Merge branch 'main' into preface-update

Signed-off-by: Bill Traynor <wmat@riscv.org>

15 files changed, 175 insertions, 264 deletions

diff --git a/src/b-st-ext.adoc b/src/b-st-ext.adoc
index 5a6c69f..18680dd 100644
--- a/src/b-st-ext.adoc
+++ b/src/b-st-ext.adoc
@@ -41,7 +41,7 @@ The first group of bitmanip extensions to be released for Public Review are:
 * <<#zbc>>
 * <<#zbs>>
 
-Below is a list of all of the instructions (and pseudoinstructions) that are included in these extensions
+Below is a list of all of the instructions that are included in these extensions
 along with their specific mapping:
 
 [%header,cols="^3,^3,10,16,^2,^2,^2,^2"]
@@ -442,15 +442,6 @@ along with their specific mapping:
 |
 |
 
-|
-|&#10003;
-|zext.w _rd_, _rs_
-|<<#insns-add_uw>>
-|&#10003;
-|
-|
-|
-
 |====
 
 [#zba,reftext=Address generation instructions]
@@ -865,78 +856,6 @@ a single bit in a register. The bit is specified by its index.
 
 |===
 
-[#zbkc,reftext="Carry-less multiplication for Cryptography"]
-==== Zbkc: Carry-less multiplication for Cryptography
-
-[NOTE,caption=Frozen]
-====
-The Zbkc extension is frozen.
-====
-
-Carry-less multiplication is the multiplication in the polynomial ring over
-GF(2). This is a critical operation in some cryptographic workloads,
-particularly the AES-GCM authenticated encryption scheme.
-This extension provides only the instructions needed to
-efficiently implement the GHASH operation, which is part of this workload.
-
-[%header,cols="^1,^1,4,8"]
-|===
-|RV32
-|RV64
-|Mnemonic
-|Instruction
-
-|&#10003;
-|&#10003;
-|clmul _rd_, _rs1_, _rs2_
-|<<#insns-clmul>>
-
-|&#10003;
-|&#10003;
-|clmulh _rd_, _rs1_, _rs2_
-|<<#insns-clmulh>>
-
-|===
-
-[#zbkx,reftext="Crossbar permutations"]
-==== Zbkx: Crossbar permutations
-
-[NOTE,caption=Frozen]
-====
-The Zbkx extension is frozen.
-====
-
-These instructions implement a "lookup table" for 4 and 8 bit elements
-inside the general purpose registers.
-_rs1_ is used as a vector of N-bit words, and _rs2_ as a vector of N-bit
-indices into _rs1_.
-Elements in _rs1_ are replaced by the indexed element in _rs2_, or zero
-if the index into _rs2_ is out of bounds.
-
-These instructions are useful for expressing N-bit to N-bit boolean
-operations, and implementing cryptographic code with secret
-dependent memory accesses (particularly SBoxes) such that the execution
-latency does not depend on the (secret) data being operated on.
-
-[%header,cols="^1,^1,4,8"]
-|===
-|RV32
-|RV64
-|Mnemonic
-|Instruction
-
-|&#10003;
-|&#10003;
-|xperm.n _rd_, _rs1_, _rs2_
-|<<#insns-xpermn>>
-
-|&#10003;
-|&#10003;
-|xperm.b _rd_, _rs1_, _rs2_
-|<<#insns-xpermb>>
-
-|===
-
 [#zbkb,reftext="Bit-manipulation for Cryptography"]
 ==== Zbkb: Bit-manipulation for Cryptography
 
@@ -1038,6 +957,78 @@ common operations in cryptographic workloads.
 
 |===
 
+[#zbkc,reftext="Carry-less multiplication for Cryptography"]
+==== Zbkc: Carry-less multiplication for Cryptography
+
+[NOTE,caption=Frozen]
+====
+The Zbkc extension is frozen.
+====
+
+Carry-less multiplication is the multiplication in the polynomial ring over
+GF(2). This is a critical operation in some cryptographic workloads,
+particularly the AES-GCM authenticated encryption scheme.
+This extension provides only the instructions needed to
+efficiently implement the GHASH operation, which is part of this workload.
+
+[%header,cols="^1,^1,4,8"]
+|===
+|RV32
+|RV64
+|Mnemonic
+|Instruction
+
+|&#10003;
+|&#10003;
+|clmul _rd_, _rs1_, _rs2_
+|<<#insns-clmul>>
+
+|&#10003;
+|&#10003;
+|clmulh _rd_, _rs1_, _rs2_
+|<<#insns-clmulh>>
+
+|===
+
+[#zbkx,reftext="Crossbar permutations"]
+==== Zbkx: Crossbar permutations
+
+[NOTE,caption=Frozen]
+====
+The Zbkx extension is frozen.
+====
+
+These instructions implement a "lookup table" for 4 and 8 bit elements
+inside the general purpose registers.
+_rs1_ is used as a vector of N-bit words, and _rs2_ as a vector of N-bit
+indices into _rs1_.
+Elements in _rs1_ are replaced by the indexed element in _rs2_, or zero
+if the index into _rs2_ is out of bounds.
+
+These instructions are useful for expressing N-bit to N-bit boolean
+operations, and implementing cryptographic code with secret
+dependent memory accesses (particularly SBoxes) such that the execution
+latency does not depend on the (secret) data being operated on.
+
+[%header,cols="^1,^1,4,8"]
+|===
+|RV32
+|RV64
+|Mnemonic
+|Instruction
+
+|&#10003;
+|&#10003;
+|xperm.n _rd_, _rs1_, _rs2_
+|<<#insns-xpermn>>
+
+|&#10003;
+|&#10003;
+|xperm.b _rd_, _rs1_, _rs2_
+|<<#insns-xpermb>>
+
+|===
+
 <<<
 
 [#insns,reftext="Instructions (in alphabetical order)"]
diff --git a/src/cmo.adoc b/src/cmo.adoc
index 705166a..c477dca 100644
--- a/src/cmo.adoc
+++ b/src/cmo.adoc
@@ -89,7 +89,7 @@ a cache that first performs a read transfer from memory._
 
 Caches organize copies of data into _cache blocks_, each of which represents a
 contiguous, naturally aligned power-of-two (or _NAPOT_) range of memory
-locations. A cache block is identified by a physical address corresponding to
+locations. A cache block is identified by any of the physical addresses corresponding to
 the underlying memory locations. The capacity and organization of a cache and
 the size of a cache block are both _implementation-specific_, and the execution
 environment provides software a means to discover information about the caches
@@ -381,6 +381,8 @@ exceptions and shall not access any caches or memory. During address
 translation, the instruction does _not_ check the accessed and dirty bits and
 neither raises an exception nor sets the bits.
 
+When a page fault, guest-page fault, or access fault exception is taken, the relevant *tval CSR is written with the faulting effective address (i.e. the same faulting address value as for other causes of these exceptions).
+
 [NOTE]
 ====
 _Like a load or store instruction, a CMO instruction may or may not be permitted
diff --git a/src/hypervisor.adoc b/src/hypervisor.adoc
index e4775b5..5a66919 100644
--- a/src/hypervisor.adoc
+++ b/src/hypervisor.adoc
@@ -1708,7 +1708,7 @@ NOTE: No mechanism is provided to atomically change `vsatp` and `hgatp`
 together.  Hence, to prevent speculative execution causing one guest's
 VS-stage translations to be cached under another guest's VMID, world-switch
 code should zero `vsatp`, then swap `hgatp`, then finally write the new
-`vstap` value.  Similarly, if `henvcfg`.PBMTE need be world-switched, it
+`vsatp` value.  Similarly, if `henvcfg`.PBMTE need be world-switched, it
 should be switched after zeroing `vsatp` but before writing the new `vsatp`
 value, obviating the need to execute an HFENCE.VVMA instruction.
 
diff --git a/src/images/bytefield/hpmcounters.adoc b/src/images/bytefield/hpmcounters.adoc
deleted file mode 100644
index 62a0357..0000000
--- a/src/images/bytefield/hpmcounters.adoc
+++ /dev/null
@@ -1,20 +0,0 @@
-[bytefield]
-----
-(defattrs :plain [:plain {:font-family "M+ 1p Fallback"}])
-(def row-header-fn nil)
-(def boxes-per-row 14)
-(def left-margin 200)
-(def right-margin 200)
-
-(draw-box "31" {:span 7 :text-anchor "start" :borders {}})
-(draw-box "0" {:span 7 :text-anchor "end" :borders {}})
-
-(draw-box "mcycleh" {:span 14})
-(draw-box "minstreth" {:span 14})
-(draw-box "mhpmcounter3h" {:span 14})
-(draw-box "mhpmcounter4h" {:span 14})
-(draw-box "⋮" {:span 14})
-(draw-box "mhpmcounter30h" {:span 14})
-(draw-box "mhpmcounter31h" {:span 14})
-(draw-box "32" {:span 14 :borders {}})
-----
\ No newline at end of file
diff --git a/src/images/bytefield/hpmevents.adoc b/src/images/bytefield/hpmevents.adoc
index 98a703d..8556b8b 100644
--- a/src/images/bytefield/hpmevents.adoc
+++ b/src/images/bytefield/hpmevents.adoc
@@ -18,7 +18,7 @@
 
 (draw-box nil {:span 14 :borders {}})
 (draw-box nil {:span 4 :borders {}})
-(draw-box "MXLEN-1" {:span 7 :text-anchor "start" :borders{}})
+(draw-box "63" {:span 7 :text-anchor "start" :borders{}})
 (draw-box "0" {:span 7 :text-anchor "end" :borders{}})
 
 (draw-box "mhpmcounter3" {:span 14})
@@ -43,5 +43,5 @@
 
 (draw-box "64" {:span 14 :borders {}})
 (draw-box nil {:span 4 :borders {}})
-(draw-box "MXLEN" {:span 14 :borders {}})
-----
\ No newline at end of file
+(draw-box "64" {:span 14 :borders {}})
+----
diff --git a/src/machine.adoc b/src/machine.adoc
index b92781a..2745dac 100644
--- a/src/machine.adoc
+++ b/src/machine.adoc
@@ -1424,7 +1424,7 @@ to indicate which harts share an `mcycle` CSR.
 
 The hardware performance monitor includes 29 additional 64-bit event
 counters, `mhpmcounter3`-`mhpmcounter31`. The event selector CSRs,
-`mhpmevent3`-`mhpmevent31`, are MXLEN-bit *WARL* registers that control which
+`mhpmevent3`-`mhpmevent31`, are 64-bit *WARL* registers that control which
 event causes the corresponding counter to increment. The meaning of
 these events is defined by the platform, but event 0 is defined to mean
 "no event." All counters should be implemented, but a legal
@@ -1444,14 +1444,12 @@ generate an interrupt when a hardware performance monitor counter
 overflows.
 ====
 
-When XLEN=32, reads of the `mcycle`, `minstret`, and `mhpmcountern`
-CSRs return bits 31-0 of the corresponding counter, and writes change
-only bits 31-0; reads of the `mcycleh`, `minstreth`, and `mhpmcounternh`
-CSRs return bits 63-32 of the corresponding counter, and writes change
+When XLEN=32, reads of the `mcycle`, `minstret`, `mhpmcounter__n__`, and `mhpmevent__n__`
+CSRs return bits 31-0 of the corresponding register, and writes change
+only bits 31-0; reads of the `mcycleh`, `minstreth`, `mhpmcounter__n__h`, and `mhpmevent__n__h`
+CSRs return bits 63-32 of the corresponding register, and writes change
 only bits 63-32.
-
-.Upper 32 bits of hardware performance monitor counters, RV32 only.
-include::images/bytefield/hpmcounters.adoc[]
+The `mhpmevent__n__h` CSRs are provided only if the Sscofpmf extension is implemented.
 
 [[mcounteren]]
 ==== Machine Counter-Enable Register (`mcounteren`)
diff --git a/src/priv-csrs.adoc b/src/priv-csrs.adoc
index a414e81..6383bb0 100644
--- a/src/priv-csrs.adoc
+++ b/src/priv-csrs.adoc
@@ -253,22 +253,26 @@ Supervisor counter enable.
 `0x141` +
 `0x142` +
 `0x143` +
-`0x144` 
+`0x144` +
+`0xDA0`
 |SRW +
 SRW +
 SRW +
 SRW +
-SRW 
+SRW +
+SRO
 |`sscratch` +
 `sepc` +
 `scause` +
 `stval` +
-`sip`
+`sip` +
+`scountovf`
 |Scratch register for supervisor trap handlers. +
 Supervisor exception program counter. +
 Supervisor trap cause. +
 Supervisor bad address or instruction. +
-Supervisor interrupt pending.
+Supervisor interrupt pending. +
+Supervisor count overflow.
 
 4+^|Supervisor Protection and Translation
 
@@ -661,22 +665,38 @@ Upper 32 bits of `mhpmcounter31`, RV32 only.
 `0x323` +
 `0x324` +
 &#160; +
-`0x33F`
+`0x33F` +
+`0x723` +
+`0x724` +
+&#160; +
+`0x73F`
 |MRW + 
 MRW +
 MRW +
 &#160; +
 MRW +
+MRW +
+MRW +
+&#160; +
+MRW
 |`mcountinhibit` +
 `mhpmevent3` +
 `mhpmevent4` +
 &#8942; +
-`mhpmevent31` 
+`mhpmevent31` +
+`mhpmevent3h` +
+`mhpmevent4h` +
+&#8942; +
+`mhpmevent31h`
 |Machine counter-inhibit register. +
 Machine performance-monitoring event selector. +
 Machine performance-monitoring event selector. +
 &#160; +
-Machine performance-monitoring event selector.
+Machine performance-monitoring event selector. +
+Upper 32 bits of `mhpmevent3`, RV32 only. +
+Upper 32 bits of `mhpmevent4`, RV32 only. +
+&#160; +
+Upper 32 bits of `mhpmevent31`, RV32 only.
 
 
 4+^|Debug/Trace Registers (shared with Debug Mode)
diff --git a/src/resources/themes/riscv-spec.yml b/src/resources/themes/riscv-spec.yml
index 29daeaf..b09c4e4 100644
--- a/src/resources/themes/riscv-spec.yml
+++ b/src/resources/themes/riscv-spec.yml
@@ -76,11 +76,7 @@ codespan:
     #font_family: Droid Fallback
     font_family: M+ 1mn
     font_style: normal
-    font-size: 11.5
-role:
-  monofont:
-    codespan:
-      font-size: 9
+#    font-size: 11.5
 menu_caret_content: " <font size=\"1.15em\"><color rgb=\"000000\">\u203a</color></font> "
 heading:
     align: left
diff --git a/src/riscv-unprivileged.adoc b/src/riscv-unprivileged.adoc
index fd26baf..e68ea0c 100644
--- a/src/riscv-unprivileged.adoc
+++ b/src/riscv-unprivileged.adoc
@@ -186,8 +186,8 @@ include::b-st-ext.adoc[]
 include::j-st-ext.adoc[]
 include::p-st-ext.adoc[]
 include::v-st-ext.adoc[]
-include::vector-crypto.adoc[]
 include::scalar-crypto.adoc[]
+include::vector-crypto.adoc[]
 include::rv-32-64g.adoc[]
 include::extending.adoc[]
 include::naming.adoc[]
diff --git a/src/rv-32-64g.adoc b/src/rv-32-64g.adoc
index 1818ddf..0464228 100644
--- a/src/rv-32-64g.adoc
+++ b/src/rv-32-64g.adoc
@@ -19,7 +19,7 @@ and RV64G.
 |00           |LOAD   |LOAD-FP  |_custom-0_ |MISC-MEM |OP-IMM |AUIPC      |OP-IMM-32       |48b
 |01           |STORE  |STORE-FP |_custom-1_ |AMO      |OP     |LUI        |OP-32           |64b
 |10           |MADD   |MSUB     |NMSUB      |NMADD    |OP-FP  |OP-V       |_custom-2/rv128_|48b
-|11           |BRANCH |JALR     |_reserved_ |JAL      |SYSTEM |_reserved_ |_custom-3/rv128_|&#8805;80b
+|11           |BRANCH |JALR     |_reserved_ |JAL      |SYSTEM |OP-VE      |_custom-3/rv128_|&#8805;80b
 |===
 
 <<opcodemap>> shows a map of the major opcodes for
diff --git a/src/smstateen.adoc b/src/smstateen.adoc
index f524581..6e18156 100644
--- a/src/smstateen.adoc
+++ b/src/smstateen.adoc
@@ -1,5 +1,5 @@
 [[smstateen]]
-== "Smststeen" State Enable Extension, Version 1.0.0
+== "Smstateen/Ssstateen" Extensions, Version 1.0.0
 
 === Motivation
 
@@ -45,6 +45,8 @@ Hence, a new place is proposed for them instead.
 
 === Proposal
 
+These extensions collectively specify machine-mode and supervisor-mode features. The Smstateen extension specification comprises the mstateen*, sstateen*, and hstateen* CSRs and their functionality. The Ssstateen extension specification comprises only the sstateen* and hstateen* CSRs and their functionality.
+
 For RV64 harts, this extension adds four new 64-bit CSRs at machine level,
 listed with their CSR addresses:
 
diff --git a/src/sscofpmf.adoc b/src/sscofpmf.adoc
index 8ed0984..3ee5aae 100644
--- a/src/sscofpmf.adoc
+++ b/src/sscofpmf.adoc
@@ -26,49 +26,29 @@ extensions, and 'cofpmf' for Count OverFlow and Privilege Mode Filtering).
 Note that the new count overflow interrupt will be treated as a standard local
 interrupt that is assigned to bit 13 in the mip/mie/sip/sie registers.
 
-=== Machine Level Additions
-
-==== Hardware Performance Monitor
-
-This extension expands the hardware performance monitor description and extends
-the mhpmevent registers to 64 bits (in RV32) as follows:
-
-The hardware performance monitor includes 29 additional 64-bit event counters and 29 associated 64-bit event selector registers - the mhpmcounter3–mhpmcounter31 and mhpmevent3–mhpmevent31 CSRs.
-
-The mhpmcounters are WARL registers that support up to 64 bits of precision on
-RV32 and RV64.
-
-The mhpmevent__n__ registers are WARL registers that control which event causes
-the corresponding counter to increment and what happens when the corresponding
-count overflows. Currently just a few bits are defined here. Past this, the
-actual selection and meaning of events is defined by the platform, but
-(mhpmevent == 0) is defined to mean “no event" and that the corresponding
-counter will never be incremented. Typically the lower bits of mhpmevent will
-be used for event selection purposes.
-
-On RV32 only, accesses to the mcycle, minstret, mhpmcounter__n__, and
-mhpmevent__n__ CSRs access the low 32 bits, while accesses to the mcycleh,
-minstreth, mhpmcounter__n__h, and mhpmevent__n__h CSRs access bits 63–32 of the
-corresponding counter or event selector. The proposed CSR numbers for
-mhpmevent__n__h are 0x723 - 0x73F.
-
-The following bits are added to mhpmevent:
-
-bit [63] +++OF+++ - Overflow status and interrupt disable bit that is set when counter overflows
-
-bit [62] +++MINH+++ - If set, then counting of events in M-mode is inhibited
-
-bit [61] +++SINH+++ - If set, then counting of events in S/HS-mode is inhibited
-
-bit [60] +++UINH+++ - If set, then counting of events in U-mode is inhibited
-
-bit [59] +++VSINH+++ - If set, then counting of events in VS-mode is inhibited
-
-bit [58] +++VUINH+++ - If set, then counting of events in VU-mode is inhibited
-
-bit [57] 0 - Reserved for possible future modes
-
-bit [56] 0 - Reserved for possible future modes
+=== Count Overflow Control
+
+The following bits are added to `mhpmevent`:
+
+[cols="^1,^1,^1,^1,^1,^1",stripes=even,options="header"]
+|====
+|63 |62 |61 |60 |59 |58
+|OF |MINH |SINH |UINH |VSINH |VUINH
+|====
+
+[cols="15%,85%",options="header"]
+|====
+| Field | Description
+| OF | Overflow status and interrupt disable bit that is set when counter overflows
+| MINH | If set, then counting of events in M-mode is inhibited
+| SINH | If set, then counting of events in S/HS-mode is inhibited
+| UINH | If set, then counting of events in U-mode is inhibited
+| VSINH | If set, then counting of events in VS-mode is inhibited
+| VUINH | If set, then counting of events in VU-mode is inhibited
+|====
+
+For each ``x``INH bit, if the associated privilege mode is not implemented,
+the bit is read-only zero.
 
 Each of the five ``x``INH bits, when set, inhibit counting of events while in
 privilege mode ``x``. All-zeroes for these bits results in counting of events in
@@ -123,58 +103,12 @@ maintaining a bit mask reflecting which counters are active and due to
 eventually overflow.
 ====
 
-==== Machine Interrupt Registers (mip and mie)
-
-This extension adds the description of the LCOFIP/LCOFIE bits in these
-registers (and modifies related text) as follows:
-
-LCOFIP is added to mip in <<mipreg-standard>> as bit 13. LCOFIE is added to mie in
-<<miereg-standard>> as bit 13.
-
-If the Sscofpmf extension is implemented, bits mip.LCOFIP and mie.LCOFIE are
-the interrupt-pending and interrupt-enable bits for local count overflow
-interrupts. LCOFIP is read-write in mip and reflects the occurrence of a local
-count overflow interrupt request resulting from any of the mhpmevent__n__.OF
-bits being set. If the Sscofpmf extension is not implemented, these LCOFIP and
-LCOFIE bits are hardwired to zeros.
-
-Multiple simultaneous interrupts destined for different privilege modes are
-handled in decreasing order of destined privilege mode. Multiple simultaneous
-interrupts destined for the same privilege mode are handled in the following
-decreasing priority order: MEI, MSI, MTI, SEI, SSI, STI, LCOFI.
-
-=== Supervisor Level Additions
-
-==== Supervisor Interrupt Registers (sip and sie)
-
-This extension adds the description of the LCOFIP/LCOFIE bits in these
-registers (and modifies related text) as follows:
-
-LCOFIP is added to sip in <<sipreg-standard>> as bit 13. LCOFIE is added to sie in
-<<siereg-standard>> as bit 13.
-
-If the Sscofpmf extension is implemented, bits sip.LCOFIP and sie.LCOFIE are
-the interrupt-pending and interrupt-enable bits for local count overflow
-interrupts. LCOFIP is read-write in sip and reflects the occurrence of a local
-count overflow interrupt request resulting from any of the mhpmevent__n__.OF
-bits being set. If the Sscofpmf extension is not implemented, these LCOFIP and
-LCOFIE bits are hardwired to zeros.
-
-Each standard interrupt type (LCOFI, SEI, STI, or SSI) may not be implemented,
-in which case the corresponding interrupt-pending and interrupt-enable bits are
-hardwired to zeros. All bits in sip and sie are WARL fields.
-
-Multiple simultaneous interrupts destined for supervisor mode are handled in
-the following decreasing priority order: SEI, SSI, STI, LCOFI.
-
-==== Supervisor Count Overflow (scountovf)
-
-This extension adds this new CSR.
+=== Supervisor Count Overflow (scountovf) CSR
 
-The scountovf CSR is a 32-bit read-only register that contains shadow copies of
+This extension adds the `scountovf` CSR,
+a 32-bit read-only register that contains shadow copies of
 the OF bits in the 29 mhpmevent CSRs (mhpmevent__3__ - mhpmevent__31__) - where
-scountovf bit _X_ corresponds to mhpmevent__X__. The proposed CSR number is
-0xDA0.
+scountovf bit _X_ corresponds to mhpmevent__X__.
 
 This register enables supervisor-level overflow interrupt handler software to
 quickly and easily determine which counter(s) have overflowed (without needing
@@ -183,7 +117,7 @@ M-mode).
 
 Read access to bit _X_ is subject to the same mcounteren (or mcounteren and
 hcounteren) CSRs that mediate access to the hpmcounter CSRs by S-mode (or
-VS-mode). In M and S modes, scountovf bit _X_ is readable when mcounteren bit
+VS-mode). In M-mode, scountovf bit _X_ is always readable. In S/HS-mode, scountovf bit _X_ is readable when mcounteren bit
 _X_ is set, and otherwise reads as zero. Similarly, in VS mode, scountovf bit
 _X_ is readable when mcounteren bit _X_ and hcounteren bit _X_ are both set,
 and otherwise reads as zero.
diff --git a/src/sstc.adoc b/src/sstc.adoc
index b0e3738..bbee9a9 100644
--- a/src/sstc.adoc
+++ b/src/sstc.adoc
@@ -179,12 +179,12 @@ enables stimecmp for S-mode when set to one, and the same bit of henvcfg
 enables vstimecmp for VS-mode. These STCE bits are WARL and are hard-wired to 0
 when this extension is not implemented.
 
-When STCE in menvcfg is zero, an attempt to access stimecmp or vstimecmp in a
+When this extension is implemented and STCE in menvcfg is zero, an attempt to access stimecmp or vstimecmp in a
 mode other than M-mode raises an illegal instruction exception, STCE in henvcfg
 is read-only zero, and STIP in mip and sip reverts to its defined behavior as
-if this extension is not implemented.
+if this extension is not implemented. Further, if the H extension is implemented, then hip.VSTIP also reverts its defined behavior as if this extension is not implemented.
 
-When STCE in menvcfg is one but STCE in henvcfg is zero, an attempt to access
+But when STCE in menvcfg is one and STCE in henvcfg is zero, an attempt to access
 stimecmp (really vstimecmp) when V = 1 raises a virtual instruction exception,
 and VSTIP in hip reverts to its defined behavior as if this extension is not
 implemented.
diff --git a/src/vector-crypto.adoc b/src/vector-crypto.adoc
index 7700801..788575f 100644
--- a/src/vector-crypto.adoc
+++ b/src/vector-crypto.adoc
@@ -1,4 +1,4 @@
-== RISC-V Cryptography Extensions Volume II: Vector Instructions, Version 1.0.0
+== Cryptography Extensions Volume II: Vector Instructions, Version 1.0.0
 
 This document describes the Vector Cryptography extensions to the 
 RISC-V Instruction Set Architecture.
@@ -1199,7 +1199,7 @@ Encoding (Vector-Vector)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00001'},
@@ -1213,7 +1213,7 @@ Encoding (Vector-Scalar)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00001'},
@@ -1300,7 +1300,7 @@ Encoding (Vector-Vector)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00000'},
@@ -1314,7 +1314,7 @@ Encoding (Vector-Scalar)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00000'},
@@ -1406,7 +1406,7 @@ Encoding (Vector-Vector)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00011'},
@@ -1420,7 +1420,7 @@ Encoding (Vector-Scalar)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00011'},
@@ -1511,7 +1511,7 @@ Encoding (Vector-Vector)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00010'},
@@ -1525,7 +1525,7 @@ Encoding (Vector-Scalar)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00010'},
@@ -1616,7 +1616,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'uimm'},
@@ -1732,7 +1732,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'uimm'},
@@ -1845,7 +1845,7 @@ Encoding (Vector-Scalar)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '00111'},
@@ -2564,7 +2564,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'vs1'},
@@ -2692,7 +2692,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '10001'},
@@ -3136,7 +3136,7 @@ Encoding (Vector-Vector) High part::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'vs1'},
@@ -3150,7 +3150,7 @@ Encoding (Vector-Vector) Low part::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'vs1'},
@@ -3348,7 +3348,7 @@ Encoding (Vector-Vector)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'vs1'},
@@ -3533,7 +3533,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'uimm'},
@@ -3726,7 +3726,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'vs1'},
@@ -3878,7 +3878,7 @@ Encoding::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: 'uimm'},
@@ -4096,7 +4096,7 @@ Encoding (Vector-Vector)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '10000'},
@@ -4110,7 +4110,7 @@ Encoding (Vector-Scalar)::
 [wavedrom, , svg]
 ....
 {reg:[
-{bits: 7, name: 'OP-P'},
+{bits: 7, name: 'OP-VE'},
 {bits: 5, name: 'vd'},
 {bits: 3, name: 'OPMVV'},
 {bits: 5, name: '10000'},
@@ -4372,7 +4372,7 @@ Included in::
 [[crypto_vector_instructions]]
 === Crypto Vector Cryptographic Instructions
 
-OP-P (0x77)
+OP-VE (0x77)
 Crypto Vector instructions except Zvbb and Zvbc
 
 // [cols="4,1,1,1,8,4,1,1,8,4,1,1,8"]
diff --git a/src/zimop.adoc b/src/zimop.adoc
index 620aae3..b3a8a2e 100644
--- a/src/zimop.adoc
+++ b/src/zimop.adoc
@@ -1,11 +1,5 @@
 [[zimop]]
-== "Zimop" May-Be-Operations Extension, Version 0.1
-
-[WARNING]
-====
-*Warning! This stable specification may change before being accepted as
-a standard by RISC-V International.*
-====
+== "Zimop" May-Be-Operations Extension, Version 1.0
 
 This chapter defines the "Zimop" extension, which introduces the concept of
 instructions that _may be operations_ (MOPs).  MOPs are initially defined to
@@ -69,13 +63,7 @@ MOP may impose such a requirement.
 NOTE: Not carrying a syntactic dependency relieves straightforward
 implementations of reading `x[rs1]` and `x[rs2]`.
 
-=== "Zcmop" Compressed May-Be-Operations Extension, Version 0.2
-
-[WARNING]
-====
-*Warning! This stable specification may change before being accepted as
-a standard by RISC-V International.*
-====
+=== "Zcmop" Compressed May-Be-Operations Extension, Version 1.0
 
 This section defines the "Zcmop" extension, which defines eight 16-bit MOP
 instructions named C.MOP.__n__, where __n__ is an odd integer between 1 and