[PULL 0/5] riscv-to-apply queue

[PULL 0/5] riscv-to-apply queue

[Alistair Francis]

The following changes since commit 3cbc8970f55c87cb58699b6dc8fe42998bc79dc0:

  Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2020-07-21' into staging (2020-07-22 09:13:46 +0100)

are available in the Git repository at:

  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20200722-1

for you to fetch changes up to 8ba26b0b2b00dd5849a6c0981e358dc7a7cc315d:

  target/riscv: Fix the range of pmpcfg of CSR funcion table (2020-07-22 09:41:36 -0700)

----------------------------------------------------------------
This PR contains a few RISC-V fixes.

The main fix is the correction of the goldfish RTC time. On top of that
some small fixes to the recently added vector extensions have been added
(including an assert that fixed a coverity report). There is a change in
the SiFive E debug memory size to match hardware. Finally there is a fix
for PMP accesses.

----------------------------------------------------------------
Bin Meng (1):
      hw/riscv: sifive_e: Correct debug block size

Jessica Clarke (1):
      goldfish_rtc: Fix non-atomic read behaviour of TIME_LOW/TIME_HIGH

LIU Zhiwei (2):
      target/riscv: Quiet Coverity complains about vamo*
      target/riscv: fix vector index load/store constraints

Zong Li (1):
      target/riscv: Fix the range of pmpcfg of CSR funcion table

 include/hw/rtc/goldfish_rtc.h           |  1 +
 hw/riscv/sifive_e.c                     |  2 +-
 hw/rtc/goldfish_rtc.c                   | 17 ++++++++++++++---
 target/riscv/csr.c                      |  2 +-
 target/riscv/insn_trans/trans_rvv.inc.c | 11 ++++++++++-
 5 files changed, 27 insertions(+), 6 deletions(-)

Re: [PULL 0/5] riscv-to-apply queue

[Peter Maydell]

On Wed, 22 Jul 2020 at 18:00, Alistair Francis <alistair.francis@wdc.com> wrote:
>
> The following changes since commit 3cbc8970f55c87cb58699b6dc8fe42998bc79dc0:
>
>   Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2020-07-21' into staging (2020-07-22 09:13:46 +0100)
>
> are available in the Git repository at:
>
>   git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20200722-1
>
> for you to fetch changes up to 8ba26b0b2b00dd5849a6c0981e358dc7a7cc315d:
>
>   target/riscv: Fix the range of pmpcfg of CSR funcion table (2020-07-22 09:41:36 -0700)
>
> ----------------------------------------------------------------
> This PR contains a few RISC-V fixes.
>
> The main fix is the correction of the goldfish RTC time. On top of that
> some small fixes to the recently added vector extensions have been added
> (including an assert that fixed a coverity report). There is a change in
> the SiFive E debug memory size to match hardware. Finally there is a fix
> for PMP accesses.


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/5.1
for any user-visible changes.

-- PMM

[PULL 0/5] riscv-to-apply queue

[Alistair Francis]

The following changes since commit 361d5397355276e3007825cc17217c1e4d4320f7:

  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2023-07-17 15:49:27 +0100)

are available in the Git repository at:

  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230719-1

for you to fetch changes up to 32be32509987fbe42cf5c2fd3cea3c2ad6eae179:

  target/riscv: Fix LMUL check to use VLEN (2023-07-19 14:37:26 +1000)

----------------------------------------------------------------
Fourth RISC-V PR for 8.1

* Fix LMUL check to use VLEN
* Fix typo field in NUMA error_report
* check priv_ver before auto-enable zca/zcd/zcf
* Fix disas output of upper immediates
* tidy CPU firmware section

----------------------------------------------------------------
Christoph Müllner (1):
      riscv/disas: Fix disas output of upper immediates

Daniel Henrique Barboza (2):
      docs/system/target-riscv.rst: tidy CPU firmware section
      target/riscv/cpu.c: check priv_ver before auto-enable zca/zcd/zcf

Rob Bradford (1):
      target/riscv: Fix LMUL check to use VLEN

Zhao Liu (1):
      hw/riscv: Fix typo field in error_report

 docs/system/target-riscv.rst | 24 ++++++++++++++++--------
 disas/riscv.h                |  2 ++
 disas/riscv.c                | 19 ++++++++++++++++---
 hw/riscv/numa.c              |  4 ++--
 target/riscv/cpu.c           |  3 ++-
 target/riscv/vector_helper.c |  4 ++--
 6 files changed, 40 insertions(+), 16 deletions(-)

Re: [PULL 0/5] riscv-to-apply queue

[Peter Maydell]

On Wed, 19 Jul 2023 at 05:46, Alistair Francis <alistair23@gmail.com> wrote:
>
> The following changes since commit 361d5397355276e3007825cc17217c1e4d4320f7:
>
>   Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2023-07-17 15:49:27 +0100)
>
> are available in the Git repository at:
>
>   https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230719-1
>
> for you to fetch changes up to 32be32509987fbe42cf5c2fd3cea3c2ad6eae179:
>
>   target/riscv: Fix LMUL check to use VLEN (2023-07-19 14:37:26 +1000)
>
> ----------------------------------------------------------------
> Fourth RISC-V PR for 8.1
>
> * Fix LMUL check to use VLEN
> * Fix typo field in NUMA error_report
> * check priv_ver before auto-enable zca/zcd/zcf
> * Fix disas output of upper immediates
> * tidy CPU firmware section
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.1
for any user-visible changes.

-- PMM

[PULL 0/5] riscv-to-apply queue

[Alistair Francis]

The following changes since commit e7207a9971dd41618b407030902b0b2256deb664:

  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2024-08-06 08:02:34 +1000)

are available in the Git repository at:

  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240806-2

for you to fetch changes up to b3a34eb90d8264bd73ccb25295b1a7e271a9029c:

  roms/opensbi: Update to v1.5.1 (2024-08-06 15:01:01 +1000)

----------------------------------------------------------------
RISC-V PR for 9.1

* roms/opensbi: update to v1.5.1
* target/riscv: Add asserts for out-of-bound access
* Remove redundant insn length check for zama16b

----------------------------------------------------------------
Atish Patra (1):
      target/riscv: Add asserts for out-of-bound access

Daniel Henrique Barboza (1):
      roms/opensbi: Update to v1.5.1

LIU Zhiwei (3):
      target/riscv: Remove redundant insn length check for zama16b
      target/riscv: Add MXLEN check for F/D/Q applies to zama16b
      target/riscv: Relax fld alignment requirement

 target/riscv/pmu.c                             |   4 ++++
 target/riscv/insn_trans/trans_rvd.c.inc        |  18 ++++++++++++++++--
 target/riscv/insn_trans/trans_rvf.c.inc        |   4 ++--
 target/riscv/insn_trans/trans_rvi.c.inc        |   4 ++--
 pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 268312 -> 268312 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 272504 -> 272504 bytes
 roms/opensbi                                   |   2 +-
 7 files changed, 25 insertions(+), 7 deletions(-)

[PULL 1/5] target/riscv: Remove redundant insn length check for zama16b

[Alistair Francis]

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Compressed encodings also applies to zama16b.
https://github.com/riscv/riscv-isa-manual/pull/1557

Suggested-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240802072417.659-2-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvd.c.inc | 4 ++--
 target/riscv/insn_trans/trans_rvf.c.inc | 4 ++--
 target/riscv/insn_trans/trans_rvi.c.inc | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index 1f5fac65a2..0ac42c3223 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -47,7 +47,7 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    if (ctx->cfg_ptr->ext_zama16b && (ctx->cur_insn_len != 2)) {
+    if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
 
@@ -67,7 +67,7 @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    if (ctx->cfg_ptr->ext_zama16b && (ctx->cur_insn_len != 2)) {
+    if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
 
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index f771aa1939..0222a728df 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -48,7 +48,7 @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
-    if (ctx->cfg_ptr->ext_zama16b && (ctx->cur_insn_len != 2)) {
+    if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
 
@@ -70,7 +70,7 @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
-    if (ctx->cfg_ptr->ext_zama16b && (ctx->cur_insn_len != 2)) {
+    if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
 
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index 98e3806d5e..fab5c06719 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -268,7 +268,7 @@ static bool gen_load(DisasContext *ctx, arg_lb *a, MemOp memop)
 {
     bool out;
 
-    if (ctx->cfg_ptr->ext_zama16b && (ctx->cur_insn_len != 2)) {
+    if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
     decode_save_opc(ctx);
@@ -369,7 +369,7 @@ static bool gen_store_i128(DisasContext *ctx, arg_sb *a, MemOp memop)
 
 static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop)
 {
-    if (ctx->cfg_ptr->ext_zama16b && (ctx->cur_insn_len != 2)) {
+    if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
     decode_save_opc(ctx);
-- 
2.45.2

[PULL 2/5] target/riscv: Add MXLEN check for F/D/Q applies to zama16b

[Alistair Francis]

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Zama16b loads and stores of no more than MXLEN bits defined in the F, D, and Q
extensions.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240802072417.659-3-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvd.c.inc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index 0ac42c3223..49682292b8 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -47,7 +47,11 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    if (ctx->cfg_ptr->ext_zama16b) {
+    /*
+     * Zama16b applies to loads and stores of no more than MXLEN bits defined
+     * in the F, D, and Q extensions.
+     */
+    if ((get_xl_max(ctx) >= MXL_RV64) && ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
 
@@ -67,7 +71,7 @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    if (ctx->cfg_ptr->ext_zama16b) {
+    if ((get_xl_max(ctx) >= MXL_RV64) && ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
 
-- 
2.45.2

[PULL 3/5] target/riscv: Relax fld alignment requirement

[Alistair Francis]

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

According to the risc-v specification:
"FLD and FSD are only guaranteed to execute atomically if the effective
address is naturally aligned and XLEN≥64."

We currently implement fld as MO_ATOM_IFALIGN when XLEN < 64, which does
not violate the rules. But it will hide some problems. So relax it to
MO_ATOM_NONE.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240802072417.659-4-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvd.c.inc | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index 49682292b8..8a46124f98 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -48,11 +48,17 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
     REQUIRE_EXT(ctx, RVD);
 
     /*
-     * Zama16b applies to loads and stores of no more than MXLEN bits defined
-     * in the F, D, and Q extensions.
+     * FLD and FSD are only guaranteed to execute atomically if the effective
+     * address is naturally aligned and XLEN≥64. Also, zama16b applies to
+     * loads and stores of no more than MXLEN bits defined in the F, D, and
+     * Q extensions.
      */
-    if ((get_xl_max(ctx) >= MXL_RV64) && ctx->cfg_ptr->ext_zama16b) {
+    if (get_xl_max(ctx) == MXL_RV32) {
+        memop |= MO_ATOM_NONE;
+    } else if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
+    } else {
+        memop |= MO_ATOM_IFALIGN;
     }
 
     decode_save_opc(ctx);
@@ -71,8 +77,12 @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    if ((get_xl_max(ctx) >= MXL_RV64) && ctx->cfg_ptr->ext_zama16b) {
+    if (get_xl_max(ctx) == MXL_RV32) {
+        memop |= MO_ATOM_NONE;
+    } else if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
+    } else {
+        memop |= MO_ATOM_IFALIGN;
     }
 
     decode_save_opc(ctx);
-- 
2.45.2

[PULL 4/5] target/riscv: Add asserts for out-of-bound access

[Alistair Francis]

From: Atish Patra <atishp@rivosinc.com>

Coverity complained about the possible out-of-bounds access with
counter_virt/counter_virt_prev because these two arrays are
accessed with privilege mode. However, these two arrays are accessed
only when virt is enabled. Thus, the privilege mode can't be M mode.

Add the asserts anyways to detect any wrong usage of these arrays
in the future.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Fixes: Coverity CID 1558459
Fixes: Coverity CID 1558462
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240724-fixes-v1-1-4a64596b0d64@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index 3cc0b3648c..e05ab067d2 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -204,6 +204,7 @@ static void riscv_pmu_icount_update_priv(CPURISCVState *env,
     }
 
     if (env->virt_enabled) {
+        g_assert(env->priv <= PRV_S);
         counter_arr = env->pmu_fixed_ctrs[1].counter_virt;
         snapshot_prev = env->pmu_fixed_ctrs[1].counter_virt_prev;
     } else {
@@ -212,6 +213,7 @@ static void riscv_pmu_icount_update_priv(CPURISCVState *env,
     }
 
     if (new_virt) {
+        g_assert(newpriv <= PRV_S);
         snapshot_new = env->pmu_fixed_ctrs[1].counter_virt_prev;
     } else {
         snapshot_new = env->pmu_fixed_ctrs[1].counter_prev;
@@ -242,6 +244,7 @@ static void riscv_pmu_cycle_update_priv(CPURISCVState *env,
     }
 
     if (env->virt_enabled) {
+        g_assert(env->priv <= PRV_S);
         counter_arr = env->pmu_fixed_ctrs[0].counter_virt;
         snapshot_prev = env->pmu_fixed_ctrs[0].counter_virt_prev;
     } else {
@@ -250,6 +253,7 @@ static void riscv_pmu_cycle_update_priv(CPURISCVState *env,
     }
 
     if (new_virt) {
+        g_assert(newpriv <= PRV_S);
         snapshot_new = env->pmu_fixed_ctrs[0].counter_virt_prev;
     } else {
         snapshot_new = env->pmu_fixed_ctrs[0].counter_prev;
-- 
2.45.2

[PULL 5/5] roms/opensbi: Update to v1.5.1

[Alistair Francis]

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

A new minor version of OpenSBI was just released after our bump to
OpenSBI 1.5. It contains significant bug fixes that it's worth doing
a new update for QEMU 9.1.

Submodule roms/opensbi 455de672dd..43cace6c36:
  > lib: sbi: check result of pmp_get() in is_pmp_entry_mapped()
  > lib: sbi: fwft: fix incorrect size passed to sbi_zalloc()
  > lib: sbi: dbtr: fix potential NULL pointer dereferences
  > include: Adjust Sscofpmf mhpmevent mask for upper 8 bits
  > lib: sbi_hsm: Save/restore menvcfg only when it exists

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240805120259.1705016-2-dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 268312 -> 268312 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 272504 -> 272504 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index 7ec260ff40..b2e740010b 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index 090c0cf6ac..018b4731a7 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index 455de672dd..43cace6c36 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 455de672dd7c2aa1992df54dfb08dc11abbc1b1a
+Subproject commit 43cace6c3671e5172d0df0a8963e552bb04b7b20
-- 
2.45.2

Re: [PULL 0/5] riscv-to-apply queue

[Richard Henderson]

On 8/6/24 16:25, Alistair Francis wrote:
> The following changes since commit e7207a9971dd41618b407030902b0b2256deb664:
> 
>    Merge tag 'for-upstream' ofhttps://gitlab.com/bonzini/qemu into staging (2024-08-06 08:02:34 +1000)
> 
> are available in the Git repository at:
> 
>    https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240806-2
> 
> for you to fetch changes up to b3a34eb90d8264bd73ccb25295b1a7e271a9029c:
> 
>    roms/opensbi: Update to v1.5.1 (2024-08-06 15:01:01 +1000)
> 
> ----------------------------------------------------------------
> RISC-V PR for 9.1
> 
> * roms/opensbi: update to v1.5.1
> * target/riscv: Add asserts for out-of-bound access
> * Remove redundant insn length check for zama16b

Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/9.1 as appropriate.

r~