socket];
+-            *irq_pcie_phandle = xplic_phandles[socket];
+-        }
+-        if (socket == 2) {
+-            *irq_pcie_phandle = xplic_phandles[socket];
++    if (virt_use_kvm_aia(s)) {
++        *irq_mmio_phandle = xplic_phandles[0];
++        *irq_virtio_phandle = xplic_phandles[0];
++        *irq_pcie_phandle = xplic_phandles[0];
++    } else {
++        for (socket = 0; socket < socket_count; socket++) {
++            if (socket == 0) {
++                *irq_mmio_phandle = xplic_phandles[socket];
++                *irq_virtio_phandle = xplic_phandles[socket];
++                *irq_pcie_phandle = xplic_phandles[socket];
++            }
++            if (socket == 1) {
++                *irq_virtio_phandle = xplic_phandles[socket];
++                *irq_pcie_phandle = xplic_phandles[socket];
++            }
++            if (socket == 2) {
++                *irq_pcie_phandle = xplic_phandles[socket];
++            }
+         }
+     }
 @@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-         exit(1);
+         }
      }
--    if (!tcg_enabled() && s->have_aclint) {
++    if (virt_use_kvm_aia(s)) {
-+    if (!virt_aclint_allowed() && s->have_aclint) {
++        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
-         error_report("'aclint' is only available with TCG acceleration");
++                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
-         exit(1);
++                             memmap[VIRT_APLIC_S].base,
-     }
++                             memmap[VIRT_IMSIC_S].base,
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
++                             s->aia_guests);
-                                 hart_count, &error_abort);
++    }
-         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
++
+     if (riscv_is_32bit(&s->soc[0])) {
--        if (tcg_enabled()) {
+ #if HOST_LONG_BITS == 64
--            if (s->have_aclint) {
+         /* limit RAM size in a 32-bit system */
 -                if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
 -                    /* Per-socket ACLINT MTIMER */
 -                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
 +        if (virt_aclint_allowed() && s->have_aclint) {
 +            if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
 +                /* Per-socket ACLINT MTIMER */
 +                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
                              i * RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                          RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                          base_hartid, hart_count,
                          RISCV_ACLINT_DEFAULT_MTIMECMP,
                          RISCV_ACLINT_DEFAULT_MTIME,
                          RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 -                } else {
 -                    /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
 -                    riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
 +            } else {
 +                /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
 +                riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
                              i * memmap[VIRT_CLINT].size,
                          base_hartid, hart_count, false);
 -                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
 +                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
                              i * memmap[VIRT_CLINT].size +
                              RISCV_ACLINT_SWI_SIZE,
                          RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                          RISCV_ACLINT_DEFAULT_MTIMECMP,
                          RISCV_ACLINT_DEFAULT_MTIME,
                          RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 -                    riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
 +                riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
                              i * memmap[VIRT_ACLINT_SSWI].size,
                          base_hartid, hart_count, true);
 -                }
 -            } else {
 -                /* Per-socket SiFive CLINT */
 -                riscv_aclint_swi_create(
 +            }
 +        } else if (tcg_enabled()) {
 +            /* Per-socket SiFive CLINT */
 +            riscv_aclint_swi_create(
                      memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
                      base_hartid, hart_count, false);
 -                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
 +            riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
                          i * memmap[VIRT_CLINT].size + RISCV_ACLINT_SWI_SIZE,
                      RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
                      RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
                      RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 -            }
          }
          /* Per-socket interrupt controller */
 --
-.44.0
+.41.0

-[PULL 23/34] tests: riscv64: Use 'zfa' instead of 'Zfa'
+[PULL v2 34/45] hw/riscv: virt: Fix riscv,pmu DT node path
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Conor Dooley <conor.dooley@microchip.com>
-Running test-fcvtmod triggers the following deprecation warning:
+On a dtb dumped from the virt machine, dt-validate complains:
-  warning: CPU property 'Zfa' is deprecated. Please use 'zfa' instead
+soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
-Let's fix that.
+        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
 That's pretty cryptic, but running the dtb back through dtc produces
 something a lot more reasonable:
 Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Moving the riscv,pmu node out of the soc bus solves the problem.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
 Message-ID: <20240229180656.1208881-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- tests/tcg/riscv64/Makefile.target | 2 +-
+ hw/riscv/virt.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/riscv64/Makefile.target
+--- a/hw/riscv/virt.c
-+++ b/tests/tcg/riscv64/Makefile.target
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
- TESTS += test-fcvtmod
+     MachineState *ms = MACHINE(s);
- test-fcvtmod: CFLAGS += -march=rv64imafdc
+     RISCVCPU hart = s->soc[0].harts[0];
- test-fcvtmod: LDFLAGS += -static
--run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
+-    pmu_name = g_strdup_printf("/soc/pmu");
-+run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,zfa=true
++    pmu_name = g_strdup_printf("/pmu");
      qemu_fdt_add_subnode(ms->fdt, pmu_name);
      qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
      riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
 --
-.44.0
+.41.0

-[PULL 11/34] target/riscv: Gate hardware A/D PTE bit updating
+[PULL v2 35/45] target/riscv: Update CSR bits name for svadu extension
-From: Andrew Jones <ajones@ventanamicro.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-Gate hardware A/D PTE bit updating on {m,h}envcfg.ADUE and only
+The Svadu specification updated the name of the *envcfg bit from
-enable menvcfg.ADUE on reset if svade has not been selected. Now
+HADE to ADUE.
 that we also consider svade, we have four possible configurations:
-) !svade && !svadu
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-    use hardware updating and there's no way to disable it
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
     (the default, which maintains past behavior. Maintaining
      the default, even with !svadu is a change that fixes [1])
 ) !svade && svadu
     use hardware updating, but also provide {m,h}envcfg.ADUE,
     allowing software to switch to exception mode
     (being able to switch is a change which fixes [1])
 ) svade && !svadu
     use exception mode and there's no way to switch to hardware
     updating
     (this behavior change fixes [2])
 ) svade && svadu
     use exception mode, but also provide {m,h}envcfg.ADUE,
     allowing software to switch to hardware updating
     (this behavior change fixes [2])
 Fixes: 0af3f115e68e ("target/riscv: Add *envcfg.HADE related check in address translation") [1]
 Fixes: 48531f5adb2a ("target/riscv: implement svade") [2]
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240215223955.969568-6-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c         |  3 ++-
+ target/riscv/cpu_bits.h   |  8 ++++----
- target/riscv/cpu_helper.c  | 19 +++++++++++++++----
+ target/riscv/cpu.c        |  4 ++--
- target/riscv/tcg/tcg-cpu.c | 15 +++++----------
+ target/riscv/cpu_helper.c |  6 +++---
-files changed, 22 insertions(+), 15 deletions(-)
+ target/riscv/csr.c        | 12 ++++++------
 files changed, 15 insertions(+), 15 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define MENVCFG_CBIE                       (3UL << 4)
+ #define MENVCFG_CBCFE                      BIT(6)
+ #define MENVCFG_CBZE                       BIT(7)
+-#define MENVCFG_HADE                       (1ULL << 61)
++#define MENVCFG_ADUE                       (1ULL << 61)
+ #define MENVCFG_PBMTE                      (1ULL << 62)
+ #define MENVCFG_STCE                       (1ULL << 63)
+ /* For RV32 */
+-#define MENVCFGH_HADE                      BIT(29)
++#define MENVCFGH_ADUE                      BIT(29)
+ #define MENVCFGH_PBMTE                     BIT(30)
+ #define MENVCFGH_STCE                      BIT(31)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define HENVCFG_CBIE                       MENVCFG_CBIE
+ #define HENVCFG_CBCFE                      MENVCFG_CBCFE
+ #define HENVCFG_CBZE                       MENVCFG_CBZE
+-#define HENVCFG_HADE                       MENVCFG_HADE
++#define HENVCFG_ADUE                       MENVCFG_ADUE
+ #define HENVCFG_PBMTE                      MENVCFG_PBMTE
+ #define HENVCFG_STCE                       MENVCFG_STCE
+ /* For RV32 */
+-#define HENVCFGH_HADE                       MENVCFGH_HADE
++#define HENVCFGH_ADUE                       MENVCFGH_ADUE
+ #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
+ #define HENVCFGH_STCE                       MENVCFGH_STCE
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
      env->two_stage_lookup = false;
      env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
--                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
+-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
-+                   (!cpu->cfg.ext_svade && cpu->cfg.ext_svadu ?
++                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
-+                    MENVCFG_ADUE : 0);
+     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-     env->henvcfg = 0;
+-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
 +                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
      /* Initialized default priorities of local interrupts. */
+     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
 @@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      }
      bool pbmte = env->menvcfg & MENVCFG_PBMTE;
--    bool adue = env->menvcfg & MENVCFG_ADUE;
+-    bool hade = env->menvcfg & MENVCFG_HADE;
-+    bool svade = riscv_cpu_cfg(env)->ext_svade;
++    bool adue = env->menvcfg & MENVCFG_ADUE;
 +    bool svadu = riscv_cpu_cfg(env)->ext_svadu;
 +    bool adue = svadu ? env->menvcfg & MENVCFG_ADUE : !svade;
      if (first_stage && two_stage && env->virt_enabled) {
          pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
+-        hade = hade && (env->henvcfg & HENVCFG_HADE);
++        adue = adue && (env->henvcfg & HENVCFG_ADUE);
+     }
+     int ptshift = (levels - 1) * ptidxbits;
 @@ -XXX,XX +XXX,XX @@ restart:
-         return TRANSLATE_FAIL;
-     }
--    /* If necessary, set accessed and dirty bits. */
--    target_ulong updated_pte = pte | PTE_A |
--                (access_type == MMU_DATA_STORE ? PTE_D : 0);
-+    target_ulong updated_pte = pte;
-+
-+    /*
-+     * If ADUE is enabled, set accessed and dirty bits.
-+     * Otherwise raise an exception if necessary.
-+     */
-+    if (adue) {
-+        updated_pte |= PTE_A | (access_type == MMU_DATA_STORE ? PTE_D : 0);
-+    } else if (!(pte & PTE_A) ||
-+               (access_type == MMU_DATA_STORE && !(pte & PTE_D))) {
-+        return TRANSLATE_FAIL;
-+    }
      /* Page table updates need to be atomic with MTTCG enabled */
      if (updated_pte != pte && !is_debug) {
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+-        if (!hade) {
 +        if (!adue) {
              return TRANSLATE_FAIL;
          }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/target/riscv/csr.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
- static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
+         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                  (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                (cfg->ext_svadu ? MENVCFG_HADE : 0);
 +                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
      }
      env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
      const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
      uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                      (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
 +                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
      uint64_t valh = (uint64_t)val << 32;
      env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
       * henvcfg.stce is read_only 0 when menvcfg.stce = 0
       * henvcfg.hade is read_only 0 when menvcfg.hade = 0
       */
 -    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
 +    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
      }
      if (riscv_cpu_mxl(env) == MXL_RV64) {
 -        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
 +        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
      }
      env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
          return ret;
      }
 -    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
 +    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                              env->menvcfg)) >> 32;
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                       target_ulong val)
  {
--    switch (feat_offset) {
+     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
--    case CPU_CFG_OFFSET(ext_zic64b):
+-                                    HENVCFG_HADE);
-+     /*
++                                    HENVCFG_ADUE);
-+      * All other named features are already enabled
+     uint64_t valh = (uint64_t)val << 32;
-+      * in riscv_tcg_cpu_instance_init().
+     RISCVException ret;
-+      */
 +    if (feat_offset == CPU_CFG_OFFSET(ext_zic64b)) {
          cpu->cfg.cbom_blocksize = 64;
          cpu->cfg.cbop_blocksize = 64;
          cpu->cfg.cboz_blocksize = 64;
 -        break;
 -    case CPU_CFG_OFFSET(ext_svade):
 -        cpu->cfg.ext_svadu = false;
 -        break;
 -    default:
 -        g_assert_not_reached();
      }
  }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
      cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
                            cpu->cfg.cbop_blocksize == 64 &&
                            cpu->cfg.cboz_blocksize == 64;
 -
 -    cpu->cfg.ext_svade = !cpu->cfg.ext_svadu;
  }
  static void riscv_cpu_validate_g(RISCVCPU *cpu)
 --
-.44.0
+.41.0

-[PULL 24/34] linux-headers: Update to Linux v6.8-rc6
+[PULL v2 36/45] target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The idea with this update is to get the latest KVM caps for RISC-V.
+In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
 longer to boot than the 'rv64' KVM CPU.
+The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
+when satp_mode.supported = 0, i.e. when cpu_init() does not set
+satp_mode_max_supported(). satp_mode_max_from_map(map) does:
+- __builtin_clz(map)
+This means that, if satp_mode.supported = 0, satp_mode_supported_max
+wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
+set it to UINT_MAX (4294967295). After that, if the user didn't set a
+satp_mode, set_satp_mode_default_map(cpu) will make
+cfg.satp_mode.map = cfg.satp_mode.supported
+So satp_mode.map = 0. And then satp_mode_map_max will be set to
+satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
+guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
+here since both are UINT_MAX.
+And finally we have 2 loops:
+        for (int i = satp_mode_map_max - 1; i >= 0; --i) {
+Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
+extra delay when booting the 'host' CPU is coming from.
+Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
+in a different manner. We're doing the same here. If supported == 0,
+interpret as 'the CPU wants the OS to handle satp mode alone' and skip
+satp_mode_finalize().
+We'll also put a guard in satp_mode_max_from_map() to assert out if map
+is 0 since the function is not ready to deal with it.
+Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
+Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20240304134732.386590-2-dbarboza@ventanamicro.com>
+Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/standard-headers/drm/drm_fourcc.h     |  10 +-
+ target/riscv/cpu.c | 23 ++++++++++++++++++++---
- include/standard-headers/linux/ethtool.h      |  41 +++--
+file changed, 20 insertions(+), 3 deletions(-)
  .../standard-headers/linux/virtio_config.h    |   8 +-
  include/standard-headers/linux/virtio_pci.h   |  68 +++++++++
  include/standard-headers/linux/virtio_pmem.h  |   7 +
  linux-headers/asm-generic/unistd.h            |  15 +-
  linux-headers/asm-mips/mman.h                 |   2 +-
  linux-headers/asm-mips/unistd_n32.h           |   5 +
  linux-headers/asm-mips/unistd_n64.h           |   5 +
  linux-headers/asm-mips/unistd_o32.h           |   5 +
  linux-headers/asm-powerpc/unistd_32.h         |   5 +
  linux-headers/asm-powerpc/unistd_64.h         |   5 +
  linux-headers/asm-riscv/kvm.h                 |  40 +++++
  linux-headers/asm-s390/unistd_32.h            |   5 +
  linux-headers/asm-s390/unistd_64.h            |   5 +
  linux-headers/asm-x86/kvm.h                   |   3 +
  linux-headers/asm-x86/unistd_32.h             |   5 +
  linux-headers/asm-x86/unistd_64.h             |   5 +
  linux-headers/asm-x86/unistd_x32.h            |   5 +
  linux-headers/linux/iommufd.h                 |  79 ++++++++++
  linux-headers/linux/kvm.h                     | 140 +++++++-----------
  linux-headers/linux/userfaultfd.h             |  29 +++-
  linux-headers/linux/vfio.h                    |   1 +
 files changed, 381 insertions(+), 112 deletions(-)
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/drm/drm_fourcc.h
+--- a/target/riscv/cpu.c
-+++ b/include/standard-headers/drm/drm_fourcc.h
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ extern "C" {
+@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
-  * Format modifiers may change any property of the buffer, including the number
-  * of planes and/or the required allocation size. Format modifiers are
+ uint8_t satp_mode_max_from_map(uint32_t map)
-  * vendor-namespaced, and as such the relationship between a fourcc code and a
+ {
-- * modifier is specific to the modifer being used. For example, some modifiers
++    /*
-+ * modifier is specific to the modifier being used. For example, some modifiers
++     * 'map = 0' will make us return (31 - 32), which C will
-  * may preserve meaning - such as number of planes - from the fourcc code,
++     * happily overflow to UINT_MAX. There's no good result to
-  * whereas others may not.
++     * return if 'map = 0' (e.g. returning 0 will be ambiguous
-  *
++     * with the result for 'map = 1').
-@@ -XXX,XX +XXX,XX @@ extern "C" {
++     *
-  *   format.
++     * Assert out if map = 0. Callers will have to deal with
-  * - Higher-level programs interfacing with KMS/GBM/EGL/Vulkan/etc: these users
++     * it outside of this function.
-  *   see modifiers as opaque tokens they can check for equality and intersect.
++     */
-- *   These users musn't need to know to reason about the modifier value
++    g_assert(map > 0);
 + *   These users mustn't need to know to reason about the modifier value
   *   (i.e. they are not expected to extract information out of the modifier).
   *
   * Vendors should document their modifier usage in as much detail as
@@ -XXX,XX +XXX,XX @@ extern "C" {
   * This is a tiled layout using 4Kb tiles in row-major layout.
   * Within the tile pixels are laid out in 16 256 byte units / sub-tiles which
   * are arranged in four groups (two wide, two high) with column-major layout.
 - * Each group therefore consits out of four 256 byte units, which are also laid
 + * Each group therefore consists out of four 256 byte units, which are also laid
   * out as 2x2 column-major.
   * 256 byte units are made out of four 64 byte blocks of pixels, producing
   * either a square block or a 2:1 unit.
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
   */
  /*
 - * The top 4 bits (out of the 56 bits alloted for specifying vendor specific
 + * The top 4 bits (out of the 56 bits allotted for specifying vendor specific
   * modifiers) denote the category for modifiers. Currently we have three
   * categories of modifiers ie AFBC, MISC and AFRC. We can have a maximum of
   * sixteen different categories.
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
   * Amlogic FBC Memory Saving mode
   *
   * Indicates the storage is packed when pixel size is multiple of word
 - * boudaries, i.e. 8bit should be stored in this mode to save allocation
 + * boundaries, i.e. 8bit should be stored in this mode to save allocation
   * memory.
   *
   * This mode reduces body layout to 3072 bytes per 64x32 superblock with
 diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/ethtool.h
 +++ b/include/standard-headers/linux/ethtool.h
@@ -XXX,XX +XXX,XX @@ struct ethtool_rxfh_indir {
   *    hardware hash key.
   * @hfunc: Defines the current RSS hash function used by HW (or to be set to).
   *    Valid values are one of the %ETH_RSS_HASH_*.
 + * @input_xfrm: Defines how the input data is transformed. Valid values are one
 + *    of %RXH_XFRM_*.
   * @rsvd8: Reserved for future use; see the note on reserved space.
   * @rsvd32: Reserved for future use; see the note on reserved space.
   * @rss_config: RX ring/queue index for each hash value i.e., indirection table
@@ -XXX,XX +XXX,XX @@ struct ethtool_rxfh {
      uint32_t   indir_size;
      uint32_t   key_size;
      uint8_t    hfunc;
 -    uint8_t    rsvd8[3];
 +    uint8_t    input_xfrm;
 +    uint8_t    rsvd8[2];
      uint32_t    rsvd32;
      uint32_t   rss_config[];
  };
@@ -XXX,XX +XXX,XX @@ static inline int ethtool_validate_duplex(uint8_t duplex)
  #define WOL_MODE_COUNT        8
 +/* RSS hash function data
 + * XOR the corresponding source and destination fields of each specified
 + * protocol. Both copies of the XOR'ed fields are fed into the RSS and RXHASH
 + * calculation. Note that this XORing reduces the input set entropy and could
 + * be exploited to reduce the RSS queue spread.
 + */
 +#define    RXH_XFRM_SYM_XOR    (1 << 0)
 +#define    RXH_XFRM_NO_CHANGE    0xff
 +
- /* L2-L4 network traffic flow types */
+     /* map here has at least one bit set, so no problem with clz */
- #define    TCP_V4_FLOW    0x01    /* hash or spec (tcp_ip4_spec) */
+     return 31 - __builtin_clz(map);
- #define    UDP_V4_FLOW    0x02    /* hash or spec (udp_ip4_spec) */
+ }
-@@ -XXX,XX +XXX,XX @@ enum ethtool_reset_flags {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-  *    refused. For drivers: ignore this field (use kernel's
+ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
-  *    __ETHTOOL_LINK_MODE_MASK_NBITS instead), any change to it will
+ {
-  *    be overwritten by kernel.
+     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-- * @supported: Bitmap with each bit meaning given by
+-    uint8_t satp_mode_map_max;
-- *    %ethtool_link_mode_bit_indices for the link modes, physical
+-    uint8_t satp_mode_supported_max =
-- *    connectors and other link features for which the interface
+-                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
-- *    supports autonegotiation or auto-detection.  Read-only.
++    uint8_t satp_mode_map_max, satp_mode_supported_max;
 - * @advertising: Bitmap with each bit meaning given by
 - *    %ethtool_link_mode_bit_indices for the link modes, physical
 - *    connectors and other link features that are advertised through
 - *    autonegotiation or enabled for auto-detection.
 - * @lp_advertising: Bitmap with each bit meaning given by
 - *    %ethtool_link_mode_bit_indices for the link modes, and other
 - *    link features that the link partner advertised through
 - *    autonegotiation; 0 if unknown or not applicable.  Read-only.
   * @transceiver: Used to distinguish different possible PHY types,
   *    reported consistently by PHYLIB.  Read-only.
   * @master_slave_cfg: Master/slave port mode.
@@ -XXX,XX +XXX,XX @@ enum ethtool_reset_flags {
   * %set_link_ksettings() should validate all fields other than @cmd
   * and @link_mode_masks_nwords that are not described as read-only or
   * deprecated, and must ignore all fields described as read-only.
 + *
 + * @link_mode_masks is divided into three bitfields, each of length
 + * @link_mode_masks_nwords:
 + * - supported: Bitmap with each bit meaning given by
 + *    %ethtool_link_mode_bit_indices for the link modes, physical
 + *    connectors and other link features for which the interface
 + *    supports autonegotiation or auto-detection.  Read-only.
 + * - advertising: Bitmap with each bit meaning given by
 + *    %ethtool_link_mode_bit_indices for the link modes, physical
 + *    connectors and other link features that are advertised through
 + *    autonegotiation or enabled for auto-detection.
 + * - lp_advertising: Bitmap with each bit meaning given by
 + *    %ethtool_link_mode_bit_indices for the link modes, and other
 + *    link features that the link partner advertised through
 + *    autonegotiation; 0 if unknown or not applicable.  Read-only.
   */
  struct ethtool_link_settings {
      uint32_t    cmd;
 diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/virtio_config.h
 +++ b/include/standard-headers/linux/virtio_config.h
@@ -XXX,XX +XXX,XX @@
   * rest are per-device feature bits.
   */
  #define VIRTIO_TRANSPORT_F_START    28
 -#define VIRTIO_TRANSPORT_F_END        41
 +#define VIRTIO_TRANSPORT_F_END        42
  #ifndef VIRTIO_CONFIG_NO_LEGACY
  /* Do we get callbacks when the ring is completely used, even if we've
@@ -XXX,XX +XXX,XX @@
   * This feature indicates that the driver can reset a queue individually.
   */
  #define VIRTIO_F_RING_RESET        40
 +
-+/*
++    /* The CPU wants the OS to decide which satp mode to use */
-+ * This feature indicates that the device support administration virtqueues.
++    if (cpu->cfg.satp_mode.supported == 0) {
-+ */
++        return;
-+#define VIRTIO_F_ADMIN_VQ        41
++    }
 +
- #endif /* _LINUX_VIRTIO_CONFIG_H */
++    satp_mode_supported_max =
-diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
++                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
-index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/virtio_pci.h
+     if (cpu->cfg.satp_mode.map == 0) {
-+++ b/include/standard-headers/linux/virtio_pci.h
+         if (cpu->cfg.satp_mode.init == 0) {
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_modern_common_cfg {
      uint16_t queue_notify_data;    /* read-write */
      uint16_t queue_reset;        /* read-write */
 +
 +    uint16_t admin_queue_index;    /* read-only */
 +    uint16_t admin_queue_num;        /* read-only */
  };
  /* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_cfg_cap {
  #define VIRTIO_PCI_COMMON_Q_USEDHI    52
  #define VIRTIO_PCI_COMMON_Q_NDATA    56
  #define VIRTIO_PCI_COMMON_Q_RESET    58
 +#define VIRTIO_PCI_COMMON_ADM_Q_IDX    60
 +#define VIRTIO_PCI_COMMON_ADM_Q_NUM    62
  #endif /* VIRTIO_PCI_NO_MODERN */
 +/* Admin command status. */
 +#define VIRTIO_ADMIN_STATUS_OK        0
 +
 +/* Admin command opcode. */
 +#define VIRTIO_ADMIN_CMD_LIST_QUERY    0x0
 +#define VIRTIO_ADMIN_CMD_LIST_USE    0x1
 +
 +/* Admin command group type. */
 +#define VIRTIO_ADMIN_GROUP_TYPE_SRIOV    0x1
 +
 +/* Transitional device admin command. */
 +#define VIRTIO_ADMIN_CMD_LEGACY_COMMON_CFG_WRITE    0x2
 +#define VIRTIO_ADMIN_CMD_LEGACY_COMMON_CFG_READ        0x3
 +#define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_WRITE        0x4
 +#define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_READ        0x5
 +#define VIRTIO_ADMIN_CMD_LEGACY_NOTIFY_INFO        0x6
 +
 +struct QEMU_PACKED virtio_admin_cmd_hdr {
 +    uint16_t opcode;
 +    /*
 +     * 1 - SR-IOV
 +     * 2-65535 - reserved
 +     */
 +    uint16_t group_type;
 +    /* Unused, reserved for future extensions. */
 +    uint8_t reserved1[12];
 +    uint64_t group_member_id;
 +};
 +
 +struct QEMU_PACKED virtio_admin_cmd_status {
 +    uint16_t status;
 +    uint16_t status_qualifier;
 +    /* Unused, reserved for future extensions. */
 +    uint8_t reserved2[4];
 +};
 +
 +struct QEMU_PACKED virtio_admin_cmd_legacy_wr_data {
 +    uint8_t offset; /* Starting offset of the register(s) to write. */
 +    uint8_t reserved[7];
 +    uint8_t registers[];
 +};
 +
 +struct QEMU_PACKED virtio_admin_cmd_legacy_rd_data {
 +    uint8_t offset; /* Starting offset of the register(s) to read. */
 +};
 +
 +#define VIRTIO_ADMIN_CMD_NOTIFY_INFO_FLAGS_END 0
 +#define VIRTIO_ADMIN_CMD_NOTIFY_INFO_FLAGS_OWNER_DEV 0x1
 +#define VIRTIO_ADMIN_CMD_NOTIFY_INFO_FLAGS_OWNER_MEM 0x2
 +
 +#define VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO 4
 +
 +struct QEMU_PACKED virtio_admin_cmd_notify_info_data {
 +    uint8_t flags; /* 0 = end of list, 1 = owner device, 2 = member device */
 +    uint8_t bar; /* BAR of the member or the owner device */
 +    uint8_t padding[6];
 +    uint64_t offset; /* Offset within bar. */
 +};
 +
 +struct virtio_admin_cmd_notify_info_result {
 +    struct virtio_admin_cmd_notify_info_data entries[VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO];
 +};
 +
  #endif
 diff --git a/include/standard-headers/linux/virtio_pmem.h b/include/standard-headers/linux/virtio_pmem.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/virtio_pmem.h
 +++ b/include/standard-headers/linux/virtio_pmem.h
@@ -XXX,XX +XXX,XX @@
  #include "standard-headers/linux/virtio_ids.h"
  #include "standard-headers/linux/virtio_config.h"
 +/* Feature bits */
 +/* guest physical address range will be indicated as shared memory region 0 */
 +#define VIRTIO_PMEM_F_SHMEM_REGION 0
 +
 +/* shmid of the shared memory region corresponding to the pmem */
 +#define VIRTIO_PMEM_SHMEM_REGION_ID 0
 +
  struct virtio_pmem_config {
      uint64_t start;
      uint64_t size;
 diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-generic/unistd.h
 +++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_futex_wait, sys_futex_wait)
  #define __NR_futex_requeue 456
  __SYSCALL(__NR_futex_requeue, sys_futex_requeue)
 +#define __NR_statmount   457
 +__SYSCALL(__NR_statmount, sys_statmount)
 +
 +#define __NR_listmount   458
 +__SYSCALL(__NR_listmount, sys_listmount)
 +
 +#define __NR_lsm_get_self_attr 459
 +__SYSCALL(__NR_lsm_get_self_attr, sys_lsm_get_self_attr)
 +#define __NR_lsm_set_self_attr 460
 +__SYSCALL(__NR_lsm_set_self_attr, sys_lsm_set_self_attr)
 +#define __NR_lsm_list_modules 461
 +__SYSCALL(__NR_lsm_list_modules, sys_lsm_list_modules)
 +
  #undef __NR_syscalls
 -#define __NR_syscalls 457
 +#define __NR_syscalls 462
  /*
   * 32 bit systems traditionally used different
 diff --git a/linux-headers/asm-mips/mman.h b/linux-headers/asm-mips/mman.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/mman.h
 +++ b/linux-headers/asm-mips/mman.h
@@ -XXX,XX +XXX,XX @@
  #define MADV_HUGEPAGE    14        /* Worth backing with hugepages */
  #define MADV_NOHUGEPAGE 15        /* Not worth backing with hugepages */
 -#define MADV_DONTDUMP    16        /* Explicity exclude from the core dump,
 +#define MADV_DONTDUMP    16        /* Explicitly exclude from core dump,
                         overrides the coredump filter bits */
  #define MADV_DODUMP    17        /* Clear the MADV_NODUMP flag */
 diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_n32.h
 +++ b/linux-headers/asm-mips/unistd_n32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake (__NR_Linux + 454)
  #define __NR_futex_wait (__NR_Linux + 455)
  #define __NR_futex_requeue (__NR_Linux + 456)
 +#define __NR_statmount (__NR_Linux + 457)
 +#define __NR_listmount (__NR_Linux + 458)
 +#define __NR_lsm_get_self_attr (__NR_Linux + 459)
 +#define __NR_lsm_set_self_attr (__NR_Linux + 460)
 +#define __NR_lsm_list_modules (__NR_Linux + 461)
  #endif /* _ASM_UNISTD_N32_H */
 diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_n64.h
 +++ b/linux-headers/asm-mips/unistd_n64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake (__NR_Linux + 454)
  #define __NR_futex_wait (__NR_Linux + 455)
  #define __NR_futex_requeue (__NR_Linux + 456)
 +#define __NR_statmount (__NR_Linux + 457)
 +#define __NR_listmount (__NR_Linux + 458)
 +#define __NR_lsm_get_self_attr (__NR_Linux + 459)
 +#define __NR_lsm_set_self_attr (__NR_Linux + 460)
 +#define __NR_lsm_list_modules (__NR_Linux + 461)
  #endif /* _ASM_UNISTD_N64_H */
 diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_o32.h
 +++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake (__NR_Linux + 454)
  #define __NR_futex_wait (__NR_Linux + 455)
  #define __NR_futex_requeue (__NR_Linux + 456)
 +#define __NR_statmount (__NR_Linux + 457)
 +#define __NR_listmount (__NR_Linux + 458)
 +#define __NR_lsm_get_self_attr (__NR_Linux + 459)
 +#define __NR_lsm_set_self_attr (__NR_Linux + 460)
 +#define __NR_lsm_list_modules (__NR_Linux + 461)
  #endif /* _ASM_UNISTD_O32_H */
 diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/unistd_32.h
 +++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake 454
  #define __NR_futex_wait 455
  #define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
  #endif /* _ASM_UNISTD_32_H */
 diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/unistd_64.h
 +++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake 454
  #define __NR_futex_wait 455
  #define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
  #endif /* _ASM_UNISTD_64_H */
 diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-riscv/kvm.h
 +++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
      KVM_RISCV_ISA_EXT_ZIHPM,
      KVM_RISCV_ISA_EXT_SMSTATEEN,
      KVM_RISCV_ISA_EXT_ZICOND,
 +    KVM_RISCV_ISA_EXT_ZBC,
 +    KVM_RISCV_ISA_EXT_ZBKB,
 +    KVM_RISCV_ISA_EXT_ZBKC,
 +    KVM_RISCV_ISA_EXT_ZBKX,
 +    KVM_RISCV_ISA_EXT_ZKND,
 +    KVM_RISCV_ISA_EXT_ZKNE,
 +    KVM_RISCV_ISA_EXT_ZKNH,
 +    KVM_RISCV_ISA_EXT_ZKR,
 +    KVM_RISCV_ISA_EXT_ZKSED,
 +    KVM_RISCV_ISA_EXT_ZKSH,
 +    KVM_RISCV_ISA_EXT_ZKT,
 +    KVM_RISCV_ISA_EXT_ZVBB,
 +    KVM_RISCV_ISA_EXT_ZVBC,
 +    KVM_RISCV_ISA_EXT_ZVKB,
 +    KVM_RISCV_ISA_EXT_ZVKG,
 +    KVM_RISCV_ISA_EXT_ZVKNED,
 +    KVM_RISCV_ISA_EXT_ZVKNHA,
 +    KVM_RISCV_ISA_EXT_ZVKNHB,
 +    KVM_RISCV_ISA_EXT_ZVKSED,
 +    KVM_RISCV_ISA_EXT_ZVKSH,
 +    KVM_RISCV_ISA_EXT_ZVKT,
 +    KVM_RISCV_ISA_EXT_ZFH,
 +    KVM_RISCV_ISA_EXT_ZFHMIN,
 +    KVM_RISCV_ISA_EXT_ZIHINTNTL,
 +    KVM_RISCV_ISA_EXT_ZVFH,
 +    KVM_RISCV_ISA_EXT_ZVFHMIN,
 +    KVM_RISCV_ISA_EXT_ZFA,
      KVM_RISCV_ISA_EXT_MAX,
  };
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
      KVM_RISCV_SBI_EXT_EXPERIMENTAL,
      KVM_RISCV_SBI_EXT_VENDOR,
      KVM_RISCV_SBI_EXT_DBCN,
 +    KVM_RISCV_SBI_EXT_STA,
      KVM_RISCV_SBI_EXT_MAX,
  };
 +/* SBI STA extension registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
 +struct kvm_riscv_sbi_sta {
 +    unsigned long shmem_lo;
 +    unsigned long shmem_hi;
 +};
 +
  /* Possible states for kvm_riscv_timer */
  #define KVM_RISCV_TIMER_STATE_OFF    0
  #define KVM_RISCV_TIMER_STATE_ON    1
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
  #define KVM_REG_RISCV_VECTOR_REG(n)    \
          ((n) + sizeof(struct __riscv_v_ext_state) / sizeof(unsigned long))
 +/* Registers for specific SBI extensions are mapped as type 10 */
 +#define KVM_REG_RISCV_SBI_STATE        (0x0a << KVM_REG_RISCV_TYPE_SHIFT)
 +#define KVM_REG_RISCV_SBI_STA        (0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 +#define KVM_REG_RISCV_SBI_STA_REG(name)        \
 +        (offsetof(struct kvm_riscv_sbi_sta, name) / sizeof(unsigned long))
 +
  /* Device Control API: RISC-V AIA */
  #define KVM_DEV_RISCV_APLIC_ALIGN        0x1000
  #define KVM_DEV_RISCV_APLIC_SIZE        0x4000
 diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/unistd_32.h
 +++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake 454
  #define __NR_futex_wait 455
  #define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
  #endif /* _ASM_S390_UNISTD_32_H */
 diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/unistd_64.h
 +++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake 454
  #define __NR_futex_wait 455
  #define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
  #endif /* _ASM_S390_UNISTD_64_H */
 diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/kvm.h
 +++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_pmu_event_filter {
  /* x86-specific KVM_EXIT_HYPERCALL flags. */
  #define KVM_EXIT_HYPERCALL_LONG_MODE    BIT(0)
 +#define KVM_X86_DEFAULT_VM    0
 +#define KVM_X86_SW_PROTECTED_VM    1
 +
  #endif /* _ASM_X86_KVM_H */
 diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_32.h
 +++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake 454
  #define __NR_futex_wait 455
  #define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
  #endif /* _ASM_UNISTD_32_H */
 diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_64.h
 +++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake 454
  #define __NR_futex_wait 455
  #define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
  #endif /* _ASM_UNISTD_64_H */
 diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_x32.h
 +++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_futex_wake (__X32_SYSCALL_BIT + 454)
  #define __NR_futex_wait (__X32_SYSCALL_BIT + 455)
  #define __NR_futex_requeue (__X32_SYSCALL_BIT + 456)
 +#define __NR_statmount (__X32_SYSCALL_BIT + 457)
 +#define __NR_listmount (__X32_SYSCALL_BIT + 458)
 +#define __NR_lsm_get_self_attr (__X32_SYSCALL_BIT + 459)
 +#define __NR_lsm_set_self_attr (__X32_SYSCALL_BIT + 460)
 +#define __NR_lsm_list_modules (__X32_SYSCALL_BIT + 461)
  #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
  #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
  #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
 diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/iommufd.h
 +++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@ enum {
      IOMMUFD_CMD_GET_HW_INFO,
      IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
      IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
 +    IOMMUFD_CMD_HWPT_INVALIDATE,
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_get_dirty_bitmap {
  #define IOMMU_HWPT_GET_DIRTY_BITMAP _IO(IOMMUFD_TYPE, \
                      IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP)
 +/**
 + * enum iommu_hwpt_invalidate_data_type - IOMMU HWPT Cache Invalidation
 + *                                        Data Type
 + * @IOMMU_HWPT_INVALIDATE_DATA_VTD_S1: Invalidation data for VTD_S1
 + */
 +enum iommu_hwpt_invalidate_data_type {
 +    IOMMU_HWPT_INVALIDATE_DATA_VTD_S1,
 +};
 +
 +/**
 + * enum iommu_hwpt_vtd_s1_invalidate_flags - Flags for Intel VT-d
 + *                                           stage-1 cache invalidation
 + * @IOMMU_VTD_INV_FLAGS_LEAF: Indicates whether the invalidation applies
 + *                            to all-levels page structure cache or just
 + *                            the leaf PTE cache.
 + */
 +enum iommu_hwpt_vtd_s1_invalidate_flags {
 +    IOMMU_VTD_INV_FLAGS_LEAF = 1 << 0,
 +};
 +
 +/**
 + * struct iommu_hwpt_vtd_s1_invalidate - Intel VT-d cache invalidation
 + *                                       (IOMMU_HWPT_INVALIDATE_DATA_VTD_S1)
 + * @addr: The start address of the range to be invalidated. It needs to
 + *        be 4KB aligned.
 + * @npages: Number of contiguous 4K pages to be invalidated.
 + * @flags: Combination of enum iommu_hwpt_vtd_s1_invalidate_flags
 + * @__reserved: Must be 0
 + *
 + * The Intel VT-d specific invalidation data for user-managed stage-1 cache
 + * invalidation in nested translation. Userspace uses this structure to
 + * tell the impacted cache scope after modifying the stage-1 page table.
 + *
 + * Invalidating all the caches related to the page table by setting @addr
 + * to be 0 and @npages to be U64_MAX.
 + *
 + * The device TLB will be invalidated automatically if ATS is enabled.
 + */
 +struct iommu_hwpt_vtd_s1_invalidate {
 +    __aligned_u64 addr;
 +    __aligned_u64 npages;
 +    __u32 flags;
 +    __u32 __reserved;
 +};
 +
 +/**
 + * struct iommu_hwpt_invalidate - ioctl(IOMMU_HWPT_INVALIDATE)
 + * @size: sizeof(struct iommu_hwpt_invalidate)
 + * @hwpt_id: ID of a nested HWPT for cache invalidation
 + * @data_uptr: User pointer to an array of driver-specific cache invalidation
 + *             data.
 + * @data_type: One of enum iommu_hwpt_invalidate_data_type, defining the data
 + *             type of all the entries in the invalidation request array. It
 + *             should be a type supported by the hwpt pointed by @hwpt_id.
 + * @entry_len: Length (in bytes) of a request entry in the request array
 + * @entry_num: Input the number of cache invalidation requests in the array.
 + *             Output the number of requests successfully handled by kernel.
 + * @__reserved: Must be 0.
 + *
 + * Invalidate the iommu cache for user-managed page table. Modifications on a
 + * user-managed page table should be followed by this operation to sync cache.
 + * Each ioctl can support one or more cache invalidation requests in the array
 + * that has a total size of @entry_len * @entry_num.
 + *
 + * An empty invalidation request array by setting @entry_num==0 is allowed, and
 + * @entry_len and @data_uptr would be ignored in this case. This can be used to
 + * check if the given @data_type is supported or not by kernel.
 + */
 +struct iommu_hwpt_invalidate {
 +    __u32 size;
 +    __u32 hwpt_id;
 +    __aligned_u64 data_uptr;
 +    __u32 data_type;
 +    __u32 entry_len;
 +    __u32 entry_num;
 +    __u32 __reserved;
 +};
 +#define IOMMU_HWPT_INVALIDATE _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_INVALIDATE)
  #endif
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@
  #define KVM_API_VERSION 12
 -/* *** Deprecated interfaces *** */
 -
 -#define KVM_TRC_SHIFT           16
 -
 -#define KVM_TRC_ENTRYEXIT       (1 << KVM_TRC_SHIFT)
 -#define KVM_TRC_HANDLER         (1 << (KVM_TRC_SHIFT + 1))
 -
 -#define KVM_TRC_VMENTRY         (KVM_TRC_ENTRYEXIT + 0x01)
 -#define KVM_TRC_VMEXIT          (KVM_TRC_ENTRYEXIT + 0x02)
 -#define KVM_TRC_PAGE_FAULT      (KVM_TRC_HANDLER + 0x01)
 -
 -#define KVM_TRC_HEAD_SIZE       12
 -#define KVM_TRC_CYCLE_SIZE      8
 -#define KVM_TRC_EXTRA_MAX       7
 -
 -#define KVM_TRC_INJ_VIRQ         (KVM_TRC_HANDLER + 0x02)
 -#define KVM_TRC_REDELIVER_EVT    (KVM_TRC_HANDLER + 0x03)
 -#define KVM_TRC_PEND_INTR        (KVM_TRC_HANDLER + 0x04)
 -#define KVM_TRC_IO_READ          (KVM_TRC_HANDLER + 0x05)
 -#define KVM_TRC_IO_WRITE         (KVM_TRC_HANDLER + 0x06)
 -#define KVM_TRC_CR_READ          (KVM_TRC_HANDLER + 0x07)
 -#define KVM_TRC_CR_WRITE         (KVM_TRC_HANDLER + 0x08)
 -#define KVM_TRC_DR_READ          (KVM_TRC_HANDLER + 0x09)
 -#define KVM_TRC_DR_WRITE         (KVM_TRC_HANDLER + 0x0A)
 -#define KVM_TRC_MSR_READ         (KVM_TRC_HANDLER + 0x0B)
 -#define KVM_TRC_MSR_WRITE        (KVM_TRC_HANDLER + 0x0C)
 -#define KVM_TRC_CPUID            (KVM_TRC_HANDLER + 0x0D)
 -#define KVM_TRC_INTR             (KVM_TRC_HANDLER + 0x0E)
 -#define KVM_TRC_NMI              (KVM_TRC_HANDLER + 0x0F)
 -#define KVM_TRC_VMMCALL          (KVM_TRC_HANDLER + 0x10)
 -#define KVM_TRC_HLT              (KVM_TRC_HANDLER + 0x11)
 -#define KVM_TRC_CLTS             (KVM_TRC_HANDLER + 0x12)
 -#define KVM_TRC_LMSW             (KVM_TRC_HANDLER + 0x13)
 -#define KVM_TRC_APIC_ACCESS      (KVM_TRC_HANDLER + 0x14)
 -#define KVM_TRC_TDP_FAULT        (KVM_TRC_HANDLER + 0x15)
 -#define KVM_TRC_GTLB_WRITE       (KVM_TRC_HANDLER + 0x16)
 -#define KVM_TRC_STLB_WRITE       (KVM_TRC_HANDLER + 0x17)
 -#define KVM_TRC_STLB_INVAL       (KVM_TRC_HANDLER + 0x18)
 -#define KVM_TRC_PPC_INSTR        (KVM_TRC_HANDLER + 0x19)
 -
 -struct kvm_user_trace_setup {
 -    __u32 buf_size;
 -    __u32 buf_nr;
 -};
 -
 -#define __KVM_DEPRECATED_MAIN_W_0x06 \
 -    _IOW(KVMIO, 0x06, struct kvm_user_trace_setup)
 -#define __KVM_DEPRECATED_MAIN_0x07 _IO(KVMIO, 0x07)
 -#define __KVM_DEPRECATED_MAIN_0x08 _IO(KVMIO, 0x08)
 -
 -#define __KVM_DEPRECATED_VM_R_0x70 _IOR(KVMIO, 0x70, struct kvm_assigned_irq)
 -
 -struct kvm_breakpoint {
 -    __u32 enabled;
 -    __u32 padding;
 -    __u64 address;
 -};
 -
 -struct kvm_debug_guest {
 -    __u32 enabled;
 -    __u32 pad;
 -    struct kvm_breakpoint breakpoints[4];
 -    __u32 singlestep;
 -};
 -
 -#define __KVM_DEPRECATED_VCPU_W_0x87 _IOW(KVMIO, 0x87, struct kvm_debug_guest)
 -
 -/* *** End of deprecated interfaces *** */
 -
 -
  /* for KVM_SET_USER_MEMORY_REGION */
  struct kvm_userspace_memory_region {
      __u32 slot;
@@ -XXX,XX +XXX,XX @@ struct kvm_userspace_memory_region {
      __u64 userspace_addr; /* start of the userspace allocated memory */
  };
 +/* for KVM_SET_USER_MEMORY_REGION2 */
 +struct kvm_userspace_memory_region2 {
 +    __u32 slot;
 +    __u32 flags;
 +    __u64 guest_phys_addr;
 +    __u64 memory_size;
 +    __u64 userspace_addr;
 +    __u64 guest_memfd_offset;
 +    __u32 guest_memfd;
 +    __u32 pad1;
 +    __u64 pad2[14];
 +};
 +
  /*
   * The bit 0 ~ bit 15 of kvm_userspace_memory_region::flags are visible for
   * userspace, other bits are reserved for kvm internal use which are defined
@@ -XXX,XX +XXX,XX @@ struct kvm_userspace_memory_region {
   */
  #define KVM_MEM_LOG_DIRTY_PAGES    (1UL << 0)
  #define KVM_MEM_READONLY    (1UL << 1)
 +#define KVM_MEM_GUEST_MEMFD    (1UL << 2)
  /* for KVM_IRQ_LINE */
  struct kvm_irq_level {
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
  #define KVM_EXIT_RISCV_CSR        36
  #define KVM_EXIT_NOTIFY           37
  #define KVM_EXIT_LOONGARCH_IOCSR  38
 +#define KVM_EXIT_MEMORY_FAULT     39
  /* For KVM_EXIT_INTERNAL_ERROR */
  /* Emulate instruction failed. */
@@ -XXX,XX +XXX,XX @@ struct kvm_run {
  #define KVM_NOTIFY_CONTEXT_INVALID    (1 << 0)
              __u32 flags;
          } notify;
 +        /* KVM_EXIT_MEMORY_FAULT */
 +        struct {
 +#define KVM_MEMORY_EXIT_FLAG_PRIVATE    (1ULL << 3)
 +            __u64 flags;
 +            __u64 gpa;
 +            __u64 size;
 +        } memory_fault;
          /* Fix the size of the union. */
          char padding[256];
      };
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
   */
  #define KVM_GET_VCPU_MMAP_SIZE    _IO(KVMIO,   0x04) /* in bytes */
  #define KVM_GET_SUPPORTED_CPUID   _IOWR(KVMIO, 0x05, struct kvm_cpuid2)
 -#define KVM_TRACE_ENABLE          __KVM_DEPRECATED_MAIN_W_0x06
 -#define KVM_TRACE_PAUSE           __KVM_DEPRECATED_MAIN_0x07
 -#define KVM_TRACE_DISABLE         __KVM_DEPRECATED_MAIN_0x08
  #define KVM_GET_EMULATED_CPUID      _IOWR(KVMIO, 0x09, struct kvm_cpuid2)
  #define KVM_GET_MSR_FEATURE_INDEX_LIST    _IOWR(KVMIO, 0x0a, struct kvm_msr_list)
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
  #define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
  #define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
  #define KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES 230
 +#define KVM_CAP_USER_MEMORY2 231
 +#define KVM_CAP_MEMORY_FAULT_INFO 232
 +#define KVM_CAP_MEMORY_ATTRIBUTES 233
 +#define KVM_CAP_GUEST_MEMFD 234
 +#define KVM_CAP_VM_TYPES 235
  #ifdef KVM_CAP_IRQ_ROUTING
@@ -XXX,XX +XXX,XX @@ struct kvm_x86_mce {
  #define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL    (1 << 4)
  #define KVM_XEN_HVM_CONFIG_EVTCHN_SEND        (1 << 5)
  #define KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG    (1 << 6)
 +#define KVM_XEN_HVM_CONFIG_PVCLOCK_TSC_UNSTABLE    (1 << 7)
  struct kvm_xen_hvm_config {
      __u32 flags;
@@ -XXX,XX +XXX,XX @@ struct kvm_vfio_spapr_tce {
                      struct kvm_userspace_memory_region)
  #define KVM_SET_TSS_ADDR          _IO(KVMIO,   0x47)
  #define KVM_SET_IDENTITY_MAP_ADDR _IOW(KVMIO,  0x48, __u64)
 +#define KVM_SET_USER_MEMORY_REGION2 _IOW(KVMIO, 0x49, \
 +                     struct kvm_userspace_memory_region2)
  /* enable ucontrol for s390 */
  struct kvm_s390_ucas_mapping {
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
              _IOW(KVMIO,  0x67, struct kvm_coalesced_mmio_zone)
  #define KVM_UNREGISTER_COALESCED_MMIO \
              _IOW(KVMIO,  0x68, struct kvm_coalesced_mmio_zone)
 -#define KVM_ASSIGN_PCI_DEVICE     _IOR(KVMIO,  0x69, \
 -                       struct kvm_assigned_pci_dev)
  #define KVM_SET_GSI_ROUTING       _IOW(KVMIO,  0x6a, struct kvm_irq_routing)
 -/* deprecated, replaced by KVM_ASSIGN_DEV_IRQ */
 -#define KVM_ASSIGN_IRQ            __KVM_DEPRECATED_VM_R_0x70
 -#define KVM_ASSIGN_DEV_IRQ        _IOW(KVMIO,  0x70, struct kvm_assigned_irq)
  #define KVM_REINJECT_CONTROL      _IO(KVMIO,   0x71)
 -#define KVM_DEASSIGN_PCI_DEVICE   _IOW(KVMIO,  0x72, \
 -                       struct kvm_assigned_pci_dev)
 -#define KVM_ASSIGN_SET_MSIX_NR    _IOW(KVMIO,  0x73, \
 -                       struct kvm_assigned_msix_nr)
 -#define KVM_ASSIGN_SET_MSIX_ENTRY _IOW(KVMIO,  0x74, \
 -                       struct kvm_assigned_msix_entry)
 -#define KVM_DEASSIGN_DEV_IRQ      _IOW(KVMIO,  0x75, struct kvm_assigned_irq)
  #define KVM_IRQFD                 _IOW(KVMIO,  0x76, struct kvm_irqfd)
  #define KVM_CREATE_PIT2          _IOW(KVMIO,  0x77, struct kvm_pit_config)
  #define KVM_SET_BOOT_CPU_ID       _IO(KVMIO,   0x78)
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
  *  KVM_CAP_VM_TSC_CONTROL to set defaults for a VM */
  #define KVM_SET_TSC_KHZ           _IO(KVMIO,  0xa2)
  #define KVM_GET_TSC_KHZ           _IO(KVMIO,  0xa3)
 -/* Available with KVM_CAP_PCI_2_3 */
 -#define KVM_ASSIGN_SET_INTX_MASK  _IOW(KVMIO,  0xa4, \
 -                       struct kvm_assigned_pci_dev)
  /* Available with KVM_CAP_SIGNAL_MSI */
  #define KVM_SIGNAL_MSI            _IOW(KVMIO,  0xa5, struct kvm_msi)
  /* Available with KVM_CAP_PPC_GET_SMMU_INFO */
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
  #define KVM_SET_SREGS             _IOW(KVMIO,  0x84, struct kvm_sregs)
  #define KVM_TRANSLATE             _IOWR(KVMIO, 0x85, struct kvm_translation)
  #define KVM_INTERRUPT             _IOW(KVMIO,  0x86, struct kvm_interrupt)
 -/* KVM_DEBUG_GUEST is no longer supported, use KVM_SET_GUEST_DEBUG instead */
 -#define KVM_DEBUG_GUEST           __KVM_DEPRECATED_VCPU_W_0x87
  #define KVM_GET_MSRS              _IOWR(KVMIO, 0x88, struct kvm_msrs)
  #define KVM_SET_MSRS              _IOW(KVMIO,  0x89, struct kvm_msrs)
  #define KVM_SET_CPUID             _IOW(KVMIO,  0x8a, struct kvm_cpuid)
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_zpci_op {
  /* flags for kvm_s390_zpci_op->u.reg_aen.flags */
  #define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
 +/* Available with KVM_CAP_MEMORY_ATTRIBUTES */
 +#define KVM_SET_MEMORY_ATTRIBUTES              _IOW(KVMIO,  0xd2, struct kvm_memory_attributes)
 +
 +struct kvm_memory_attributes {
 +    __u64 address;
 +    __u64 size;
 +    __u64 attributes;
 +    __u64 flags;
 +};
 +
 +#define KVM_MEMORY_ATTRIBUTE_PRIVATE           (1ULL << 3)
 +
 +#define KVM_CREATE_GUEST_MEMFD    _IOWR(KVMIO,  0xd4, struct kvm_create_guest_memfd)
 +
 +struct kvm_create_guest_memfd {
 +    __u64 size;
 +    __u64 flags;
 +    __u64 reserved[6];
 +};
 +
  #endif /* __LINUX_KVM_H */
 diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/userfaultfd.h
 +++ b/linux-headers/linux/userfaultfd.h
@@ -XXX,XX +XXX,XX @@
                 UFFD_FEATURE_WP_HUGETLBFS_SHMEM |    \
                 UFFD_FEATURE_WP_UNPOPULATED |    \
                 UFFD_FEATURE_POISON |        \
 -               UFFD_FEATURE_WP_ASYNC)
 +               UFFD_FEATURE_WP_ASYNC |        \
 +               UFFD_FEATURE_MOVE)
  #define UFFD_API_IOCTLS                \
      ((__u64)1 << _UFFDIO_REGISTER |        \
       (__u64)1 << _UFFDIO_UNREGISTER |    \
@@ -XXX,XX +XXX,XX @@
      ((__u64)1 << _UFFDIO_WAKE |        \
       (__u64)1 << _UFFDIO_COPY |        \
       (__u64)1 << _UFFDIO_ZEROPAGE |        \
 +     (__u64)1 << _UFFDIO_MOVE |        \
       (__u64)1 << _UFFDIO_WRITEPROTECT |    \
       (__u64)1 << _UFFDIO_CONTINUE |        \
       (__u64)1 << _UFFDIO_POISON)
@@ -XXX,XX +XXX,XX @@
  #define _UFFDIO_WAKE            (0x02)
  #define _UFFDIO_COPY            (0x03)
  #define _UFFDIO_ZEROPAGE        (0x04)
 +#define _UFFDIO_MOVE            (0x05)
  #define _UFFDIO_WRITEPROTECT        (0x06)
  #define _UFFDIO_CONTINUE        (0x07)
  #define _UFFDIO_POISON            (0x08)
@@ -XXX,XX +XXX,XX @@
                        struct uffdio_copy)
  #define UFFDIO_ZEROPAGE        _IOWR(UFFDIO, _UFFDIO_ZEROPAGE,    \
                        struct uffdio_zeropage)
 +#define UFFDIO_MOVE        _IOWR(UFFDIO, _UFFDIO_MOVE,    \
 +                      struct uffdio_move)
  #define UFFDIO_WRITEPROTECT    _IOWR(UFFDIO, _UFFDIO_WRITEPROTECT, \
                        struct uffdio_writeprotect)
  #define UFFDIO_CONTINUE        _IOWR(UFFDIO, _UFFDIO_CONTINUE,    \
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
       * asynchronous mode is supported in which the write fault is
       * automatically resolved and write-protection is un-set.
       * It implies UFFD_FEATURE_WP_UNPOPULATED.
 +     *
 +     * UFFD_FEATURE_MOVE indicates that the kernel supports moving an
 +     * existing page contents from userspace.
       */
  #define UFFD_FEATURE_PAGEFAULT_FLAG_WP        (1<<0)
  #define UFFD_FEATURE_EVENT_FORK            (1<<1)
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
  #define UFFD_FEATURE_WP_UNPOPULATED        (1<<13)
  #define UFFD_FEATURE_POISON            (1<<14)
  #define UFFD_FEATURE_WP_ASYNC            (1<<15)
 +#define UFFD_FEATURE_MOVE            (1<<16)
      __u64 features;
      __u64 ioctls;
@@ -XXX,XX +XXX,XX @@ struct uffdio_poison {
      __s64 updated;
  };
 +struct uffdio_move {
 +    __u64 dst;
 +    __u64 src;
 +    __u64 len;
 +    /*
 +     * Especially if used to atomically remove memory from the
 +     * address space the wake on the dst range is not needed.
 +     */
 +#define UFFDIO_MOVE_MODE_DONTWAKE        ((__u64)1<<0)
 +#define UFFDIO_MOVE_MODE_ALLOW_SRC_HOLES    ((__u64)1<<1)
 +    __u64 mode;
 +    /*
 +     * "move" is written by the ioctl and must be at the end: the
 +     * copy_from_user will not read the last 8 bytes.
 +     */
 +    __s64 move;
 +};
 +
  /*
   * Flags for the userfaultfd(2) system call itself.
   */
 diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/vfio.h
 +++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ enum vfio_device_mig_state {
      VFIO_DEVICE_STATE_RUNNING_P2P = 5,
      VFIO_DEVICE_STATE_PRE_COPY = 6,
      VFIO_DEVICE_STATE_PRE_COPY_P2P = 7,
 +    VFIO_DEVICE_STATE_NR,
  };
  /**
 --
-.44.0
+.41.0

-[PULL 12/34] target/riscv: Promote svade to a normal extension
+[PULL v2 37/45] riscv: zicond: make non-experimental
-From: Andrew Jones <ajones@ventanamicro.com>
+From: Vineet Gupta <vineetg@rivosinc.com>
-Named features are extensions which don't make sense for users to
+zicond is now codegen supported in both llvm and gcc.
 control and are therefore not exposed on the command line. However,
 svade is an extension which makes sense for users to control, so treat
 it like a "normal" extension. The default is false, even for the max
 cpu type, since QEMU has always implemented hardware A/D PTE bit
 updating, so users must opt into svade (or get it from a CPU type
 which enables it by default).
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+This change allows seamless enabling/testing of zicond in downstream
-Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
+projects. e.g. currently riscv-gnu-toolchain parses elf attributes
 to create a cmdline for qemu but fails short of enabling it because of
 the "x-" prefix.
 Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
 Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20240215223955.969568-7-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c         | 9 ++-------
+ target/riscv/cpu.c | 2 +-
- target/riscv/tcg/tcg-cpu.c | 6 ++++++
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 8 insertions(+), 7 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
-     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
+     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
-     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
+     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
-+    MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
++    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
-     MULTI_EXT_CFG_BOOL("svadu", ext_svadu, true),
-     MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
+     /* Vendor-specific custom extensions */
-     MULTI_EXT_CFG_BOOL("svnapot", ext_svnapot, false),
+     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-  * and priv_ver like regular extensions.
+     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
-  */
- const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+     /* These are experimental so mark with 'x-' */
--    MULTI_EXT_CFG_BOOL("svade", ext_svade, true),
+-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
-     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
+     /* ePMP 0.9.3 */
-     /*
+     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
   * Other named features that we already implement: Sstvecd, Sstvala,
   * Sscounterenw
   *
 - * Named features that we need to enable: svade
 - *
   * The remaining features/extensions comes from RVA22U64.
   */
  static RISCVCPUProfile RVA22S64 = {
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22S64 = {
      .ext_offsets = {
          /* rva22s64 exts */
          CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
 -        CPU_CFG_OFFSET(ext_svinval),
 -
 -        /* rva22s64 named features */
 -        CPU_CFG_OFFSET(ext_svade),
 +        CPU_CFG_OFFSET(ext_svinval), CPU_CFG_OFFSET(ext_svade),
          RISCV_PROFILE_EXT_LIST_END
      }
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
          isa_ext_update_enabled(cpu, prop->offset, true);
      }
 +    /*
 +     * Some extensions can't be added without backward compatibilty concerns.
 +     * Disable those, the user can still opt in to them on the command line.
 +     */
 +    cpu->cfg.ext_svade = false;
 +
      /* set vector version */
      env->vext_ver = VEXT_VERSION_1_00_0;
 --
-.44.0
+.41.0

-[PULL 17/34] hw/riscv/virt.c: create '/soc/pci@...' fdt node earlier
+[PULL v2 38/45] hw/riscv/virt.c: fix non-KVM --enable-debug build
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Hotplugged FDT nodes will attempt to write this node that, at this
+A build with --enable-debug and without KVM will fail as follows:
 moment, is being created only in create_fdt_pcie() during
 finalize_fdt().
-Create it earlier.
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
 ./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'
+This happens because the code block with "if virt_use_kvm_aia(s)" isn't
+being ignored by the debug build, resulting in an undefined reference to
+a KVM only function.
+Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
+make the compiler crop the kvm_riscv_aia_create() call entirely from a
+non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
+virt_use_kvm_aia() won't fix the build because this function would need
+to be inlined multiple times to make the compiler zero out the entire
+block.
+While we're at it, use kvm_enabled() in all instances where
+virt_use_kvm_aia() is checked to allow the compiler to elide these other
+kvm-only instances as well.
+Suggested-by: Richard Henderson <richard.henderson@linaro.org>
+Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20240217192607.32565-4-dbarboza@ventanamicro.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 9 ++++++++-
+ hw/riscv/virt.c | 6 +++---
-file changed, 8 insertions(+), 1 deletion(-)
+file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+     }
-     name = g_strdup_printf("/soc/pci@%lx",
-         (long) memmap[VIRT_PCIE_ECAM].base);
+     /* KVM AIA only has one APLIC instance */
--    qemu_fdt_add_subnode(ms->fdt, name);
+-    if (virt_use_kvm_aia(s)) {
-     qemu_fdt_setprop_cell(ms->fdt, name, "#address-cells",
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-         FDT_PCI_ADDR_CELLS);
+         create_fdt_socket_aplic(s, memmap, 0,
-     qemu_fdt_setprop_cell(ms->fdt, name, "#interrupt-cells",
+                                 msi_m_phandle, msi_s_phandle, phandle,
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
+                                 &intc_phandles[0], xplic_phandles,
- {
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-     MachineState *ms = MACHINE(s);
-     uint8_t rng_seed[32];
+     g_free(intc_phandles);
-+    g_autofree char *name = NULL;
+-    if (virt_use_kvm_aia(s)) {
-     ms->fdt = create_device_tree(&s->fdt_size);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-     if (!ms->fdt) {
+         *irq_mmio_phandle = xplic_phandles[0];
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
+         *irq_virtio_phandle = xplic_phandles[0];
-     qemu_fdt_setprop_cell(ms->fdt, "/soc", "#size-cells", 0x2);
+         *irq_pcie_phandle = xplic_phandles[0];
-     qemu_fdt_setprop_cell(ms->fdt, "/soc", "#address-cells", 0x2);
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
+         }
-+    /*
+     }
-+     * The "/soc/pci@..." node is needed for PCIE hotplugs
-+     * that might happen before finalize_fdt().
+-    if (virt_use_kvm_aia(s)) {
-+     */
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-+    name = g_strdup_printf("/soc/pci@%lx", (long) memmap[VIRT_PCIE_ECAM].base);
+         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
-+    qemu_fdt_add_subnode(ms->fdt, name);
+                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
-+
+                              memmap[VIRT_APLIC_S].base,
      qemu_fdt_add_subnode(ms->fdt, "/chosen");
      /* Pass seed to RNG */
 --
-.44.0
+.41.0

-[PULL 32/34] hw/intc/riscv_aplic: Fix in_clrip[x] read emulation
+[PULL v2 39/45] hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-From: Anup Patel <apatel@ventanamicro.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The reads to in_clrip[x] registers return rectified input values of the
+Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
-interrupt sources.
+environment with the following error:
-A rectified input value of an interrupt source is defined by the section
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
-"4.5.2 Source configurations (sourcecfg[1]–sourcecfg[1023])" of the RISC-V
+./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
-AIA specification as:
+collect2: error: ld returned 1 exit status
 "rectified input value = (incoming wire value) XOR (source is inverted)"
-Update the riscv_aplic_read_input_word() implementation to match the above.
+This happens because the debug build will poke into the
 'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
 the KVM only function riscv_kvm_aplic_request().
-Fixes: e8f79343cfc8 ("hw/intc: Add RISC-V AIA APLIC device emulation")
+There are multiple solutions to fix this. We'll go with the same
-Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+solution from the previous patch, i.e. add a kvm_enabled() conditional
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+to filter out the block. But there's a catch: riscv_kvm_aplic_request()
-Message-ID: <20240306095722.463296-3-apatel@ventanamicro.com>
+is a local function that would end up being used if the compiler crops
 the block, and this won't work. Quoting Richard Henderson's explanation
 in [1]:
 "(...) the compiler won't eliminate entire unused functions with -O0"
 We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
 declaration in kvm_riscv.h, where all other KVM specific public
 functions are already declared. Other archs handles KVM specific code in
 this manner and we expect to do the same from now on.
 [1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/riscv_aplic.c | 17 +++++++++++++++--
+ target/riscv/kvm_riscv.h | 1 +
-file changed, 15 insertions(+), 2 deletions(-)
+ hw/intc/riscv_aplic.c    | 8 ++------
  target/riscv/kvm.c       | 5 +++++
 files changed, 8 insertions(+), 6 deletions(-)
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm_riscv.h
++++ b/target/riscv/kvm_riscv.h
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                           uint64_t aia_irq_num, uint64_t aia_msi_num,
+                           uint64_t aplic_base, uint64_t imsic_base,
+                           uint64_t guest_num);
++void riscv_kvm_aplic_request(void *opaque, int irq, int level);
+ #endif
 diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_aplic.c
 +++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static bool is_kvm_aia(bool msimode)
+@@ -XXX,XX +XXX,XX @@
- static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
+ #include "target/riscv/cpu.h"
-                                             uint32_t word)
+ #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 +#include "kvm_riscv.h"
  #include "migration/vmstate.h"
  #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
      return topi;
  }
 -static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 -{
 -    kvm_set_irq(kvm_state, irq, !!level);
 -}
 -
  static void riscv_aplic_request(void *opaque, int irq, int level)
  {
--    uint32_t i, irq, ret = 0;
+     bool update = false;
-+    uint32_t i, irq, sourcecfg, sm, raw_input, irq_inverted, ret = 0;
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
+      * have IRQ lines delegated by their parent APLIC.
-     for (i = 0; i < 32; i++) {
+      */
-         irq = word * 32 + i;
+     if (!aplic->parent) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
+-        if (is_kvm_aia(aplic->msimode)) {
-             continue;
++        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
-         }
+             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+         } else {
--        ret |= ((aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0) << i;
+             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
-+        sourcecfg = aplic->sourcecfg[irq];
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
-+        if (sourcecfg & APLIC_SOURCECFG_D) {
+index XXXXXXX..XXXXXXX 100644
-+            continue;
+--- a/target/riscv/kvm.c
-+        }
++++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/runstate.h"
  #include "hw/riscv/numa.h"
 +void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 +{
 +    kvm_set_irq(kvm_state, irq, !!level);
 +}
 +
-+        sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
+ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-+        if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
+                                  uint64_t idx)
-+            continue;
+ {
 +        }
 +
 +        raw_input = (aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0;
 +        irq_inverted = (sm == APLIC_SOURCECFG_SM_LEVEL_LOW ||
 +                        sm == APLIC_SOURCECFG_SM_EDGE_FALL) ? 1 : 0;
 +        ret |= (raw_input ^ irq_inverted) << i;
      }
      return ret;
 --
-.44.0
+.41.0

-[PULL 06/34] linux-user/riscv: Sync hwprobe keys with Linux
+[PULL v2 40/45] linux-user/riscv: Add new extensions to hwprobe
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Robbin Ehn <rehn@rivosinc.com>
-Upstream Linux recently added many additional keys to the hwprobe API.
+This patch adds the new extensions in
-This patch adds support for all of them with the exception of Ztso,
+linux 6.5 to the hwprobe syscall.
 which is currently not supported in QEMU.
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+And fixes RVC check to OR with correct value.
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+The previous variable contains 0 therefore it
-Message-ID: <20240207115926.887816-3-christoph.muellner@vrull.eu>
+did work.
-[ Changes by AF:
- - Fixup whitespace
+Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
-]
+Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- linux-user/syscall.c | 100 +++++++++++++++++++++++++++++++++++++++----
+ linux-user/syscall.c | 14 +++++++++++++-
-file changed, 92 insertions(+), 8 deletions(-)
+file changed, 13 insertions(+), 1 deletion(-)
 diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/syscall.c
 +++ b/linux-user/syscall.c
 @@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
- #define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
+ #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
- #define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+ #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+ #define     RISCV_HWPROBE_IMA_C        (1 << 1)
--#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
++#define     RISCV_HWPROBE_IMA_V        (1 << 2)
--#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
++#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
--#define     RISCV_HWPROBE_IMA_C        (1 << 1)
++#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
--#define     RISCV_HWPROBE_IMA_V        (1 << 2)
++#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
 -#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
 -#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
 -#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
 -#define     RISCV_HWPROBE_EXT_ZICBOZ   (1 << 6)
 +#define RISCV_HWPROBE_KEY_IMA_EXT_0         4
 +#define     RISCV_HWPROBE_IMA_FD            (1 << 0)
 +#define     RISCV_HWPROBE_IMA_C             (1 << 1)
 +#define     RISCV_HWPROBE_IMA_V             (1 << 2)
 +#define     RISCV_HWPROBE_EXT_ZBA           (1 << 3)
 +#define     RISCV_HWPROBE_EXT_ZBB           (1 << 4)
 +#define     RISCV_HWPROBE_EXT_ZBS           (1 << 5)
 +#define     RISCV_HWPROBE_EXT_ZICBOZ        (1 << 6)
 +#define     RISCV_HWPROBE_EXT_ZBC           (1 << 7)
 +#define     RISCV_HWPROBE_EXT_ZBKB          (1 << 8)
 +#define     RISCV_HWPROBE_EXT_ZBKC          (1 << 9)
 +#define     RISCV_HWPROBE_EXT_ZBKX          (1 << 10)
 +#define     RISCV_HWPROBE_EXT_ZKND          (1 << 11)
 +#define     RISCV_HWPROBE_EXT_ZKNE          (1 << 12)
 +#define     RISCV_HWPROBE_EXT_ZKNH          (1 << 13)
 +#define     RISCV_HWPROBE_EXT_ZKSED         (1 << 14)
 +#define     RISCV_HWPROBE_EXT_ZKSH          (1 << 15)
 +#define     RISCV_HWPROBE_EXT_ZKT           (1 << 16)
 +#define     RISCV_HWPROBE_EXT_ZVBB          (1 << 17)
 +#define     RISCV_HWPROBE_EXT_ZVBC          (1 << 18)
 +#define     RISCV_HWPROBE_EXT_ZVKB          (1 << 19)
 +#define     RISCV_HWPROBE_EXT_ZVKG          (1 << 20)
 +#define     RISCV_HWPROBE_EXT_ZVKNED        (1 << 21)
 +#define     RISCV_HWPROBE_EXT_ZVKNHA        (1 << 22)
 +#define     RISCV_HWPROBE_EXT_ZVKNHB        (1 << 23)
 +#define     RISCV_HWPROBE_EXT_ZVKSED        (1 << 24)
 +#define     RISCV_HWPROBE_EXT_ZVKSH         (1 << 25)
 +#define     RISCV_HWPROBE_EXT_ZVKT          (1 << 26)
 +#define     RISCV_HWPROBE_EXT_ZFH           (1 << 27)
 +#define     RISCV_HWPROBE_EXT_ZFHMIN        (1 << 28)
 +#define     RISCV_HWPROBE_EXT_ZIHINTNTL     (1 << 29)
 +#define     RISCV_HWPROBE_EXT_ZVFH          (1 << 30)
 +#define     RISCV_HWPROBE_EXT_ZVFHMIN       (1 << 31)
 +#define     RISCV_HWPROBE_EXT_ZFA           (1ULL << 32)
 +#define     RISCV_HWPROBE_EXT_ZACAS         (1ULL << 34)
 +#define     RISCV_HWPROBE_EXT_ZICOND        (1ULL << 35)
  #define RISCV_HWPROBE_KEY_CPUPERF_0     5
  #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
 @@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
-                      RISCV_HWPROBE_EXT_ZBS : 0;
+                     riscv_has_ext(env, RVD) ?
-             value |= cfg->ext_zicboz ?
+                     RISCV_HWPROBE_IMA_FD : 0;
-                      RISCV_HWPROBE_EXT_ZICBOZ : 0;
+             value |= riscv_has_ext(env, RVC) ?
-+            value |= cfg->ext_zbc ?
+-                     RISCV_HWPROBE_IMA_C : pair->value;
-+                     RISCV_HWPROBE_EXT_ZBC : 0;
++                     RISCV_HWPROBE_IMA_C : 0;
-+            value |= cfg->ext_zbkb ?
++            value |= riscv_has_ext(env, RVV) ?
-+                     RISCV_HWPROBE_EXT_ZBKB : 0;
++                     RISCV_HWPROBE_IMA_V : 0;
-+            value |= cfg->ext_zbkc ?
++            value |= cfg->ext_zba ?
-+                     RISCV_HWPROBE_EXT_ZBKC : 0;
++                     RISCV_HWPROBE_EXT_ZBA : 0;
-+            value |= cfg->ext_zbkx ?
++            value |= cfg->ext_zbb ?
-+                     RISCV_HWPROBE_EXT_ZBKX : 0;
++                     RISCV_HWPROBE_EXT_ZBB : 0;
-+            value |= cfg->ext_zknd ?
++            value |= cfg->ext_zbs ?
-+                     RISCV_HWPROBE_EXT_ZKND : 0;
++                     RISCV_HWPROBE_EXT_ZBS : 0;
 +            value |= cfg->ext_zkne ?
 +                     RISCV_HWPROBE_EXT_ZKNE : 0;
 +            value |= cfg->ext_zknh ?
 +                     RISCV_HWPROBE_EXT_ZKNH : 0;
 +            value |= cfg->ext_zksed ?
 +                     RISCV_HWPROBE_EXT_ZKSED : 0;
 +            value |= cfg->ext_zksh ?
 +                     RISCV_HWPROBE_EXT_ZKSH : 0;
 +            value |= cfg->ext_zkt ?
 +                     RISCV_HWPROBE_EXT_ZKT : 0;
 +            value |= cfg->ext_zvbb ?
 +                     RISCV_HWPROBE_EXT_ZVBB : 0;
 +            value |= cfg->ext_zvbc ?
 +                     RISCV_HWPROBE_EXT_ZVBC : 0;
 +            value |= cfg->ext_zvkb ?
 +                     RISCV_HWPROBE_EXT_ZVKB : 0;
 +            value |= cfg->ext_zvkg ?
 +                     RISCV_HWPROBE_EXT_ZVKG : 0;
 +            value |= cfg->ext_zvkned ?
 +                     RISCV_HWPROBE_EXT_ZVKNED : 0;
 +            value |= cfg->ext_zvknha ?
 +                     RISCV_HWPROBE_EXT_ZVKNHA : 0;
 +            value |= cfg->ext_zvknhb ?
 +                     RISCV_HWPROBE_EXT_ZVKNHB : 0;
 +            value |= cfg->ext_zvksed ?
 +                     RISCV_HWPROBE_EXT_ZVKSED : 0;
 +            value |= cfg->ext_zvksh ?
 +                     RISCV_HWPROBE_EXT_ZVKSH : 0;
 +            value |= cfg->ext_zvkt ?
 +                     RISCV_HWPROBE_EXT_ZVKT : 0;
 +            value |= cfg->ext_zfh ?
 +                     RISCV_HWPROBE_EXT_ZFH : 0;
 +            value |= cfg->ext_zfhmin ?
 +                     RISCV_HWPROBE_EXT_ZFHMIN : 0;
 +            value |= cfg->ext_zihintntl ?
 +                     RISCV_HWPROBE_EXT_ZIHINTNTL : 0;
 +            value |= cfg->ext_zvfh ?
 +                     RISCV_HWPROBE_EXT_ZVFH : 0;
 +            value |= cfg->ext_zvfhmin ?
 +                     RISCV_HWPROBE_EXT_ZVFHMIN : 0;
 +            value |= cfg->ext_zfa ?
 +                     RISCV_HWPROBE_EXT_ZFA : 0;
 +            value |= cfg->ext_zacas ?
 +                     RISCV_HWPROBE_EXT_ZACAS : 0;
 +            value |= cfg->ext_zicond ?
 +                     RISCV_HWPROBE_EXT_ZICOND : 0;
              __put_user(value, &pair->value);
              break;
          case RISCV_HWPROBE_KEY_CPUPERF_0:
 --
-.44.0
+.41.0

-[PULL 22/34] linux-user/riscv: Add Ztso extension to hwprobe
+[PULL v2 41/45] target/riscv: Use accelerated helper for AES64KS1I
-From: Christoph Müllner <christoph.muellner@vrull.eu>
+From: Ard Biesheuvel <ardb@kernel.org>
-This patch exposes Ztso via hwprobe in QEMU's user space emulator.
+Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
 implement the first half of the key schedule derivation. This does not
 actually involve shifting rows, so clone the same value into all four
 columns of the AES vector to counter that operation.
-Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Cc: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-ID: <20240207122256.902627-3-christoph.muellner@vrull.eu>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
 Cc: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230831154118.138727-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- linux-user/syscall.c | 3 +++
+ target/riscv/crypto_helper.c | 17 +++++------------
-file changed, 3 insertions(+)
+file changed, 5 insertions(+), 12 deletions(-)
-diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/syscall.c
+--- a/target/riscv/crypto_helper.c
-+++ b/linux-user/syscall.c
++++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
- #define     RISCV_HWPROBE_EXT_ZVFH          (1 << 30)
- #define     RISCV_HWPROBE_EXT_ZVFHMIN       (1 << 31)
+     uint8_t enc_rnum = rnum;
- #define     RISCV_HWPROBE_EXT_ZFA           (1ULL << 32)
+     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-+#define     RISCV_HWPROBE_EXT_ZTSO          (1ULL << 33)
+-    uint8_t rcon_ = 0;
- #define     RISCV_HWPROBE_EXT_ZACAS         (1ULL << 34)
+-    target_ulong result;
- #define     RISCV_HWPROBE_EXT_ZICOND        (1ULL << 35)
++    AESState t, rc = {};
-@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+     if (enc_rnum != 0xA) {
-                      RISCV_HWPROBE_EXT_ZVFHMIN : 0;
+         temp = ror32(temp, 8); /* Rotate right by 8 */
-             value |= cfg->ext_zfa ?
+-        rcon_ = round_consts[enc_rnum];
-                      RISCV_HWPROBE_EXT_ZFA : 0;
++        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
-+            value |= cfg->ext_ztso ?
+     }
-+                     RISCV_HWPROBE_EXT_ZTSO : 0;
-             value |= cfg->ext_zacas ?
+-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-                      RISCV_HWPROBE_EXT_ZACAS : 0;
+-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-             value |= cfg->ext_zicond ?
+-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
 -           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
 +    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
 +    aesenc_SB_SR_AK(&t, &t, &rc, false);
 -    temp ^= rcon_;
 -
 -    result = ((uint64_t)temp << 32) | temp;
 -
 -    return result;
 +    return t.d[0];
  }
  target_ulong HELPER(aes64im)(target_ulong rs1)
 --
-.44.0
+.41.0

-[PULL 10/34] target/riscv: Reset henvcfg to zero
+[PULL v2 42/45] target/riscv: Allocate itrigger timers only once
-From: Andrew Jones <ajones@ventanamicro.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-The hypervisor should decide what it wants to enable. Zero all
+riscv_trigger_init() had been called on reset events that can happen
-configuration enable bits on reset.
+several times for a CPU and it allocated timers for itrigger. If old
 timers were present, they were simply overwritten by the new timers,
 resulting in a memory leak.
-Also, commit ed67d63798f2 ("target/riscv: Update CSR bits name for
+Divide riscv_trigger_init() into two functions, namely
-svadu extension") missed one reference to 'hade'. Change it now.
+riscv_trigger_realize() and riscv_trigger_reset() and call them in
 appropriate timing. The timer allocation will happen only once for a
 CPU in riscv_trigger_realize().
-Fixes: 0af3f115e68e ("target/riscv: Add *envcfg.HADE related check in address translation")
+Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
-Fixes: ed67d63798f2 ("target/riscv: Update CSR bits name for svadu extension")
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20240215223955.969568-5-dbarboza@ventanamicro.com>
+Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 3 +--
+ target/riscv/debug.h |  3 ++-
- target/riscv/csr.c | 2 +-
+ target/riscv/cpu.c   |  8 +++++++-
-files changed, 2 insertions(+), 3 deletions(-)
+ target/riscv/debug.c | 15 ++++++++++++---
 files changed, 21 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/debug.h
++++ b/target/riscv/debug.h
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
+ bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
+ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
+-void riscv_trigger_init(CPURISCVState *env);
++void riscv_trigger_realize(CPURISCVState *env);
++void riscv_trigger_reset_hold(CPURISCVState *env);
+ bool riscv_itrigger_enabled(CPURISCVState *env);
+ void riscv_itrigger_update_priv(CPURISCVState *env);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
-     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
+ #ifndef CONFIG_USER_ONLY
-                    (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
+     if (cpu->cfg.debug) {
--    env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
+-        riscv_trigger_init(env);
--                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
++        riscv_trigger_reset_hold(env);
-+    env->henvcfg = 0;
+     }
-     /* Initialized default priorities of local interrupts. */
+     if (kvm_enabled()) {
-     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
      riscv_cpu_register_gdb_regs_for_features(cs);
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.debug) {
 +        riscv_trigger_realize(&cpu->env);
 +    }
 +#endif
 +
      qemu_init_vcpu(cs);
      cpu_reset(cs);
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/debug.c
-+++ b/target/riscv/csr.c
++++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
-     /*
+     return false;
-      * henvcfg.pbmte is read_only 0 when menvcfg.pbmte = 0
+ }
-      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
--     * henvcfg.hade is read_only 0 when menvcfg.hade = 0
+-void riscv_trigger_init(CPURISCVState *env)
-+     * henvcfg.adue is read_only 0 when menvcfg.adue = 0
++void riscv_trigger_realize(CPURISCVState *env)
-      */
++{
-     *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
++    int i;
-                            env->menvcfg);
++
 +    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 +        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                              riscv_itrigger_timer_cb, env);
 +    }
 +}
 +
 +void riscv_trigger_reset_hold(CPURISCVState *env)
  {
      target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
      int i;
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
          env->tdata3[i] = 0;
          env->cpu_breakpoint[i] = NULL;
          env->cpu_watchpoint[i] = NULL;
 -        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 -                                              riscv_itrigger_timer_cb, env);
 +        timer_del(env->itrigger_timer[i]);
      }
  }
 --
-.44.0
+.41.0

-[PULL 27/34] target/riscv: mcountinhibit, mcounteren, scounteren, hcounteren is 32-bit
+[PULL v2 43/45] target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
-From: Vadim Shakirov <vadim.shakirov@syntacore.com>
+From: Leon Schuermann <leons@opentitan.org>
-mcountinhibit, mcounteren, scounteren and hcounteren must always be 32-bit
+When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
-by privileged spec
+configuration lock bits must not apply. While this behavior is
 implemented for the pmpcfgX CSRs, this bit is not respected for
 changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
 writes work even on locked regions when the global rule-lock bypass is
 enabled.
-Signed-off-by: Vadim Shakirov <vadim.shakirov@syntacore.com>
+Signed-off-by: Leon Schuermann <leons@opentitan.org>
 Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
 Message-ID: <20240202113919.18236-1-vadim.shakirov@syntacore.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h     |  8 ++++----
+ target/riscv/pmp.c | 4 ++++
- target/riscv/machine.c | 16 ++++++++--------
+file changed, 4 insertions(+)
 files changed, 12 insertions(+), 12 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/pmp.c
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
-     target_ulong hstatus;
+  */
-     target_ulong hedeleg;
+ static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
-     uint64_t hideleg;
+ {
--    target_ulong hcounteren;
++    /* mseccfg.RLB is set */
-+    uint32_t hcounteren;
++    if (MSECCFG_RLB_ISSET(env)) {
-     target_ulong htval;
++        return 0;
-     target_ulong htinst;
++    }
-     target_ulong hgatp;
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
-      */
+         return 1;
      bool two_stage_indirect_lookup;
 -    target_ulong scounteren;
 -    target_ulong mcounteren;
 +    uint32_t scounteren;
 +    uint32_t mcounteren;
 -    target_ulong mcountinhibit;
 +    uint32_t mcountinhibit;
      /* PMU counter state */
      PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static bool hyper_needed(void *opaque)
  static const VMStateDescription vmstate_hyper = {
      .name = "cpu/hyper",
 -    .version_id = 3,
 -    .minimum_version_id = 3,
 +    .version_id = 4,
 +    .minimum_version_id = 4,
      .needed = hyper_needed,
      .fields = (const VMStateField[]) {
          VMSTATE_UINTTL(env.hstatus, RISCVCPU),
          VMSTATE_UINTTL(env.hedeleg, RISCVCPU),
          VMSTATE_UINT64(env.hideleg, RISCVCPU),
 -        VMSTATE_UINTTL(env.hcounteren, RISCVCPU),
 +        VMSTATE_UINT32(env.hcounteren, RISCVCPU),
          VMSTATE_UINTTL(env.htval, RISCVCPU),
          VMSTATE_UINTTL(env.htinst, RISCVCPU),
          VMSTATE_UINTTL(env.hgatp, RISCVCPU),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_jvt = {
  const VMStateDescription vmstate_riscv_cpu = {
      .name = "cpu",
 -    .version_id = 9,
 -    .minimum_version_id = 9,
 +    .version_id = 10,
 +    .minimum_version_id = 10,
      .post_load = riscv_cpu_post_load,
      .fields = (const VMStateField[]) {
          VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
          VMSTATE_UINTTL(env.mtval, RISCVCPU),
          VMSTATE_UINTTL(env.miselect, RISCVCPU),
          VMSTATE_UINTTL(env.siselect, RISCVCPU),
 -        VMSTATE_UINTTL(env.scounteren, RISCVCPU),
 -        VMSTATE_UINTTL(env.mcounteren, RISCVCPU),
 -        VMSTATE_UINTTL(env.mcountinhibit, RISCVCPU),
 +        VMSTATE_UINT32(env.scounteren, RISCVCPU),
 +        VMSTATE_UINT32(env.mcounteren, RISCVCPU),
 +        VMSTATE_UINT32(env.mcountinhibit, RISCVCPU),
          VMSTATE_STRUCT_ARRAY(env.pmu_ctrs, RISCVCPU, RV_MAX_MHPMCOUNTERS, 0,
                               vmstate_pmu_ctr_state, PMUCTRState),
          VMSTATE_UINTTL_ARRAY(env.mhpmevent_val, RISCVCPU, RV_MAX_MHPMEVENTS),
 --
-.44.0
+.41.0

-[PULL 13/34] target/riscv: FIX xATP_MODE validation
+[PULL v2 44/45] target/riscv: Align the AIA model to v1.0 ratified spec
-From: Irina Ryapolova <irina.ryapolova@syntacore.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-The SATP register is an SXLEN-bit read/write WARL register. It means that CSR fields are only defined
+According to the new spec, when vsiselect has a reserved value, attempts
-for a subset of bit encodings, but allow any value to be written while guaranteeing to return a legal
+from M-mode or HS-mode to access vsireg, or from VS-mode to access
-value whenever read (See riscv-privileged-20211203, SATP CSR).
+sireg, should preferably raise an illegal instruction exception.
-For example on rv64 we are trying to write to SATP CSR val = 0x1000000000000000 (SATP_MODE = 1 - Reserved for standard use)
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
-and after that we are trying to read SATP_CSR. We read from the SATP CSR value = 0x1000000000000000, which is not a correct
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-operation (return illegal value).
+Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
 Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20240109145923.37893-1-irina.ryapolova@syntacore.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 4 ++--
+ target/riscv/csr.c | 7 +++++--
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
+ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
- static bool validate_vm(CPURISCVState *env, target_ulong vm)
+                      target_ulong new_val, target_ulong wr_mask)
  {
--    return (vm & 0xf) <=
+-    bool virt;
--           satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
++    bool virt, isel_reserved;
-+    uint64_t mode_supported = riscv_cpu_cfg(env)->satp_mode.map;
+     uint8_t *iprio;
-+    return get_field(mode_supported, (1 << vm));
+     int ret = -EINVAL;
- }
+     target_ulong priv, isel, vgein;
+@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
- static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
      /* Decode register details from CSR number */
      virt = false;
 +    isel_reserved = false;
      switch (csrno) {
      case CSR_MIREG:
          iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                    riscv_cpu_mxl_bits(env)),
                                      val, new_val, wr_mask);
          }
 +    } else {
 +        isel_reserved = true;
      }
  done:
      if (ret) {
 -        return (env->virt_enabled && virt) ?
 +        return (env->virt_enabled && virt && !isel_reserved) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
      return RISCV_EXCP_NONE;
 --
-.44.0
+.41.0

-[PULL 04/34] hw: riscv: Allow large kernels to boot by moving the initrd further away in RAM
+[PULL v2 45/45] target/riscv: don't read CSR in riscv_csrrw_do64
-From: Alexandre Ghiti <alexghiti@rivosinc.com>
+From: Nikita Shubin <n.shubin@yadro.com>
-Currently, the initrd is placed at 128MB, which overlaps with the kernel
+As per ISA:
 when it is large (for example syzbot kernels are). From the kernel side,
 there is no reason we could not push the initrd further away in memory
 to accommodate large kernels, so move the initrd at 512MB when possible.
-The ideal solution would have been to place the initrd based on the
+"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
-kernel size but we actually can't since the bss size is not known when
+shall not cause any of the side effects that might occur on a CSR read."
 the image is loaded by load_image_targphys_as() and the initrd would
 then overlap with this section.
-Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
 riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.
 Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
 Message-ID: <20240206154042.514698-1-alexghiti@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/boot.c | 12 ++++++------
+ target/riscv/csr.c | 24 +++++++++++++++---------
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 15 insertions(+), 9 deletions(-)
-diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/boot.c
+--- a/target/riscv/csr.c
-+++ b/hw/riscv/boot.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
-      * kernel is uncompressed it will not clobber the initrd. However
+                                        target_ulong write_mask)
-      * on boards without much RAM we must ensure that we still leave
+ {
-      * enough room for a decent sized initrd, and on boards with large
+     RISCVException ret;
--     * amounts of RAM we must avoid the initrd being so far up in RAM
+-    target_ulong old_value;
--     * that it is outside lowmem and inaccessible to the kernel.
++    target_ulong old_value = 0;
--     * So for boards with less  than 256MB of RAM we put the initrd
--     * halfway into RAM, and for boards with 256MB of RAM or more we put
+     /* execute combined read/write operation if it exists */
--     * the initrd at 128MB.
+     if (csr_ops[csrno].op) {
-+     * amounts of RAM, we put the initrd at 512MB to allow large kernels
+         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
-+     * to boot.
+     }
-+     * So for boards with less than 1GB of RAM we put the initrd
-+     * halfway into RAM, and for boards with 1GB of RAM or more we put
+-    /* if no accessor exists then return failure */
-+     * the initrd at 512MB.
+-    if (!csr_ops[csrno].read) {
-      */
+-        return RISCV_EXCP_ILLEGAL_INST;
--    start = kernel_entry + MIN(mem_size / 2, 128 * MiB);
+-    }
-+    start = kernel_entry + MIN(mem_size / 2, 512 * MiB);
+-    /* read old value */
+-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-     size = load_ramdisk(filename, start, mem_size - start);
+-    if (ret != RISCV_EXCP_NONE) {
-     if (size == -1) {
+-        return ret;
 +    /*
 +     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
 +     * and we can't throw side effects caused by CSR reads.
 +     */
 +    if (ret_value) {
 +        /* if no accessor exists then return failure */
 +        if (!csr_ops[csrno].read) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
 +        /* read old value */
 +        ret = csr_ops[csrno].read(env, csrno, &old_value);
 +        if (ret != RISCV_EXCP_NONE) {
 +            return ret;
 +        }
      }
      /* write value if writable and write mask set, otherwise drop writes */
 --
-.44.0
+.41.0

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240308-1

for you to fetch changes up to 301876597112218c1e465ecc2b2fef6b27d5c27b:

target/riscv: fix ACPI MCFG table (2024-03-08 21:00:37 +1000)

----------------------------------------------------------------
RISC-V PR for 9.0

* Update $ra with current $pc in trans_cm_jalt
* Enable SPCR for SCPI virt machine
* Allow large kernels to boot by moving the initrd further away in RAM
* Sync hwprobe keys with kernel
* Named features riscv,isa, 'svade' rework
* FIX xATP_MODE validation
* Add missing include guard in pmu.h
* Add SRAT and SLIT ACPI tables
* libqos fixes and add a riscv machine
* Add Ztso extension
* Use 'zfa' instead of 'Zfa'
* Update KVM exts to Linux 6.8
* move ratified/frozen exts to non-experimental
* Ensure mcountinhibit, mcounteren, scounteren, hcounteren are 32-bit
* mark_vs_dirty() before loads and stores
* Remove 'is_store' bool from load/store fns
* Fix shift count overflow
* Fix setipnum_le write emulation for APLIC MSI-mode
* Fix in_clrip[x] read emulation
* Fix privilege mode of G-stage translation for debugging
* Fix ACPI MCFG table for virt machine

----------------------------------------------------------------
Alexandre Ghiti (1):
      hw: riscv: Allow large kernels to boot by moving the initrd further away in RAM

Andrew Jones (3):
      target/riscv: Reset henvcfg to zero
      target/riscv: Gate hardware A/D PTE bit updating
      target/riscv: Promote svade to a normal extension

Anup Patel (2):
      hw/intc/riscv_aplic: Fix setipnum_le write emulation for APLIC MSI-mode
      hw/intc/riscv_aplic: Fix in_clrip[x] read emulation

Christoph Müllner (4):
      linux-user/riscv: Add Zicboz extensions to hwprobe
      linux-user/riscv: Sync hwprobe keys with Linux
      linux-user/riscv: Add Ztso extension to hwprobe
      tests: riscv64: Use 'zfa' instead of 'Zfa'

Daniel Henrique Barboza (12):
      target/riscv/tcg: set 'mmu' with 'satp' in cpu_set_profile()
      target/riscv: add riscv,isa to named features
      target/riscv: add remaining named features
      hw/riscv/virt.c: create '/soc/pci@...' fdt node earlier
      hw/riscv/virt.c: add virtio-iommu-pci hotplug support
      hw/riscv/virt.c: make aclint compatible with 'qtest' accel
      tests/libqos: add riscv/virt machine nodes
      linux-headers: Update to Linux v6.8-rc6
      target/riscv/kvm: update KVM exts to Linux 6.8
      target/riscv: move ratified/frozen exts to non-experimental
      trans_rvv.c.inc: mark_vs_dirty() before loads and stores
      trans_rvv.c.inc: remove 'is_store' bool from load/store fns

Frank Chang (1):
      target/riscv: Add missing include guard in pmu.h

Haibo Xu (1):
      hw/riscv/virt-acpi-build.c: Add SRAT and SLIT ACPI tables

Hiroaki Yamamoto (1):
      target/riscv: Fix privilege mode of G-stage translation for debugging

Ilya Chugin (1):
      target/riscv: fix ACPI MCFG table

Irina Ryapolova (2):
      target/riscv: FIX xATP_MODE validation
      target/riscv: UPDATE xATP write CSR

Jason Chien (1):
      target/riscv: Update $ra with current $pc in trans_cm_jalt()

Palmer Dabbelt (1):
      RISC-V: Add support for Ztso

Sia Jee Heng (2):
      hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location
      hw/riscv/virt-acpi-build.c: Generate SPCR table

Vadim Shakirov (1):
      target/riscv: mcountinhibit, mcounteren, scounteren, hcounteren is 32-bit

demin.han (1):
      target/riscv: Fix shift count overflow

include/hw/acpi/acpi-defs.h                    |  33 ++++++
 include/hw/acpi/aml-build.h                    |   4 +
 include/standard-headers/drm/drm_fourcc.h      |  10 +-
 include/standard-headers/linux/ethtool.h       |  41 +++++---
 include/standard-headers/linux/virtio_config.h |   8 +-
 include/standard-headers/linux/virtio_pci.h    |  68 ++++++++++++
 include/standard-headers/linux/virtio_pmem.h   |   7 ++
 linux-headers/asm-generic/unistd.h             |  15 ++-
 linux-headers/asm-mips/mman.h                  |   2 +-
 linux-headers/asm-mips/unistd_n32.h            |   5 +
 linux-headers/asm-mips/unistd_n64.h            |   5 +
 linux-headers/asm-mips/unistd_o32.h            |   5 +
 linux-headers/asm-powerpc/unistd_32.h          |   5 +
 linux-headers/asm-powerpc/unistd_64.h          |   5 +
 linux-headers/asm-riscv/kvm.h                  |  40 +++++++
 linux-headers/asm-s390/unistd_32.h             |   5 +
 linux-headers/asm-s390/unistd_64.h             |   5 +
 linux-headers/asm-x86/kvm.h                    |   3 +
 linux-headers/asm-x86/unistd_32.h              |   5 +
 linux-headers/asm-x86/unistd_64.h              |   5 +
 linux-headers/asm-x86/unistd_x32.h             |   5 +
 linux-headers/linux/iommufd.h                  |  79 ++++++++++++++
 linux-headers/linux/kvm.h                      | 140 +++++++++----------------
 linux-headers/linux/userfaultfd.h              |  29 ++++-
 linux-headers/linux/vfio.h                     |   1 +
 target/riscv/cpu.h                             |   8 +-
 target/riscv/cpu_cfg.h                         |  13 ++-
 target/riscv/pmu.h                             |   5 +
 hw/acpi/aml-build.c                            |  53 ++++++++++
 hw/arm/virt-acpi-build.c                       |  68 +++++-------
 hw/intc/riscv_aplic.c                          |  37 +++++--
 hw/riscv/boot.c                                |  12 +--
 hw/riscv/virt-acpi-build.c                     | 103 +++++++++++++++++-
 hw/riscv/virt.c                                |  97 ++++++++++++-----
 linux-user/syscall.c                           | 104 ++++++++++++++++--
 target/riscv/cpu.c                             |  94 +++++++++++------
 target/riscv/cpu_helper.c                      |  21 +++-
 target/riscv/csr.c                             |  58 +++++-----
 target/riscv/kvm/kvm-cpu.c                     |  29 +++++
 target/riscv/machine.c                         |  16 +--
 target/riscv/tcg/tcg-cpu.c                     |  34 +++---
 target/riscv/translate.c                       |   3 +
 target/riscv/vector_helper.c                   |   5 +-
 tests/qtest/libqos/riscv-virt-machine.c        | 137 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rva.c.inc        |  11 +-
 target/riscv/insn_trans/trans_rvi.c.inc        |  16 ++-
 target/riscv/insn_trans/trans_rvv.c.inc        |  97 +++++++++--------
 target/riscv/insn_trans/trans_rvzce.c.inc      |   6 +-
 tests/qtest/libqos/meson.build                 |   1 +
 tests/tcg/riscv64/Makefile.target              |   2 +-
 50 files changed, 1213 insertions(+), 347 deletions(-)
 create mode 100644 tests/qtest/libqos/riscv-virt-machine.c

From: Jason Chien <jason.chien@sifive.com>

The original implementation sets $pc to the address read from the jump
vector table first and links $ra with the address of the next instruction
after the updated $pc. After jumping to the updated $pc and executing the
next ret instruction, the program jumps to $ra, which is in the same
function currently executing, which results in an infinite loop.
This commit stores the jump address in a temporary, updates $ra with the
current $pc, and copies the temporary to $pc.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240207081820.28559-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzce.c.inc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
 {
     REQUIRE_ZCMT(ctx);
 
+    TCGv addr = tcg_temp_new();
+
     /*
      * Update pc to current for the non-unwinding exception
      * that might come from cpu_ld*_code() in the helper.
      */
     gen_update_pc(ctx, 0);
-    gen_helper_cm_jalt(cpu_pc, tcg_env, tcg_constant_i32(a->index));
+    gen_helper_cm_jalt(addr, tcg_env, tcg_constant_i32(a->index));
 
     /* c.jt vs c.jalt depends on the index. */
     if (a->index >= 32) {
@@ -XXX,XX +XXX,XX @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
         gen_set_gpr(ctx, xRA, succ_pc);
     }
 
+    tcg_gen_mov_tl(cpu_pc, addr);
+
     tcg_gen_lookup_and_goto_ptr();
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
-- 
2.44.0

From: Sia Jee Heng <jeeheng.sia@starfivetech.com>

RISC-V should also generate the SPCR in a manner similar to ARM.
Therefore, instead of replicating the code, relocate this function
to the common AML build.

Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240129021440.17640-2-jeeheng.sia@starfivetech.com>
[ Changes by AF:
 - Add missing Language SPCR entry
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/acpi/acpi-defs.h | 33 ++++++++++++++++++
 include/hw/acpi/aml-build.h |  4 +++
 hw/acpi/aml-build.c         | 53 +++++++++++++++++++++++++++++
 hw/arm/virt-acpi-build.c    | 68 +++++++++++++++----------------------
 4 files changed, 117 insertions(+), 41 deletions(-)

diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/acpi/acpi-defs.h
+++ b/include/hw/acpi/acpi-defs.h
@@ -XXX,XX +XXX,XX @@ typedef struct AcpiFadtData {
     unsigned *xdsdt_tbl_offset;
 } AcpiFadtData;
 
+typedef struct AcpiGas {
+    uint8_t id;                /* Address space ID */
+    uint8_t width;             /* Register bit width */
+    uint8_t offset;            /* Register bit offset */
+    uint8_t size;              /* Access size */
+    uint64_t addr;             /* Address */
+} AcpiGas;
+
+/* SPCR (Serial Port Console Redirection table) */
+typedef struct AcpiSpcrData {
+    uint8_t interface_type;
+    uint8_t reserved[3];
+    struct AcpiGas base_addr;
+    uint8_t interrupt_type;
+    uint8_t pc_interrupt;
+    uint32_t interrupt;        /* Global system interrupt */
+    uint8_t baud_rate;
+    uint8_t parity;
+    uint8_t stop_bits;
+    uint8_t flow_control;
+    uint8_t terminal_type;
+    uint8_t language;
+    uint8_t reserved1;
+    uint16_t pci_device_id;    /* Must be 0xffff if not PCI device */
+    uint16_t pci_vendor_id;    /* Must be 0xffff if not PCI device */
+    uint8_t pci_bus;
+    uint8_t pci_device;
+    uint8_t pci_function;
+    uint32_t pci_flags;
+    uint8_t pci_segment;
+    uint32_t reserved2;
+} AcpiSpcrData;
+
 #define ACPI_FADT_ARM_PSCI_COMPLIANT  (1 << 0)
 #define ACPI_FADT_ARM_PSCI_USE_HVC    (1 << 1)
 
diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/acpi/aml-build.h
+++ b/include/hw/acpi/aml-build.h
@@ -XXX,XX +XXX,XX @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const AcpiFadtData *f,
 
 void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog,
                 const char *oem_id, const char *oem_table_id);
+
+void build_spcr(GArray *table_data, BIOSLinker *linker,
+                const AcpiSpcrData *f, const uint8_t rev,
+                const char *oem_id, const char *oem_table_id);
 #endif
diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -XXX,XX +XXX,XX @@ static void build_processor_hierarchy_node(GArray *tbl, uint32_t flags,
     }
 }
 
+void build_spcr(GArray *table_data, BIOSLinker *linker,
+                const AcpiSpcrData *f, const uint8_t rev,
+                const char *oem_id, const char *oem_table_id)
+{
+    AcpiTable table = { .sig = "SPCR", .rev = rev, .oem_id = oem_id,
+                        .oem_table_id = oem_table_id };
+
+    acpi_table_begin(&table, table_data);
+    /* Interface type */
+    build_append_int_noprefix(table_data, f->interface_type, 1);
+    /* Reserved */
+    build_append_int_noprefix(table_data, 0, 3);
+    /* Base Address */
+    build_append_gas(table_data, f->base_addr.id, f->base_addr.width,
+                     f->base_addr.offset, f->base_addr.size,
+                     f->base_addr.addr);
+    /* Interrupt type */
+    build_append_int_noprefix(table_data, f->interrupt_type, 1);
+    /* IRQ */
+    build_append_int_noprefix(table_data, f->pc_interrupt, 1);
+    /* Global System Interrupt */
+    build_append_int_noprefix(table_data, f->interrupt, 4);
+    /* Baud Rate */
+    build_append_int_noprefix(table_data, f->baud_rate, 1);
+    /* Parity */
+    build_append_int_noprefix(table_data, f->parity, 1);
+    /* Stop Bits */
+    build_append_int_noprefix(table_data, f->stop_bits, 1);
+    /* Flow Control */
+    build_append_int_noprefix(table_data, f->flow_control, 1);
+    /* Language */
+    build_append_int_noprefix(table_data, f->language, 1);
+    /* Terminal Type */
+    build_append_int_noprefix(table_data, f->terminal_type, 1);
+    /* PCI Device ID  */
+    build_append_int_noprefix(table_data, f->pci_device_id, 2);
+    /* PCI Vendor ID */
+    build_append_int_noprefix(table_data, f->pci_vendor_id, 2);
+    /* PCI Bus Number */
+    build_append_int_noprefix(table_data, f->pci_bus, 1);
+    /* PCI Device Number */
+    build_append_int_noprefix(table_data, f->pci_device, 1);
+    /* PCI Function Number */
+    build_append_int_noprefix(table_data, f->pci_function, 1);
+    /* PCI Flags */
+    build_append_int_noprefix(table_data, f->pci_flags, 4);
+    /* PCI Segment */
+    build_append_int_noprefix(table_data, f->pci_segment, 1);
+    /* Reserved */
+    build_append_int_noprefix(table_data, 0, 4);
+
+    acpi_table_end(linker, &table);
+}
 /*
  * ACPI spec, Revision 6.3
  * 5.2.29 Processor Properties Topology Table (PPTT)
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
  * Rev: 1.07
  */
 static void
-build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+spcr_setup(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
-    AcpiTable table = { .sig = "SPCR", .rev = 2, .oem_id = vms->oem_id,
-                        .oem_table_id = vms->oem_table_id };
-
-    acpi_table_begin(&table, table_data);
-
-    /* Interface Type */
-    build_append_int_noprefix(table_data, 3, 1); /* ARM PL011 UART */
-    build_append_int_noprefix(table_data, 0, 3); /* Reserved */
-    /* Base Address */
-    build_append_gas(table_data, AML_AS_SYSTEM_MEMORY, 32, 0, 3,
-                     vms->memmap[VIRT_UART].base);
-    /* Interrupt Type */
-    build_append_int_noprefix(table_data,
-        (1 << 3) /* Bit[3] ARMH GIC interrupt */, 1);
-    build_append_int_noprefix(table_data, 0, 1); /* IRQ */
-    /* Global System Interrupt */
-    build_append_int_noprefix(table_data,
-                              vms->irqmap[VIRT_UART] + ARM_SPI_BASE, 4);
-    build_append_int_noprefix(table_data, 3 /* 9600 */, 1); /* Baud Rate */
-    build_append_int_noprefix(table_data, 0 /* No Parity */, 1); /* Parity */
-    /* Stop Bits */
-    build_append_int_noprefix(table_data, 1 /* 1 Stop bit */, 1);
-    /* Flow Control */
-    build_append_int_noprefix(table_data,
-        (1 << 1) /* RTS/CTS hardware flow control */, 1);
-    /* Terminal Type */
-    build_append_int_noprefix(table_data, 0 /* VT100 */, 1);
-    build_append_int_noprefix(table_data, 0, 1); /* Language */
-    /* PCI Device ID  */
-    build_append_int_noprefix(table_data, 0xffff /* not a PCI device*/, 2);
-    /* PCI Vendor ID */
-    build_append_int_noprefix(table_data, 0xffff /* not a PCI device*/, 2);
-    build_append_int_noprefix(table_data, 0, 1); /* PCI Bus Number */
-    build_append_int_noprefix(table_data, 0, 1); /* PCI Device Number */
-    build_append_int_noprefix(table_data, 0, 1); /* PCI Function Number */
-    build_append_int_noprefix(table_data, 0, 4); /* PCI Flags */
-    build_append_int_noprefix(table_data, 0, 1); /* PCI Segment */
-    build_append_int_noprefix(table_data, 0, 4); /* Reserved */
+    AcpiSpcrData serial = {
+        .interface_type = 3,       /* ARM PL011 UART */
+        .base_addr.id = AML_AS_SYSTEM_MEMORY,
+        .base_addr.width = 32,
+        .base_addr.offset = 0,
+        .base_addr.size = 3,
+        .base_addr.addr = vms->memmap[VIRT_UART].base,
+        .interrupt_type = (1 << 3),/* Bit[3] ARMH GIC interrupt*/
+        .pc_interrupt = 0,         /* IRQ */
+        .interrupt = (vms->irqmap[VIRT_UART] + ARM_SPI_BASE),
+        .baud_rate = 3,            /* 9600 */
+        .parity = 0,               /* No Parity */
+        .stop_bits = 1,            /* 1 Stop bit */
+        .flow_control = 1 << 1,    /* RTS/CTS hardware flow control */
+        .terminal_type = 0,        /* VT100 */
+        .language = 0,             /* Language */
+        .pci_device_id = 0xffff,   /* not a PCI device*/
+        .pci_vendor_id = 0xffff,   /* not a PCI device*/
+        .pci_bus = 0,
+        .pci_device = 0,
+        .pci_function = 0,
+        .pci_flags = 0,
+        .pci_segment = 0,
+    };
 
-    acpi_table_end(linker, &table);
+    build_spcr(table_data, linker, &serial, 2, vms->oem_id, vms->oem_table_id);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     }
 
     acpi_add_table(table_offsets, tables_blob);
-    build_spcr(tables_blob, tables->linker, vms);
+    spcr_setup(tables_blob, tables->linker, vms);
 
     acpi_add_table(table_offsets, tables_blob);
     build_dbg2(tables_blob, tables->linker, vms);
-- 
2.44.0

From: Sia Jee Heng <jeeheng.sia@starfivetech.com>

Generate Serial Port Console Redirection Table (SPCR) for RISC-V
virtual machine.

Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240129021440.17640-3-jeeheng.sia@starfivetech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 39 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
     aml_append(scope, dev);
 }
 
+/*
+ * Serial Port Console Redirection Table (SPCR)
+ * Rev: 1.07
+ */
+
+static void
+spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
+{
+    AcpiSpcrData serial = {
+        .interface_type = 0,       /* 16550 compatible */
+        .base_addr.id = AML_AS_SYSTEM_MEMORY,
+        .base_addr.width = 32,
+        .base_addr.offset = 0,
+        .base_addr.size = 1,
+        .base_addr.addr = s->memmap[VIRT_UART0].base,
+        .interrupt_type = (1 << 4),/* Bit[4] RISC-V PLIC/APLIC */
+        .pc_interrupt = 0,
+        .interrupt = UART0_IRQ,
+        .baud_rate = 7,            /* 15200 */
+        .parity = 0,
+        .stop_bits = 1,
+        .flow_control = 0,
+        .terminal_type = 3,        /* ANSI */
+        .language = 0,             /* Language */
+        .pci_device_id = 0xffff,   /* not a PCI device*/
+        .pci_vendor_id = 0xffff,   /* not a PCI device*/
+        .pci_bus = 0,
+        .pci_device = 0,
+        .pci_function = 0,
+        .pci_flags = 0,
+        .pci_segment = 0,
+    };
+
+    build_spcr(table_data, linker, &serial, 2, s->oem_id, s->oem_table_id);
+}
+
 /* RHCT Node[N] starts at offset 56 */
 #define RHCT_NODE_ARRAY_OFFSET 56
 
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
     acpi_add_table(table_offsets, tables_blob);
     build_rhct(tables_blob, tables->linker, s);
 
+    acpi_add_table(table_offsets, tables_blob);
+    spcr_setup(tables_blob, tables->linker, s);
+
     acpi_add_table(table_offsets, tables_blob);
     {
         AcpiMcfgInfo mcfg = {
-- 
2.44.0

From: Alexandre Ghiti <alexghiti@rivosinc.com>

Currently, the initrd is placed at 128MB, which overlaps with the kernel
when it is large (for example syzbot kernels are). From the kernel side,
there is no reason we could not push the initrd further away in memory
to accommodate large kernels, so move the initrd at 512MB when possible.

The ideal solution would have been to place the initrd based on the
kernel size but we actually can't since the bss size is not known when
the image is loaded by load_image_targphys_as() and the initrd would
then overlap with this section.

Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240206154042.514698-1-alexghiti@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/boot.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
      * kernel is uncompressed it will not clobber the initrd. However
      * on boards without much RAM we must ensure that we still leave
      * enough room for a decent sized initrd, and on boards with large
-     * amounts of RAM we must avoid the initrd being so far up in RAM
-     * that it is outside lowmem and inaccessible to the kernel.
-     * So for boards with less  than 256MB of RAM we put the initrd
-     * halfway into RAM, and for boards with 256MB of RAM or more we put
-     * the initrd at 128MB.
+     * amounts of RAM, we put the initrd at 512MB to allow large kernels
+     * to boot.
+     * So for boards with less than 1GB of RAM we put the initrd
+     * halfway into RAM, and for boards with 1GB of RAM or more we put
+     * the initrd at 512MB.
      */
-    start = kernel_entry + MIN(mem_size / 2, 128 * MiB);
+    start = kernel_entry + MIN(mem_size / 2, 512 * MiB);
 
     size = load_ramdisk(filename, start, mem_size - start);
     if (size == -1) {
-- 
2.44.0

From: Christoph Müllner <christoph.muellner@vrull.eu>

Upstream Linux recently added RISC-V Zicboz support to the hwprobe API.
This patch introduces this for QEMU's user space emulator.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240207115926.887816-2-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 3 +++
 1 file changed, 3 insertions(+)

From: Christoph Müllner <christoph.muellner@vrull.eu>

Upstream Linux recently added many additional keys to the hwprobe API.
This patch adds support for all of them with the exception of Ztso,
which is currently not supported in QEMU.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240207115926.887816-3-christoph.muellner@vrull.eu>
[ Changes by AF:
 - Fixup whitespace
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 100 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 92 insertions(+), 8 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
 #define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
 
-#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
-#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
-#define     RISCV_HWPROBE_IMA_C        (1 << 1)
-#define     RISCV_HWPROBE_IMA_V        (1 << 2)
-#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
-#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
-#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
-#define     RISCV_HWPROBE_EXT_ZICBOZ   (1 << 6)
+#define RISCV_HWPROBE_KEY_IMA_EXT_0         4
+#define     RISCV_HWPROBE_IMA_FD            (1 << 0)
+#define     RISCV_HWPROBE_IMA_C             (1 << 1)
+#define     RISCV_HWPROBE_IMA_V             (1 << 2)
+#define     RISCV_HWPROBE_EXT_ZBA           (1 << 3)
+#define     RISCV_HWPROBE_EXT_ZBB           (1 << 4)
+#define     RISCV_HWPROBE_EXT_ZBS           (1 << 5)
+#define     RISCV_HWPROBE_EXT_ZICBOZ        (1 << 6)
+#define     RISCV_HWPROBE_EXT_ZBC           (1 << 7)
+#define     RISCV_HWPROBE_EXT_ZBKB          (1 << 8)
+#define     RISCV_HWPROBE_EXT_ZBKC          (1 << 9)
+#define     RISCV_HWPROBE_EXT_ZBKX          (1 << 10)
+#define     RISCV_HWPROBE_EXT_ZKND          (1 << 11)
+#define     RISCV_HWPROBE_EXT_ZKNE          (1 << 12)
+#define     RISCV_HWPROBE_EXT_ZKNH          (1 << 13)
+#define     RISCV_HWPROBE_EXT_ZKSED         (1 << 14)
+#define     RISCV_HWPROBE_EXT_ZKSH          (1 << 15)
+#define     RISCV_HWPROBE_EXT_ZKT           (1 << 16)
+#define     RISCV_HWPROBE_EXT_ZVBB          (1 << 17)
+#define     RISCV_HWPROBE_EXT_ZVBC          (1 << 18)
+#define     RISCV_HWPROBE_EXT_ZVKB          (1 << 19)
+#define     RISCV_HWPROBE_EXT_ZVKG          (1 << 20)
+#define     RISCV_HWPROBE_EXT_ZVKNED        (1 << 21)
+#define     RISCV_HWPROBE_EXT_ZVKNHA        (1 << 22)
+#define     RISCV_HWPROBE_EXT_ZVKNHB        (1 << 23)
+#define     RISCV_HWPROBE_EXT_ZVKSED        (1 << 24)
+#define     RISCV_HWPROBE_EXT_ZVKSH         (1 << 25)
+#define     RISCV_HWPROBE_EXT_ZVKT          (1 << 26)
+#define     RISCV_HWPROBE_EXT_ZFH           (1 << 27)
+#define     RISCV_HWPROBE_EXT_ZFHMIN        (1 << 28)
+#define     RISCV_HWPROBE_EXT_ZIHINTNTL     (1 << 29)
+#define     RISCV_HWPROBE_EXT_ZVFH          (1 << 30)
+#define     RISCV_HWPROBE_EXT_ZVFHMIN       (1 << 31)
+#define     RISCV_HWPROBE_EXT_ZFA           (1ULL << 32)
+#define     RISCV_HWPROBE_EXT_ZACAS         (1ULL << 34)
+#define     RISCV_HWPROBE_EXT_ZICOND        (1ULL << 35)
 
 #define RISCV_HWPROBE_KEY_CPUPERF_0     5
 #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                      RISCV_HWPROBE_EXT_ZBS : 0;
             value |= cfg->ext_zicboz ?
                      RISCV_HWPROBE_EXT_ZICBOZ : 0;
+            value |= cfg->ext_zbc ?
+                     RISCV_HWPROBE_EXT_ZBC : 0;
+            value |= cfg->ext_zbkb ?
+                     RISCV_HWPROBE_EXT_ZBKB : 0;
+            value |= cfg->ext_zbkc ?
+                     RISCV_HWPROBE_EXT_ZBKC : 0;
+            value |= cfg->ext_zbkx ?
+                     RISCV_HWPROBE_EXT_ZBKX : 0;
+            value |= cfg->ext_zknd ?
+                     RISCV_HWPROBE_EXT_ZKND : 0;
+            value |= cfg->ext_zkne ?
+                     RISCV_HWPROBE_EXT_ZKNE : 0;
+            value |= cfg->ext_zknh ?
+                     RISCV_HWPROBE_EXT_ZKNH : 0;
+            value |= cfg->ext_zksed ?
+                     RISCV_HWPROBE_EXT_ZKSED : 0;
+            value |= cfg->ext_zksh ?
+                     RISCV_HWPROBE_EXT_ZKSH : 0;
+            value |= cfg->ext_zkt ?
+                     RISCV_HWPROBE_EXT_ZKT : 0;
+            value |= cfg->ext_zvbb ?
+                     RISCV_HWPROBE_EXT_ZVBB : 0;
+            value |= cfg->ext_zvbc ?
+                     RISCV_HWPROBE_EXT_ZVBC : 0;
+            value |= cfg->ext_zvkb ?
+                     RISCV_HWPROBE_EXT_ZVKB : 0;
+            value |= cfg->ext_zvkg ?
+                     RISCV_HWPROBE_EXT_ZVKG : 0;
+            value |= cfg->ext_zvkned ?
+                     RISCV_HWPROBE_EXT_ZVKNED : 0;
+            value |= cfg->ext_zvknha ?
+                     RISCV_HWPROBE_EXT_ZVKNHA : 0;
+            value |= cfg->ext_zvknhb ?
+                     RISCV_HWPROBE_EXT_ZVKNHB : 0;
+            value |= cfg->ext_zvksed ?
+                     RISCV_HWPROBE_EXT_ZVKSED : 0;
+            value |= cfg->ext_zvksh ?
+                     RISCV_HWPROBE_EXT_ZVKSH : 0;
+            value |= cfg->ext_zvkt ?
+                     RISCV_HWPROBE_EXT_ZVKT : 0;
+            value |= cfg->ext_zfh ?
+                     RISCV_HWPROBE_EXT_ZFH : 0;
+            value |= cfg->ext_zfhmin ?
+                     RISCV_HWPROBE_EXT_ZFHMIN : 0;
+            value |= cfg->ext_zihintntl ?
+                     RISCV_HWPROBE_EXT_ZIHINTNTL : 0;
+            value |= cfg->ext_zvfh ?
+                     RISCV_HWPROBE_EXT_ZVFH : 0;
+            value |= cfg->ext_zvfhmin ?
+                     RISCV_HWPROBE_EXT_ZVFHMIN : 0;
+            value |= cfg->ext_zfa ?
+                     RISCV_HWPROBE_EXT_ZFA : 0;
+            value |= cfg->ext_zacas ?
+                     RISCV_HWPROBE_EXT_ZACAS : 0;
+            value |= cfg->ext_zicond ?
+                     RISCV_HWPROBE_EXT_ZICOND : 0;
             __put_user(value, &pair->value);
             break;
         case RISCV_HWPROBE_KEY_CPUPERF_0:
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Recent changes in options handling removed the 'mmu' default the bare
CPUs had, meaning that we must enable 'mmu' by hand when using the
rva22s64 profile CPU.

Given that this profile is setting a satp mode, it already implies that
we need a 'mmu'. Enable the 'mmu' in this case.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240215223955.969568-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
 
 #ifndef CONFIG_USER_ONLY
     if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+        object_property_set_bool(obj, "mmu", true, NULL);
         const char *satp_prop = satp_mode_str(profile->satp_mode,
                                               riscv_cpu_is_32bit(cpu));
         object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Further discussions after the introduction of rva22 support in QEMU
revealed that what we've been calling 'named features' are actually
regular extensions, with their respective riscv,isa DTs. This is
clarified in [1]. [2] is a bug tracker asking for the profile spec to be
less cryptic about it.

As far as QEMU goes we understand extensions as something that the user
can enable/disable in the command line. This isn't the case for named
features, so we'll have to reach a middle ground.

We'll keep our existing nomenclature 'named features' to refer to any
extension that the user can't control in the command line. We'll also do
the following:

- 'svade' and 'zic64b' flags are renamed to 'ext_svade' and
  'ext_zic64b'. 'ext_svade' and 'ext_zic64b' now have riscv,isa strings and
  priv_spec versions;

- skip name feature check in cpu_bump_multi_ext_priv_ver(). Now that
  named features have a riscv,isa and an entry in isa_edata_arr[] we
  don't need to gate the call to cpu_cfg_ext_get_min_version() anymore.

[1] https://github.com/riscv/riscv-profiles/issues/121
[2] https://github.com/riscv/riscv-profiles/issues/142

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240215223955.969568-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     |  6 ++++--
 target/riscv/cpu.c         | 17 +++++++++++++----
 target/riscv/tcg/tcg-cpu.c | 16 ++++++----------
 3 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smepmp;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
-    bool svade;
-    bool zic64b;
 
     uint32_t mvendorid;
     uint64_t marchid;
     uint64_t mimpid;
 
+    /* Named features  */
+    bool ext_svade;
+    bool ext_zic64b;
+
     /* Vendor-specific custom extensions */
     bool ext_xtheadba;
     bool ext_xtheadbb;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_option_set(const char *optname)
  * instead.
  */
 const RISCVIsaExtData isa_edata_arr[] = {
+    ISA_EXT_DATA_ENTRY(zic64b, PRIV_VERSION_1_12_0, ext_zic64b),
     ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
     ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
     ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
+    ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
     ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+/*
+ * 'Named features' is the name we give to extensions that we
+ * don't want to expose to users. They are either immutable
+ * (always enabled/disable) or they'll vary depending on
+ * the resulting CPU state. They have riscv,isa strings
+ * and priv_ver like regular extensions.
+ */
 const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
-    MULTI_EXT_CFG_BOOL("svade", svade, true),
-    MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
+    MULTI_EXT_CFG_BOOL("svade", ext_svade, true),
+    MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
 
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
         CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
 
         /* mandatory named features for this profile */
-        CPU_CFG_OFFSET(zic64b),
+        CPU_CFG_OFFSET(ext_zic64b),
 
         RISCV_PROFILE_EXT_LIST_END
     }
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22S64 = {
         CPU_CFG_OFFSET(ext_svinval),
 
         /* rva22s64 named features */
-        CPU_CFG_OFFSET(svade),
+        CPU_CFG_OFFSET(ext_svade),
 
         RISCV_PROFILE_EXT_LIST_END
     }
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
 static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
 {
     switch (feat_offset) {
-    case CPU_CFG_OFFSET(zic64b):
+    case CPU_CFG_OFFSET(ext_zic64b):
         cpu->cfg.cbom_blocksize = 64;
         cpu->cfg.cbop_blocksize = 64;
         cpu->cfg.cboz_blocksize = 64;
         break;
-    case CPU_CFG_OFFSET(svade):
+    case CPU_CFG_OFFSET(ext_svade):
         cpu->cfg.ext_svadu = false;
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
         return;
     }
 
-    if (cpu_cfg_offset_is_named_feat(ext_offset)) {
-        return;
-    }
-
     ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
 
     if (env->priv_ver < ext_priv_ver) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
 
 static void riscv_cpu_update_named_features(RISCVCPU *cpu)
 {
-    cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
-                      cpu->cfg.cbop_blocksize == 64 &&
-                      cpu->cfg.cboz_blocksize == 64;
+    cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
+                          cpu->cfg.cbop_blocksize == 64 &&
+                          cpu->cfg.cboz_blocksize == 64;
 
-    cpu->cfg.svade = !cpu->cfg.ext_svadu;
+    cpu->cfg.ext_svade = !cpu->cfg.ext_svadu;
 }
 
 static void riscv_cpu_validate_g(RISCVCPU *cpu)
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The RVA22U64 and RVA22S64 profiles mandates certain extensions that,
until now, we were implying that they were available.

We can't do this anymore since named features also has a riscv,isa
entry. Let's add them to riscv_cpu_named_features[].

Instead of adding one bool for each named feature that we'll always
implement, i.e. can't be turned off, add a 'ext_always_enabled' bool in
cpu->cfg. This bool will be set to 'true' in TCG accel init, and all
named features will point to it. This also means that KVM won't see
these features as always enable, which is our intention.

If any accelerator adds support to disable one of these features, we'll
have to promote them to regular extensions and allow users to disable it
via command line.

After this patch, here's the riscv,isa from a buildroot using the
'rva22s64' CPU:

# cat /proc/device-tree/cpus/cpu@0/riscv,isa
rv64imafdc_zic64b_zicbom_zicbop_zicboz_ziccamoa_ziccif_zicclsm_ziccrse_
zicntr_zicsr_zifencei_zihintpause_zihpm_za64rs_zfhmin_zca_zcd_zba_zbb_
zbs_zkt_ssccptr_sscounterenw_sstvala_sstvecd_svade_svinval_svpbmt#

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20240215223955.969568-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     |  6 ++++++
 target/riscv/cpu.c         | 42 +++++++++++++++++++++++++++++++-------
 target/riscv/tcg/tcg-cpu.c |  2 ++
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svade;
     bool ext_zic64b;
 
+    /*
+     * Always 'true' boolean for named features
+     * TCG always implement/can't be disabled.
+     */
+    bool ext_always_enabled;
+
     /* Vendor-specific custom extensions */
     bool ext_xtheadba;
     bool ext_xtheadbb;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
     ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
     ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
+    ISA_EXT_DATA_ENTRY(ziccamoa, PRIV_VERSION_1_11_0, ext_always_enabled),
+    ISA_EXT_DATA_ENTRY(ziccif, PRIV_VERSION_1_11_0, ext_always_enabled),
+    ISA_EXT_DATA_ENTRY(zicclsm, PRIV_VERSION_1_11_0, ext_always_enabled),
+    ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, ext_always_enabled),
     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
     ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr),
     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_zicsr),
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+    ISA_EXT_DATA_ENTRY(za64rs, PRIV_VERSION_1_12_0, ext_always_enabled),
     ISA_EXT_DATA_ENTRY(zaamo, PRIV_VERSION_1_12_0, ext_zaamo),
     ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
     ISA_EXT_DATA_ENTRY(zalrsc, PRIV_VERSION_1_12_0, ext_zalrsc),
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
+    ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, ext_always_enabled),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
+    ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, ext_always_enabled),
     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
+    ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, ext_always_enabled),
+    ISA_EXT_DATA_ENTRY(sstvecd, PRIV_VERSION_1_12_0, ext_always_enabled),
     ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
     ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#define ALWAYS_ENABLED_FEATURE(_name) \
+    {.name = _name, \
+     .offset = CPU_CFG_OFFSET(ext_always_enabled), \
+     .enabled = true}
+
 /*
  * 'Named features' is the name we give to extensions that we
  * don't want to expose to users. They are either immutable
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
     MULTI_EXT_CFG_BOOL("svade", ext_svade, true),
     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
 
+    /*
+     * cache-related extensions that are always enabled
+     * in TCG since QEMU RISC-V does not have a cache
+     * model.
+     */
+    ALWAYS_ENABLED_FEATURE("za64rs"),
+    ALWAYS_ENABLED_FEATURE("ziccif"),
+    ALWAYS_ENABLED_FEATURE("ziccrse"),
+    ALWAYS_ENABLED_FEATURE("ziccamoa"),
+    ALWAYS_ENABLED_FEATURE("zicclsm"),
+    ALWAYS_ENABLED_FEATURE("ssccptr"),
+
+    /* Other named features that TCG always implements */
+    ALWAYS_ENABLED_FEATURE("sstvecd"),
+    ALWAYS_ENABLED_FEATURE("sstvala"),
+    ALWAYS_ENABLED_FEATURE("sscounterenw"),
+
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static const PropertyInfo prop_marchid = {
 };
 
 /*
- * RVA22U64 defines some 'named features' or 'synthetic extensions'
- * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
- * and Zicclsm. We do not implement caching in QEMU so we'll consider
- * all these named features as always enabled.
- *
- * There's no riscv,isa update for them (nor for zic64b, despite it
- * having a cfg offset) at this moment.
+ * RVA22U64 defines some 'named features' that are cache
+ * related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
+ * and Zicclsm. They are always implemented in TCG and
+ * doesn't need to be manually enabled by the profile.
  */
 static RISCVCPUProfile RVA22U64 = {
     .parent = NULL,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tcg_cpu_instance_init(CPUState *cs)
     RISCVCPU *cpu = RISCV_CPU(cs);
     Object *obj = OBJECT(cpu);
 
+    cpu->cfg.ext_always_enabled = true;
+
     misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
     multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
     riscv_cpu_add_user_properties(obj);
-- 
2.44.0

From: Andrew Jones <ajones@ventanamicro.com>

The hypervisor should decide what it wants to enable. Zero all
configuration enable bits on reset.

Also, commit ed67d63798f2 ("target/riscv: Update CSR bits name for
svadu extension") missed one reference to 'hade'. Change it now.

Fixes: 0af3f115e68e ("target/riscv: Add *envcfg.HADE related check in address translation")
Fixes: ed67d63798f2 ("target/riscv: Update CSR bits name for svadu extension")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240215223955.969568-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +--
 target/riscv/csr.c | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

From: Andrew Jones <ajones@ventanamicro.com>

Gate hardware A/D PTE bit updating on {m,h}envcfg.ADUE and only
enable menvcfg.ADUE on reset if svade has not been selected. Now
that we also consider svade, we have four possible configurations:

1) !svade && !svadu
    use hardware updating and there's no way to disable it
    (the default, which maintains past behavior. Maintaining
     the default, even with !svadu is a change that fixes [1])

2) !svade && svadu
    use hardware updating, but also provide {m,h}envcfg.ADUE,
    allowing software to switch to exception mode
    (being able to switch is a change which fixes [1])

3) svade && !svadu
    use exception mode and there's no way to switch to hardware
    updating
    (this behavior change fixes [2])

4) svade && svadu
    use exception mode, but also provide {m,h}envcfg.ADUE,
    allowing software to switch to hardware updating
    (this behavior change fixes [2])

Fixes: 0af3f115e68e ("target/riscv: Add *envcfg.HADE related check in address translation") [1]
Fixes: 48531f5adb2a ("target/riscv: implement svade") [2]
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240215223955.969568-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         |  3 ++-
 target/riscv/cpu_helper.c  | 19 +++++++++++++++----
 target/riscv/tcg/tcg-cpu.c | 15 +++++----------
 3 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     env->two_stage_lookup = false;
 
     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
+                   (!cpu->cfg.ext_svade && cpu->cfg.ext_svadu ?
+                    MENVCFG_ADUE : 0);
     env->henvcfg = 0;
 
     /* Initialized default priorities of local interrupts. */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-    bool adue = env->menvcfg & MENVCFG_ADUE;
+    bool svade = riscv_cpu_cfg(env)->ext_svade;
+    bool svadu = riscv_cpu_cfg(env)->ext_svadu;
+    bool adue = svadu ? env->menvcfg & MENVCFG_ADUE : !svade;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
@@ -XXX,XX +XXX,XX @@ restart:
         return TRANSLATE_FAIL;
     }
 
-    /* If necessary, set accessed and dirty bits. */
-    target_ulong updated_pte = pte | PTE_A |
-                (access_type == MMU_DATA_STORE ? PTE_D : 0);
+    target_ulong updated_pte = pte;
+
+    /*
+     * If ADUE is enabled, set accessed and dirty bits.
+     * Otherwise raise an exception if necessary.
+     */
+    if (adue) {
+        updated_pte |= PTE_A | (access_type == MMU_DATA_STORE ? PTE_D : 0);
+    } else if (!(pte & PTE_A) ||
+               (access_type == MMU_DATA_STORE && !(pte & PTE_D))) {
+        return TRANSLATE_FAIL;
+    }
 
     /* Page table updates need to be atomic with MTTCG enabled */
     if (updated_pte != pte && !is_debug) {
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
 
 static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
 {
-    switch (feat_offset) {
-    case CPU_CFG_OFFSET(ext_zic64b):
+     /*
+      * All other named features are already enabled
+      * in riscv_tcg_cpu_instance_init().
+      */
+    if (feat_offset == CPU_CFG_OFFSET(ext_zic64b)) {
         cpu->cfg.cbom_blocksize = 64;
         cpu->cfg.cbop_blocksize = 64;
         cpu->cfg.cboz_blocksize = 64;
-        break;
-    case CPU_CFG_OFFSET(ext_svade):
-        cpu->cfg.ext_svadu = false;
-        break;
-    default:
-        g_assert_not_reached();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
     cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
                           cpu->cfg.cbop_blocksize == 64 &&
                           cpu->cfg.cboz_blocksize == 64;
-
-    cpu->cfg.ext_svade = !cpu->cfg.ext_svadu;
 }
 
 static void riscv_cpu_validate_g(RISCVCPU *cpu)
-- 
2.44.0

From: Andrew Jones <ajones@ventanamicro.com>

Named features are extensions which don't make sense for users to
control and are therefore not exposed on the command line. However,
svade is an extension which makes sense for users to control, so treat
it like a "normal" extension. The default is false, even for the max
cpu type, since QEMU has always implemented hardware A/D PTE bit
updating, so users must opt into svade (or get it from a CPU type
which enables it by default).

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240215223955.969568-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         | 9 ++-------
 target/riscv/tcg/tcg-cpu.c | 6 ++++++
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
 
     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
+    MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
     MULTI_EXT_CFG_BOOL("svadu", ext_svadu, true),
     MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
     MULTI_EXT_CFG_BOOL("svnapot", ext_svnapot, false),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
  * and priv_ver like regular extensions.
  */
 const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
-    MULTI_EXT_CFG_BOOL("svade", ext_svade, true),
     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
 
     /*
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
  * Other named features that we already implement: Sstvecd, Sstvala,
  * Sscounterenw
  *
- * Named features that we need to enable: svade
- *
  * The remaining features/extensions comes from RVA22U64.
  */
 static RISCVCPUProfile RVA22S64 = {
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22S64 = {
     .ext_offsets = {
         /* rva22s64 exts */
         CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
-        CPU_CFG_OFFSET(ext_svinval),
-
-        /* rva22s64 named features */
-        CPU_CFG_OFFSET(ext_svade),
+        CPU_CFG_OFFSET(ext_svinval), CPU_CFG_OFFSET(ext_svade),
 
         RISCV_PROFILE_EXT_LIST_END
     }
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
         isa_ext_update_enabled(cpu, prop->offset, true);
     }
 
+    /*
+     * Some extensions can't be added without backward compatibilty concerns.
+     * Disable those, the user can still opt in to them on the command line.
+     */
+    cpu->cfg.ext_svade = false;
+
     /* set vector version */
     env->vext_ver = VEXT_VERSION_1_00_0;
 
-- 
2.44.0

From: Irina Ryapolova <irina.ryapolova@syntacore.com>

The SATP register is an SXLEN-bit read/write WARL register. It means that CSR fields are only defined
for a subset of bit encodings, but allow any value to be written while guaranteeing to return a legal
value whenever read (See riscv-privileged-20211203, SATP CSR).

For example on rv64 we are trying to write to SATP CSR val = 0x1000000000000000 (SATP_MODE = 1 - Reserved for standard use)
and after that we are trying to read SATP_CSR. We read from the SATP CSR value = 0x1000000000000000, which is not a correct
operation (return illegal value).

Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240109145923.37893-1-irina.ryapolova@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mstatus(CPURISCVState *env, int csrno,
 
 static bool validate_vm(CPURISCVState *env, target_ulong vm)
 {
-    return (vm & 0xf) <=
-           satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
+    uint64_t mode_supported = riscv_cpu_cfg(env)->satp_mode.map;
+    return get_field(mode_supported, (1 << vm));
 }
 
 static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
-- 
2.44.0

From: Irina Ryapolova <irina.ryapolova@syntacore.com>

Added xATP_MODE validation for vsatp/hgatp CSRs.
The xATP register is an SXLEN-bit read/write WARL register, so
the legal value must be returned (See riscv-privileged-20211203, SATP/VSATP/HGATP CSRs).

Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240109145923.37893-2-irina.ryapolova@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 52 ++++++++++++++++++++++++++--------------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static bool validate_vm(CPURISCVState *env, target_ulong vm)
     return get_field(mode_supported, (1 << vm));
 }
 
+static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
+                                  target_ulong val)
+{
+    target_ulong mask;
+    bool vm;
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        vm = validate_vm(env, get_field(val, SATP32_MODE));
+        mask = (val ^ old_xatp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
+    } else {
+        vm = validate_vm(env, get_field(val, SATP64_MODE));
+        mask = (val ^ old_xatp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
+    }
+
+    if (vm && mask) {
+        /*
+         * The ISA defines SATP.MODE=Bare as "no translation", but we still
+         * pass these through QEMU's TLB emulation as it improves
+         * performance.  Flushing the TLB on SATP writes with paging
+         * enabled avoids leaking those invalid cached mappings.
+         */
+        tlb_flush(env_cpu(env));
+        return val;
+    }
+    return old_xatp;
+}
+
 static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
                                  target_ulong val)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
 static RISCVException write_satp(CPURISCVState *env, int csrno,
                                  target_ulong val)
 {
-    target_ulong mask;
-    bool vm;
-
     if (!riscv_cpu_cfg(env)->mmu) {
         return RISCV_EXCP_NONE;
     }
 
-    if (riscv_cpu_mxl(env) == MXL_RV32) {
-        vm = validate_vm(env, get_field(val, SATP32_MODE));
-        mask = (val ^ env->satp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
-    } else {
-        vm = validate_vm(env, get_field(val, SATP64_MODE));
-        mask = (val ^ env->satp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
-    }
-
-    if (vm && mask) {
-        /*
-         * The ISA defines SATP.MODE=Bare as "no translation", but we still
-         * pass these through QEMU's TLB emulation as it improves
-         * performance.  Flushing the TLB on SATP writes with paging
-         * enabled avoids leaking those invalid cached mappings.
-         */
-        tlb_flush(env_cpu(env));
-        env->satp = val;
-    }
+    env->satp = legalize_xatp(env, env->satp, val);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_hgatp(CPURISCVState *env, int csrno,
 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
                                   target_ulong val)
 {
-    env->hgatp = val;
+    env->hgatp = legalize_xatp(env, env->hgatp, val);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_vsatp(CPURISCVState *env, int csrno,
 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
                                   target_ulong val)
 {
-    env->vsatp = val;
+    env->vsatp = legalize_xatp(env, env->vsatp, val);
     return RISCV_EXCP_NONE;
 }
 
-- 
2.44.0

From: Frank Chang <frank.chang@sifive.com>

Add missing include guard in pmu.h to avoid the problem of double
inclusion.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240220110907.10479-1-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmu.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/pmu.h b/target/riscv/pmu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.h
+++ b/target/riscv/pmu.h
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#ifndef RISCV_PMU_H
+#define RISCV_PMU_H
+
 #include "cpu.h"
 #include "qapi/error.h"
 
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
 void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name);
 int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
                           uint32_t ctr_idx);
+
+#endif /* RISCV_PMU_H */
-- 
2.44.0

From: Haibo Xu <haibo1.xu@intel.com>

Enable ACPI NUMA support by adding the following 2 ACPI tables:
SRAT: provides the association for memory/Harts and Proximity Domains
SLIT: provides the relative distance between Proximity Domains

The SRAT RINTC Affinity Structure definition[1] was based on the recently
approved ACPI CodeFirst ECR[2].

[1] https://github.com/riscv-non-isa/riscv-acpi/issues/25
[2] https://mantis.uefi.org/mantis/view.php?id=2433

Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20240129094200.3581037-1-haibo1.xu@intel.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 60 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
     acpi_table_end(linker, &table);
 }
 
+/*
+ * ACPI spec, Revision 6.5+
+ * 5.2.16 System Resource Affinity Table (SRAT)
+ * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/25
+ *      https://drive.google.com/file/d/1YTdDx2IPm5IeZjAW932EYU-tUtgS08tX/view
+ */
+static void
+build_srat(GArray *table_data, BIOSLinker *linker, RISCVVirtState *vms)
+{
+    int i;
+    uint64_t mem_base;
+    MachineClass *mc = MACHINE_GET_CLASS(vms);
+    MachineState *ms = MACHINE(vms);
+    const CPUArchIdList *cpu_list = mc->possible_cpu_arch_ids(ms);
+    AcpiTable table = { .sig = "SRAT", .rev = 3, .oem_id = vms->oem_id,
+                        .oem_table_id = vms->oem_table_id };
+
+    acpi_table_begin(&table, table_data);
+    build_append_int_noprefix(table_data, 1, 4); /* Reserved */
+    build_append_int_noprefix(table_data, 0, 8); /* Reserved */
+
+    for (i = 0; i < cpu_list->len; ++i) {
+        uint32_t nodeid = cpu_list->cpus[i].props.node_id;
+        /*
+         * 5.2.16.8 RINTC Affinity Structure
+         */
+        build_append_int_noprefix(table_data, 7, 1);      /* Type */
+        build_append_int_noprefix(table_data, 20, 1);     /* Length */
+        build_append_int_noprefix(table_data, 0, 2);        /* Reserved */
+        build_append_int_noprefix(table_data, nodeid, 4); /* Proximity Domain */
+        build_append_int_noprefix(table_data, i, 4); /* ACPI Processor UID */
+        /* Flags, Table 5-70 */
+        build_append_int_noprefix(table_data, 1 /* Flags: Enabled */, 4);
+        build_append_int_noprefix(table_data, 0, 4); /* Clock Domain */
+    }
+
+    mem_base = vms->memmap[VIRT_DRAM].base;
+    for (i = 0; i < ms->numa_state->num_nodes; ++i) {
+        if (ms->numa_state->nodes[i].node_mem > 0) {
+            build_srat_memory(table_data, mem_base,
+                              ms->numa_state->nodes[i].node_mem, i,
+                              MEM_AFFINITY_ENABLED);
+            mem_base += ms->numa_state->nodes[i].node_mem;
+        }
+    }
+
+    acpi_table_end(linker, &table);
+}
+
 static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
 {
     GArray *table_offsets;
     unsigned dsdt, xsdt;
     GArray *tables_blob = tables->table_data;
+    MachineState *ms = MACHINE(s);
 
     table_offsets = g_array_new(false, true,
                                 sizeof(uint32_t));
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
                    s->oem_table_id);
     }
 
+    if (ms->numa_state->num_nodes > 0) {
+        acpi_add_table(table_offsets, tables_blob);
+        build_srat(tables_blob, tables->linker, s);
+        if (ms->numa_state->have_numa_distance) {
+            acpi_add_table(table_offsets, tables_blob);
+            build_slit(tables_blob, tables->linker, ms, s->oem_id,
+                       s->oem_table_id);
+        }
+    }
+
     /* XSDT is pointed to by RSDP */
     xsdt = tables_blob->len;
     build_xsdt(tables_blob, tables->linker, table_offsets, s->oem_id,
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Hotplugged FDT nodes will attempt to write this node that, at this
moment, is being created only in create_fdt_pcie() during
finalize_fdt().

Create it earlier.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240217192607.32565-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
 
     name = g_strdup_printf("/soc/pci@%lx",
         (long) memmap[VIRT_PCIE_ECAM].base);
-    qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_cell(ms->fdt, name, "#address-cells",
         FDT_PCI_ADDR_CELLS);
     qemu_fdt_setprop_cell(ms->fdt, name, "#interrupt-cells",
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
 {
     MachineState *ms = MACHINE(s);
     uint8_t rng_seed[32];
+    g_autofree char *name = NULL;
 
     ms->fdt = create_device_tree(&s->fdt_size);
     if (!ms->fdt) {
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
     qemu_fdt_setprop_cell(ms->fdt, "/soc", "#size-cells", 0x2);
     qemu_fdt_setprop_cell(ms->fdt, "/soc", "#address-cells", 0x2);
 
+    /*
+     * The "/soc/pci@..." node is needed for PCIE hotplugs
+     * that might happen before finalize_fdt().
+     */
+    name = g_strdup_printf("/soc/pci@%lx", (long) memmap[VIRT_PCIE_ECAM].base);
+    qemu_fdt_add_subnode(ms->fdt, name);
+
     qemu_fdt_add_subnode(ms->fdt, "/chosen");
 
     /* Pass seed to RNG */
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We want to add a RISC-V 'virt' libqos machine to increase our test
coverage. Some of the tests will try to plug a virtio-iommu-pci
device into the board and do some tests with it.

Enable virtio-iommu-pci in the 'virt' machine.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240217192607.32565-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/display/ramfb.h"
 #include "hw/acpi/aml-build.h"
 #include "qapi/qapi-visit-common.h"
+#include "hw/virtio/virtio-iommu.h"
 
 /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 static bool virt_use_kvm_aia(RISCVVirtState *s)
@@ -XXX,XX +XXX,XX @@ static void create_fdt_fw_cfg(RISCVVirtState *s, const MemMapEntry *memmap)
     qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
 }
 
+static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
+{
+    const char compat[] = "virtio,pci-iommu\0pci1af4,1057";
+    void *fdt = MACHINE(s)->fdt;
+    uint32_t iommu_phandle;
+    g_autofree char *iommu_node = NULL;
+    g_autofree char *pci_node = NULL;
+
+    pci_node = g_strdup_printf("/soc/pci@%lx",
+                               (long) virt_memmap[VIRT_PCIE_ECAM].base);
+    iommu_node = g_strdup_printf("%s/virtio_iommu@%x,%x", pci_node,
+                                 PCI_SLOT(bdf), PCI_FUNC(bdf));
+    iommu_phandle = qemu_fdt_alloc_phandle(fdt);
+
+    qemu_fdt_add_subnode(fdt, iommu_node);
+
+    qemu_fdt_setprop(fdt, iommu_node, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(fdt, iommu_node, "reg",
+                                 1, bdf << 8, 1, 0, 1, 0,
+                                 1, 0, 1, 0);
+    qemu_fdt_setprop_cell(fdt, iommu_node, "#iommu-cells", 1);
+    qemu_fdt_setprop_cell(fdt, iommu_node, "phandle", iommu_phandle);
+
+    qemu_fdt_setprop_cells(fdt, pci_node, "iommu-map",
+                           0, iommu_phandle, 0, bdf,
+                           bdf + 1, iommu_phandle, bdf + 1, 0xffff - bdf);
+}
+
 static void finalize_fdt(RISCVVirtState *s)
 {
     uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
 {
     MachineClass *mc = MACHINE_GET_CLASS(machine);
 
-    if (device_is_dynamic_sysbus(mc, dev)) {
+    if (device_is_dynamic_sysbus(mc, dev) ||
+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
         return HOTPLUG_HANDLER(machine);
     }
     return NULL;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
                                      SYS_BUS_DEVICE(dev));
         }
     }
+
+    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
+        create_fdt_virtio_iommu(s, pci_get_bdf(PCI_DEVICE(dev)));
+    }
 }
 
 static void virt_machine_class_init(ObjectClass *oc, void *data)
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The 'virt' machine makes assumptions on the Advanced Core-Local
Interruptor, or aclint, based on 'tcg_enabled()' conditionals.  This
will impact MSI related tests support when adding a RISC-V 'virt' libqos
machine. The accelerator used in that case, 'qtest', isn't being
accounted for and we'll error out if we try to enable aclint.

Create a new virt_aclint_allowed() helper to gate the aclint code
considering both TCG and 'qtest' accelerators. The error message is
left untouched, mentioning TCG only, because we don't expect the
regular user to be aware of 'qtest'.

We want to add 'qtest' support for aclint only, leaving the TCG specific
bits out of it. This is done by changing the current format we use
today:

if (tcg_enabled()) {
   if (s->have_aclint) { - aclint logic - }
   else { - non-aclint, TCG logic - }
}

into:

if (virt_aclint_allowed() && s->have_aclint) {
 - aclint logic -
} else if (tcg_enabled()) {
 - non-aclint, TCG logic -
}

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240217192607.32565-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 52 +++++++++++++++++++++++++------------------------
 1 file changed, 27 insertions(+), 25 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/tcg.h"
 #include "sysemu/kvm.h"
 #include "sysemu/tpm.h"
+#include "sysemu/qtest.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
@@ -XXX,XX +XXX,XX @@ static bool virt_use_kvm_aia(RISCVVirtState *s)
     return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 }
 
+static bool virt_aclint_allowed(void)
+{
+    return tcg_enabled() || qtest_enabled();
+}
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =        {        0x0,         0x100 },
     [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         create_fdt_socket_memory(s, memmap, socket);
 
-        if (tcg_enabled()) {
-            if (s->have_aclint) {
-                create_fdt_socket_aclint(s, memmap, socket,
-                    &intc_phandles[phandle_pos]);
-            } else {
-                create_fdt_socket_clint(s, memmap, socket,
-                    &intc_phandles[phandle_pos]);
-            }
+        if (virt_aclint_allowed() && s->have_aclint) {
+            create_fdt_socket_aclint(s, memmap, socket,
+                                     &intc_phandles[phandle_pos]);
+        } else if (tcg_enabled()) {
+            create_fdt_socket_clint(s, memmap, socket,
+                                    &intc_phandles[phandle_pos]);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         exit(1);
     }
 
-    if (!tcg_enabled() && s->have_aclint) {
+    if (!virt_aclint_allowed() && s->have_aclint) {
         error_report("'aclint' is only available with TCG acceleration");
         exit(1);
     }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                 hart_count, &error_abort);
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
 
-        if (tcg_enabled()) {
-            if (s->have_aclint) {
-                if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-                    /* Per-socket ACLINT MTIMER */
-                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+        if (virt_aclint_allowed() && s->have_aclint) {
+            if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+                /* Per-socket ACLINT MTIMER */
+                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
                             i * RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                         RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                         base_hartid, hart_count,
                         RISCV_ACLINT_DEFAULT_MTIMECMP,
                         RISCV_ACLINT_DEFAULT_MTIME,
                         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
-                } else {
-                    /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
-                    riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
+            } else {
+                /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
+                riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
                             i * memmap[VIRT_CLINT].size,
                         base_hartid, hart_count, false);
-                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
                             i * memmap[VIRT_CLINT].size +
                             RISCV_ACLINT_SWI_SIZE,
                         RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                         RISCV_ACLINT_DEFAULT_MTIMECMP,
                         RISCV_ACLINT_DEFAULT_MTIME,
                         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
-                    riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
+                riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
                             i * memmap[VIRT_ACLINT_SSWI].size,
                         base_hartid, hart_count, true);
-                }
-            } else {
-                /* Per-socket SiFive CLINT */
-                riscv_aclint_swi_create(
+            }
+        } else if (tcg_enabled()) {
+            /* Per-socket SiFive CLINT */
+            riscv_aclint_swi_create(
                     memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
                     base_hartid, hart_count, false);
-                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+            riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
                         i * memmap[VIRT_CLINT].size + RISCV_ACLINT_SWI_SIZE,
                     RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
                     RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
                     RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
-            }
         }
 
         /* Per-socket interrupt controller */
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add a RISC-V 'virt' machine to the graph. This implementation is a
modified copy of the existing arm machine in arm-virt-machine.c

It contains a virtio-mmio and a generic-pcihost controller. The
generic-pcihost controller hardcodes assumptions from the ARM 'virt'
machine, like ecam and pio_base addresses, so we'll add an extra step to
set its parameters after creating it.

Our command line is incremented with 'aclint' parameters to allow the
machine to run MSI tests.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20240217192607.32565-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/libqos/riscv-virt-machine.c | 137 ++++++++++++++++++++++++
 tests/qtest/libqos/meson.build          |   1 +
 2 files changed, 138 insertions(+)
 create mode 100644 tests/qtest/libqos/riscv-virt-machine.c

diff --git a/tests/qtest/libqos/riscv-virt-machine.c b/tests/qtest/libqos/riscv-virt-machine.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/libqos/riscv-virt-machine.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * libqos driver framework for risc-v
+ *
+ * Initial version based on arm-virt-machine.c
+ *
+ * Copyright (c) 2024 Ventana Micro
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1 as published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+
+#include "qemu/osdep.h"
+#include "../libqtest.h"
+#include "qemu/module.h"
+#include "libqos-malloc.h"
+#include "qgraph.h"
+#include "virtio-mmio.h"
+#include "generic-pcihost.h"
+#include "hw/pci/pci_regs.h"
+
+#define RISCV_PAGE_SIZE            4096
+
+/* VIRT_DRAM */
+#define RISCV_VIRT_RAM_ADDR        0x80000000
+#define RISCV_VIRT_RAM_SIZE        0x20000000
+
+/*
+ * VIRT_VIRTIO. BASE_ADDR  points to the last
+ * virtio_mmio device.
+ */
+#define VIRTIO_MMIO_BASE_ADDR      0x10008000
+#define VIRTIO_MMIO_SIZE           0x00001000
+
+/* VIRT_PCIE_PIO  */
+#define RISCV_GPEX_PIO_BASE        0x3000000
+#define RISCV_BUS_PIO_LIMIT        0x10000
+
+/* VIRT_PCIE_MMIO */
+#define RISCV_BUS_MMIO_ALLOC_PTR   0x40000000
+#define RISCV_BUS_MMIO_LIMIT       0x80000000
+
+/* VIRT_PCIE_ECAM */
+#define RISCV_ECAM_ALLOC_PTR   0x30000000
+
+typedef struct QVirtMachine QVirtMachine;
+
+struct QVirtMachine {
+    QOSGraphObject obj;
+    QGuestAllocator alloc;
+    QVirtioMMIODevice virtio_mmio;
+    QGenericPCIHost bridge;
+};
+
+static void virt_destructor(QOSGraphObject *obj)
+{
+    QVirtMachine *machine = (QVirtMachine *) obj;
+    alloc_destroy(&machine->alloc);
+}
+
+static void *virt_get_driver(void *object, const char *interface)
+{
+    QVirtMachine *machine = object;
+    if (!g_strcmp0(interface, "memory")) {
+        return &machine->alloc;
+    }
+
+    fprintf(stderr, "%s not present in riscv/virtio\n", interface);
+    g_assert_not_reached();
+}
+
+static QOSGraphObject *virt_get_device(void *obj, const char *device)
+{
+    QVirtMachine *machine = obj;
+    if (!g_strcmp0(device, "generic-pcihost")) {
+        return &machine->bridge.obj;
+    } else if (!g_strcmp0(device, "virtio-mmio")) {
+        return &machine->virtio_mmio.obj;
+    }
+
+    fprintf(stderr, "%s not present in riscv/virt\n", device);
+    g_assert_not_reached();
+}
+
+static void riscv_config_qpci_bus(QGenericPCIBus *qpci)
+{
+    qpci->gpex_pio_base = RISCV_GPEX_PIO_BASE;
+    qpci->bus.pio_limit = RISCV_BUS_PIO_LIMIT;
+
+    qpci->bus.mmio_alloc_ptr = RISCV_BUS_MMIO_ALLOC_PTR;
+    qpci->bus.mmio_limit = RISCV_BUS_MMIO_LIMIT;
+
+    qpci->ecam_alloc_ptr = RISCV_ECAM_ALLOC_PTR;
+}
+
+static void *qos_create_machine_riscv_virt(QTestState *qts)
+{
+    QVirtMachine *machine = g_new0(QVirtMachine, 1);
+
+    alloc_init(&machine->alloc, 0,
+               RISCV_VIRT_RAM_ADDR,
+               RISCV_VIRT_RAM_ADDR + RISCV_VIRT_RAM_SIZE,
+               RISCV_PAGE_SIZE);
+    qvirtio_mmio_init_device(&machine->virtio_mmio, qts, VIRTIO_MMIO_BASE_ADDR,
+                              VIRTIO_MMIO_SIZE);
+
+    qos_create_generic_pcihost(&machine->bridge, qts, &machine->alloc);
+    riscv_config_qpci_bus(&machine->bridge.pci);
+
+    machine->obj.get_device = virt_get_device;
+    machine->obj.get_driver = virt_get_driver;
+    machine->obj.destructor = virt_destructor;
+    return machine;
+}
+
+static void virt_machine_register_nodes(void)
+{
+    qos_node_create_machine_args("riscv32/virt", qos_create_machine_riscv_virt,
+                                 "aclint=on,aia=aplic-imsic");
+    qos_node_contains("riscv32/virt", "virtio-mmio", NULL);
+    qos_node_contains("riscv32/virt", "generic-pcihost", NULL);
+
+    qos_node_create_machine_args("riscv64/virt", qos_create_machine_riscv_virt,
+                                 "aclint=on,aia=aplic-imsic");
+    qos_node_contains("riscv64/virt", "virtio-mmio", NULL);
+    qos_node_contains("riscv64/virt", "generic-pcihost", NULL);
+}
+
+libqos_init(virt_machine_register_nodes);
diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/libqos/meson.build
+++ b/tests/qtest/libqos/meson.build
@@ -XXX,XX +XXX,XX @@ libqos_srcs = files(
         'arm-xilinx-zynq-a9-machine.c',
         'ppc64_pseries-machine.c',
         'x86_64_pc-machine.c',
+        'riscv-virt-machine.c',
 )
 
 if have_virtfs
-- 
2.44.0

From: Palmer Dabbelt <palmer@rivosinc.com>

The Ztso extension is already ratified, this adds it as a CPU property
and adds various fences throughout the port in order to allow TSO
targets to function on weaker hosts.  We need no fences for AMOs as
they're already SC, the places we need barriers are described.
These fences are placed in the RISC-V backend rather than TCG as is
planned for x86-on-arm64 because RISC-V allows heterogeneous (and
likely soon dynamic) hart memory models.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-ID: <20240207122256.902627-2-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                  |  1 +
 target/riscv/cpu.c                      |  2 ++
 target/riscv/translate.c                |  3 +++
 target/riscv/insn_trans/trans_rva.c.inc | 11 ++++++++---
 target/riscv/insn_trans/trans_rvi.c.inc | 16 ++++++++++++++--
 target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++++
 6 files changed, 48 insertions(+), 5 deletions(-)

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch exposes Ztso via hwprobe in QEMU's user space emulator.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240207122256.902627-3-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 3 +++
 1 file changed, 3 insertions(+)

From: Christoph Müllner <christoph.muellner@vrull.eu>

Running test-fcvtmod triggers the following deprecation warning:
  warning: CPU property 'Zfa' is deprecated. Please use 'zfa' instead
Let's fix that.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240229180656.1208881-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/tcg/riscv64/Makefile.target | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
 TESTS += test-fcvtmod
 test-fcvtmod: CFLAGS += -march=rv64imafdc
 test-fcvtmod: LDFLAGS += -static
-run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
+run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,zfa=true
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The idea with this update is to get the latest KVM caps for RISC-V.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240304134732.386590-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/standard-headers/drm/drm_fourcc.h     |  10 +-
 include/standard-headers/linux/ethtool.h      |  41 +++--
 .../standard-headers/linux/virtio_config.h    |   8 +-
 include/standard-headers/linux/virtio_pci.h   |  68 +++++++++
 include/standard-headers/linux/virtio_pmem.h  |   7 +
 linux-headers/asm-generic/unistd.h            |  15 +-
 linux-headers/asm-mips/mman.h                 |   2 +-
 linux-headers/asm-mips/unistd_n32.h           |   5 +
 linux-headers/asm-mips/unistd_n64.h           |   5 +
 linux-headers/asm-mips/unistd_o32.h           |   5 +
 linux-headers/asm-powerpc/unistd_32.h         |   5 +
 linux-headers/asm-powerpc/unistd_64.h         |   5 +
 linux-headers/asm-riscv/kvm.h                 |  40 +++++
 linux-headers/asm-s390/unistd_32.h            |   5 +
 linux-headers/asm-s390/unistd_64.h            |   5 +
 linux-headers/asm-x86/kvm.h                   |   3 +
 linux-headers/asm-x86/unistd_32.h             |   5 +
 linux-headers/asm-x86/unistd_64.h             |   5 +
 linux-headers/asm-x86/unistd_x32.h            |   5 +
 linux-headers/linux/iommufd.h                 |  79 ++++++++++
 linux-headers/linux/kvm.h                     | 140 +++++++-----------
 linux-headers/linux/userfaultfd.h             |  29 +++-
 linux-headers/linux/vfio.h                    |   1 +
 23 files changed, 381 insertions(+), 112 deletions(-)

diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -XXX,XX +XXX,XX @@ extern "C" {
  * Format modifiers may change any property of the buffer, including the number
  * of planes and/or the required allocation size. Format modifiers are
  * vendor-namespaced, and as such the relationship between a fourcc code and a
- * modifier is specific to the modifer being used. For example, some modifiers
+ * modifier is specific to the modifier being used. For example, some modifiers
  * may preserve meaning - such as number of planes - from the fourcc code,
  * whereas others may not.
  *
@@ -XXX,XX +XXX,XX @@ extern "C" {
  *   format.
  * - Higher-level programs interfacing with KMS/GBM/EGL/Vulkan/etc: these users
  *   see modifiers as opaque tokens they can check for equality and intersect.
- *   These users musn't need to know to reason about the modifier value
+ *   These users mustn't need to know to reason about the modifier value
  *   (i.e. they are not expected to extract information out of the modifier).
  *
  * Vendors should document their modifier usage in as much detail as
@@ -XXX,XX +XXX,XX @@ extern "C" {
  * This is a tiled layout using 4Kb tiles in row-major layout.
  * Within the tile pixels are laid out in 16 256 byte units / sub-tiles which
  * are arranged in four groups (two wide, two high) with column-major layout.
- * Each group therefore consits out of four 256 byte units, which are also laid
+ * Each group therefore consists out of four 256 byte units, which are also laid
  * out as 2x2 column-major.
  * 256 byte units are made out of four 64 byte blocks of pixels, producing
  * either a square block or a 2:1 unit.
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
  */
 
 /*
- * The top 4 bits (out of the 56 bits alloted for specifying vendor specific
+ * The top 4 bits (out of the 56 bits allotted for specifying vendor specific
  * modifiers) denote the category for modifiers. Currently we have three
  * categories of modifiers ie AFBC, MISC and AFRC. We can have a maximum of
  * sixteen different categories.
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
  * Amlogic FBC Memory Saving mode
  *
  * Indicates the storage is packed when pixel size is multiple of word
- * boudaries, i.e. 8bit should be stored in this mode to save allocation
+ * boundaries, i.e. 8bit should be stored in this mode to save allocation
  * memory.
  *
  * This mode reduces body layout to 3072 bytes per 64x32 superblock with
diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -XXX,XX +XXX,XX @@ struct ethtool_rxfh_indir {
  *	hardware hash key.
  * @hfunc: Defines the current RSS hash function used by HW (or to be set to).
  *	Valid values are one of the %ETH_RSS_HASH_*.
+ * @input_xfrm: Defines how the input data is transformed. Valid values are one
+ *	of %RXH_XFRM_*.
  * @rsvd8: Reserved for future use; see the note on reserved space.
  * @rsvd32: Reserved for future use; see the note on reserved space.
  * @rss_config: RX ring/queue index for each hash value i.e., indirection table
@@ -XXX,XX +XXX,XX @@ struct ethtool_rxfh {
 	uint32_t   indir_size;
 	uint32_t   key_size;
 	uint8_t	hfunc;
-	uint8_t	rsvd8[3];
+	uint8_t	input_xfrm;
+	uint8_t	rsvd8[2];
 	uint32_t	rsvd32;
 	uint32_t   rss_config[];
 };
@@ -XXX,XX +XXX,XX @@ static inline int ethtool_validate_duplex(uint8_t duplex)
 
 #define WOL_MODE_COUNT		8
 
+/* RSS hash function data
+ * XOR the corresponding source and destination fields of each specified
+ * protocol. Both copies of the XOR'ed fields are fed into the RSS and RXHASH
+ * calculation. Note that this XORing reduces the input set entropy and could
+ * be exploited to reduce the RSS queue spread.
+ */
+#define	RXH_XFRM_SYM_XOR	(1 << 0)
+#define	RXH_XFRM_NO_CHANGE	0xff
+
 /* L2-L4 network traffic flow types */
 #define	TCP_V4_FLOW	0x01	/* hash or spec (tcp_ip4_spec) */
 #define	UDP_V4_FLOW	0x02	/* hash or spec (udp_ip4_spec) */
@@ -XXX,XX +XXX,XX @@ enum ethtool_reset_flags {
  *	refused. For drivers: ignore this field (use kernel's
  *	__ETHTOOL_LINK_MODE_MASK_NBITS instead), any change to it will
  *	be overwritten by kernel.
- * @supported: Bitmap with each bit meaning given by
- *	%ethtool_link_mode_bit_indices for the link modes, physical
- *	connectors and other link features for which the interface
- *	supports autonegotiation or auto-detection.  Read-only.
- * @advertising: Bitmap with each bit meaning given by
- *	%ethtool_link_mode_bit_indices for the link modes, physical
- *	connectors and other link features that are advertised through
- *	autonegotiation or enabled for auto-detection.
- * @lp_advertising: Bitmap with each bit meaning given by
- *	%ethtool_link_mode_bit_indices for the link modes, and other
- *	link features that the link partner advertised through
- *	autonegotiation; 0 if unknown or not applicable.  Read-only.
  * @transceiver: Used to distinguish different possible PHY types,
  *	reported consistently by PHYLIB.  Read-only.
  * @master_slave_cfg: Master/slave port mode.
@@ -XXX,XX +XXX,XX @@ enum ethtool_reset_flags {
  * %set_link_ksettings() should validate all fields other than @cmd
  * and @link_mode_masks_nwords that are not described as read-only or
  * deprecated, and must ignore all fields described as read-only.
+ *
+ * @link_mode_masks is divided into three bitfields, each of length
+ * @link_mode_masks_nwords:
+ * - supported: Bitmap with each bit meaning given by
+ *	%ethtool_link_mode_bit_indices for the link modes, physical
+ *	connectors and other link features for which the interface
+ *	supports autonegotiation or auto-detection.  Read-only.
+ * - advertising: Bitmap with each bit meaning given by
+ *	%ethtool_link_mode_bit_indices for the link modes, physical
+ *	connectors and other link features that are advertised through
+ *	autonegotiation or enabled for auto-detection.
+ * - lp_advertising: Bitmap with each bit meaning given by
+ *	%ethtool_link_mode_bit_indices for the link modes, and other
+ *	link features that the link partner advertised through
+ *	autonegotiation; 0 if unknown or not applicable.  Read-only.
  */
 struct ethtool_link_settings {
 	uint32_t	cmd;
diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_config.h
+++ b/include/standard-headers/linux/virtio_config.h
@@ -XXX,XX +XXX,XX @@
  * rest are per-device feature bits.
  */
 #define VIRTIO_TRANSPORT_F_START	28
-#define VIRTIO_TRANSPORT_F_END		41
+#define VIRTIO_TRANSPORT_F_END		42
 
 #ifndef VIRTIO_CONFIG_NO_LEGACY
 /* Do we get callbacks when the ring is completely used, even if we've
@@ -XXX,XX +XXX,XX @@
  * This feature indicates that the driver can reset a queue individually.
  */
 #define VIRTIO_F_RING_RESET		40
+
+/*
+ * This feature indicates that the device support administration virtqueues.
+ */
+#define VIRTIO_F_ADMIN_VQ		41
+
 #endif /* _LINUX_VIRTIO_CONFIG_H */
diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_pci.h
+++ b/include/standard-headers/linux/virtio_pci.h
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_modern_common_cfg {
 
 	uint16_t queue_notify_data;	/* read-write */
 	uint16_t queue_reset;		/* read-write */
+
+	uint16_t admin_queue_index;	/* read-only */
+	uint16_t admin_queue_num;		/* read-only */
 };
 
 /* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_cfg_cap {
 #define VIRTIO_PCI_COMMON_Q_USEDHI	52
 #define VIRTIO_PCI_COMMON_Q_NDATA	56
 #define VIRTIO_PCI_COMMON_Q_RESET	58
+#define VIRTIO_PCI_COMMON_ADM_Q_IDX	60
+#define VIRTIO_PCI_COMMON_ADM_Q_NUM	62
 
 #endif /* VIRTIO_PCI_NO_MODERN */
 
+/* Admin command status. */
+#define VIRTIO_ADMIN_STATUS_OK		0
+
+/* Admin command opcode. */
+#define VIRTIO_ADMIN_CMD_LIST_QUERY	0x0
+#define VIRTIO_ADMIN_CMD_LIST_USE	0x1
+
+/* Admin command group type. */
+#define VIRTIO_ADMIN_GROUP_TYPE_SRIOV	0x1
+
+/* Transitional device admin command. */
+#define VIRTIO_ADMIN_CMD_LEGACY_COMMON_CFG_WRITE	0x2
+#define VIRTIO_ADMIN_CMD_LEGACY_COMMON_CFG_READ		0x3
+#define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_WRITE		0x4
+#define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_READ		0x5
+#define VIRTIO_ADMIN_CMD_LEGACY_NOTIFY_INFO		0x6
+
+struct QEMU_PACKED virtio_admin_cmd_hdr {
+	uint16_t opcode;
+	/*
+	 * 1 - SR-IOV
+	 * 2-65535 - reserved
+	 */
+	uint16_t group_type;
+	/* Unused, reserved for future extensions. */
+	uint8_t reserved1[12];
+	uint64_t group_member_id;
+};
+
+struct QEMU_PACKED virtio_admin_cmd_status {
+	uint16_t status;
+	uint16_t status_qualifier;
+	/* Unused, reserved for future extensions. */
+	uint8_t reserved2[4];
+};
+
+struct QEMU_PACKED virtio_admin_cmd_legacy_wr_data {
+	uint8_t offset; /* Starting offset of the register(s) to write. */
+	uint8_t reserved[7];
+	uint8_t registers[];
+};
+
+struct QEMU_PACKED virtio_admin_cmd_legacy_rd_data {
+	uint8_t offset; /* Starting offset of the register(s) to read. */
+};
+
+#define VIRTIO_ADMIN_CMD_NOTIFY_INFO_FLAGS_END 0
+#define VIRTIO_ADMIN_CMD_NOTIFY_INFO_FLAGS_OWNER_DEV 0x1
+#define VIRTIO_ADMIN_CMD_NOTIFY_INFO_FLAGS_OWNER_MEM 0x2
+
+#define VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO 4
+
+struct QEMU_PACKED virtio_admin_cmd_notify_info_data {
+	uint8_t flags; /* 0 = end of list, 1 = owner device, 2 = member device */
+	uint8_t bar; /* BAR of the member or the owner device */
+	uint8_t padding[6];
+	uint64_t offset; /* Offset within bar. */
+};
+
+struct virtio_admin_cmd_notify_info_result {
+	struct virtio_admin_cmd_notify_info_data entries[VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO];
+};
+
 #endif
diff --git a/include/standard-headers/linux/virtio_pmem.h b/include/standard-headers/linux/virtio_pmem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_pmem.h
+++ b/include/standard-headers/linux/virtio_pmem.h
@@ -XXX,XX +XXX,XX @@
 #include "standard-headers/linux/virtio_ids.h"
 #include "standard-headers/linux/virtio_config.h"
 
+/* Feature bits */
+/* guest physical address range will be indicated as shared memory region 0 */
+#define VIRTIO_PMEM_F_SHMEM_REGION 0
+
+/* shmid of the shared memory region corresponding to the pmem */
+#define VIRTIO_PMEM_SHMEM_REGION_ID 0
+
 struct virtio_pmem_config {
 	uint64_t start;
 	uint64_t size;
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_futex_wait, sys_futex_wait)
 #define __NR_futex_requeue 456
 __SYSCALL(__NR_futex_requeue, sys_futex_requeue)
 
+#define __NR_statmount   457
+__SYSCALL(__NR_statmount, sys_statmount)
+
+#define __NR_listmount   458
+__SYSCALL(__NR_listmount, sys_listmount)
+
+#define __NR_lsm_get_self_attr 459
+__SYSCALL(__NR_lsm_get_self_attr, sys_lsm_get_self_attr)
+#define __NR_lsm_set_self_attr 460
+__SYSCALL(__NR_lsm_set_self_attr, sys_lsm_set_self_attr)
+#define __NR_lsm_list_modules 461
+__SYSCALL(__NR_lsm_list_modules, sys_lsm_list_modules)
+
 #undef __NR_syscalls
-#define __NR_syscalls 457
+#define __NR_syscalls 462
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-mips/mman.h b/linux-headers/asm-mips/mman.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/mman.h
+++ b/linux-headers/asm-mips/mman.h
@@ -XXX,XX +XXX,XX @@
 #define MADV_HUGEPAGE	14		/* Worth backing with hugepages */
 #define MADV_NOHUGEPAGE 15		/* Not worth backing with hugepages */
 
-#define MADV_DONTDUMP	16		/* Explicity exclude from the core dump,
+#define MADV_DONTDUMP	16		/* Explicitly exclude from core dump,
 					   overrides the coredump filter bits */
 #define MADV_DODUMP	17		/* Clear the MADV_NODUMP flag */
 
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake (__NR_Linux + 454)
 #define __NR_futex_wait (__NR_Linux + 455)
 #define __NR_futex_requeue (__NR_Linux + 456)
+#define __NR_statmount (__NR_Linux + 457)
+#define __NR_listmount (__NR_Linux + 458)
+#define __NR_lsm_get_self_attr (__NR_Linux + 459)
+#define __NR_lsm_set_self_attr (__NR_Linux + 460)
+#define __NR_lsm_list_modules (__NR_Linux + 461)
 
 #endif /* _ASM_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake (__NR_Linux + 454)
 #define __NR_futex_wait (__NR_Linux + 455)
 #define __NR_futex_requeue (__NR_Linux + 456)
+#define __NR_statmount (__NR_Linux + 457)
+#define __NR_listmount (__NR_Linux + 458)
+#define __NR_lsm_get_self_attr (__NR_Linux + 459)
+#define __NR_lsm_set_self_attr (__NR_Linux + 460)
+#define __NR_lsm_list_modules (__NR_Linux + 461)
 
 #endif /* _ASM_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake (__NR_Linux + 454)
 #define __NR_futex_wait (__NR_Linux + 455)
 #define __NR_futex_requeue (__NR_Linux + 456)
+#define __NR_statmount (__NR_Linux + 457)
+#define __NR_listmount (__NR_Linux + 458)
+#define __NR_lsm_get_self_attr (__NR_Linux + 459)
+#define __NR_lsm_set_self_attr (__NR_Linux + 460)
+#define __NR_lsm_list_modules (__NR_Linux + 461)
 
 #endif /* _ASM_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake 454
 #define __NR_futex_wait 455
 #define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake 454
 #define __NR_futex_wait 455
 #define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_ZIHPM,
 	KVM_RISCV_ISA_EXT_SMSTATEEN,
 	KVM_RISCV_ISA_EXT_ZICOND,
+	KVM_RISCV_ISA_EXT_ZBC,
+	KVM_RISCV_ISA_EXT_ZBKB,
+	KVM_RISCV_ISA_EXT_ZBKC,
+	KVM_RISCV_ISA_EXT_ZBKX,
+	KVM_RISCV_ISA_EXT_ZKND,
+	KVM_RISCV_ISA_EXT_ZKNE,
+	KVM_RISCV_ISA_EXT_ZKNH,
+	KVM_RISCV_ISA_EXT_ZKR,
+	KVM_RISCV_ISA_EXT_ZKSED,
+	KVM_RISCV_ISA_EXT_ZKSH,
+	KVM_RISCV_ISA_EXT_ZKT,
+	KVM_RISCV_ISA_EXT_ZVBB,
+	KVM_RISCV_ISA_EXT_ZVBC,
+	KVM_RISCV_ISA_EXT_ZVKB,
+	KVM_RISCV_ISA_EXT_ZVKG,
+	KVM_RISCV_ISA_EXT_ZVKNED,
+	KVM_RISCV_ISA_EXT_ZVKNHA,
+	KVM_RISCV_ISA_EXT_ZVKNHB,
+	KVM_RISCV_ISA_EXT_ZVKSED,
+	KVM_RISCV_ISA_EXT_ZVKSH,
+	KVM_RISCV_ISA_EXT_ZVKT,
+	KVM_RISCV_ISA_EXT_ZFH,
+	KVM_RISCV_ISA_EXT_ZFHMIN,
+	KVM_RISCV_ISA_EXT_ZIHINTNTL,
+	KVM_RISCV_ISA_EXT_ZVFH,
+	KVM_RISCV_ISA_EXT_ZVFHMIN,
+	KVM_RISCV_ISA_EXT_ZFA,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 	KVM_RISCV_SBI_EXT_EXPERIMENTAL,
 	KVM_RISCV_SBI_EXT_VENDOR,
 	KVM_RISCV_SBI_EXT_DBCN,
+	KVM_RISCV_SBI_EXT_STA,
 	KVM_RISCV_SBI_EXT_MAX,
 };
 
+/* SBI STA extension registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_sbi_sta {
+	unsigned long shmem_lo;
+	unsigned long shmem_hi;
+};
+
 /* Possible states for kvm_riscv_timer */
 #define KVM_RISCV_TIMER_STATE_OFF	0
 #define KVM_RISCV_TIMER_STATE_ON	1
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 #define KVM_REG_RISCV_VECTOR_REG(n)	\
 		((n) + sizeof(struct __riscv_v_ext_state) / sizeof(unsigned long))
 
+/* Registers for specific SBI extensions are mapped as type 10 */
+#define KVM_REG_RISCV_SBI_STATE		(0x0a << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_STA		(0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_STA_REG(name)		\
+		(offsetof(struct kvm_riscv_sbi_sta, name) / sizeof(unsigned long))
+
 /* Device Control API: RISC-V AIA */
 #define KVM_DEV_RISCV_APLIC_ALIGN		0x1000
 #define KVM_DEV_RISCV_APLIC_SIZE		0x4000
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake 454
 #define __NR_futex_wait 455
 #define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake 454
 #define __NR_futex_wait 455
 #define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_pmu_event_filter {
 /* x86-specific KVM_EXIT_HYPERCALL flags. */
 #define KVM_EXIT_HYPERCALL_LONG_MODE	BIT(0)
 
+#define KVM_X86_DEFAULT_VM	0
+#define KVM_X86_SW_PROTECTED_VM	1
+
 #endif /* _ASM_X86_KVM_H */
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake 454
 #define __NR_futex_wait 455
 #define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake 454
 #define __NR_futex_wait 455
 #define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_futex_wake (__X32_SYSCALL_BIT + 454)
 #define __NR_futex_wait (__X32_SYSCALL_BIT + 455)
 #define __NR_futex_requeue (__X32_SYSCALL_BIT + 456)
+#define __NR_statmount (__X32_SYSCALL_BIT + 457)
+#define __NR_listmount (__X32_SYSCALL_BIT + 458)
+#define __NR_lsm_get_self_attr (__X32_SYSCALL_BIT + 459)
+#define __NR_lsm_set_self_attr (__X32_SYSCALL_BIT + 460)
+#define __NR_lsm_list_modules (__X32_SYSCALL_BIT + 461)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@ enum {
 	IOMMUFD_CMD_GET_HW_INFO,
 	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
 	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
+	IOMMUFD_CMD_HWPT_INVALIDATE,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_get_dirty_bitmap {
 #define IOMMU_HWPT_GET_DIRTY_BITMAP _IO(IOMMUFD_TYPE, \
 					IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP)
 
+/**
+ * enum iommu_hwpt_invalidate_data_type - IOMMU HWPT Cache Invalidation
+ *                                        Data Type
+ * @IOMMU_HWPT_INVALIDATE_DATA_VTD_S1: Invalidation data for VTD_S1
+ */
+enum iommu_hwpt_invalidate_data_type {
+	IOMMU_HWPT_INVALIDATE_DATA_VTD_S1,
+};
+
+/**
+ * enum iommu_hwpt_vtd_s1_invalidate_flags - Flags for Intel VT-d
+ *                                           stage-1 cache invalidation
+ * @IOMMU_VTD_INV_FLAGS_LEAF: Indicates whether the invalidation applies
+ *                            to all-levels page structure cache or just
+ *                            the leaf PTE cache.
+ */
+enum iommu_hwpt_vtd_s1_invalidate_flags {
+	IOMMU_VTD_INV_FLAGS_LEAF = 1 << 0,
+};
+
+/**
+ * struct iommu_hwpt_vtd_s1_invalidate - Intel VT-d cache invalidation
+ *                                       (IOMMU_HWPT_INVALIDATE_DATA_VTD_S1)
+ * @addr: The start address of the range to be invalidated. It needs to
+ *        be 4KB aligned.
+ * @npages: Number of contiguous 4K pages to be invalidated.
+ * @flags: Combination of enum iommu_hwpt_vtd_s1_invalidate_flags
+ * @__reserved: Must be 0
+ *
+ * The Intel VT-d specific invalidation data for user-managed stage-1 cache
+ * invalidation in nested translation. Userspace uses this structure to
+ * tell the impacted cache scope after modifying the stage-1 page table.
+ *
+ * Invalidating all the caches related to the page table by setting @addr
+ * to be 0 and @npages to be U64_MAX.
+ *
+ * The device TLB will be invalidated automatically if ATS is enabled.
+ */
+struct iommu_hwpt_vtd_s1_invalidate {
+	__aligned_u64 addr;
+	__aligned_u64 npages;
+	__u32 flags;
+	__u32 __reserved;
+};
+
+/**
+ * struct iommu_hwpt_invalidate - ioctl(IOMMU_HWPT_INVALIDATE)
+ * @size: sizeof(struct iommu_hwpt_invalidate)
+ * @hwpt_id: ID of a nested HWPT for cache invalidation
+ * @data_uptr: User pointer to an array of driver-specific cache invalidation
+ *             data.
+ * @data_type: One of enum iommu_hwpt_invalidate_data_type, defining the data
+ *             type of all the entries in the invalidation request array. It
+ *             should be a type supported by the hwpt pointed by @hwpt_id.
+ * @entry_len: Length (in bytes) of a request entry in the request array
+ * @entry_num: Input the number of cache invalidation requests in the array.
+ *             Output the number of requests successfully handled by kernel.
+ * @__reserved: Must be 0.
+ *
+ * Invalidate the iommu cache for user-managed page table. Modifications on a
+ * user-managed page table should be followed by this operation to sync cache.
+ * Each ioctl can support one or more cache invalidation requests in the array
+ * that has a total size of @entry_len * @entry_num.
+ *
+ * An empty invalidation request array by setting @entry_num==0 is allowed, and
+ * @entry_len and @data_uptr would be ignored in this case. This can be used to
+ * check if the given @data_type is supported or not by kernel.
+ */
+struct iommu_hwpt_invalidate {
+	__u32 size;
+	__u32 hwpt_id;
+	__aligned_u64 data_uptr;
+	__u32 data_type;
+	__u32 entry_len;
+	__u32 entry_num;
+	__u32 __reserved;
+};
+#define IOMMU_HWPT_INVALIDATE _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_INVALIDATE)
 #endif
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@
 
 #define KVM_API_VERSION 12
 
-/* *** Deprecated interfaces *** */
-
-#define KVM_TRC_SHIFT           16
-
-#define KVM_TRC_ENTRYEXIT       (1 << KVM_TRC_SHIFT)
-#define KVM_TRC_HANDLER         (1 << (KVM_TRC_SHIFT + 1))
-
-#define KVM_TRC_VMENTRY         (KVM_TRC_ENTRYEXIT + 0x01)
-#define KVM_TRC_VMEXIT          (KVM_TRC_ENTRYEXIT + 0x02)
-#define KVM_TRC_PAGE_FAULT      (KVM_TRC_HANDLER + 0x01)
-
-#define KVM_TRC_HEAD_SIZE       12
-#define KVM_TRC_CYCLE_SIZE      8
-#define KVM_TRC_EXTRA_MAX       7
-
-#define KVM_TRC_INJ_VIRQ         (KVM_TRC_HANDLER + 0x02)
-#define KVM_TRC_REDELIVER_EVT    (KVM_TRC_HANDLER + 0x03)
-#define KVM_TRC_PEND_INTR        (KVM_TRC_HANDLER + 0x04)
-#define KVM_TRC_IO_READ          (KVM_TRC_HANDLER + 0x05)
-#define KVM_TRC_IO_WRITE         (KVM_TRC_HANDLER + 0x06)
-#define KVM_TRC_CR_READ          (KVM_TRC_HANDLER + 0x07)
-#define KVM_TRC_CR_WRITE         (KVM_TRC_HANDLER + 0x08)
-#define KVM_TRC_DR_READ          (KVM_TRC_HANDLER + 0x09)
-#define KVM_TRC_DR_WRITE         (KVM_TRC_HANDLER + 0x0A)
-#define KVM_TRC_MSR_READ         (KVM_TRC_HANDLER + 0x0B)
-#define KVM_TRC_MSR_WRITE        (KVM_TRC_HANDLER + 0x0C)
-#define KVM_TRC_CPUID            (KVM_TRC_HANDLER + 0x0D)
-#define KVM_TRC_INTR             (KVM_TRC_HANDLER + 0x0E)
-#define KVM_TRC_NMI              (KVM_TRC_HANDLER + 0x0F)
-#define KVM_TRC_VMMCALL          (KVM_TRC_HANDLER + 0x10)
-#define KVM_TRC_HLT              (KVM_TRC_HANDLER + 0x11)
-#define KVM_TRC_CLTS             (KVM_TRC_HANDLER + 0x12)
-#define KVM_TRC_LMSW             (KVM_TRC_HANDLER + 0x13)
-#define KVM_TRC_APIC_ACCESS      (KVM_TRC_HANDLER + 0x14)
-#define KVM_TRC_TDP_FAULT        (KVM_TRC_HANDLER + 0x15)
-#define KVM_TRC_GTLB_WRITE       (KVM_TRC_HANDLER + 0x16)
-#define KVM_TRC_STLB_WRITE       (KVM_TRC_HANDLER + 0x17)
-#define KVM_TRC_STLB_INVAL       (KVM_TRC_HANDLER + 0x18)
-#define KVM_TRC_PPC_INSTR        (KVM_TRC_HANDLER + 0x19)
-
-struct kvm_user_trace_setup {
-	__u32 buf_size;
-	__u32 buf_nr;
-};
-
-#define __KVM_DEPRECATED_MAIN_W_0x06 \
-	_IOW(KVMIO, 0x06, struct kvm_user_trace_setup)
-#define __KVM_DEPRECATED_MAIN_0x07 _IO(KVMIO, 0x07)
-#define __KVM_DEPRECATED_MAIN_0x08 _IO(KVMIO, 0x08)
-
-#define __KVM_DEPRECATED_VM_R_0x70 _IOR(KVMIO, 0x70, struct kvm_assigned_irq)
-
-struct kvm_breakpoint {
-	__u32 enabled;
-	__u32 padding;
-	__u64 address;
-};
-
-struct kvm_debug_guest {
-	__u32 enabled;
-	__u32 pad;
-	struct kvm_breakpoint breakpoints[4];
-	__u32 singlestep;
-};
-
-#define __KVM_DEPRECATED_VCPU_W_0x87 _IOW(KVMIO, 0x87, struct kvm_debug_guest)
-
-/* *** End of deprecated interfaces *** */
-
-
 /* for KVM_SET_USER_MEMORY_REGION */
 struct kvm_userspace_memory_region {
 	__u32 slot;
@@ -XXX,XX +XXX,XX @@ struct kvm_userspace_memory_region {
 	__u64 userspace_addr; /* start of the userspace allocated memory */
 };
 
+/* for KVM_SET_USER_MEMORY_REGION2 */
+struct kvm_userspace_memory_region2 {
+	__u32 slot;
+	__u32 flags;
+	__u64 guest_phys_addr;
+	__u64 memory_size;
+	__u64 userspace_addr;
+	__u64 guest_memfd_offset;
+	__u32 guest_memfd;
+	__u32 pad1;
+	__u64 pad2[14];
+};
+
 /*
  * The bit 0 ~ bit 15 of kvm_userspace_memory_region::flags are visible for
  * userspace, other bits are reserved for kvm internal use which are defined
@@ -XXX,XX +XXX,XX @@ struct kvm_userspace_memory_region {
  */
 #define KVM_MEM_LOG_DIRTY_PAGES	(1UL << 0)
 #define KVM_MEM_READONLY	(1UL << 1)
+#define KVM_MEM_GUEST_MEMFD	(1UL << 2)
 
 /* for KVM_IRQ_LINE */
 struct kvm_irq_level {
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
 #define KVM_EXIT_RISCV_CSR        36
 #define KVM_EXIT_NOTIFY           37
 #define KVM_EXIT_LOONGARCH_IOCSR  38
+#define KVM_EXIT_MEMORY_FAULT     39
 
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
@@ -XXX,XX +XXX,XX @@ struct kvm_run {
 #define KVM_NOTIFY_CONTEXT_INVALID	(1 << 0)
 			__u32 flags;
 		} notify;
+		/* KVM_EXIT_MEMORY_FAULT */
+		struct {
+#define KVM_MEMORY_EXIT_FLAG_PRIVATE	(1ULL << 3)
+			__u64 flags;
+			__u64 gpa;
+			__u64 size;
+		} memory_fault;
 		/* Fix the size of the union. */
 		char padding[256];
 	};
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
  */
 #define KVM_GET_VCPU_MMAP_SIZE    _IO(KVMIO,   0x04) /* in bytes */
 #define KVM_GET_SUPPORTED_CPUID   _IOWR(KVMIO, 0x05, struct kvm_cpuid2)
-#define KVM_TRACE_ENABLE          __KVM_DEPRECATED_MAIN_W_0x06
-#define KVM_TRACE_PAUSE           __KVM_DEPRECATED_MAIN_0x07
-#define KVM_TRACE_DISABLE         __KVM_DEPRECATED_MAIN_0x08
 #define KVM_GET_EMULATED_CPUID	  _IOWR(KVMIO, 0x09, struct kvm_cpuid2)
 #define KVM_GET_MSR_FEATURE_INDEX_LIST    _IOWR(KVMIO, 0x0a, struct kvm_msr_list)
 
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
 #define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
 #define KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES 230
+#define KVM_CAP_USER_MEMORY2 231
+#define KVM_CAP_MEMORY_FAULT_INFO 232
+#define KVM_CAP_MEMORY_ATTRIBUTES 233
+#define KVM_CAP_GUEST_MEMFD 234
+#define KVM_CAP_VM_TYPES 235
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -XXX,XX +XXX,XX @@ struct kvm_x86_mce {
 #define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL	(1 << 4)
 #define KVM_XEN_HVM_CONFIG_EVTCHN_SEND		(1 << 5)
 #define KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG	(1 << 6)
+#define KVM_XEN_HVM_CONFIG_PVCLOCK_TSC_UNSTABLE	(1 << 7)
 
 struct kvm_xen_hvm_config {
 	__u32 flags;
@@ -XXX,XX +XXX,XX @@ struct kvm_vfio_spapr_tce {
 					struct kvm_userspace_memory_region)
 #define KVM_SET_TSS_ADDR          _IO(KVMIO,   0x47)
 #define KVM_SET_IDENTITY_MAP_ADDR _IOW(KVMIO,  0x48, __u64)
+#define KVM_SET_USER_MEMORY_REGION2 _IOW(KVMIO, 0x49, \
+					 struct kvm_userspace_memory_region2)
 
 /* enable ucontrol for s390 */
 struct kvm_s390_ucas_mapping {
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
 			_IOW(KVMIO,  0x67, struct kvm_coalesced_mmio_zone)
 #define KVM_UNREGISTER_COALESCED_MMIO \
 			_IOW(KVMIO,  0x68, struct kvm_coalesced_mmio_zone)
-#define KVM_ASSIGN_PCI_DEVICE     _IOR(KVMIO,  0x69, \
-				       struct kvm_assigned_pci_dev)
 #define KVM_SET_GSI_ROUTING       _IOW(KVMIO,  0x6a, struct kvm_irq_routing)
-/* deprecated, replaced by KVM_ASSIGN_DEV_IRQ */
-#define KVM_ASSIGN_IRQ            __KVM_DEPRECATED_VM_R_0x70
-#define KVM_ASSIGN_DEV_IRQ        _IOW(KVMIO,  0x70, struct kvm_assigned_irq)
 #define KVM_REINJECT_CONTROL      _IO(KVMIO,   0x71)
-#define KVM_DEASSIGN_PCI_DEVICE   _IOW(KVMIO,  0x72, \
-				       struct kvm_assigned_pci_dev)
-#define KVM_ASSIGN_SET_MSIX_NR    _IOW(KVMIO,  0x73, \
-				       struct kvm_assigned_msix_nr)
-#define KVM_ASSIGN_SET_MSIX_ENTRY _IOW(KVMIO,  0x74, \
-				       struct kvm_assigned_msix_entry)
-#define KVM_DEASSIGN_DEV_IRQ      _IOW(KVMIO,  0x75, struct kvm_assigned_irq)
 #define KVM_IRQFD                 _IOW(KVMIO,  0x76, struct kvm_irqfd)
 #define KVM_CREATE_PIT2		  _IOW(KVMIO,  0x77, struct kvm_pit_config)
 #define KVM_SET_BOOT_CPU_ID       _IO(KVMIO,   0x78)
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
 *  KVM_CAP_VM_TSC_CONTROL to set defaults for a VM */
 #define KVM_SET_TSC_KHZ           _IO(KVMIO,  0xa2)
 #define KVM_GET_TSC_KHZ           _IO(KVMIO,  0xa3)
-/* Available with KVM_CAP_PCI_2_3 */
-#define KVM_ASSIGN_SET_INTX_MASK  _IOW(KVMIO,  0xa4, \
-				       struct kvm_assigned_pci_dev)
 /* Available with KVM_CAP_SIGNAL_MSI */
 #define KVM_SIGNAL_MSI            _IOW(KVMIO,  0xa5, struct kvm_msi)
 /* Available with KVM_CAP_PPC_GET_SMMU_INFO */
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
 #define KVM_SET_SREGS             _IOW(KVMIO,  0x84, struct kvm_sregs)
 #define KVM_TRANSLATE             _IOWR(KVMIO, 0x85, struct kvm_translation)
 #define KVM_INTERRUPT             _IOW(KVMIO,  0x86, struct kvm_interrupt)
-/* KVM_DEBUG_GUEST is no longer supported, use KVM_SET_GUEST_DEBUG instead */
-#define KVM_DEBUG_GUEST           __KVM_DEPRECATED_VCPU_W_0x87
 #define KVM_GET_MSRS              _IOWR(KVMIO, 0x88, struct kvm_msrs)
 #define KVM_SET_MSRS              _IOW(KVMIO,  0x89, struct kvm_msrs)
 #define KVM_SET_CPUID             _IOW(KVMIO,  0x8a, struct kvm_cpuid)
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_zpci_op {
 /* flags for kvm_s390_zpci_op->u.reg_aen.flags */
 #define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
 
+/* Available with KVM_CAP_MEMORY_ATTRIBUTES */
+#define KVM_SET_MEMORY_ATTRIBUTES              _IOW(KVMIO,  0xd2, struct kvm_memory_attributes)
+
+struct kvm_memory_attributes {
+	__u64 address;
+	__u64 size;
+	__u64 attributes;
+	__u64 flags;
+};
+
+#define KVM_MEMORY_ATTRIBUTE_PRIVATE           (1ULL << 3)
+
+#define KVM_CREATE_GUEST_MEMFD	_IOWR(KVMIO,  0xd4, struct kvm_create_guest_memfd)
+
+struct kvm_create_guest_memfd {
+	__u64 size;
+	__u64 flags;
+	__u64 reserved[6];
+};
+
 #endif /* __LINUX_KVM_H */
diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/userfaultfd.h
+++ b/linux-headers/linux/userfaultfd.h
@@ -XXX,XX +XXX,XX @@
 			   UFFD_FEATURE_WP_HUGETLBFS_SHMEM |	\
 			   UFFD_FEATURE_WP_UNPOPULATED |	\
 			   UFFD_FEATURE_POISON |		\
-			   UFFD_FEATURE_WP_ASYNC)
+			   UFFD_FEATURE_WP_ASYNC |		\
+			   UFFD_FEATURE_MOVE)
 #define UFFD_API_IOCTLS				\
 	((__u64)1 << _UFFDIO_REGISTER |		\
 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
@@ -XXX,XX +XXX,XX @@
 	((__u64)1 << _UFFDIO_WAKE |		\
 	 (__u64)1 << _UFFDIO_COPY |		\
 	 (__u64)1 << _UFFDIO_ZEROPAGE |		\
+	 (__u64)1 << _UFFDIO_MOVE |		\
 	 (__u64)1 << _UFFDIO_WRITEPROTECT |	\
 	 (__u64)1 << _UFFDIO_CONTINUE |		\
 	 (__u64)1 << _UFFDIO_POISON)
@@ -XXX,XX +XXX,XX @@
 #define _UFFDIO_WAKE			(0x02)
 #define _UFFDIO_COPY			(0x03)
 #define _UFFDIO_ZEROPAGE		(0x04)
+#define _UFFDIO_MOVE			(0x05)
 #define _UFFDIO_WRITEPROTECT		(0x06)
 #define _UFFDIO_CONTINUE		(0x07)
 #define _UFFDIO_POISON			(0x08)
@@ -XXX,XX +XXX,XX @@
 				      struct uffdio_copy)
 #define UFFDIO_ZEROPAGE		_IOWR(UFFDIO, _UFFDIO_ZEROPAGE,	\
 				      struct uffdio_zeropage)
+#define UFFDIO_MOVE		_IOWR(UFFDIO, _UFFDIO_MOVE,	\
+				      struct uffdio_move)
 #define UFFDIO_WRITEPROTECT	_IOWR(UFFDIO, _UFFDIO_WRITEPROTECT, \
 				      struct uffdio_writeprotect)
 #define UFFDIO_CONTINUE		_IOWR(UFFDIO, _UFFDIO_CONTINUE,	\
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
 	 * asynchronous mode is supported in which the write fault is
 	 * automatically resolved and write-protection is un-set.
 	 * It implies UFFD_FEATURE_WP_UNPOPULATED.
+	 *
+	 * UFFD_FEATURE_MOVE indicates that the kernel supports moving an
+	 * existing page contents from userspace.
 	 */
 #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
 #define UFFD_FEATURE_EVENT_FORK			(1<<1)
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
 #define UFFD_FEATURE_WP_UNPOPULATED		(1<<13)
 #define UFFD_FEATURE_POISON			(1<<14)
 #define UFFD_FEATURE_WP_ASYNC			(1<<15)
+#define UFFD_FEATURE_MOVE			(1<<16)
 	__u64 features;
 
 	__u64 ioctls;
@@ -XXX,XX +XXX,XX @@ struct uffdio_poison {
 	__s64 updated;
 };
 
+struct uffdio_move {
+	__u64 dst;
+	__u64 src;
+	__u64 len;
+	/*
+	 * Especially if used to atomically remove memory from the
+	 * address space the wake on the dst range is not needed.
+	 */
+#define UFFDIO_MOVE_MODE_DONTWAKE		((__u64)1<<0)
+#define UFFDIO_MOVE_MODE_ALLOW_SRC_HOLES	((__u64)1<<1)
+	__u64 mode;
+	/*
+	 * "move" is written by the ioctl and must be at the end: the
+	 * copy_from_user will not read the last 8 bytes.
+	 */
+	__s64 move;
+};
+
 /*
  * Flags for the userfaultfd(2) system call itself.
  */
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ enum vfio_device_mig_state {
 	VFIO_DEVICE_STATE_RUNNING_P2P = 5,
 	VFIO_DEVICE_STATE_PRE_COPY = 6,
 	VFIO_DEVICE_STATE_PRE_COPY_P2P = 7,
+	VFIO_DEVICE_STATE_NR,
 };
 
 /**
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The last KVM extensions added were back in 6.6. Sync them to Linux 6.8.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240304134732.386590-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("zicbom", ext_zicbom, KVM_RISCV_ISA_EXT_ZICBOM),
     KVM_EXT_CFG("zicboz", ext_zicboz, KVM_RISCV_ISA_EXT_ZICBOZ),
     KVM_EXT_CFG("zicntr", ext_zicntr, KVM_RISCV_ISA_EXT_ZICNTR),
+    KVM_EXT_CFG("zicond", ext_zicond, KVM_RISCV_ISA_EXT_ZICOND),
     KVM_EXT_CFG("zicsr", ext_zicsr, KVM_RISCV_ISA_EXT_ZICSR),
     KVM_EXT_CFG("zifencei", ext_zifencei, KVM_RISCV_ISA_EXT_ZIFENCEI),
+    KVM_EXT_CFG("zihintntl", ext_zihintntl, KVM_RISCV_ISA_EXT_ZIHINTNTL),
     KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
     KVM_EXT_CFG("zihpm", ext_zihpm, KVM_RISCV_ISA_EXT_ZIHPM),
+    KVM_EXT_CFG("zfa", ext_zfa, KVM_RISCV_ISA_EXT_ZFA),
+    KVM_EXT_CFG("zfh", ext_zfh, KVM_RISCV_ISA_EXT_ZFH),
+    KVM_EXT_CFG("zfhmin", ext_zfhmin, KVM_RISCV_ISA_EXT_ZFHMIN),
     KVM_EXT_CFG("zba", ext_zba, KVM_RISCV_ISA_EXT_ZBA),
     KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
+    KVM_EXT_CFG("zbc", ext_zbc, KVM_RISCV_ISA_EXT_ZBC),
+    KVM_EXT_CFG("zbkb", ext_zbkb, KVM_RISCV_ISA_EXT_ZBKB),
+    KVM_EXT_CFG("zbkc", ext_zbkc, KVM_RISCV_ISA_EXT_ZBKC),
+    KVM_EXT_CFG("zbkx", ext_zbkx, KVM_RISCV_ISA_EXT_ZBKX),
     KVM_EXT_CFG("zbs", ext_zbs, KVM_RISCV_ISA_EXT_ZBS),
+    KVM_EXT_CFG("zknd", ext_zknd, KVM_RISCV_ISA_EXT_ZKND),
+    KVM_EXT_CFG("zkne", ext_zkne, KVM_RISCV_ISA_EXT_ZKNE),
+    KVM_EXT_CFG("zknh", ext_zknh, KVM_RISCV_ISA_EXT_ZKNH),
+    KVM_EXT_CFG("zkr", ext_zkr, KVM_RISCV_ISA_EXT_ZKR),
+    KVM_EXT_CFG("zksed", ext_zksed, KVM_RISCV_ISA_EXT_ZKSED),
+    KVM_EXT_CFG("zksh", ext_zksh, KVM_RISCV_ISA_EXT_ZKSH),
+    KVM_EXT_CFG("zkt", ext_zkt, KVM_RISCV_ISA_EXT_ZKT),
+    KVM_EXT_CFG("zvbb", ext_zvbb, KVM_RISCV_ISA_EXT_ZVBB),
+    KVM_EXT_CFG("zvbc", ext_zvbc, KVM_RISCV_ISA_EXT_ZVBC),
+    KVM_EXT_CFG("zvfh", ext_zvfh, KVM_RISCV_ISA_EXT_ZVFH),
+    KVM_EXT_CFG("zvfhmin", ext_zvfhmin, KVM_RISCV_ISA_EXT_ZVFHMIN),
+    KVM_EXT_CFG("zvkb", ext_zvkb, KVM_RISCV_ISA_EXT_ZVKB),
+    KVM_EXT_CFG("zvkg", ext_zvkg, KVM_RISCV_ISA_EXT_ZVKG),
+    KVM_EXT_CFG("zvkned", ext_zvkned, KVM_RISCV_ISA_EXT_ZVKNED),
+    KVM_EXT_CFG("zvknha", ext_zvknha, KVM_RISCV_ISA_EXT_ZVKNHA),
+    KVM_EXT_CFG("zvknhb", ext_zvknhb, KVM_RISCV_ISA_EXT_ZVKNHB),
+    KVM_EXT_CFG("zvksed", ext_zvksed, KVM_RISCV_ISA_EXT_ZVKSED),
+    KVM_EXT_CFG("zvksh", ext_zvksh, KVM_RISCV_ISA_EXT_ZVKSH),
+    KVM_EXT_CFG("zvkt", ext_zvkt, KVM_RISCV_ISA_EXT_ZVKT),
+    KVM_EXT_CFG("smstateen", ext_smstateen, KVM_RISCV_ISA_EXT_SMSTATEEN),
     KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
     KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
     KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

smaia and ssaia were ratified in August 25th 2023 [1].

zvfh and zvfhmin were ratified in August 2nd 2023 [2].

zfbfmin and zvfbf(min|wma) are frozen and moved to public review since
Dec 16th 2023 [3].

zaamo and zalrsc are both marked as "Frozen" since January 24th 2024
[4].

[1] https://jira.riscv.org/browse/RVS-438
[2] https://jira.riscv.org/browse/RVS-871
[3] https://jira.riscv.org/browse/RVS-704
[4] https://jira.riscv.org/browse/RVS-1995

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240301144053.265964-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
     MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
     MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
+    MULTI_EXT_CFG_BOOL("zaamo", ext_zaamo, false),
+    MULTI_EXT_CFG_BOOL("zalrsc", ext_zalrsc, false),
     MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
     MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
+    MULTI_EXT_CFG_BOOL("zfbfmin", ext_zfbfmin, false),
     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
+    MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
+    MULTI_EXT_CFG_BOOL("zvfbfwma", ext_zvfbfwma, false),
+    MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
+    MULTI_EXT_CFG_BOOL("zvfhmin", ext_zvfhmin, false),
     MULTI_EXT_CFG_BOOL("sstc", ext_sstc, true),
 
+    MULTI_EXT_CFG_BOOL("smaia", ext_smaia, false),
     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
+    MULTI_EXT_CFG_BOOL("ssaia", ext_ssaia, false),
     MULTI_EXT_CFG_BOOL("svade", ext_svade, false),
     MULTI_EXT_CFG_BOOL("svadu", ext_svadu, true),
     MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[] = {
 
 /* These are experimental so mark with 'x-' */
 const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
-    MULTI_EXT_CFG_BOOL("x-smaia", ext_smaia, false),
-    MULTI_EXT_CFG_BOOL("x-ssaia", ext_ssaia, false),
-
-    MULTI_EXT_CFG_BOOL("x-zaamo", ext_zaamo, false),
-    MULTI_EXT_CFG_BOOL("x-zalrsc", ext_zalrsc, false),
-
-    MULTI_EXT_CFG_BOOL("x-zvfh", ext_zvfh, false),
-    MULTI_EXT_CFG_BOOL("x-zvfhmin", ext_zvfhmin, false),
-
-    MULTI_EXT_CFG_BOOL("x-zfbfmin", ext_zfbfmin, false),
-    MULTI_EXT_CFG_BOOL("x-zvfbfmin", ext_zvfbfmin, false),
-    MULTI_EXT_CFG_BOOL("x-zvfbfwma", ext_zvfbfwma, false),
-
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.44.0

From: Vadim Shakirov <vadim.shakirov@syntacore.com>

mcountinhibit, mcounteren, scounteren and hcounteren must always be 32-bit
by privileged spec

Signed-off-by: Vadim Shakirov <vadim.shakirov@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20240202113919.18236-1-vadim.shakirov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h     |  8 ++++----
 target/riscv/machine.c | 16 ++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     target_ulong hstatus;
     target_ulong hedeleg;
     uint64_t hideleg;
-    target_ulong hcounteren;
+    uint32_t hcounteren;
     target_ulong htval;
     target_ulong htinst;
     target_ulong hgatp;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      */
     bool two_stage_indirect_lookup;
 
-    target_ulong scounteren;
-    target_ulong mcounteren;
+    uint32_t scounteren;
+    uint32_t mcounteren;
 
-    target_ulong mcountinhibit;
+    uint32_t mcountinhibit;
 
     /* PMU counter state */
     PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static bool hyper_needed(void *opaque)
 
 static const VMStateDescription vmstate_hyper = {
     .name = "cpu/hyper",
-    .version_id = 3,
-    .minimum_version_id = 3,
+    .version_id = 4,
+    .minimum_version_id = 4,
     .needed = hyper_needed,
     .fields = (const VMStateField[]) {
         VMSTATE_UINTTL(env.hstatus, RISCVCPU),
         VMSTATE_UINTTL(env.hedeleg, RISCVCPU),
         VMSTATE_UINT64(env.hideleg, RISCVCPU),
-        VMSTATE_UINTTL(env.hcounteren, RISCVCPU),
+        VMSTATE_UINT32(env.hcounteren, RISCVCPU),
         VMSTATE_UINTTL(env.htval, RISCVCPU),
         VMSTATE_UINTTL(env.htinst, RISCVCPU),
         VMSTATE_UINTTL(env.hgatp, RISCVCPU),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_jvt = {
 
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
-    .version_id = 9,
-    .minimum_version_id = 9,
+    .version_id = 10,
+    .minimum_version_id = 10,
     .post_load = riscv_cpu_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_UINTTL(env.mtval, RISCVCPU),
         VMSTATE_UINTTL(env.miselect, RISCVCPU),
         VMSTATE_UINTTL(env.siselect, RISCVCPU),
-        VMSTATE_UINTTL(env.scounteren, RISCVCPU),
-        VMSTATE_UINTTL(env.mcounteren, RISCVCPU),
-        VMSTATE_UINTTL(env.mcountinhibit, RISCVCPU),
+        VMSTATE_UINT32(env.scounteren, RISCVCPU),
+        VMSTATE_UINT32(env.mcounteren, RISCVCPU),
+        VMSTATE_UINT32(env.mcountinhibit, RISCVCPU),
         VMSTATE_STRUCT_ARRAY(env.pmu_ctrs, RISCVCPU, RV_MAX_MHPMCOUNTERS, 0,
                              vmstate_pmu_ctr_state, PMUCTRState),
         VMSTATE_UINTTL_ARRAY(env.mhpmevent_val, RISCVCPU, RV_MAX_MHPMEVENTS),
-- 
2.44.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

While discussing a problem with how we're (not) setting vstart_eq_zero
Richard had the following to say w.r.t the conditional mark_vs_dirty()
calls on load/store functions [1]:

"I think it's required to have stores set dirty unconditionally, before
the operation.

Consider a store that traps on the 2nd element, leaving vstart = 2, and
exiting to the main loop via exception. The exception enters the kernel
page fault handler. The kernel may need to fault in the page for the
process, and in the meantime task switch.

If vs dirty is not already set, the kernel won't know to save vector
state on task switch."

Do a mark_vs_dirty() before both loads and stores.

[1] https://lore.kernel.org/qemu-riscv/72c7503b-0f43-44b8-aa82-fbafed2aac0c@linaro.org/

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240306171932.549549-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

After the 'mark_vs_dirty' changes from the previous patch the 'is_store'
bool is unused in some load/store functions that were changed. Remove it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240306171932.549549-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 58 ++++++++++++-------------
 1 file changed, 29 insertions(+), 29 deletions(-)

From: "demin.han" <demin.han@starfivetech.com>

The result of (8 - 3 - vlmul) is negative when vlmul >= 6,
and results in wrong vill.

Signed-off-by: demin.han <demin.han@starfivetech.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240225174114.5298-1-demin.han@starfivetech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     target_ulong reserved = s2 &
                             MAKE_64BIT_MASK(R_VTYPE_RESERVED_SHIFT,
                                             xlen - 1 - R_VTYPE_RESERVED_SHIFT);
+    uint16_t vlen = cpu->cfg.vlenb << 3;
     int8_t lmul;
 
     if (vlmul & 4) {
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
          * VLEN * LMUL >= SEW
          * VLEN >> (8 - lmul) >= sew
          * (vlenb << 3) >> (8 - lmul) >= sew
-         * vlenb >> (8 - 3 - lmul) >= sew
          */
-        if (vlmul == 4 ||
-            cpu->cfg.vlenb >> (8 - 3 - vlmul) < sew) {
+        if (vlmul == 4 || (vlen >> (8 - vlmul)) < sew) {
             vill = true;
         }
     }
-- 
2.44.0

From: Anup Patel <apatel@ventanamicro.com>

The writes to setipnum_le register in APLIC MSI-mode have special
consideration for level-triggered interrupts as-per section "4.9.2
Special consideration for level-sensitive interrupt sources" of the
RISC-V AIA specification.

Particularly, the below text from the RISC-V specification defines
the behaviour of writes to setipnum_le for level-triggered interrupts:

"A second option is for the interrupt service routine to write the
APLIC’s source identity number for the interrupt to the domain’s
setipnum register just before exiting. This will cause the interrupt’s
pending bit to be set to one again if the source is still asserting
an interrupt, but not if the source is not asserting an interrupt."

Fix setipnum_le write emulation for APLIC MSI-mode by implementing
the above behaviour in riscv_aplic_set_pending() function.

Fixes: e8f79343cfc8 ("hw/intc: Add RISC-V AIA APLIC device emulation")
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240306095722.463296-2-apatel@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
     }
 
     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
-    if ((sm == APLIC_SOURCECFG_SM_INACTIVE) ||
-        ((!aplic->msimode || (aplic->msimode && !pending)) &&
-         ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
-          (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)))) {
+    if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
         return;
     }
 
+    if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
+        (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
+        if (!aplic->msimode || (aplic->msimode && !pending)) {
+            return;
+        }
+        if ((aplic->state[irq] & APLIC_ISTATE_INPUT) &&
+            (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
+            return;
+        }
+        if (!(aplic->state[irq] & APLIC_ISTATE_INPUT) &&
+            (sm == APLIC_SOURCECFG_SM_LEVEL_HIGH)) {
+            return;
+        }
+    }
+
     riscv_aplic_set_pending_raw(aplic, irq, pending);
 }
 
-- 
2.44.0

From: Anup Patel <apatel@ventanamicro.com>

The reads to in_clrip[x] registers return rectified input values of the
interrupt sources.

A rectified input value of an interrupt source is defined by the section
"4.5.2 Source configurations (sourcecfg[1]–sourcecfg[1023])" of the RISC-V
AIA specification as:
"rectified input value = (incoming wire value) XOR (source is inverted)"

Update the riscv_aplic_read_input_word() implementation to match the above.

Fixes: e8f79343cfc8 ("hw/intc: Add RISC-V AIA APLIC device emulation")
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240306095722.463296-3-apatel@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ static bool is_kvm_aia(bool msimode)
 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                             uint32_t word)
 {
-    uint32_t i, irq, ret = 0;
+    uint32_t i, irq, sourcecfg, sm, raw_input, irq_inverted, ret = 0;
 
     for (i = 0; i < 32; i++) {
         irq = word * 32 + i;
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
             continue;
         }
 
-        ret |= ((aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0) << i;
+        sourcecfg = aplic->sourcecfg[irq];
+        if (sourcecfg & APLIC_SOURCECFG_D) {
+            continue;
+        }
+
+        sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
+        if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
+            continue;
+        }
+
+        raw_input = (aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0;
+        irq_inverted = (sm == APLIC_SOURCECFG_SM_LEVEL_LOW ||
+                        sm == APLIC_SOURCECFG_SM_EDGE_FALL) ? 1 : 0;
+        ret |= (raw_input ^ irq_inverted) << i;
     }
 
     return ret;
-- 
2.44.0

From: Hiroaki Yamamoto <hrak1529@gmail.com>

G-stage translation should be considered to be user-level access in
riscv_cpu_get_phys_page_debug(), as already done in riscv_cpu_tlb_fill().

This fixes a bug that prevents gdb from reading memory while the VM is
running in VS-mode.

Signed-off-by: Hiroaki Yamamoto <hrak1529@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240228081028.35081-1-hrak1529@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 
     if (env->virt_enabled) {
         if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
-                                 0, mmu_idx, false, true, true)) {
+                                 0, MMUIdx_U, false, true, true)) {
             return -1;
         }
     }
-- 
2.44.0

From: Ilya Chugin <danger_mail@list.ru>

MCFG segments should point to PCI configuration range, not BAR MMIO.

Signed-off-by: Ilya Chugin <danger_mail@list.ru>
Fixes: 55ecd83b36 ("hw/riscv/virt-acpi-build.c: Add IO controllers and devices")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Message-ID: <180d236d-c8e4-411a-b4d2-632eb82092fa@list.ru>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
     acpi_add_table(table_offsets, tables_blob);
     {
         AcpiMcfgInfo mcfg = {
-           .base = s->memmap[VIRT_PCIE_MMIO].base,
-           .size = s->memmap[VIRT_PCIE_MMIO].size,
+           .base = s->memmap[VIRT_PCIE_ECAM].base,
+           .size = s->memmap[VIRT_PCIE_ECAM].size,
         };
         build_mcfg(tables_blob, tables->linker, &mcfg, s->oem_id,
                    s->oem_table_id);
-- 
2.44.0

The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911

for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:

target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)

----------------------------------------------------------------
First RISC-V PR for 8.2

* Remove 'host' CPU from TCG
 * riscv_htif Fixup printing on big endian hosts
 * Add zmmul isa string
 * Add smepmp isa string
 * Fix page_check_range use in fault-only-first
 * Use existing lookup tables for MixColumns
 * Add RISC-V vector cryptographic instruction set support
 * Implement WARL behaviour for mcountinhibit/mcounteren
 * Add Zihintntl extension ISA string to DTS
 * Fix zfa fleq.d and fltq.d
 * Fix upper/lower mtime write calculation
 * Make rtc variable names consistent
 * Use abi type for linux-user target_ucontext
 * Add RISC-V KVM AIA Support
 * Fix riscv,pmu DT node path in the virt machine
 * Update CSR bits name for svadu extension
 * Mark zicond non-experimental
 * Fix satp_mode_finalize() when satp_mode.supported = 0
 * Fix non-KVM --enable-debug build
 * Add new extensions to hwprobe
 * Use accelerated helper for AES64KS1I
 * Allocate itrigger timers only once
 * Respect mseccfg.RLB for pmpaddrX changes
 * Align the AIA model to v1.0 ratified spec
 * Don't read the CSR in riscv_csrrw_do64

----------------------------------------------------------------
Akihiko Odaki (1):
      target/riscv: Allocate itrigger timers only once

Ard Biesheuvel (2):
      target/riscv: Use existing lookup tables for MixColumns
      target/riscv: Use accelerated helper for AES64KS1I

Conor Dooley (1):
      hw/riscv: virt: Fix riscv,pmu DT node path

Daniel Henrique Barboza (6):
      target/riscv/cpu.c: do not run 'host' CPU with TCG
      target/riscv/cpu.c: add zmmul isa string
      target/riscv/cpu.c: add smepmp isa string
      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
      hw/riscv/virt.c: fix non-KVM --enable-debug build
      hw/intc/riscv_aplic.c fix non-KVM --enable-debug build

Dickon Hood (2):
      target/riscv: Refactor translation of vector-widening instruction
      target/riscv: Add Zvbb ISA extension support

Jason Chien (3):
      target/riscv: Add Zihintntl extension ISA string to DTS
      hw/intc: Fix upper/lower mtime write calculation
      hw/intc: Make rtc variable names consistent

Kiran Ostrolenk (4):
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Refactor vector-vector translation macro
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Add Zvknh ISA extension support

LIU Zhiwei (3):
      target/riscv: Fix page_check_range use in fault-only-first
      target/riscv: Fix zfa fleq.d and fltq.d
      linux-user/riscv: Use abi type for target_ucontext

Lawrence Hunter (2):
      target/riscv: Add Zvbc ISA extension support
      target/riscv: Add Zvksh ISA extension support

Leon Schuermann (1):
      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes

Max Chou (3):
      crypto: Create sm4_subword
      crypto: Add SM4 constant parameter CK
      target/riscv: Add Zvksed ISA extension support

Nazar Kazakov (4):
      target/riscv: Remove redundant "cpu_vl == 0" checks
      target/riscv: Move vector translation checks
      target/riscv: Add Zvkned ISA extension support
      target/riscv: Add Zvkg ISA extension support

Nikita Shubin (1):
      target/riscv: don't read CSR in riscv_csrrw_do64

Rob Bradford (1):
      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren

Robbin Ehn (1):
      linux-user/riscv: Add new extensions to hwprobe

Thomas Huth (2):
      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
      hw/char/riscv_htif: Fix the console syscall on big endian hosts

Tommy Wu (1):
      target/riscv: Align the AIA model to v1.0 ratified spec

Vineet Gupta (1):
      riscv: zicond: make non-experimental

Weiwei Li (1):
      target/riscv: Update CSR bits name for svadu extension

Yong-Xuan Wang (5):
      target/riscv: support the AIA device emulation with KVM enabled
      target/riscv: check the in-kernel irqchip support
      target/riscv: Create an KVM AIA irqchip
      target/riscv: update APLIC and IMSIC to support KVM AIA
      target/riscv: select KVM AIA in riscv virt machine

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The 'host' CPU is available in a CONFIG_KVM build and it's currently
available for all accels, but is a KVM only CPU. This means that in a
RISC-V KVM capable host we can do things like this:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: H extension requires priv spec 1.12.0

This CPU does not have a priv spec because we don't filter its extensions
via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
with the 'host' CPU.

We don't have a way to filter the 'host' CPU out of the available CPU
options (-cpu help) if the build includes both KVM and TCG. What we can
do is to error out during riscv_cpu_realize_tcg() if the user chooses
the 'host' CPU with accel=tcg:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
+    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
+        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
+        return;
+    }
+
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

The character that should be printed is stored in the 64 bit "payload"
variable. The code currently tries to print it by taking the address
of the variable and passing this pointer to qemu_chr_fe_write(). However,
this only works on little endian hosts where the least significant bits
are stored on the lowest address. To do this in a portable way, we have
to store the value in an uint8_t variable instead.

Fixes: 5033606780 ("RISC-V HTIF Console")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721094720.902454-2-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             s->tohost = 0; /* clear to indicate we read */
             return;
         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
+            uint8_t ch = (uint8_t)payload;
+            qemu_chr_fe_write(&s->chr, &ch, 1);
             resp = 0x100 | (uint8_t)payload;
         } else {
             qemu_log("HTIF device %d: unknown command\n", device);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

Values that have been read via cpu_physical_memory_read() from the
guest's memory have to be swapped in case the host endianess differs
from the guest.

Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230721094720.902454-3-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
+#include "exec/tswap.h"
 #include "sysemu/dma.h"
 
 #define RISCV_DEBUG_HTIF 0
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             } else {
                 uint64_t syscall[8];
                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-                if (syscall[0] == PK_SYS_WRITE &&
-                    syscall[1] == HTIF_DEV_CONSOLE &&
-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
+                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
+                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
+                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                     uint8_t ch;
-                    cpu_physical_memory_read(syscall[2], &ch, 1);
+                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                     qemu_chr_fe_write(&s->chr, &ch, 1);
                     resp = 0x100 | (uint8_t)payload;
                 } else {
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
Add a riscv,isa string for it.

Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The cpu->cfg.epmp extension is still experimental, but it already has a
'smepmp' riscv,isa string. Add it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
integer return value to bool type. However, it wrongly converted the use
of the API in riscv fault-only-first, where page_check_range < = 0, should
be converted to !page_check_range.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, offset, PAGE_READ)) {
+                    if (!page_check_range(addr, offset, PAGE_READ)) {
                         vl = i;
                         goto ProbeSuccess;
                     }
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

The AES MixColumns and InvMixColumns operations are relatively
expensive 4x4 matrix multiplications in GF(2^8), which is why C
implementations usually rely on precomputed lookup tables rather than
performing the calculations on demand.

Given that we already carry those tables in QEMU, we can just grab the
right value in the implementation of the RISC-V AES32 instructions. Note
that the tables in question are permuted according to the respective
Sbox, so we can omit the Sbox lookup as well in this case.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Zewen Ye <lustrew@foxmail.com>
Cc: Weiwei Li <liweiwei@iscas.ac.cn>
Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/aes.h         |  7 +++++++
 crypto/aes.c                 |  4 ++--
 target/riscv/crypto_helper.c | 34 ++++------------------------------
 3 files changed, 13 insertions(+), 32 deletions(-)

diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
+/*
+AES_Te0[x] = S [x].[02, 01, 01, 03];
+AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
+*/
+
+extern const uint32_t AES_Te0[256], AES_Td0[256];
+
 #endif
diff --git a/crypto/aes.c b/crypto/aes.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
 AES_Td4[x] = Si[x].[01, 01, 01, 01];
 */
 
-static const uint32_t AES_Te0[256] = {
+const uint32_t AES_Te0[256] = {
     0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
     0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
     0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
     0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
 
-static const uint32_t AES_Td0[256] = {
+const uint32_t AES_Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
     0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 
-#define AES_XTIME(a) \
-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
-
-#define AES_GFMUL(a, b) (( \
-    (((b) & 0x1) ? (a) : 0) ^ \
-    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
-    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-
-static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
-{
-    uint32_t u;
-
-    if (fwd) {
-        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
-            (AES_GFMUL(x, 2) << 0);
-    } else {
-        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-    }
-    return u;
-}
-
 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
 
 static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                            bool enc, bool mix)
 {
     uint8_t si = rs2 >> shamt;
-    uint8_t so;
     uint32_t mixed;
     target_ulong res;
 
     if (enc) {
-        so = AES_sbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, true);
+            mixed = be32_to_cpu(AES_Te0[si]);
         } else {
-            mixed = so;
+            mixed = AES_sbox[si];
         }
     } else {
-        so = AES_isbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, false);
+            mixed = be32_to_cpu(AES_Td0[si]);
         } else {
-            mixed = so;
+            mixed = AES_isbox[si];
         }
     }
     mixed = rol32(mixed, shamt);
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Take some functions/macros out of `vector_helper` and put them in a new
module called `vector_internals`. This ensures they can be used by both
vector and vector-crypto helpers (latter implemented in proceeding
commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 201 +-------------------------------
 target/riscv/vector_internals.c |  81 +++++++++++++
 target/riscv/meson.build        |   1 +
 4 files changed, 265 insertions(+), 200 deletions(-)
 create mode 100644 target/riscv/vector_internals.h
 create mode 100644 target/riscv/vector_internals.c

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
+#define TARGET_RISCV_VECTOR_INTERNALS_H
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "cpu.h"
+#include "tcg/tcg-gvec-desc.h"
+#include "internals.h"
+
+static inline uint32_t vext_nf(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, NF);
+}
+
+/*
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing units smaller than that needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define H1(x)   ((x) ^ 7)
+#define H1_2(x) ((x) ^ 6)
+#define H1_4(x) ((x) ^ 4)
+#define H2(x)   ((x) ^ 3)
+#define H4(x)   ((x) ^ 1)
+#define H8(x)   ((x))
+#else
+#define H1(x)   (x)
+#define H1_2(x) (x)
+#define H1_4(x) (x)
+#define H2(x)   (x)
+#define H4(x)   (x)
+#define H8(x)   (x)
+#endif
+
+/*
+ * Encode LMUL to lmul as following:
+ *     LMUL    vlmul    lmul
+ *      1       000       0
+ *      2       001       1
+ *      4       010       2
+ *      8       011       3
+ *      -       100       -
+ *     1/8      101      -3
+ *     1/4      110      -2
+ *     1/2      111      -1
+ */
+static inline int32_t vext_lmul(uint32_t desc)
+{
+    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+}
+
+static inline uint32_t vext_vm(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VM);
+}
+
+static inline uint32_t vext_vma(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+}
+
+static inline uint32_t vext_vta(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+}
+
+static inline uint32_t vext_vta_all_1s(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+}
+
+/*
+ * Earlier designs (pre-0.9) had a varying number of bits
+ * per mask value (MLEN). In the 0.9 design, MLEN=1.
+ * (Section 4.5)
+ */
+static inline int vext_elem_mask(void *v0, int index)
+{
+    int idx = index / 64;
+    int pos = index  % 64;
+    return (((uint64_t *)v0)[idx] >> pos) & 1;
+}
+
+/*
+ * Get number of total elements, including prestart, body and tail elements.
+ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+ * are held in the same vector register.
+ */
+static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+                                            uint32_t esz)
+{
+    uint32_t vlenb = simd_maxsz(desc);
+    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+    return (vlenb << emul) / esz;
+}
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot);
+
+/* expand macro args before macro */
+#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+
+/* (TD, T1, T2, TX1, TX2) */
+#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+
+/* operation of two vector elements */
+typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+
+#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+{                                                               \
+    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz);
+
+/* generate the helpers for OPIVV */
+#define GEN_VEXT_VV(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+               do_##NAME, ESZ);                           \
+}
+
+typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+
+/*
+ * (T1)s1 gives the real operator type.
+ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+ */
+#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+{                                                                   \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz);
+
+/* generate the helpers for OPIVX */
+#define GEN_VEXT_VX(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+               do_##NAME, ESZ);                           \
+}
+
+#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
+#include "vector_internals.h"
 #include <math.h>
 
 target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     return vl;
 }
 
-/*
- * Note that vector data is stored in host-endian 64-bit chunks,
- * so addressing units smaller than that needs a host-endian fixup.
- */
-#if HOST_BIG_ENDIAN
-#define H1(x)   ((x) ^ 7)
-#define H1_2(x) ((x) ^ 6)
-#define H1_4(x) ((x) ^ 4)
-#define H2(x)   ((x) ^ 3)
-#define H4(x)   ((x) ^ 1)
-#define H8(x)   ((x))
-#else
-#define H1(x)   (x)
-#define H1_2(x) (x)
-#define H1_4(x) (x)
-#define H2(x)   (x)
-#define H4(x)   (x)
-#define H8(x)   (x)
-#endif
-
-static inline uint32_t vext_nf(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, NF);
-}
-
-static inline uint32_t vext_vm(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VM);
-}
-
-/*
- * Encode LMUL to lmul as following:
- *     LMUL    vlmul    lmul
- *      1       000       0
- *      2       001       1
- *      4       010       2
- *      8       011       3
- *      -       100       -
- *     1/8      101      -3
- *     1/4      110      -2
- *     1/2      111      -1
- */
-static inline int32_t vext_lmul(uint32_t desc)
-{
-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
-}
-
-static inline uint32_t vext_vta(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
-}
-
-static inline uint32_t vext_vma(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
-}
-
-static inline uint32_t vext_vta_all_1s(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
-}
-
 /*
  * Get the maximum number of elements can be operated.
  *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
-/*
- * Get number of total elements, including prestart, body and tail elements.
- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
- * are held in the same vector register.
- */
-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
-                                            uint32_t esz)
-{
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
-    return (vlenb << emul) / esz;
-}
-
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
     }
 }
 
-/* set agnostic elements to 1s */
-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-                              uint32_t tot)
-{
-    if (is_agnostic == 0) {
-        /* policy undisturbed */
-        return;
-    }
-    if (tot - cnt == 0) {
-        return;
-    }
-    memset(base + cnt, -1, tot - cnt);
-}
-
 static inline void vext_set_elem_mask(void *v0, int index,
                                       uint8_t value)
 {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
 }
 
-/*
- * Earlier designs (pre-0.9) had a varying number of bits
- * per mask value (MLEN). In the 0.9 design, MLEN=1.
- * (Section 4.5)
- */
-static inline int vext_elem_mask(void *v0, int index)
-{
-    int idx = index / 64;
-    int pos = index  % 64;
-    return (((uint64_t *)v0)[idx] >> pos) & 1;
-}
-
 /* elements operations for load and store */
 typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  * Vector Integer Arithmetic Instructions
  */
 
-/* expand macro args before macro */
-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
 #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
 #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
 #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
 #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 
-/* operation of two vector elements */
-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
-
-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
-{                                                               \
-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
-}
 #define DO_SUB(N, M) (N - M)
 #define DO_RSUB(N, M) (M - N)
 
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 
-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivv2_fn *fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, vs1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVV */
-#define GEN_VEXT_VV(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VV(vadd_vv_b, 1)
 GEN_VEXT_VV(vadd_vv_h, 2)
 GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
 GEN_VEXT_VV(vsub_vv_w, 4)
 GEN_VEXT_VV(vsub_vv_d, 8)
 
-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
-
-/*
- * (T1)s1 gives the real operator type.
- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
- */
-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
-{                                                                   \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
-}
 
 RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
 RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 
-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivx2_fn fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, s1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVX */
-#define GEN_VEXT_VX(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VX(vadd_vx_b, 1)
 GEN_VEXT_VX(vadd_vx_h, 2)
 GEN_VEXT_VX(vadd_vx_w, 4)
diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vector_internals.h"
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot)
+{
+    if (is_agnostic == 0) {
+        /* policy undisturbed */
+        return;
+    }
+    if (tot - cnt == 0) {
+        return ;
+    }
+    memset(base + cnt, -1, tot - cnt);
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, vs1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, s1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'gdbstub.c',
   'op_helper.c',
   'vector_helper.c',
+  'vector_internals.c',
   'bitmanip_helper.c',
   'translate.c',
   'm128_helper.c',
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
used in proceeding vector-crypto commits.

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
 1 file changed, 32 insertions(+), 30 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
 1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         return false;
     }
 
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
     if (checkfn(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
     if (opiwv_widen_check(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
 {
     uint32_t data = 0;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     data = FIELD_DP32(data, VDATA, VM, vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
             gen_helper_##NAME##_w,                                 \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
         vext_check_ss(s, a->rd, 0, 1)) {
         TCGv s1;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i64 t1;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         };                                                       \
         TCGLabel *over = gen_new_label();                        \
         gen_set_rm(s, RISCV_FRM_DYN);                            \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                  \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
         gen_set_rm_chkfrm(s, rm);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                 gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
         uint32_t data = 0;                                         \
         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
         require_vm(a->vm, a->rd)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
         TCGv s1;
         TCGLabel *over = gen_new_label();
 
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
         TCGv_i64 t1;
         TCGLabel *over = gen_new_label();
 
-        /* if vl == 0 or vstart >= vl, skip vector register write back */
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        /* if vstart >= vl, skip vector register write back */
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
     uint32_t data = 0;
     gen_helper_gvec_3_ptr *fn;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     static gen_helper_gvec_3_ptr * const fns[6][4] = {
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvbc vector-crypto extension, which
consists of the following instructions:

* vclmulh.[vx,vv]
* vclmul.[vx,vv]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
[max.chou@sifive.com: Exposed x-zvbc property]
Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  6 +++
 target/riscv/insn32.decode               |  6 +++
 target/riscv/cpu.c                       |  9 ++++
 target/riscv/translate.c                 |  1 +
 target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
 target/riscv/meson.build                 |  3 +-
 8 files changed, 146 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/vcrypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
and into the corresponding macros. This enables the functions to be
reused in proceeding commits without check duplication.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
 1 file changed, 12 insertions(+), 16 deletions(-)

From: Dickon Hood <dickon.hood@codethink.co.uk>

Zvbb (implemented in later commit) has a widening instruction, which
requires an extra check on the enabled extensions.  Refactor
GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
it.

Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
 1 file changed, 23 insertions(+), 29 deletions(-)

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Move some macros out of `vector_helper` and into `vector_internals`.
This ensures they can be used by both vector and vector-crypto helpers
(latter implemented in proceeding commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 42 ------------------------------
 2 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 /* expand macro args before macro */
 #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 
+/* (TD, T2, TX2) */
+#define OP_UU_B uint8_t, uint8_t, uint8_t
+#define OP_UU_H uint16_t, uint16_t, uint16_t
+#define OP_UU_W uint32_t, uint32_t, uint32_t
+#define OP_UU_D uint64_t, uint64_t, uint64_t
+
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 
+#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+static void do_##NAME(void *vd, void *vs2, int i)      \
+{                                                      \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+    *((TD *)vd + HD(i)) = OP(s2);                      \
+}
+
+#define GEN_VEXT_V(NAME, ESZ)                          \
+void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+                  CPURISCVState *env, uint32_t desc)   \
+{                                                      \
+    uint32_t vm = vext_vm(desc);                       \
+    uint32_t vl = env->vl;                             \
+    uint32_t total_elems =                             \
+        vext_get_total_elems(env, desc, ESZ);          \
+    uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
+    uint32_t i;                                        \
+                                                       \
+    for (i = env->vstart; i < vl; i++) {               \
+        if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
+            continue;                                  \
+        }                                              \
+        do_##NAME(vd, vs2, i);                         \
+    }                                                  \
+    env->vstart = 0;                                   \
+    /* set tail elements to 1s */                      \
+    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+                      total_elems * ESZ);              \
+}
+
 /* operation of two vector elements */
 typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                do_##NAME, ESZ);                           \
 }
 
+/* Three of the widening shortening macros: */
+/* (TD, T1, T2, TX1, TX2) */
+#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+
 #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
 #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
 #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
 #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
 GEN_VEXT_VF(vfwnmsac_vf_w, 8)
 
 /* Vector Floating-Point Square-Root Instruction */
-/* (TD, T2, TX2) */
-#define OP_UU_H uint16_t, uint16_t, uint16_t
-#define OP_UU_W uint32_t, uint32_t, uint32_t
-#define OP_UU_D uint64_t, uint64_t, uint64_t
-
 #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 static void do_##NAME(void *vd, void *vs2, int i,      \
                       CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
-static void do_##NAME(void *vd, void *vs2, int i)      \
-{                                                      \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
-    *((TD *)vd + HD(i)) = OP(s2);                      \
-}
-
-#define GEN_VEXT_V(NAME, ESZ)                          \
-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-                  CPURISCVState *env, uint32_t desc)   \
-{                                                      \
-    uint32_t vm = vext_vm(desc);                       \
-    uint32_t vl = env->vl;                             \
-    uint32_t total_elems =                             \
-        vext_get_total_elems(env, desc, ESZ);          \
-    uint32_t vta = vext_vta(desc);                     \
-    uint32_t vma = vext_vma(desc);                     \
-    uint32_t i;                                        \
-                                                       \
-    for (i = env->vstart; i < vl; i++) {               \
-        if (!vm && !vext_elem_mask(v0, i)) {           \
-            /* set masked-off elements to 1s */        \
-            vext_set_elems_1s(vd, vma, i * ESZ,        \
-                              (i + 1) * ESZ);          \
-            continue;                                  \
-        }                                              \
-        do_##NAME(vd, vs2, i);                         \
-    }                                                  \
-    env->vstart = 0;                                   \
-    /* set tail elements to 1s */                      \
-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
-                      total_elems * ESZ);              \
-}
-
 target_ulong fclass_h(uint64_t frs1)
 {
     float16 f = frs1;
-- 
2.41.0

From: Dickon Hood <dickon.hood@codethink.co.uk>

This commit adds support for the Zvbb vector-crypto extension, which
consists of the following instructions:

* vrol.[vv,vx]
* vror.[vv,vx,vi]
* vbrev8.v
* vrev8.v
* vandn.[vv,vx]
* vbrev.v
* vclz.v
* vctz.v
* vcpop.v
* vwsll.[vv,vx,vi]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Fix imm mode of vror.vi]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvbb property]
Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  62 +++++++++
 target/riscv/insn32.decode               |  20 +++
 target/riscv/cpu.c                       |  12 ++
 target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 6 files changed, 397 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
     bool ext_zve64d;
+    bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zmmul;
     bool ext_zvfbfmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_u    12:s20                 !function=ex_shift_12
 %imm_bs   30:2                   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_z6   26:1 15:5
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
 @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
 @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
+@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
 @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
 @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
 @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
+
+# *** Zvbb vector crypto extension ***
+vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
+vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
+vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
+vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
+vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
+vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
+vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
+vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
+vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
+vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
+vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    /*
+     * In principle Zve*x would also suffice here, were they supported
+     * in qemu
+     */
+    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+        error_setg(errp,
+                   "Vector crypto extensions require V or Zve* extensions");
+        return;
+    }
+
     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 
     /* Vector cryptography extensions */
+    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
+#include "qemu/bswap.h"
 #include "cpu.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 GEN_VEXT_VV(vclmulh_vv, 8)
 RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 GEN_VEXT_VX(vclmulh_vx, 8)
+
+RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
+RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
+RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
+RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
+GEN_VEXT_VV(vror_vv_b, 1)
+GEN_VEXT_VV(vror_vv_h, 2)
+GEN_VEXT_VV(vror_vv_w, 4)
+GEN_VEXT_VV(vror_vv_d, 8)
+
+RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
+RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
+RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
+RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
+GEN_VEXT_VX(vror_vx_b, 1)
+GEN_VEXT_VX(vror_vx_h, 2)
+GEN_VEXT_VX(vror_vx_w, 4)
+GEN_VEXT_VX(vror_vx_d, 8)
+
+RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
+RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
+RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
+RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
+GEN_VEXT_VV(vrol_vv_b, 1)
+GEN_VEXT_VV(vrol_vv_h, 2)
+GEN_VEXT_VV(vrol_vv_w, 4)
+GEN_VEXT_VV(vrol_vv_d, 8)
+
+RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
+RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
+RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
+RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
+GEN_VEXT_VX(vrol_vx_b, 1)
+GEN_VEXT_VX(vrol_vx_h, 2)
+GEN_VEXT_VX(vrol_vx_w, 4)
+GEN_VEXT_VX(vrol_vx_d, 8)
+
+static uint64_t brev8(uint64_t val)
+{
+    val = ((val & 0x5555555555555555ull) << 1) |
+          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
+    val = ((val & 0x3333333333333333ull) << 2) |
+          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
+    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
+          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
+
+    return val;
+}
+
+RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
+RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
+RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
+RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
+GEN_VEXT_V(vbrev8_v_b, 1)
+GEN_VEXT_V(vbrev8_v_h, 2)
+GEN_VEXT_V(vbrev8_v_w, 4)
+GEN_VEXT_V(vbrev8_v_d, 8)
+
+#define DO_IDENTITY(a) (a)
+RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
+RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
+RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
+RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
+GEN_VEXT_V(vrev8_v_b, 1)
+GEN_VEXT_V(vrev8_v_h, 2)
+GEN_VEXT_V(vrev8_v_w, 4)
+GEN_VEXT_V(vrev8_v_d, 8)
+
+#define DO_ANDN(a, b) ((a) & ~(b))
+RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
+GEN_VEXT_VV(vandn_vv_b, 1)
+GEN_VEXT_VV(vandn_vv_h, 2)
+GEN_VEXT_VV(vandn_vv_w, 4)
+GEN_VEXT_VV(vandn_vv_d, 8)
+
+RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
+GEN_VEXT_VX(vandn_vx_b, 1)
+GEN_VEXT_VX(vandn_vx_h, 2)
+GEN_VEXT_VX(vandn_vx_w, 4)
+GEN_VEXT_VX(vandn_vx_d, 8)
+
+RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
+RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
+RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
+RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
+GEN_VEXT_V(vbrev_v_b, 1)
+GEN_VEXT_V(vbrev_v_h, 2)
+GEN_VEXT_V(vbrev_v_w, 4)
+GEN_VEXT_V(vbrev_v_d, 8)
+
+RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
+RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
+RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
+RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
+GEN_VEXT_V(vclz_v_b, 1)
+GEN_VEXT_V(vclz_v_h, 2)
+GEN_VEXT_V(vclz_v_w, 4)
+GEN_VEXT_V(vclz_v_d, 8)
+
+RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
+RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
+RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
+RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
+GEN_VEXT_V(vctz_v_b, 1)
+GEN_VEXT_V(vctz_v_h, 2)
+GEN_VEXT_V(vctz_v_w, 4)
+GEN_VEXT_V(vctz_v_d, 8)
+
+RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
+RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
+RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
+RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
+GEN_VEXT_V(vcpop_v_b, 1)
+GEN_VEXT_V(vcpop_v_h, 2)
+GEN_VEXT_V(vcpop_v_w, 4)
+GEN_VEXT_V(vcpop_v_d, 8)
+
+#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
+RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
+GEN_VEXT_VV(vwsll_vv_b, 2)
+GEN_VEXT_VV(vwsll_vv_h, 4)
+GEN_VEXT_VV(vwsll_vv_w, 8)
+
+RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+GEN_VEXT_VX(vwsll_vx_b, 2)
+GEN_VEXT_VX(vwsll_vx_h, 4)
+GEN_VEXT_VX(vwsll_vx_w, 8)
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 
 GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
+
+/*
+ * Zvbb
+ */
+
+#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
+    {                                                                   \
+        if (CHECK(s, a)) {                                              \
+            static gen_helper_opivx *const fns[4] = {                   \
+                gen_helper_##OPIVX##_b,                                 \
+                gen_helper_##OPIVX##_h,                                 \
+                gen_helper_##OPIVX##_w,                                 \
+                gen_helper_##OPIVX##_d,                                 \
+            };                                                          \
+            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
+                                 IMM_MODE);                             \
+        }                                                               \
+        return false;                                                   \
+    }
+
+#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_gvec_4_ptr *const fns[4] = {               \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
+    {                                                            \
+        if (CHECK(s, a)) {                                       \
+            static gen_helper_opivx *const fns[4] = {            \
+                gen_helper_##NAME##_b,                           \
+                gen_helper_##NAME##_h,                           \
+                gen_helper_##NAME##_w,                           \
+                gen_helper_##NAME##_d,                           \
+            };                                                   \
+            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
+                                       fns[s->sew]);             \
+        }                                                        \
+        return false;                                            \
+    }
+
+static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+/* vrol.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
+
+/* vror.v[vxi] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
+GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
+
+#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_opivx *const fns[4] = {                    \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+/* vandn.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
+GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
+
+#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
+    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
+    {                                                                      \
+        if (CHECK(s, a)) {                                                 \
+            uint32_t data = 0;                                             \
+            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
+                gen_helper_##NAME##_b,                                     \
+                gen_helper_##NAME##_h,                                     \
+                gen_helper_##NAME##_w,                                     \
+                gen_helper_##NAME##_d,                                     \
+            };                                                             \
+            TCGLabel *over = gen_new_label();                              \
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
+                                                                           \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
+                               vreg_ofs(s, a->rs2), cpu_env,               \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
+                               data, fns[s->sew]);                         \
+            mark_vs_dirty(s);                                              \
+            gen_set_label(over);                                           \
+            return true;                                                   \
+        }                                                                  \
+        return false;                                                      \
+    }
+
+static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
+{
+    return s->cfg_ptr->ext_zvbb == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ss(s, a->rd, a->rs2, a->vm);
+}
+
+GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
+
+static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
+}
+
+static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
+}
+
+/* OPIVI without GVEC IR */
+#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
+    {                                                                        \
+        if (CHECK(s, a)) {                                                   \
+            static gen_helper_opivx *const fns[3] = {                        \
+                gen_helper_##OPIVX##_b,                                      \
+                gen_helper_##OPIVX##_h,                                      \
+                gen_helper_##OPIVX##_w,                                      \
+            };                                                               \
+            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
+                               IMM_MODE);                                    \
+        }                                                                    \
+        return false;                                                        \
+    }
+
+GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
-- 
2.41.0

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkned vector-crypto extension, which
consists of the following instructions:

* vaesef.[vv,vs]
* vaesdf.[vv,vs]
* vaesdm.[vv,vs]
* vaesz.vs
* vaesem.[vv,vs]
* vaeskf1.vi
* vaeskf2.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
property]
[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
egs checking by helper function]
[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  14 ++
 target/riscv/insn32.decode               |  14 ++
 target/riscv/cpu.c                       |   4 +-
 target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 6 files changed, 381 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64d;
     bool ext_zvbb;
     bool ext_zvbc;
+    bool ext_zvkned;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_2(egs_check, void, i32, env)
+
+DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
+DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
 @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
 @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
+@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
 @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
 @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
 @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
+
+# *** Zvkned vector crypto extension ***
+vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
+vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/bswap.h"
 #include "cpu.h"
+#include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 GEN_VEXT_VX(vwsll_vx_b, 2)
 GEN_VEXT_VX(vwsll_vx_h, 4)
 GEN_VEXT_VX(vwsll_vx_w, 8)
+
+void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
+{
+    uint32_t vl = env->vl;
+    uint32_t vstart = env->vstart;
+
+    if (vl % egs != 0 || vstart % egs != 0) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
+static inline void xor_round_key(AESState *round_state, AESState *round_key)
+{
+    round_state->v = round_state->v ^ round_key->v;
+}
+
+#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
+
+void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 10 || uimm == 0) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[8], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vs2[i * 4 + H4(0)];
+        rk[1] = vs2[i * 4 + H4(1)];
+        rk[2] = vs2[i * 4 + H4(2)];
+        rk[3] = vs2[i * 4 + H4(3)];
+        tmp = ror32(rk[3], 8);
+
+        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                      ^ rcon[uimm - 1];
+        rk[5] = rk[1] ^ rk[4];
+        rk[6] = rk[2] ^ rk[5];
+        rk[7] = rk[3] ^ rk[6];
+
+        vd[i * 4 + H4(0)] = rk[4];
+        vd[i * 4 + H4(1)] = rk[5];
+        vd[i * 4 + H4(2)] = rk[6];
+        vd[i * 4 + H4(3)] = rk[7];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
+
+void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 14 || uimm < 2) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[12], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vd[i * 4 + H4(0)];
+        rk[1] = vd[i * 4 + H4(1)];
+        rk[2] = vd[i * 4 + H4(2)];
+        rk[3] = vd[i * 4 + H4(3)];
+        rk[4] = vs2[i * 4 + H4(0)];
+        rk[5] = vs2[i * 4 + H4(1)];
+        rk[6] = vs2[i * 4 + H4(2)];
+        rk[7] = vs2[i * 4 + H4(3)];
+
+        if (uimm % 2 == 0) {
+            tmp = ror32(rk[7], 8);
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                          ^ rcon[(uimm - 1) / 2];
+        } else {
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
+        }
+        rk[9] = rk[1] ^ rk[8];
+        rk[10] = rk[2] ^ rk[9];
+        rk[11] = rk[3] ^ rk[10];
+
+        vd[i * 4 + H4(0)] = rk[8];
+        vd[i * 4 + H4(1)] = rk[9];
+        vd[i * 4 + H4(2)] = rk[10];
+        vd[i * 4 + H4(3)] = rk[11];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
+
+/*
+ * Zvkned
+ */
+
+#define ZVKNED_EGS 4
+
+#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 desc, egs;                                               \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul) &&
+           s->sew == MO_32;
+}
+
+static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
+{
+    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
+    return !is_overlapped(vd, op_size, vs2, 1);
+}
+
+static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return vaes_check_overlap(s, a->rd, a->rs2) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           require_align(a->rd, s->lmul) &&
+           s->sew == MO_32;
+}
+
+GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
+
+#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 uimm_v, desc, egs;                                       \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            uimm_v = tcg_constant_i32(a->rs1);                                \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
+GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

This commit adds support for the Zvknh vector-crypto extension, which
consists of the following instructions:

* vsha2ms.vv
* vsha2c[hl].vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
[max.chou@sifive.com: Replaced SEW selection to happened during
translation]
Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   2 +
 target/riscv/helper.h                    |   6 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |  13 +-
 target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 6 files changed, 390 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zvkned;
+    bool ext_zvknha;
+    bool ext_zvknhb;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+
+DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+
+# *** Zvknh vector crypto extension ***
+vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
+        !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
     }
 
-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
+    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
+        error_setg(
+            errp,
+            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
+    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     /* set tail elements to 1s */
     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 }
+
+static inline uint32_t sig0_sha256(uint32_t x)
+{
+    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
+}
+
+static inline uint32_t sig1_sha256(uint32_t x)
+{
+    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
+}
+
+static inline uint64_t sig0_sha512(uint64_t x)
+{
+    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
+}
+
+static inline uint64_t sig1_sha512(uint64_t x)
+{
+    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
+}
+
+static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
+{
+    uint32_t res[4];
+    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
+             vd[H4(0)];
+    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
+             vd[H4(1)];
+    res[2] =
+        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
+    res[3] =
+        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
+    vd[H4(3)] = res[3];
+    vd[H4(2)] = res[2];
+    vd[H4(1)] = res[1];
+    vd[H4(0)] = res[0];
+}
+
+static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
+{
+    uint64_t res[4];
+    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
+    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
+    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
+    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
+    vd[3] = res[3];
+    vd[2] = res[2];
+    vd[1] = res[1];
+    vd[0] = res[0];
+}
+
+void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                        uint32_t desc)
+{
+    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
+    uint32_t esz = sew == MO_32 ? 4 : 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        if (sew == MO_32) {
+            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
+                        ((uint32_t *)vs2) + i * 4);
+        } else {
+            /* If not 32 then SEW should be 64 */
+            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
+                        ((uint64_t *)vs2) + i * 4);
+        }
+    }
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+static inline uint64_t sum0_64(uint64_t x)
+{
+    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
+}
+
+static inline uint32_t sum0_32(uint32_t x)
+{
+    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
+}
+
+static inline uint64_t sum1_64(uint64_t x)
+{
+    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
+}
+
+static inline uint32_t sum1_32(uint32_t x)
+{
+    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
+}
+
+#define ch(x, y, z) ((x & y) ^ ((~x) & z))
+
+#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
+
+static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
+{
+    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
+    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
+    uint64_t W0 = vs1[0], W1 = vs1[1];
+    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
+    uint64_t T2 = sum0_64(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
+    T2 = sum0_64(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[0] = f;
+    vd[1] = e;
+    vd[2] = b;
+    vd[3] = a;
+}
+
+static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
+{
+    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
+    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
+    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
+    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
+    uint32_t T2 = sum0_32(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
+    T2 = sum0_32(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[H4(0)] = f;
+    vd[H4(1)] = e;
+    vd[H4(2)] = b;
+    vd[H4(3)] = a;
+}
+
+void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  ((uint32_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  ((uint64_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  (((uint32_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  (((uint64_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 
 GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+
+/*
+ * Zvknh
+ */
+
+#define ZVKNH_EGS 4
+
+#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+            TCGv_i32 egs;                                                     \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
+                               vreg_ofs(s, a->rs2), cpu_env,                  \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
+                               data, gen_helper_##NAME);                      \
+                                                                              \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vsha_check_sew(DisasContext *s)
+{
+    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
+           (s->cfg_ptr->ext_zvknhb == true &&
+            (s->sew == MO_32 || s->sew == MO_64));
+}
+
+static bool vsha_check(DisasContext *s, arg_rmrr *a)
+{
+    int egw_bytes = ZVKNH_EGS << s->sew;
+    int mult = 1 << MAX(s->lmul, 0);
+    return opivv_check(s, a) &&
+           vsha_check_sew(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           !is_overlapped(a->rd, mult, a->rs1, mult) &&
+           !is_overlapped(a->rd, mult, a->rs2, mult) &&
+           s->lmul >= 0;
+}
+
+GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
+
+static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvksh vector-crypto extension, which
consists of the following instructions:

* vsm3me.vv
* vsm3c.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvksh property]
Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   3 +
 target/riscv/insn32.decode               |   4 +
 target/riscv/cpu.c                       |   6 +-
 target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 6 files changed, 177 insertions(+), 2 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkg vector-crypto extension, which
consists of the following instructions:

* vgmul.vv
* vghsh.vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvkg property]
[max.chou@sifive.com: Replaced uint by int for cross win32 build]
Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  3 +
 target/riscv/insn32.decode               |  4 ++
 target/riscv/cpu.c                       |  6 +-
 target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 6 files changed, 114 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

Allows sharing of sm4_subword between different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h           |  8 ++++++++
 target/arm/tcg/crypto_helper.c | 10 ++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 
 extern const uint8_t sm4_sbox[256];
 
+static inline uint32_t sm4_subword(uint32_t word)
+{
+    return sm4_sbox[word & 0xff] |
+           sm4_sbox[(word >> 8) & 0xff] << 8 |
+           sm4_sbox[(word >> 16) & 0xff] << 16 |
+           sm4_sbox[(word >> 24) & 0xff] << 24;
+}
+
 #endif
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(n, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
                             rol32(t, 24);
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(m, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
     }
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

Adds sm4_ck constant for use in sm4 cryptography across different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h |  1 +
 crypto/sm4.c         | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_SM4_H
 
 extern const uint8_t sm4_sbox[256];
+extern const uint32_t sm4_ck[32];
 
 static inline uint32_t sm4_subword(uint32_t word)
 {
diff --git a/crypto/sm4.c b/crypto/sm4.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/sm4.c
+++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
     0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
 };
 
+uint32_t const sm4_ck[] = {
+    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
+    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
+    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
+    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
+    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
+    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
+    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
+    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
+};
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

This commit adds support for the Zvksed vector-crypto extension, which
consists of the following instructions:

* vsm4k.vi
* vsm4r.[vv,vs]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
[lawrence.hunter@codethink.co.uk: Moved SM4 functions from
crypto_helper.c to vcrypto_helper.c]
[nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
use macros, and minor style changes]
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   4 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |   5 +-
 target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 6 files changed, 184 insertions(+), 1 deletion(-)

From: Rob Bradford <rbradford@rivosinc.com>

These are WARL fields - zero out the bits for unavailable counters and
special case the TM bit in mcountinhibit which is hardwired to zero.
This patch achieves this by modifying the value written so that any use
of the field will see the correctly masked bits.

Tested by modifying OpenSBI to write max value to these CSRs and upon
subsequent read the appropriate number of bits for number of PMUs is
enabled and the TM bit is zero in mcountinhibit.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 {
     int cidx;
     PMUCTRState *counter;
+    RISCVCPU *cpu = env_archcpu(env);
 
-    env->mcountinhibit = val;
+    /* WARL register - disable unavailable counters; TM bit is always 0 */
+    env->mcountinhibit =
+        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
 
     /* Check if any other counter is also monitoring cycles/instructions */
     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    env->mcounteren = val;
+    RISCVCPU *cpu = env_archcpu(env);
+
+    /* WARL register - disable unavailable counters */
+    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
+                             COUNTEREN_IR);
     return RISCV_EXCP_NONE;
 }
 
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

RVA23 Profiles states:
The RVA23 profiles are intended to be used for 64-bit application
processors that will run rich OS stacks from standard binary OS
distributions and with a substantial number of third-party binary user
applications that will be supported over a considerable length of time
in the field.

The chapter 4 of the unprivileged spec introduces the Zihintntl extension
and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
purpose is to enable application and operating system portability across
different implementations. Thus the DTS should contain the Zihintntl ISA
string in order to pass to software.

The unprivileged spec states:
Like any HINTs, these instructions may be freely ignored. Hence, although
they are described in terms of cache-based memory hierarchies, they do not
mandate the provision of caches.

These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
which QEMU already supports, and QEMU does not emulate cache. Therefore
these instructions can be considered as a no-op, and we only need to add
a new property for the Zihintntl extension.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 1 +
 target/riscv/cpu.c     | 2 ++
 2 files changed, 3 insertions(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
helper function.

Fixes: a47842d ("riscv: Add support for the Zfa extension")
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fleq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fltq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

When writing the upper mtime, we should keep the original lower mtime
whose value is given by cpu_riscv_read_rtc() instead of
cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         return;
     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
+        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
         if (addr == mtimer->time_base) {
             if (size == 4) {
                 /* time_lo for RV32/RV64 */
-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
+                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
             } else {
                 /* time for RV64 */
                 mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else {
             if (size == 4) {
                 /* time_hi for RV32/RV64 */
-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
+                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
             } else {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "aclint-mtimer: invalid time_hi write: %08x",
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

The variables whose values are given by cpu_riscv_read_rtc() should be named
"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
should be named "rtc_r".

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
     uint64_t next;
     uint64_t diff;
 
-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
+    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
     /* Compute the relative hartid w.r.t the socket */
     hartid = hartid - mtimer->hartid_base;
 
     mtimer->timecmp[hartid] = value;
-    if (mtimer->timecmp[hartid] <= rtc_r) {
+    if (mtimer->timecmp[hartid] <= rtc) {
         /*
          * If we're setting an MTIMECMP value in the "past",
          * immediately raise the timer interrupt
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
 
     /* otherwise, set up the future timer interrupt */
     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-    diff = mtimer->timecmp[hartid] - rtc_r;
+    diff = mtimer->timecmp[hartid] - rtc;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

We should not use types dependend on host arch for target_ucontext.
This bug is found when run rv32 applications.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
 }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
 
 struct target_ucontext {
-    unsigned long uc_flags;
-    struct target_ucontext *uc_link;
+    abi_ulong uc_flags;
+    abi_ptr uc_link;
     target_stack_t uc_stack;
     target_sigset_t uc_sigmask;
     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In this patch, we create the APLIC and IMSIC FDT helper functions and
remove M mode AIA devices when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
 1 file changed, 137 insertions(+), 153 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
     return ret;
 }
 
-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-                             uint32_t *phandle, uint32_t *intc_phandles,
-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
+                                 uint32_t *intc_phandles, uint32_t msi_phandle,
+                                 bool m_mode, uint32_t imsic_guest_bits)
 {
     int cpu, socket;
     char *imsic_name;
     MachineState *ms = MACHINE(s);
     int socket_count = riscv_socket_count(ms);
-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
+    uint32_t imsic_max_hart_per_socket;
     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 
-    *msi_m_phandle = (*phandle)++;
-    *msi_s_phandle = (*phandle)++;
     imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
     imsic_regs = g_new0(uint32_t, socket_count * 4);
 
-    /* M-level IMSIC node */
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    imsic_max_hart_per_socket = 0;
-    for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_M].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
-        imsic_regs[socket * 4 + 0] = 0;
-        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
-        imsic_regs[socket * 4 + 2] = 0;
-        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
-        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
-            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-        }
-    }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_M].base);
-    qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
-    if (socket_count > 1) {
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
-    }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
-
-    g_free(imsic_name);
 
-    /* S-level IMSIC node */
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-    }
-    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
     imsic_max_hart_per_socket = 0;
     for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_S].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
         imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                      s->soc[socket].num_harts;
         imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
             imsic_max_hart_per_socket = s->soc[socket].num_harts;
         }
     }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_S].base);
+
+    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
     qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
+    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
+                          FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
     qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
+                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
     qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
+                     socket_count * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
+                     VIRT_IRQCHIP_NUM_MSIS);
+
     if (imsic_guest_bits) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
-            imsic_guest_bits);
+                              imsic_guest_bits);
     }
+
     if (socket_count > 1) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
+                              imsic_num_bits(imsic_max_hart_per_socket));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
+                              imsic_num_bits(socket_count));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
+                              IMSIC_MMIO_GROUP_MIN_SHIFT);
     }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
-    g_free(imsic_name);
+    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 
+    g_free(imsic_name);
     g_free(imsic_regs);
     g_free(imsic_cells);
 }
 
-static void create_fdt_socket_aplic(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
-                                    uint32_t msi_m_phandle,
-                                    uint32_t msi_s_phandle,
-                                    uint32_t *phandle,
-                                    uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle, uint32_t *intc_phandles,
+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+{
+    *msi_m_phandle = (*phandle)++;
+    *msi_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level IMSIC node */
+        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
+                             *msi_m_phandle, true, 0);
+    }
+
+    /* S-level IMSIC node */
+    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
+                         *msi_s_phandle, false,
+                         imsic_num_bits(s->aia_guests + 1));
+
+}
+
+static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+                                 unsigned long aplic_addr, uint32_t aplic_size,
+                                 uint32_t msi_phandle,
+                                 uint32_t *intc_phandles,
+                                 uint32_t aplic_phandle,
+                                 uint32_t aplic_child_phandle,
+                                 bool m_mode)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
-    unsigned long aplic_addr;
     MachineState *ms = MACHINE(s);
-    uint32_t aplic_m_phandle, aplic_s_phandle;
 
-    aplic_m_phandle = (*phandle)++;
-    aplic_s_phandle = (*phandle)++;
     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 
-    /* M-level APLIC node */
     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    aplic_addr = memmap[VIRT_APLIC_M].base +
-                 (memmap[VIRT_APLIC_M].size * socket);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
     qemu_fdt_add_subnode(ms->fdt, aplic_name);
     qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
     qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
     } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_m_phandle);
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
+
     qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
+                           0x0, aplic_addr, 0x0, aplic_size);
     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
-        aplic_s_phandle);
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
-        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
+                          VIRT_IRQCHIP_NUM_SOURCES);
+
+    if (aplic_child_phandle) {
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
+                              aplic_child_phandle);
+        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
+                               aplic_child_phandle, 0x1,
+                               VIRT_IRQCHIP_NUM_SOURCES);
+    }
+
     riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
+
     g_free(aplic_name);
+    g_free(aplic_cells);
+}
 
-    /* S-level APLIC node */
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t msi_m_phandle,
+                                    uint32_t msi_s_phandle,
+                                    uint32_t *phandle,
+                                    uint32_t *intc_phandles,
+                                    uint32_t *aplic_phandles)
+{
+    char *aplic_name;
+    unsigned long aplic_addr;
+    MachineState *ms = MACHINE(s);
+    uint32_t aplic_m_phandle, aplic_s_phandle;
+
+    aplic_m_phandle = (*phandle)++;
+    aplic_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level APLIC node */
+        aplic_addr = memmap[VIRT_APLIC_M].base +
+                     (memmap[VIRT_APLIC_M].size * socket);
+        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+                             msi_m_phandle, intc_phandles,
+                             aplic_m_phandle, aplic_s_phandle,
+                             true);
     }
+
+    /* S-level APLIC node */
     aplic_addr = memmap[VIRT_APLIC_S].base +
                  (memmap[VIRT_APLIC_S].size * socket);
+    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+                         msi_s_phandle, intc_phandles,
+                         aplic_s_phandle, 0,
+                         false);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-    } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_s_phandle);
-    }
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
 
     if (!socket) {
         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 
     g_free(aplic_name);
 
-    g_free(aplic_cells);
     aplic_phandles[socket] = aplic_s_phandle;
 }
 
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
     int i;
     hwaddr addr;
     uint32_t guest_bits;
-    DeviceState *aplic_m;
-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
+    DeviceState *aplic_s = NULL;
+    DeviceState *aplic_m = NULL;
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 
     if (msimode) {
-        /* Per-socket M-level IMSICs */
-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        for (i = 0; i < hart_count; i++) {
-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-                               base_hartid + i, true, 1,
-                               VIRT_IRQCHIP_NUM_MSIS);
+        if (!kvm_enabled()) {
+            /* Per-socket M-level IMSICs */
+            addr = memmap[VIRT_IMSIC_M].base +
+                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+            for (i = 0; i < hart_count; i++) {
+                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+                                   base_hartid + i, true, 1,
+                                   VIRT_IRQCHIP_NUM_MSIS);
+            }
         }
 
         /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
         }
     }
 
-    /* Per-socket M-level APLIC */
-    aplic_m = riscv_aplic_create(
-        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
-        memmap[VIRT_APLIC_M].size,
-        (msimode) ? 0 : base_hartid,
-        (msimode) ? 0 : hart_count,
-        VIRT_IRQCHIP_NUM_SOURCES,
-        VIRT_IRQCHIP_NUM_PRIO_BITS,
-        msimode, true, NULL);
-
-    if (aplic_m) {
-        /* Per-socket S-level APLIC */
-        riscv_aplic_create(
-            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
-            memmap[VIRT_APLIC_S].size,
-            (msimode) ? 0 : base_hartid,
-            (msimode) ? 0 : hart_count,
-            VIRT_IRQCHIP_NUM_SOURCES,
-            VIRT_IRQCHIP_NUM_PRIO_BITS,
-            msimode, false, aplic_m);
+    if (!kvm_enabled()) {
+        /* Per-socket M-level APLIC */
+        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
+                                     socket * memmap[VIRT_APLIC_M].size,
+                                     memmap[VIRT_APLIC_M].size,
+                                     (msimode) ? 0 : base_hartid,
+                                     (msimode) ? 0 : hart_count,
+                                     VIRT_IRQCHIP_NUM_SOURCES,
+                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                     msimode, true, NULL);
     }
 
-    return aplic_m;
+    /* Per-socket S-level APLIC */
+    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
+                                 socket * memmap[VIRT_APLIC_S].size,
+                                 memmap[VIRT_APLIC_S].size,
+                                 (msimode) ? 0 : base_hartid,
+                                 (msimode) ? 0 : hart_count,
+                                 VIRT_IRQCHIP_NUM_SOURCES,
+                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                 msimode, false, aplic_m);
+
+    return kvm_enabled() ? aplic_s : aplic_m;
 }
 
 static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We check the in-kernel irqchip support when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    return 0;
+    if (kvm_kernel_irqchip_split()) {
+        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
+        exit(1);
+    }
+
+    /*
+     * We can create the VAIA using the newer device control API.
+     */
+    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 }
 
 int kvm_arch_process_async_events(CPUState *cs)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
parameter is passed along with --accel in QEMU command-line.
1) "riscv-aia=emul": IMSIC is emulated by hypervisor
2) "riscv-aia=hwaccel": use hardware guest IMSIC
3) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                     otherwise we fallback to software emulation.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |   4 +
 target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num);
 
 #endif
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
+#include "hw/intc/riscv_imsic.h"
 #include "qemu/log.h"
 #include "hw/loader.h"
 #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "migration/migration.h"
 #include "sysemu/runstate.h"
+#include "hw/riscv/numa.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
     return true;
 }
 
+static int aia_mode;
+
+static const char *kvm_aia_mode_str(uint64_t mode)
+{
+    switch (mode) {
+    case KVM_DEV_RISCV_AIA_MODE_EMUL:
+        return "emul";
+    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
+        return "hwaccel";
+    case KVM_DEV_RISCV_AIA_MODE_AUTO:
+    default:
+        return "auto";
+    };
+}
+
+static char *riscv_get_kvm_aia(Object *obj, Error **errp)
+{
+    return g_strdup(kvm_aia_mode_str(aia_mode));
+}
+
+static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
+{
+    if (!strcmp(val, "emul")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
+    } else if (!strcmp(val, "hwaccel")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
+    } else if (!strcmp(val, "auto")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
+    } else {
+        error_setg(errp, "Invalid KVM AIA mode");
+        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
+    }
+}
+
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
+    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
+                                  riscv_set_kvm_aia);
+    object_class_property_set_description(oc, "riscv-aia",
+                                          "Set KVM AIA mode. Valid values are "
+                                          "emul, hwaccel, and auto. Default "
+                                          "is auto.");
+    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
+                                    "auto");
+}
+
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num)
+{
+    int ret, i;
+    int aia_fd = -1;
+    uint64_t default_aia_mode;
+    uint64_t socket_count = riscv_socket_count(machine);
+    uint64_t max_hart_per_socket = 0;
+    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
+    uint64_t socket_bits, hart_bits, guest_bits;
+
+    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
+
+    if (aia_fd < 0) {
+        error_report("Unable to create in-kernel irqchip");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                            &default_aia_mode, false, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to get current KVM AIA mode");
+        exit(1);
+    }
+    qemu_log("KVM AIA: default mode is %s\n",
+             kvm_aia_mode_str(default_aia_mode));
+
+    if (default_aia_mode != aia_mode) {
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                                &aia_mode, true, NULL);
+        if (ret < 0)
+            warn_report("KVM AIA: failed to set KVM AIA mode");
+        else
+            qemu_log("KVM AIA: set current mode to %s\n",
+                     kvm_aia_mode_str(aia_mode));
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
+                            &aia_irq_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of input irq lines");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
+                            &aia_msi_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of msi");
+        exit(1);
+    }
+
+    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                            &socket_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                            &group_shift, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_shift");
+        exit(1);
+    }
+
+    guest_bits = guest_num == 0 ? 0 :
+                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
+                            &guest_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set guest_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
+                            &aplic_base, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set the base address of APLIC");
+        exit(1);
+    }
+
+    for (socket = 0; socket < socket_count; socket++) {
+        socket_imsic_base = imsic_base + socket * (1U << group_shift);
+        hart_count = riscv_socket_hart_count(machine, socket);
+        base_hart = riscv_socket_first_hartid(machine, socket);
+
+        if (max_hart_per_socket < hart_count) {
+            max_hart_per_socket = hart_count;
+        }
+
+        for (i = 0; i < hart_count; i++) {
+            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
+            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
+                                    &imsic_addr, true, NULL);
+            if (ret < 0) {
+                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
+                exit(1);
+            }
+        }
+    }
+
+    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
+                            &hart_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set hart_bits");
+        exit(1);
+    }
+
+    if (kvm_has_gsi_routing()) {
+        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
+            /* KVM AIA only has one APLIC instance */
+            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
+        }
+        kvm_gsi_routing_allowed = true;
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
+                            KVM_DEV_RISCV_AIA_CTRL_INIT,
+                            NULL, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: initialized fail");
+        exit(1);
+    }
+
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 }
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
mmio operations of APLIC when using KVM AIA and send wired interrupt
signal via KVM_IRQ_LINE API.
After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
when the IMSICs receive mmio write requests.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
 hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 2 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
 
 #define APLIC_IDC_CLAIMI               0x1c
 
+/*
+ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
+ * APLIC Wired.
+ */
+static bool is_kvm_aia(bool msimode)
+{
+    return kvm_irqchip_in_kernel() && msimode;
+}
+
 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                             uint32_t word)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
+static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-    aplic->state = g_new0(uint32_t, aplic->num_irqs);
-    aplic->target = g_new0(uint32_t, aplic->num_irqs);
-    if (!aplic->msimode) {
-        for (i = 0; i < aplic->num_irqs; i++) {
-            aplic->target[i] = 1;
+    if (!is_kvm_aia(aplic->msimode)) {
+        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
+        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
+        aplic->state = g_new0(uint32_t, aplic->num_irqs);
+        aplic->target = g_new0(uint32_t, aplic->num_irqs);
+        if (!aplic->msimode) {
+            for (i = 0; i < aplic->num_irqs; i++) {
+                aplic->target[i] = 1;
+            }
         }
-    }
-    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
-    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
-    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
+        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
+        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
+        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 
-    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
-                          TYPE_RISCV_APLIC, aplic->aperture_size);
-    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
+                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+    }
 
     /*
      * Only root APLICs have hardware IRQ lines. All non-root APLICs
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        if (is_kvm_aia(aplic->msimode)) {
+            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+        } else {
+            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        }
     }
 
     /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "mmode", mmode);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    if (!is_kvm_aia(msimode)) {
+        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+    }
 
     if (parent) {
         riscv_aplic_add_child(parent, dev);
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "target/riscv/cpu_bits.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
         goto err;
     }
 
+#if defined(CONFIG_KVM)
+    if (kvm_irqchip_in_kernel()) {
+        struct kvm_msi msi;
+
+        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
+        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
+        msi.data = le32_to_cpu(value);
+
+        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
+
+        return;
+    }
+#endif
+
     /* Writes only supported for MSI little-endian registers */
     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 
-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    if (!kvm_irqchip_in_kernel()) {
+        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    }
 
     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                           imsic, TYPE_RISCV_IMSIC,
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

Select KVM AIA when the host kernel has in-kernel AIA chip support.
Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
devices to KVM APLIC.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 63 insertions(+), 31 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
 #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
 #error "Can't accommodate all IMSIC groups in address space"
 #endif
 
+/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
+static bool virt_use_kvm_aia(RISCVVirtState *s)
+{
+    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+}
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =        {        0x0,         0x100 },
     [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                  uint32_t *intc_phandles,
                                  uint32_t aplic_phandle,
                                  uint32_t aplic_child_phandle,
-                                 bool m_mode)
+                                 bool m_mode, int num_harts)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
     MachineState *ms = MACHINE(s);
 
-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aplic_cells = g_new0(uint32_t, num_harts * 2);
 
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+    for (cpu = 0; cpu < num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-                         aplic_cells,
-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
     } else {
         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                     uint32_t msi_s_phandle,
                                     uint32_t *phandle,
                                     uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+                                    uint32_t *aplic_phandles,
+                                    int num_harts)
 {
     char *aplic_name;
     unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                              msi_m_phandle, intc_phandles,
                              aplic_m_phandle, aplic_s_phandle,
-                             true);
+                             true, num_harts);
     }
 
     /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                          msi_s_phandle, intc_phandles,
                          aplic_s_phandle, 0,
-                         false);
+                         false, num_harts);
 
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    phandle_pos = ms->smp.cpus;
-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-        phandle_pos -= s->soc[socket].num_harts;
-
-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-            create_fdt_socket_plic(s, memmap, socket, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
-        } else {
-            create_fdt_socket_aplic(s, memmap, socket,
-                msi_m_phandle, msi_s_phandle, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
+    /* KVM AIA only has one APLIC instance */
+    if (virt_use_kvm_aia(s)) {
+        create_fdt_socket_aplic(s, memmap, 0,
+                                msi_m_phandle, msi_s_phandle, phandle,
+                                &intc_phandles[0], xplic_phandles,
+                                ms->smp.cpus);
+    } else {
+        phandle_pos = ms->smp.cpus;
+        for (socket = (socket_count - 1); socket >= 0; socket--) {
+            phandle_pos -= s->soc[socket].num_harts;
+
+            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+                create_fdt_socket_plic(s, memmap, socket, phandle,
+                                       &intc_phandles[phandle_pos],
+                                       xplic_phandles);
+            } else {
+                create_fdt_socket_aplic(s, memmap, socket,
+                                        msi_m_phandle, msi_s_phandle, phandle,
+                                        &intc_phandles[phandle_pos],
+                                        xplic_phandles,
+                                        s->soc[socket].num_harts);
+            }
         }
     }
 
     g_free(intc_phandles);
 
-    for (socket = 0; socket < socket_count; socket++) {
-        if (socket == 0) {
-            *irq_mmio_phandle = xplic_phandles[socket];
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 1) {
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 2) {
-            *irq_pcie_phandle = xplic_phandles[socket];
+    if (virt_use_kvm_aia(s)) {
+        *irq_mmio_phandle = xplic_phandles[0];
+        *irq_virtio_phandle = xplic_phandles[0];
+        *irq_pcie_phandle = xplic_phandles[0];
+    } else {
+        for (socket = 0; socket < socket_count; socket++) {
+            if (socket == 0) {
+                *irq_mmio_phandle = xplic_phandles[socket];
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 1) {
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 2) {
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
+    if (virt_use_kvm_aia(s)) {
+        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
+                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
+                             memmap[VIRT_APLIC_S].base,
+                             memmap[VIRT_IMSIC_S].base,
+                             s->aia_guests);
+    }
+
     if (riscv_is_32bit(&s->soc[0])) {
 #if HOST_LONG_BITS == 64
         /* limit RAM size in a 32-bit system */
-- 
2.41.0

From: Conor Dooley <conor.dooley@microchip.com>

On a dtb dumped from the virt machine, dt-validate complains:
soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
That's pretty cryptic, but running the dtb back through dtc produces
something a lot more reasonable:
Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property

Moving the riscv,pmu node out of the soc bus solves the problem.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
     MachineState *ms = MACHINE(s);
     RISCVCPU hart = s->soc[0].harts[0];
 
-    pmu_name = g_strdup_printf("/soc/pmu");
+    pmu_name = g_strdup_printf("/pmu");
     qemu_fdt_add_subnode(ms->fdt, pmu_name);
     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
-- 
2.41.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The Svadu specification updated the name of the *envcfg bit from
HADE to ADUE.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  8 ++++----
 target/riscv/cpu.c        |  4 ++--
 target/riscv/cpu_helper.c |  6 +++---
 target/riscv/csr.c        | 12 ++++++------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBIE                       (3UL << 4)
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
-#define MENVCFG_HADE                       (1ULL << 61)
+#define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
 
 /* For RV32 */
-#define MENVCFGH_HADE                      BIT(29)
+#define MENVCFGH_ADUE                      BIT(29)
 #define MENVCFGH_PBMTE                     BIT(30)
 #define MENVCFGH_STCE                      BIT(31)
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBIE                       MENVCFG_CBIE
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
-#define HENVCFG_HADE                       MENVCFG_HADE
+#define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
 
 /* For RV32 */
-#define HENVCFGH_HADE                       MENVCFGH_HADE
+#define HENVCFGH_ADUE                       MENVCFGH_ADUE
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     env->two_stage_lookup = false;
 
     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
 
     /* Initialized default priorities of local interrupts. */
     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-    bool hade = env->menvcfg & MENVCFG_HADE;
+    bool adue = env->menvcfg & MENVCFG_ADUE;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-        hade = hade && (env->henvcfg & HENVCFG_HADE);
+        adue = adue && (env->henvcfg & HENVCFG_ADUE);
     }
 
     int ptshift = (levels - 1) * ptidxbits;
@@ -XXX,XX +XXX,XX @@ restart:
 
     /* Page table updates need to be atomic with MTTCG enabled */
     if (updated_pte != pte && !is_debug) {
-        if (!hade) {
+        if (!adue) {
             return TRANSLATE_FAIL;
         }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
      */
-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                            env->menvcfg);
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
+        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
     }
 
     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg)) >> 32;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-                                    HENVCFG_HADE);
+                                    HENVCFG_ADUE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
 
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
longer to boot than the 'rv64' KVM CPU.

The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
when satp_mode.supported = 0, i.e. when cpu_init() does not set
satp_mode_max_supported(). satp_mode_max_from_map(map) does:

31 - __builtin_clz(map)

This means that, if satp_mode.supported = 0, satp_mode_supported_max
wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
set it to UINT_MAX (4294967295). After that, if the user didn't set a
satp_mode, set_satp_mode_default_map(cpu) will make

cfg.satp_mode.map = cfg.satp_mode.supported

So satp_mode.map = 0. And then satp_mode_map_max will be set to
satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
here since both are UINT_MAX.

And finally we have 2 loops:

for (int i = satp_mode_map_max - 1; i >= 0; --i) {

Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
extra delay when booting the 'host' CPU is coming from.

Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
in a different manner. We're doing the same here. If supported == 0,
interpret as 'the CPU wants the OS to handle satp mode alone' and skip
satp_mode_finalize().

We'll also put a guard in satp_mode_max_from_map() to assert out if map
is 0 since the function is not ready to deal with it.

Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
 
 uint8_t satp_mode_max_from_map(uint32_t map)
 {
+    /*
+     * 'map = 0' will make us return (31 - 32), which C will
+     * happily overflow to UINT_MAX. There's no good result to
+     * return if 'map = 0' (e.g. returning 0 will be ambiguous
+     * with the result for 'map = 1').
+     *
+     * Assert out if map = 0. Callers will have to deal with
+     * it outside of this function.
+     */
+    g_assert(map > 0);
+
     /* map here has at least one bit set, so no problem with clz */
     return 31 - __builtin_clz(map);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-    uint8_t satp_mode_map_max;
-    uint8_t satp_mode_supported_max =
-                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+    uint8_t satp_mode_map_max, satp_mode_supported_max;
+
+    /* The CPU wants the OS to decide which satp mode to use */
+    if (cpu->cfg.satp_mode.supported == 0) {
+        return;
+    }
+
+    satp_mode_supported_max =
+                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 
     if (cpu->cfg.satp_mode.map == 0) {
         if (cpu->cfg.satp_mode.init == 0) {
-- 
2.41.0

From: Vineet Gupta <vineetg@rivosinc.com>

zicond is now codegen supported in both llvm and gcc.

This change allows seamless enabling/testing of zicond in downstream
projects. e.g. currently riscv-gnu-toolchain parses elf attributes
to create a cmdline for qemu but fails short of enabling it because of
the "x-" prefix.

Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
+    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
     /* These are experimental so mark with 'x-' */
-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

A build with --enable-debug and without KVM will fail as follows:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'

This happens because the code block with "if virt_use_kvm_aia(s)" isn't
being ignored by the debug build, resulting in an undefined reference to
a KVM only function.

Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
make the compiler crop the kvm_riscv_aia_create() call entirely from a
non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
virt_use_kvm_aia() won't fix the build because this function would need
to be inlined multiple times to make the compiler zero out the entire
block.

While we're at it, use kvm_enabled() in all instances where
virt_use_kvm_aia() is checked to allow the compiler to elide these other
kvm-only instances as well.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 
     /* KVM AIA only has one APLIC instance */
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
     g_free(intc_phandles);
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         *irq_mmio_phandle = xplic_phandles[0];
         *irq_virtio_phandle = xplic_phandles[0];
         *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                              memmap[VIRT_APLIC_S].base,
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
environment with the following error:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
collect2: error: ld returned 1 exit status

This happens because the debug build will poke into the
'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
the KVM only function riscv_kvm_aplic_request().

There are multiple solutions to fix this. We'll go with the same
solution from the previous patch, i.e. add a kvm_enabled() conditional
to filter out the block. But there's a catch: riscv_kvm_aplic_request()
is a local function that would end up being used if the compiler crops
the block, and this won't work. Quoting Richard Henderson's explanation
in [1]:

"(...) the compiler won't eliminate entire unused functions with -O0"

We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
declaration in kvm_riscv.h, where all other KVM specific public
functions are already declared. Other archs handles KVM specific code in
this manner and we expect to do the same from now on.

[1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h | 1 +
 hw/intc/riscv_aplic.c    | 8 ++------
 target/riscv/kvm.c       | 5 +++++
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
                           uint64_t aia_irq_num, uint64_t aia_msi_num,
                           uint64_t aplic_base, uint64_t imsic_base,
                           uint64_t guest_num);
+void riscv_kvm_aplic_request(void *opaque, int irq, int level);
 
 #endif
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "kvm_riscv.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-{
-    kvm_set_irq(kvm_state, irq, !!level);
-}
-
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (is_kvm_aia(aplic->msimode)) {
+        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
-- 
2.41.0

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new extensions in
linux 6.5 to the hwprobe syscall.

And fixes RVC check to OR with correct value.
The previous variable contains 0 therefore it
did work.

Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

From: Ard Biesheuvel <ardb@kernel.org>

Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
implement the first half of the key schedule derivation. This does not
actually involve shifting rows, so clone the same value into all four
columns of the AES vector to counter that operation.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230831154118.138727-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/crypto_helper.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 
     uint8_t enc_rnum = rnum;
     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-    uint8_t rcon_ = 0;
-    target_ulong result;
+    AESState t, rc = {};
 
     if (enc_rnum != 0xA) {
         temp = ror32(temp, 8); /* Rotate right by 8 */
-        rcon_ = round_consts[enc_rnum];
+        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
     }
 
-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
+    aesenc_SB_SR_AK(&t, &t, &rc, false);
 
-    temp ^= rcon_;
-
-    result = ((uint64_t)temp << 32) | temp;
-
-    return result;
+    return t.d[0];
 }
 
 target_ulong HELPER(aes64im)(target_ulong rs1)
-- 
2.41.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

riscv_trigger_init() had been called on reset events that can happen
several times for a CPU and it allocated timers for itrigger. If old
timers were present, they were simply overwritten by the new timers,
resulting in a memory leak.

Divide riscv_trigger_init() into two functions, namely
riscv_trigger_realize() and riscv_trigger_reset() and call them in
appropriate timing. The timer allocation will happen only once for a
CPU in riscv_trigger_realize().

Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  3 ++-
 target/riscv/cpu.c   |  8 +++++++-
 target/riscv/debug.c | 15 ++++++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
-void riscv_trigger_init(CPURISCVState *env);
+void riscv_trigger_realize(CPURISCVState *env);
+void riscv_trigger_reset_hold(CPURISCVState *env);
 
 bool riscv_itrigger_enabled(CPURISCVState *env);
 void riscv_itrigger_update_priv(CPURISCVState *env);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->cfg.debug) {
-        riscv_trigger_init(env);
+        riscv_trigger_reset_hold(env);
     }
 
     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 
     riscv_cpu_register_gdb_regs_for_features(cs);
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.debug) {
+        riscv_trigger_realize(&cpu->env);
+    }
+#endif
+
     qemu_init_vcpu(cs);
     cpu_reset(cs);
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return false;
 }
 
-void riscv_trigger_init(CPURISCVState *env)
+void riscv_trigger_realize(CPURISCVState *env)
+{
+    int i;
+
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                              riscv_itrigger_timer_cb, env);
+    }
+}
+
+void riscv_trigger_reset_hold(CPURISCVState *env)
 {
     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
         env->tdata3[i] = 0;
         env->cpu_breakpoint[i] = NULL;
         env->cpu_watchpoint[i] = NULL;
-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                              riscv_itrigger_timer_cb, env);
+        timer_del(env->itrigger_timer[i]);
     }
 }
-- 
2.41.0

From: Leon Schuermann <leons@opentitan.org>

When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
configuration lock bits must not apply. While this behavior is
implemented for the pmpcfgX CSRs, this bit is not respected for
changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
writes work even on locked regions when the global rule-lock bypass is
enabled.

Signed-off-by: Leon Schuermann <leons@opentitan.org>
Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
  */
 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 {
+    /* mseccfg.RLB is set */
+    if (MSECCFG_RLB_ISSET(env)) {
+        return 0;
+    }
 
     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
         return 1;
-- 
2.41.0

From: Tommy Wu <tommy.wu@sifive.com>

According to the new spec, when vsiselect has a reserved value, attempts
from M-mode or HS-mode to access vsireg, or from VS-mode to access
sireg, should preferably raise an illegal instruction exception.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                      target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt;
+    bool virt, isel_reserved;
     uint8_t *iprio;
     int ret = -EINVAL;
     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
 
     /* Decode register details from CSR number */
     virt = false;
+    isel_reserved = false;
     switch (csrno) {
     case CSR_MIREG:
         iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                   riscv_cpu_mxl_bits(env)),
                                     val, new_val, wr_mask);
         }
+    } else {
+        isel_reserved = true;
     }
 
 done:
     if (ret) {
-        return (env->virt_enabled && virt) ?
+        return (env->virt_enabled && virt && !isel_reserved) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
-- 
2.41.0

From: Nikita Shubin <n.shubin@yadro.com>

As per ISA:

"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
shall not cause any of the side effects that might occur on a CSR read."

trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.

Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                        target_ulong write_mask)
 {
     RISCVException ret;
-    target_ulong old_value;
+    target_ulong old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
     }
 
-    /* if no accessor exists then return failure */
-    if (!csr_ops[csrno].read) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-    /* read old value */
-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-    if (ret != RISCV_EXCP_NONE) {
-        return ret;
+    /*
+     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
+     * and we can't throw side effects caused by CSR reads.
+     */
+    if (ret_value) {
+        /* if no accessor exists then return failure */
+        if (!csr_ops[csrno].read) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+        /* read old value */
+        ret = csr_ops[csrno].read(env, csrno, &old_value);
+        if (ret != RISCV_EXCP_NONE) {
+            return ret;
+        }
     }
 
     /* write value if writable and write mask set, otherwise drop writes */
-- 
2.41.0