Series comparison

-[PULL v2 0/9] loongarch-to-apply queue
+[PULL v2 0/6] loongarch-to-apply queue
-The following changes since commit ece5f8374d0416a339f0c0a9399faa2c42d4ad6f:
+The following changes since commit 38d0939b86e2eef6f6a622c6f1f7befda0146595:
-  Merge tag 'linux-user-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-11-03 10:55:05 -0400)
+  Merge tag 'pull-vfio-20241226' of https://github.com/legoater/qemu into staging (2024-12-26 04:38:38 -0500)
 are available in the Git repository at:
-  https://gitlab.com/gaosong/qemu.git tags/pull-loongarch-20221104
+  https://gitlab.com/bibo-mao/qemu.git tags/pull-loongarch-20241227
-for you to fetch changes up to 2419978cb09e11bc53a07d4de5621424d2a6a86d:
+for you to fetch changes up to 5e360dabedb1ab1f15cce27a134ccbe4b8e18424:
-  target/loongarch: Fix emulation of float-point disable exception (2022-11-04 17:10:53 +0800)
+  target/loongarch: Use auto method with LASX feature (2024-12-27 11:33:06 +0800)
 ----------------------------------------------------------------
-pull-loongarch-20221104
+pull-loongarch-20241227
+v1 ... v2
-v2:
+. Modify patch auther inconsistent with SOB
  - fix win32/win64 complie error;
  - Add Rui Wang' patches.
 ----------------------------------------------------------------
-Rui Wang (2):
+Bibo Mao (5):
-      target/loongarch: Adjust the layout of hardware flags bit fields
+      target/loongarch: Use actual operand size with vbsrl check
-      target/loongarch: Fix emulation of float-point disable exception
+      hw/loongarch/virt: Create fdt table on machine creation done notification
       hw/loongarch/virt: Improve fdt table creation for CPU object
       target/loongarch: Use auto method with LSX feature
       target/loongarch: Use auto method with LASX feature
-Song Gao (2):
+Guo Hongyu (1):
-      target/loongarch: Add exception subcode
+      target/loongarch: Fix vldi inst
       target/loongarch: Fix raise_mmu_exception() set wrong exception_index
-Xiaojuan Yang (5):
+ hw/loongarch/virt.c                             | 142 ++++++++++++++----------
-      hw/intc: Convert the memops to with_attrs in LoongArch extioi
+ target/loongarch/cpu.c                          |  86 ++++++++------
-      hw/intc: Fix LoongArch extioi coreisr accessing
+ target/loongarch/cpu.h                          |   4 +
-      hw/loongarch: Load FDT table into dram memory space
+ target/loongarch/kvm/kvm.c                      | 107 ++++++++++++++++++
-      hw/loongarch: Improve fdt for LoongArch virt machine
+ target/loongarch/tcg/insn_trans/trans_vec.c.inc |   4 +-
-      hw/loongarch: Add TPM device for LoongArch virt machine
+files changed, 249 insertions(+), 94 deletions(-)
  hw/intc/loongarch_extioi.c                         | 41 +++++++------
  hw/intc/trace-events                               |  3 +-
  hw/loongarch/acpi-build.c                          | 51 +++++++++++++++-
  hw/loongarch/virt.c                                | 53 ++++++++++++++---
  include/hw/loongarch/virt.h                        |  3 -
  include/hw/pci-host/ls7a.h                         |  1 +
  target/loongarch/cpu.c                             | 10 +++-
  target/loongarch/cpu.h                             | 69 +++++++++++++---------
  target/loongarch/insn_trans/trans_farith.c.inc     | 30 ++++++++++
  target/loongarch/insn_trans/trans_fcmp.c.inc       | 11 +++-
  target/loongarch/insn_trans/trans_fmemory.c.inc    | 34 +++++++++--
  target/loongarch/insn_trans/trans_fmov.c.inc       | 29 ++++++++-
  target/loongarch/insn_trans/trans_privileged.c.inc |  2 +-
  target/loongarch/iocsr_helper.c                    | 19 +++---
  target/loongarch/tlb_helper.c                      |  5 +-
  target/loongarch/translate.c                       |  6 +-
 files changed, 283 insertions(+), 84 deletions(-)

-[PULL v2 8/9] target/loongarch: Adjust the layout of hardware flags bit fields
+[PULL v2 1/6] target/loongarch: Fix vldi inst
-From: Rui Wang <wangrui@loongson.cn>
+From: Guo Hongyu <guohongyu24@mails.ucas.ac.cn>
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
+Refer to the link below for a description of the vldi instructions:
-Reviewed-by: Song Gao <gaosong@loongson.cn>
+https://jia.je/unofficial-loongarch-intrinsics-guide/lsx/misc/#synopsis_88
-Signed-off-by: Rui Wang <wangrui@loongson.cn>
+Fixed errors in vldi instruction implementation.
-Message-Id: <20221104040517.222059-2-wangrui@loongson.cn>
-Signed-off-by: Song Gao <gaosong@loongson.cn>
+Signed-off-by: Guo Hongyu <guohongyu24@mails.ucas.ac.cn>
 Tested-by: Xianglai Li <lixianglai@loongson.cn>
 Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
 Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
 ---
- target/loongarch/cpu.h                             | 9 ++++++++-
+ target/loongarch/tcg/insn_trans/trans_vec.c.inc | 2 +-
- target/loongarch/insn_trans/trans_privileged.c.inc | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
  target/loongarch/translate.c                       | 6 +++++-
 files changed, 14 insertions(+), 3 deletions(-)
-diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
+diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.h
+--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
-+++ b/target/loongarch/cpu.h
++++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint64_t vldi_get_value(DisasContext *ctx, uint32_t imm)
- #include "qemu/timer.h"
+         break;
- #include "exec/memory.h"
+     case 1:
- #include "hw/sysbus.h"
+         /* data: {2{16'0, imm[7:0], 8'0}} */
-+#include "cpu-csr.h"
+-        data = (t << 24) | (t << 8);
++        data = (t << 40) | (t << 8);
- #define IOCSRF_TEMP             0
+         break;
- #define IOCSRF_NODECNT          1
+     case 2:
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPULoongArchState *env, bool ifetch)
+         /* data: {2{8'0, imm[7:0], 16'0}} */
  #endif
  }
 +/*
 + * LoongArch CPUs hardware flags.
 + */
 +#define HW_FLAGS_PLV_MASK   R_CSR_CRMD_PLV_MASK  /* 0x03 */
 +#define HW_FLAGS_CRMD_PG    R_CSR_CRMD_PG_MASK   /* 0x10 */
 +
  static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
                                          target_ulong *pc,
                                          target_ulong *cs_base,
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
  {
      *pc = env->pc;
      *cs_base = 0;
 -    *flags = cpu_mmu_index(env, false);
 +    *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
  }
  void loongarch_cpu_list(void);
 diff --git a/target/loongarch/insn_trans/trans_privileged.c.inc b/target/loongarch/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/insn_trans/trans_privileged.c.inc
 +++ b/target/loongarch/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static const CSRInfo csr_info[] = {
  static bool check_plv(DisasContext *ctx)
  {
 -    if (ctx->base.tb->flags == MMU_USER_IDX) {
 +    if (ctx->mem_idx == MMU_USER_IDX) {
          generate_exception(ctx, EXCCODE_IPE);
          return true;
      }
 diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/translate.c
 +++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_tr_init_disas_context(DisasContextBase *dcbase,
      DisasContext *ctx = container_of(dcbase, DisasContext, base);
      ctx->page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
 -    ctx->mem_idx = ctx->base.tb->flags;
 +    if (ctx->base.tb->flags & HW_FLAGS_CRMD_PG) {
 +        ctx->mem_idx = ctx->base.tb->flags & HW_FLAGS_PLV_MASK;
 +    } else {
 +        ctx->mem_idx = MMU_DA_IDX;
 +    }
      /* Bound the number of insns to execute to those left on the page.  */
      bound = -(ctx->base.pc_first | TARGET_PAGE_MASK) / 4;
 --
-.31.1
+.43.5

-[PULL v2 1/9] hw/intc: Convert the memops to with_attrs in LoongArch extioi
+[PULL v2 2/6] target/loongarch: Use actual operand size with vbsrl check
-From: Xiaojuan Yang <yangxiaojuan@loongson.cn>
+Hardcoded 32 bytes is used for vbsrl emulation check, there is
 problem when options lsx=on,lasx=off is used for vbsrl.v instruction
 in TCG mode. It injects LASX exception rather LSX exception.
-Converting the MemoryRegionOps read/write handlers to
+Here actual operand size is used.
 with_attrs in LoongArch extioi emulation.
-Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
+Cc: qemu-stable@nongnu.org
 Fixes: df97f338076 ("target/loongarch: Implement xvreplve xvinsve0 xvpickve")
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20221021015307.2570844-2-yangxiaojuan@loongson.cn>
-Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- hw/intc/loongarch_extioi.c | 31 +++++++++++++++++--------------
+ target/loongarch/tcg/insn_trans/trans_vec.c.inc | 2 +-
- hw/intc/trace-events       |  3 +--
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 18 insertions(+), 16 deletions(-)
-diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
+diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/loongarch_extioi.c
+--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
-+++ b/hw/intc/loongarch_extioi.c
++++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
-@@ -XXX,XX +XXX,XX @@ static void extioi_setirq(void *opaque, int irq, int level)
+@@ -XXX,XX +XXX,XX @@ static bool do_vbsrl_v(DisasContext *ctx, arg_vv_i *a, uint32_t oprsz)
      extioi_update_irq(s, irq, level);
  }
 -static uint64_t extioi_readw(void *opaque, hwaddr addr, unsigned size)
 +static MemTxResult extioi_readw(void *opaque, hwaddr addr, uint64_t *data,
 +                                unsigned size, MemTxAttrs attrs)
  {
-     LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
+     int i, ofs;
-     unsigned long offset = addr & 0xffff;
--    uint32_t index, cpu, ret = 0;
+-    if (!check_vec(ctx, 32)) {
-+    uint32_t index, cpu;
++    if (!check_vec(ctx, oprsz)) {
+         return true;
      switch (offset) {
      case EXTIOI_NODETYPE_START ... EXTIOI_NODETYPE_END - 1:
          index = (offset - EXTIOI_NODETYPE_START) >> 2;
 -        ret = s->nodetype[index];
 +        *data = s->nodetype[index];
          break;
      case EXTIOI_IPMAP_START ... EXTIOI_IPMAP_END - 1:
          index = (offset - EXTIOI_IPMAP_START) >> 2;
 -        ret = s->ipmap[index];
 +        *data = s->ipmap[index];
          break;
      case EXTIOI_ENABLE_START ... EXTIOI_ENABLE_END - 1:
          index = (offset - EXTIOI_ENABLE_START) >> 2;
 -        ret = s->enable[index];
 +        *data = s->enable[index];
          break;
      case EXTIOI_BOUNCE_START ... EXTIOI_BOUNCE_END - 1:
          index = (offset - EXTIOI_BOUNCE_START) >> 2;
 -        ret = s->bounce[index];
 +        *data = s->bounce[index];
          break;
      case EXTIOI_COREISR_START ... EXTIOI_COREISR_END - 1:
          index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
          cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
 -        ret = s->coreisr[cpu][index];
 +        *data = s->coreisr[cpu][index];
          break;
      case EXTIOI_COREMAP_START ... EXTIOI_COREMAP_END - 1:
          index = (offset - EXTIOI_COREMAP_START) >> 2;
 -        ret = s->coremap[index];
 +        *data = s->coremap[index];
          break;
      default:
          break;
      }
--    trace_loongarch_extioi_readw(addr, ret);
--    return ret;
-+    trace_loongarch_extioi_readw(addr, *data);
-+    return MEMTX_OK;
- }
- static inline void extioi_enable_irq(LoongArchExtIOI *s, int index,\
-@@ -XXX,XX +XXX,XX @@ static inline void extioi_enable_irq(LoongArchExtIOI *s, int index,\
-     }
- }
--static void extioi_writew(void *opaque, hwaddr addr,
--                          uint64_t val, unsigned size)
-+static MemTxResult extioi_writew(void *opaque, hwaddr addr,
-+                          uint64_t val, unsigned size,
-+                          MemTxAttrs attrs)
- {
-     LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
-     int i, cpu, index, old_data, irq;
-@@ -XXX,XX +XXX,XX @@ static void extioi_writew(void *opaque, hwaddr addr,
-     default:
-         break;
-     }
-+    return MEMTX_OK;
- }
- static const MemoryRegionOps extioi_ops = {
--    .read = extioi_readw,
--    .write = extioi_writew,
-+    .read_with_attrs = extioi_readw,
-+    .write_with_attrs = extioi_writew,
-     .impl.min_access_size = 4,
-     .impl.max_access_size = 4,
-     .valid.min_access_size = 4,
-diff --git a/hw/intc/trace-events b/hw/intc/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/trace-events
-+++ b/hw/intc/trace-events
-@@ -XXX,XX +XXX,XX @@ loongarch_msi_set_irq(int irq_num) "set msi irq %d"
- # loongarch_extioi.c
- loongarch_extioi_setirq(int irq, int level) "set extirq irq %d level %d"
--loongarch_extioi_readw(uint64_t addr, uint32_t val) "addr: 0x%"PRIx64 "val: 0x%x"
-+loongarch_extioi_readw(uint64_t addr, uint64_t val) "addr: 0x%"PRIx64 "val: 0x%" PRIx64
- loongarch_extioi_writew(uint64_t addr, uint64_t val) "addr: 0x%"PRIx64 "val: 0x%" PRIx64
--
 --
-.31.1
+.43.5

-[PULL v2 2/9] hw/intc: Fix LoongArch extioi coreisr accessing
+Deleted patch
-From: Xiaojuan Yang <yangxiaojuan@loongson.cn>
-. When cpu read or write extioi COREISR reg, it should access
-the reg belonged to itself, so the cpu index of 's->coreisr'
-is current cpu number. Using MemTxAttrs' requester_id to get
-the cpu index.
-. it need not to mask 0x1f when calculate the coreisr array index.
-Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20221021015307.2570844-3-yangxiaojuan@loongson.cn>
-Signed-off-by: Song Gao <gaosong@loongson.cn>
----
- hw/intc/loongarch_extioi.c      | 10 ++++++----
- target/loongarch/iocsr_helper.c | 19 +++++++++++--------
-files changed, 17 insertions(+), 12 deletions(-)
-diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/loongarch_extioi.c
-+++ b/hw/intc/loongarch_extioi.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult extioi_readw(void *opaque, hwaddr addr, uint64_t *data,
-         *data = s->bounce[index];
-         break;
-     case EXTIOI_COREISR_START ... EXTIOI_COREISR_END - 1:
--        index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
--        cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
-+        index = (offset - EXTIOI_COREISR_START) >> 2;
-+        /* using attrs to get current cpu index */
-+        cpu = attrs.requester_id;
-         *data = s->coreisr[cpu][index];
-         break;
-     case EXTIOI_COREMAP_START ... EXTIOI_COREMAP_END - 1:
-@@ -XXX,XX +XXX,XX @@ static MemTxResult extioi_writew(void *opaque, hwaddr addr,
-         s->bounce[index] = val;
-         break;
-     case EXTIOI_COREISR_START ... EXTIOI_COREISR_END - 1:
--        index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
--        cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
-+        index = (offset - EXTIOI_COREISR_START) >> 2;
-+        /* using attrs to get current cpu index */
-+        cpu = attrs.requester_id;
-         old_data = s->coreisr[cpu][index];
-         s->coreisr[cpu][index] = old_data & ~val;
-         /* write 1 to clear interrrupt */
-diff --git a/target/loongarch/iocsr_helper.c b/target/loongarch/iocsr_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/iocsr_helper.c
-+++ b/target/loongarch/iocsr_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/cpu_ldst.h"
- #include "tcg/tcg-ldst.h"
-+#define GET_MEMTXATTRS(cas) \
-+        ((MemTxAttrs){.requester_id = env_cpu(cas)->cpu_index})
-+
- uint64_t helper_iocsrrd_b(CPULoongArchState *env, target_ulong r_addr)
- {
-     return address_space_ldub(&env->address_space_iocsr, r_addr,
--                              MEMTXATTRS_UNSPECIFIED, NULL);
-+                              GET_MEMTXATTRS(env), NULL);
- }
- uint64_t helper_iocsrrd_h(CPULoongArchState *env, target_ulong r_addr)
- {
-     return address_space_lduw(&env->address_space_iocsr, r_addr,
--                              MEMTXATTRS_UNSPECIFIED, NULL);
-+                              GET_MEMTXATTRS(env), NULL);
- }
- uint64_t helper_iocsrrd_w(CPULoongArchState *env, target_ulong r_addr)
- {
-     return address_space_ldl(&env->address_space_iocsr, r_addr,
--                             MEMTXATTRS_UNSPECIFIED, NULL);
-+                             GET_MEMTXATTRS(env), NULL);
- }
- uint64_t helper_iocsrrd_d(CPULoongArchState *env, target_ulong r_addr)
- {
-     return address_space_ldq(&env->address_space_iocsr, r_addr,
--                             MEMTXATTRS_UNSPECIFIED, NULL);
-+                             GET_MEMTXATTRS(env), NULL);
- }
- void helper_iocsrwr_b(CPULoongArchState *env, target_ulong w_addr,
-                       target_ulong val)
- {
-     address_space_stb(&env->address_space_iocsr, w_addr,
--                      val, MEMTXATTRS_UNSPECIFIED, NULL);
-+                      val, GET_MEMTXATTRS(env), NULL);
- }
- void helper_iocsrwr_h(CPULoongArchState *env, target_ulong w_addr,
-                       target_ulong val)
- {
-     address_space_stw(&env->address_space_iocsr, w_addr,
--                      val, MEMTXATTRS_UNSPECIFIED, NULL);
-+                      val, GET_MEMTXATTRS(env), NULL);
- }
- void helper_iocsrwr_w(CPULoongArchState *env, target_ulong w_addr,
-                       target_ulong val)
- {
-     address_space_stl(&env->address_space_iocsr, w_addr,
--                      val, MEMTXATTRS_UNSPECIFIED, NULL);
-+                      val, GET_MEMTXATTRS(env), NULL);
- }
- void helper_iocsrwr_d(CPULoongArchState *env, target_ulong w_addr,
-                       target_ulong val)
- {
-     address_space_stq(&env->address_space_iocsr, w_addr,
--                      val, MEMTXATTRS_UNSPECIFIED, NULL);
-+                      val, GET_MEMTXATTRS(env), NULL);
- }
---
-.31.1

-[PULL v2 4/9] hw/loongarch: Improve fdt for LoongArch virt machine
+[PULL v2 3/6] hw/loongarch/virt: Create fdt table on machine creation done notification
-From: Xiaojuan Yang <yangxiaojuan@loongson.cn>
+The same with ACPI table, fdt table is created on machine done
 notification. Some objects like CPU objects can be created with cold-plug
 method with command such as -smp x, -device la464-loongarch-cpu, so all
 objects finish to create when machine is done.
-Add new items into LoongArch FDT, including rtc and uart info.
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
 Reviewed-by: Song Gao <gaosong@loongson.cn>
 Message-Id: <20221028014007.2718352-3-yangxiaojuan@loongson.cn>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- hw/loongarch/virt.c        | 31 +++++++++++++++++++++++++++++++
+ hw/loongarch/virt.c | 103 ++++++++++++++++++++++++--------------------
- include/hw/pci-host/ls7a.h |  1 +
+file changed, 57 insertions(+), 46 deletions(-)
 files changed, 32 insertions(+)
 diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/loongarch/virt.c
 +++ b/hw/loongarch/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void virt_build_smbios(LoongArchVirtMachineState *lvms)
- #include "hw/display/ramfb.h"
+     }
- #include "hw/mem/pc-dimm.h"
+ }
-+static void fdt_add_rtc_node(LoongArchMachineState *lams)
++static void virt_fdt_setup(LoongArchVirtMachineState *lvms)
 +{
-+    char *nodename;
++    MachineState *machine = MACHINE(lvms);
-+    hwaddr base = VIRT_RTC_REG_BASE;
++    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
-+    hwaddr size = VIRT_RTC_LEN;
++    int i;
-+    MachineState *ms = MACHINE(lams);
++
-+
++    create_fdt(lvms);
-+    nodename = g_strdup_printf("/rtc@%" PRIx64, base);
++    fdt_add_cpu_nodes(lvms);
-+    qemu_fdt_add_subnode(ms->fdt, nodename);
++    fdt_add_memory_nodes(machine);
-+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "loongson,ls7a-rtc");
++    fdt_add_fw_cfg_node(lvms);
-+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 0x0, base, size);
++    fdt_add_flash_node(lvms);
-+    g_free(nodename);
++
 +    /* Add cpu interrupt-controller */
 +    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
 +    /* Add Extend I/O Interrupt Controller node */
 +    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
 +    /* Add PCH PIC node */
 +    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
 +    /* Add PCH MSI node */
 +    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
 +    /* Add pcie node */
 +    fdt_add_pcie_node(lvms, &pch_pic_phandle, &pch_msi_phandle);
 +
 +    /*
 +     * Create uart fdt node in reverse order so that they appear
 +     * in the finished device tree lowest address first
 +     */
 +    for (i = VIRT_UART_COUNT; i-- > 0;) {
 +        hwaddr base = VIRT_UART_BASE + i * VIRT_UART_SIZE;
 +        int irq = VIRT_UART_IRQ + i - VIRT_GSI_BASE;
 +        fdt_add_uart_node(lvms, &pch_pic_phandle, base, irq, i == 0);
 +    }
 +
 +    fdt_add_rtc_node(lvms, &pch_pic_phandle);
 +    fdt_add_ged_reset(lvms);
 +    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
 +                                   VIRT_PLATFORM_BUS_BASEADDRESS,
 +                                   VIRT_PLATFORM_BUS_SIZE,
 +                                   VIRT_PLATFORM_BUS_IRQ);
 +
 +    /*
 +     * Since lowmem region starts from 0 and Linux kernel legacy start address
 +     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
 +     * access. FDT size limit with 1 MiB.
 +     * Put the FDT into the memory map as a ROM image: this will ensure
 +     * the FDT is copied again upon reset, even if addr points into RAM.
 +     */
 +    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
 +    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
 +                          &address_space_memory);
 +    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
 +            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
 +}
 +
-+static void fdt_add_uart_node(LoongArchMachineState *lams)
+ static void virt_done(Notifier *notifier, void *data)
 +{
 +    char *nodename;
 +    hwaddr base = VIRT_UART_BASE;
 +    hwaddr size = VIRT_UART_SIZE;
 +    MachineState *ms = MACHINE(lams);
 +
 +    nodename = g_strdup_printf("/serial@%" PRIx64, base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "ns16550a");
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0, base, 0x0, size);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "clock-frequency", 100000000);
 +    g_free(nodename);
 +}
 +
  static void create_fdt(LoongArchMachineState *lams)
  {
-     MachineState *ms = MACHINE(lams);
+     LoongArchVirtMachineState *lvms = container_of(notifier,
-@@ -XXX,XX +XXX,XX @@ static void loongarch_devices_init(DeviceState *pch_pic, LoongArchMachineState *
+                                       LoongArchVirtMachineState, machine_done);
-                    qdev_get_gpio_in(pch_pic,
+     virt_build_smbios(lvms);
-                                     VIRT_UART_IRQ - PCH_PIC_IRQ_OFFSET),
+     loongarch_acpi_setup(lvms);
-, serial_hd(0), DEVICE_LITTLE_ENDIAN);
++    virt_fdt_setup(lvms);
-+    fdt_add_uart_node(lams);
+ }
  static void virt_powerdown_req(Notifier *notifier, void *opaque)
@@ -XXX,XX +XXX,XX @@ static DeviceState *create_platform_bus(DeviceState *pch_pic)
  }
  static void virt_devices_init(DeviceState *pch_pic,
 -                                   LoongArchVirtMachineState *lvms,
 -                                   uint32_t *pch_pic_phandle,
 -                                   uint32_t *pch_msi_phandle)
 +                                   LoongArchVirtMachineState *lvms)
  {
      MachineClass *mc = MACHINE_GET_CLASS(lvms);
      DeviceState *gpex_dev;
@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
          gpex_set_irq_num(GPEX_HOST(gpex_dev), i, 16 + i);
      }
 -    /* Add pcie node */
 -    fdt_add_pcie_node(lvms, pch_pic_phandle, pch_msi_phandle);
 -
      /*
       * Create uart fdt node in reverse order so that they appear
       * in the finished device tree lowest address first
@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
          serial_mm_init(get_system_memory(), base, 0,
                         qdev_get_gpio_in(pch_pic, irq),
 , serial_hd(i), DEVICE_LITTLE_ENDIAN);
 -        fdt_add_uart_node(lvms, pch_pic_phandle, base, irq, i == 0);
      }
      /* Network init */
-     for (i = 0; i < nb_nics; i++) {
+@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
@@ -XXX,XX +XXX,XX @@ static void loongarch_devices_init(DeviceState *pch_pic, LoongArchMachineState *
      sysbus_create_simple("ls7a_rtc", VIRT_RTC_REG_BASE,
                           qdev_get_gpio_in(pch_pic,
-                          VIRT_RTC_IRQ - PCH_PIC_IRQ_OFFSET));
+                          VIRT_RTC_IRQ - VIRT_GSI_BASE));
-+    fdt_add_rtc_node(lams);
+-    fdt_add_rtc_node(lvms, pch_pic_phandle);
+-    fdt_add_ged_reset(lvms);
-     pm_mem = g_new(MemoryRegion, 1);
-     memory_region_init_io(pm_mem, NULL, &loongarch_virt_pm_ops,
+     /* acpi ged */
-diff --git a/include/hw/pci-host/ls7a.h b/include/hw/pci-host/ls7a.h
+     lvms->acpi_ged = create_acpi_ged(pch_pic, lvms);
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
---- a/include/hw/pci-host/ls7a.h
+     CPULoongArchState *env;
-+++ b/include/hw/pci-host/ls7a.h
+     CPUState *cpu_state;
-@@ -XXX,XX +XXX,XX @@
+     int cpu, pin, i, start, num;
- #define VIRT_PCI_IRQS            48
+-    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
- #define VIRT_UART_IRQ            (PCH_PIC_IRQ_OFFSET + 2)
- #define VIRT_UART_BASE           0x1fe001e0
+     /*
-+#define VIRT_UART_SIZE           0X100
+      * Extended IRQ model.
- #define VIRT_RTC_IRQ             (PCH_PIC_IRQ_OFFSET + 3)
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
- #define VIRT_MISC_REG_BASE       (VIRT_PCH_REG_BASE + 0x00080000)
+     memory_region_add_subregion(&lvms->system_iocsr, MAIL_SEND_ADDR,
- #define VIRT_RTC_REG_BASE        (VIRT_MISC_REG_BASE + 0x00050100)
+                    sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 1));
 -    /* Add cpu interrupt-controller */
 -    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
 -
      for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
          cpu_state = qemu_get_cpu(cpu);
          cpudev = DEVICE(cpu_state);
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
          }
      }
 -    /* Add Extend I/O Interrupt Controller node */
 -    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
 -
      pch_pic = qdev_new(TYPE_LOONGARCH_PIC);
      num = VIRT_PCH_PIC_IRQ_NUM;
      qdev_prop_set_uint32(pch_pic, "pch_pic_irq_num", num);
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
          qdev_connect_gpio_out(DEVICE(d), i, qdev_get_gpio_in(extioi, i));
      }
 -    /* Add PCH PIC node */
 -    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
 -
      pch_msi = qdev_new(TYPE_LOONGARCH_PCH_MSI);
      start   =  num;
      num = EXTIOI_IRQS - start;
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
                                qdev_get_gpio_in(extioi, i + start));
      }
 -    /* Add PCH MSI node */
 -    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
 -
 -    virt_devices_init(pch_pic, lvms, &pch_pic_phandle, &pch_msi_phandle);
 +    virt_devices_init(pch_pic, lvms);
  }
  static void virt_firmware_init(LoongArchVirtMachineState *lvms)
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
          cpu_model = LOONGARCH_CPU_TYPE_NAME("la464");
      }
 -    create_fdt(lvms);
 -
      /* Create IOCSR space */
      memory_region_init_io(&lvms->system_iocsr, OBJECT(machine), NULL,
                            machine, "iocsr", UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
          lacpu = LOONGARCH_CPU(cpu);
          lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
      }
 -    fdt_add_cpu_nodes(lvms);
 -    fdt_add_memory_nodes(machine);
      fw_cfg_add_memory(machine);
      /* Node0 memory */
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
                          memmap_table,
                          sizeof(struct memmap_entry) * (memmap_entries));
      }
 -    fdt_add_fw_cfg_node(lvms);
 -    fdt_add_flash_node(lvms);
      /* Initialize the IO interrupt subsystem */
      virt_irq_init(lvms);
 -    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
 -                                   VIRT_PLATFORM_BUS_BASEADDRESS,
 -                                   VIRT_PLATFORM_BUS_SIZE,
 -                                   VIRT_PLATFORM_BUS_IRQ);
      lvms->machine_done.notify = virt_done;
      qemu_add_machine_init_done_notifier(&lvms->machine_done);
       /* connect powerdown request */
      lvms->powerdown_notifier.notify = virt_powerdown_req;
      qemu_register_powerdown_notifier(&lvms->powerdown_notifier);
 -    /*
 -     * Since lowmem region starts from 0 and Linux kernel legacy start address
 -     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
 -     * access. FDT size limit with 1 MiB.
 -     * Put the FDT into the memory map as a ROM image: this will ensure
 -     * the FDT is copied again upon reset, even if addr points into RAM.
 -     */
 -    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
 -    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
 -                          &address_space_memory);
 -    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
 -            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
 -
      lvms->bootinfo.ram_size = ram_size;
      loongarch_load_kernel(machine, &lvms->bootinfo);
  }
 --
-.31.1
+.43.5

-[PULL v2 3/9] hw/loongarch: Load FDT table into dram memory space
+[PULL v2 4/6] hw/loongarch/virt: Improve fdt table creation for CPU object
-From: Xiaojuan Yang <yangxiaojuan@loongson.cn>
+For CPU object, possible_cpu_arch_ids() function is used rather than
 smp.cpus. With command -smp x, -device la464-loongarch-cpu, smp.cpus
 is not accurate for all possible CPU objects, possible_cpu_arch_ids()
 is used here.
-Load FDT table into dram memory space, and the addr is 2 MiB.
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Since lowmem region starts from 0, FDT base address is located
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 at 2 MiB to avoid NULL pointer access.
 Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
 Acked-by: Song Gao <gaosong@loongson.cn>
 Message-Id: <20221028014007.2718352-2-yangxiaojuan@loongson.cn>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- hw/loongarch/virt.c         | 18 +++++++++++-------
+ hw/loongarch/virt.c | 39 +++++++++++++++++++++++++--------------
- include/hw/loongarch/virt.h |  3 ---
+file changed, 25 insertions(+), 14 deletions(-)
 files changed, 11 insertions(+), 10 deletions(-)
 diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/loongarch/virt.c
 +++ b/hw/loongarch/virt.c
-@@ -XXX,XX +XXX,XX @@ static void fdt_add_pcie_node(const LoongArchMachineState *lams)
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(LoongArchVirtMachineState *lvms)
-, FDT_PCI_RANGE_MMIO, 2, base_mmio,
+ static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
-, base_mmio, 2, size_mmio);
+ {
-     g_free(nodename);
+     int num;
--    qemu_fdt_dumpdtb(ms->fdt, lams->fdt_size);
+-    const MachineState *ms = MACHINE(lvms);
 -    int smp_cpus = ms->smp.cpus;
 +    MachineState *ms = MACHINE(lvms);
 +    MachineClass *mc = MACHINE_GET_CLASS(ms);
 +    const CPUArchIdList *possible_cpus;
 +    LoongArchCPU *cpu;
 +    CPUState *cs;
 +    char *nodename, *map_path;
      qemu_fdt_add_subnode(ms->fdt, "/cpus");
      qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
      qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
      /* cpu nodes */
 -    for (num = smp_cpus - 1; num >= 0; num--) {
 -        char *nodename = g_strdup_printf("/cpus/cpu@%d", num);
 -        LoongArchCPU *cpu = LOONGARCH_CPU(qemu_get_cpu(num));
 -        CPUState *cs = CPU(cpu);
 +    possible_cpus = mc->possible_cpu_arch_ids(ms);
 +    for (num = 0; num < possible_cpus->len; num++) {
 +        cs = possible_cpus->cpus[num].cpu;
 +        if (cs == NULL) {
 +            continue;
 +        }
 +
 +        nodename = g_strdup_printf("/cpus/cpu@%d", num);
 +        cpu = LOONGARCH_CPU(cs);
          qemu_fdt_add_subnode(ms->fdt, nodename);
          qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "cpu");
          qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
                                  cpu->dtb_compatible);
 -        if (ms->possible_cpus->cpus[cs->cpu_index].props.has_node_id) {
 +        if (possible_cpus->cpus[num].props.has_node_id) {
              qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id",
 -                ms->possible_cpus->cpus[cs->cpu_index].props.node_id);
 +                possible_cpus->cpus[num].props.node_id);
          }
          qemu_fdt_setprop_cell(ms->fdt, nodename, "reg", num);
          qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle",
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
      /*cpu map */
      qemu_fdt_add_subnode(ms->fdt, "/cpus/cpu-map");
 +    for (num = 0; num < possible_cpus->len; num++) {
 +        cs = possible_cpus->cpus[num].cpu;
 +        if (cs == NULL) {
 +            continue;
 +        }
 -    for (num = smp_cpus - 1; num >= 0; num--) {
 -        char *cpu_path = g_strdup_printf("/cpus/cpu@%d", num);
 -        char *map_path;
 -
 +        nodename = g_strdup_printf("/cpus/cpu@%d", num);
          if (ms->smp.threads > 1) {
              map_path = g_strdup_printf(
                  "/cpus/cpu-map/socket%d/core%d/thread%d",
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
                  num % ms->smp.cores);
          }
          qemu_fdt_add_path(ms->fdt, map_path);
 -        qemu_fdt_setprop_phandle(ms->fdt, map_path, "cpu", cpu_path);
 +        qemu_fdt_setprop_phandle(ms->fdt, map_path, "cpu", nodename);
          g_free(map_path);
 -        g_free(cpu_path);
 +        g_free(nodename);
      }
  }
- static void fdt_add_irqchip_node(LoongArchMachineState *lams)
-@@ -XXX,XX +XXX,XX @@ static void loongarch_init(MachineState *machine)
-     MemoryRegion *address_space_mem = get_system_memory();
-     LoongArchMachineState *lams = LOONGARCH_MACHINE(machine);
-     int i;
-+    hwaddr fdt_base;
-     if (!cpu_model) {
-         cpu_model = LOONGARCH_CPU_TYPE_NAME("la464");
-@@ -XXX,XX +XXX,XX @@ static void loongarch_init(MachineState *machine)
-     lams->machine_done.notify = virt_machine_done;
-     qemu_add_machine_init_done_notifier(&lams->machine_done);
-     fdt_add_pcie_node(lams);
--
--    /* load fdt */
--    MemoryRegion *fdt_rom = g_new(MemoryRegion, 1);
--    memory_region_init_rom(fdt_rom, NULL, "fdt", VIRT_FDT_SIZE, &error_fatal);
--    memory_region_add_subregion(get_system_memory(), VIRT_FDT_BASE, fdt_rom);
--    rom_add_blob_fixed("fdt", machine->fdt, lams->fdt_size, VIRT_FDT_BASE);
-+    /*
-+     * Since lowmem region starts from 0, FDT base address is located
-+     * at 2 MiB to avoid NULL pointer access.
-+     *
-+     * Put the FDT into the memory map as a ROM image: this will ensure
-+     * the FDT is copied again upon reset, even if addr points into RAM.
-+     */
-+    fdt_base = 2 * MiB;
-+    qemu_fdt_dumpdtb(machine->fdt, lams->fdt_size);
-+    rom_add_blob_fixed("fdt", machine->fdt, lams->fdt_size, fdt_base);
- }
- bool loongarch_is_acpi_enabled(LoongArchMachineState *lams)
-diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/loongarch/virt.h
-+++ b/include/hw/loongarch/virt.h
-@@ -XXX,XX +XXX,XX @@
- #define VIRT_GED_MEM_ADDR       (VIRT_GED_EVT_ADDR + ACPI_GED_EVT_SEL_LEN)
- #define VIRT_GED_REG_ADDR       (VIRT_GED_MEM_ADDR + MEMORY_HOTPLUG_IO_LEN)
--#define VIRT_FDT_BASE           0x1c400000
--#define VIRT_FDT_SIZE           0x100000
--
- struct LoongArchMachineState {
-     /*< private >*/
-     MachineState parent_obj;
 --
-.31.1
+.43.5

-[PULL v2 5/9] hw/loongarch: Add TPM device for LoongArch virt machine
+Deleted patch
-From: Xiaojuan Yang <yangxiaojuan@loongson.cn>
-Add TPM device for LoongArch virt machine, including
-establish TPM acpi info and add TYPE_TPM_TIS_SYSBUS
-to dynamic_sysbus_devices list.
-Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
-Reviewed-by: Song Gao <gaosong@loongson.cn>
-Message-Id: <20221028014007.2718352-4-yangxiaojuan@loongson.cn>
-Signed-off-by: Song Gao <gaosong@loongson.cn>
----
- hw/loongarch/acpi-build.c | 51 ++++++++++++++++++++++++++++++++++++++-
- hw/loongarch/virt.c       |  4 +++
-files changed, 54 insertions(+), 1 deletion(-)
-diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/loongarch/acpi-build.c
-+++ b/hw/loongarch/acpi-build.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/acpi/generic_event_device.h"
- #include "hw/pci-host/gpex.h"
-+#include "sysemu/tpm.h"
-+#include "hw/platform-bus.h"
-+#include "hw/acpi/aml-build.h"
- #define ACPI_BUILD_ALIGN_SIZE             0x1000
- #define ACPI_BUILD_TABLE_SIZE             0x20000
-@@ -XXX,XX +XXX,XX @@ static void build_pci_device_aml(Aml *scope, LoongArchMachineState *lams)
-     acpi_dsdt_add_gpex(scope, &cfg);
- }
-+#ifdef CONFIG_TPM
-+static void acpi_dsdt_add_tpm(Aml *scope, LoongArchMachineState *vms)
-+{
-+    PlatformBusDevice *pbus = PLATFORM_BUS_DEVICE(vms->platform_bus_dev);
-+    hwaddr pbus_base = VIRT_PLATFORM_BUS_BASEADDRESS;
-+    SysBusDevice *sbdev = SYS_BUS_DEVICE(tpm_find());
-+    MemoryRegion *sbdev_mr;
-+    hwaddr tpm_base;
-+
-+    if (!sbdev) {
-+        return;
-+    }
-+
-+    tpm_base = platform_bus_get_mmio_addr(pbus, sbdev, 0);
-+    assert(tpm_base != -1);
-+
-+    tpm_base += pbus_base;
-+
-+    sbdev_mr = sysbus_mmio_get_region(sbdev, 0);
-+
-+    Aml *dev = aml_device("TPM0");
-+    aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
-+    aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
-+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
-+
-+    Aml *crs = aml_resource_template();
-+    aml_append(crs,
-+               aml_memory32_fixed(tpm_base,
-+                                  (uint32_t)memory_region_size(sbdev_mr),
-+                                  AML_READ_WRITE));
-+    aml_append(dev, aml_name_decl("_CRS", crs));
-+    aml_append(scope, dev);
-+}
-+#endif
-+
- /* build DSDT */
- static void
- build_dsdt(GArray *table_data, BIOSLinker *linker, MachineState *machine)
-@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, MachineState *machine)
-     build_uart_device_aml(dsdt);
-     build_pci_device_aml(dsdt, lams);
-     build_la_ged_aml(dsdt, machine);
--
-+#ifdef CONFIG_TPM
-+    acpi_dsdt_add_tpm(dsdt, lams);
-+#endif
-     /* System State Package */
-     scope = aml_scope("\\");
-     pkg = aml_package(4);
-@@ -XXX,XX +XXX,XX @@ static void acpi_build(AcpiBuildTables *tables, MachineState *machine)
-                    lams->oem_table_id);
-     }
-+#ifdef CONFIG_TPM
-+    /* TPM info */
-+    if (tpm_get_version(tpm_find()) == TPM_VERSION_2_0) {
-+        acpi_add_table(table_offsets, tables_blob);
-+        build_tpm2(tables_blob, tables->linker,
-+                   tables->tcpalog, lams->oem_id,
-+                   lams->oem_table_id);
-+    }
-+#endif
-     /* Add tables supplied by user (if any) */
-     for (u = acpi_table_first(); u; u = acpi_table_next(u)) {
-         unsigned len = acpi_table_len(u);
-diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/loongarch/virt.c
-+++ b/hw/loongarch/virt.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/platform-bus.h"
- #include "hw/display/ramfb.h"
- #include "hw/mem/pc-dimm.h"
-+#include "sysemu/tpm.h"
- static void fdt_add_rtc_node(LoongArchMachineState *lams)
- {
-@@ -XXX,XX +XXX,XX @@ static void loongarch_class_init(ObjectClass *oc, void *data)
-     object_class_property_set_description(oc, "acpi",
-         "Enable ACPI");
-     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
-+#ifdef CONFIG_TPM
-+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
-+#endif
- }
- static const TypeInfo loongarch_machine_types[] = {
---
-.31.1

-[PULL v2 6/9] target/loongarch: Add exception subcode
+[PULL v2 5/6] target/loongarch: Use auto method with LSX feature
-We need subcodes to distinguish the same excode cs->exception_indexs,
+Like LBT feature, add type OnOffAuto for LSX feature setting. Also
-such as EXCCODE_ADEF/EXCCODE_ADEM.
+add LSX feature detection with new VM ioctl command, fallback to old
 method if it is not supported.
-Signed-off-by: Song Gao <gaosong@loongson.cn>
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Message-ID: <20221101073210.3934280-1-gaosong@loongson.cn>
 ---
- target/loongarch/cpu.c |  7 +++--
+ target/loongarch/cpu.c     | 38 +++++++++++++++------------
- target/loongarch/cpu.h | 58 ++++++++++++++++++++++--------------------
+ target/loongarch/cpu.h     |  2 ++
-files changed, 36 insertions(+), 29 deletions(-)
+ target/loongarch/kvm/kvm.c | 54 ++++++++++++++++++++++++++++++++++++++
 files changed, 77 insertions(+), 17 deletions(-)
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.c
 +++ b/target/loongarch/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void loongarch_la464_initfn(Object *obj)
-         env->CSR_TLBRERA = FIELD_DP64(env->CSR_TLBRERA, CSR_TLBRERA,
+ {
-                                       PC, (env->pc >> 2));
+     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
      CPULoongArchState *env = &cpu->env;
 +    uint32_t data = 0;
      int i;
      for (i = 0; i < 21; i++) {
@@ -XXX,XX +XXX,XX @@ static void loongarch_la464_initfn(Object *obj)
      cpu->dtb_compatible = "loongarch,Loongson-3A5000";
      env->cpucfg[0] = 0x14c010;  /* PRID */
 -    uint32_t data = 0;
      data = FIELD_DP32(data, CPUCFG1, ARCH, 2);
      data = FIELD_DP32(data, CPUCFG1, PGMMU, 1);
      data = FIELD_DP32(data, CPUCFG1, IOCSR, 1);
@@ -XXX,XX +XXX,XX @@ static void loongarch_la132_initfn(Object *obj)
  {
      LoongArchCPU *cpu = LOONGARCH_CPU(obj);
      CPULoongArchState *env = &cpu->env;
 -
 +    uint32_t data = 0;
      int i;
      for (i = 0; i < 21; i++) {
@@ -XXX,XX +XXX,XX @@ static void loongarch_la132_initfn(Object *obj)
      cpu->dtb_compatible = "loongarch,Loongson-1C103";
      env->cpucfg[0] = 0x148042;  /* PRID */
 -    uint32_t data = 0;
      data = FIELD_DP32(data, CPUCFG1, ARCH, 1); /* LA32 */
      data = FIELD_DP32(data, CPUCFG1, PGMMU, 1);
      data = FIELD_DP32(data, CPUCFG1, IOCSR, 1);
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_realizefn(DeviceState *dev, Error **errp)
  static bool loongarch_get_lsx(Object *obj, Error **errp)
  {
 -    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 -    bool ret;
 -
 -    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
 -        ret = true;
 -    } else {
 -        ret = false;
 -    }
 -    return ret;
 +    return LOONGARCH_CPU(obj)->lsx != ON_OFF_AUTO_OFF;
  }
  static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
  {
      LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 +    uint32_t val;
 -    if (value) {
 -        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LSX, 1);
 -    } else {
 -        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LSX, 0);
 -        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LASX, 0);
 +    cpu->lsx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
 +    if (kvm_enabled()) {
 +        /* kvm feature detection in function kvm_arch_init_vcpu */
 +        return;
      }
 +
 +    /* LSX feature detection in TCG mode */
 +    val = cpu->env.cpucfg[2];
 +    if (cpu->lsx == ON_OFF_AUTO_ON) {
 +        if (FIELD_EX32(val, CPUCFG2, LSX) == 0) {
 +            error_setg(errp, "Failed to enable LSX in TCG mode");
 +            return;
 +        }
 +    }
 +
 +    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LSX, value);
  }
  static bool loongarch_get_lasx(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
  {
      LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 +    cpu->lsx = ON_OFF_AUTO_AUTO;
      object_property_add_bool(obj, "lsx", loongarch_get_lsx,
                               loongarch_set_lsx);
      object_property_add_bool(obj, "lasx", loongarch_get_lasx,
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
      } else {
--        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ECODE, cause);
+         cpu->lbt = ON_OFF_AUTO_OFF;
-+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ECODE,
++        cpu->pmu = ON_OFF_AUTO_OFF;
-+                                    EXCODE_MCODE(cause));
+     }
-+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ESUBCODE,
+ }
-+                                    EXCODE_SUBCODE(cause));
          env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PPLV,
                                     FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV));
          env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PIE,
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
              env->pc = env->CSR_TLBRENTRY;
          } else {
              env->pc = env->CSR_EENTRY;
 -            env->pc += cause * vec_size;
 +            env->pc += EXCODE_MCODE(cause) * vec_size;
          }
          qemu_log_mask(CPU_LOG_INT,
                        "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
 diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.h
 +++ b/target/loongarch/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(FCSR0, CAUSE, 24, 5)
+@@ -XXX,XX +XXX,XX @@ typedef struct LoongArchTLB LoongArchTLB;
- #define FP_DIV0           8
+ #endif
- #define FP_INVALID        16
+ enum loongarch_features {
--#define  EXCCODE_EXTERNAL_INT   64   /* plus external interrupt number */
++    LOONGARCH_FEATURE_LSX,
--#define  EXCCODE_INT                 0
+     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
--#define  EXCCODE_PIL                 1
+     LOONGARCH_FEATURE_PMU,
--#define  EXCCODE_PIS                 2
+ };
--#define  EXCCODE_PIF                 3
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
--#define  EXCCODE_PME                 4
+     uint32_t  phy_id;
--#define  EXCCODE_PNR                 5
+     OnOffAuto lbt;
--#define  EXCCODE_PNX                 6
+     OnOffAuto pmu;
--#define  EXCCODE_PPI                 7
++    OnOffAuto lsx;
--#define  EXCCODE_ADEF                8 /* Different exception subcode */
--#define  EXCCODE_ADEM                8
+     /* 'compatible' string for this CPU for Linux device trees */
--#define  EXCCODE_ALE                 9
+     const char *dtb_compatible;
--#define  EXCCODE_BCE                 10
+diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
--#define  EXCCODE_SYS                 11
+index XXXXXXX..XXXXXXX 100644
--#define  EXCCODE_BRK                 12
+--- a/target/loongarch/kvm/kvm.c
--#define  EXCCODE_INE                 13
++++ b/target/loongarch/kvm/kvm.c
--#define  EXCCODE_IPE                 14
+@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
--#define  EXCCODE_FPD                 15
+ {
--#define  EXCCODE_SXD                 16
+     int ret;
--#define  EXCCODE_ASXD                17
+     struct kvm_device_attr attr;
--#define  EXCCODE_FPE                 18 /* Different exception subcode */
++    uint64_t val;
--#define  EXCCODE_VFPE                18
--#define  EXCCODE_WPEF                19 /* Different exception subcode */
+     switch (feature) {
--#define  EXCCODE_WPEM                19
++    case LOONGARCH_FEATURE_LSX:
--#define  EXCCODE_BTD                 20
++        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
--#define  EXCCODE_BTE                 21
++        attr.attr = KVM_LOONGARCH_VM_FEAT_LSX;
--#define  EXCCODE_DBP                 26 /* Reserved subcode used for debug */
++        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
-+#define EXCODE(code, subcode) ( ((subcode) << 6) | (code) )
++        if (ret == 0) {
-+#define EXCODE_MCODE(code)    ( (code) & 0x3f )
++            return true;
-+#define EXCODE_SUBCODE(code)  ( (code) >> 6 )
++        }
 +
-+#define  EXCCODE_EXTERNAL_INT        64   /* plus external interrupt number */
++        /* Fallback to old kernel detect interface */
-+#define  EXCCODE_INT                 EXCODE(0, 0)
++        val = 0;
-+#define  EXCCODE_PIL                 EXCODE(1, 0)
++        attr.group = KVM_LOONGARCH_VCPU_CPUCFG;
-+#define  EXCCODE_PIS                 EXCODE(2, 0)
++        /* Cpucfg2 */
-+#define  EXCCODE_PIF                 EXCODE(3, 0)
++        attr.attr  = 2;
-+#define  EXCCODE_PME                 EXCODE(4, 0)
++        attr.addr = (uint64_t)&val;
-+#define  EXCCODE_PNR                 EXCODE(5, 0)
++        ret = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, &attr);
-+#define  EXCCODE_PNX                 EXCODE(6, 0)
++        if (!ret) {
-+#define  EXCCODE_PPI                 EXCODE(7, 0)
++            ret = kvm_vcpu_ioctl(cs, KVM_GET_DEVICE_ATTR, &attr);
-+#define  EXCCODE_ADEF                EXCODE(8, 0) /* Different exception subcode */
++            if (ret) {
-+#define  EXCCODE_ADEM                EXCODE(8, 1)
++                return false;
-+#define  EXCCODE_ALE                 EXCODE(9, 0)
++            }
-+#define  EXCCODE_BCE                 EXCODE(10, 0)
++
-+#define  EXCCODE_SYS                 EXCODE(11, 0)
++            ret = FIELD_EX32((uint32_t)val, CPUCFG2, LSX);
-+#define  EXCCODE_BRK                 EXCODE(12, 0)
++            return (ret != 0);
-+#define  EXCCODE_INE                 EXCODE(13, 0)
++        }
-+#define  EXCCODE_IPE                 EXCODE(14, 0)
++        return false;
-+#define  EXCCODE_FPD                 EXCODE(15, 0)
++
-+#define  EXCCODE_SXD                 EXCODE(16, 0)
+     case LOONGARCH_FEATURE_LBT:
-+#define  EXCCODE_ASXD                EXCODE(17, 0)
+         /*
-+#define  EXCCODE_FPE                 EXCODE(18, 0) /* Different exception subcode */
+          * Return all if all the LBT features are supported such as:
-+#define  EXCCODE_VFPE                EXCODE(18, 1)
+@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
-+#define  EXCCODE_WPEF                EXCODE(19, 0) /* Different exception subcode */
+     return false;
-+#define  EXCCODE_WPEM                EXCODE(19, 1)
+ }
-+#define  EXCCODE_BTD                 EXCODE(20, 0)
-+#define  EXCCODE_BTE                 EXCODE(21, 0)
++static int kvm_cpu_check_lsx(CPUState *cs, Error **errp)
-+#define  EXCCODE_DBP                 EXCODE(26, 0) /* Reserved subcode used for debug */
++{
++    CPULoongArchState *env = cpu_env(cs);
- /* cpucfg[0] bits */
++    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
- FIELD(CPUCFG0, PRID, 0, 32)
++    bool kvm_supported;
 +
 +    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_LSX);
 +    env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LSX, 0);
 +    if (cpu->lsx == ON_OFF_AUTO_ON) {
 +        if (kvm_supported) {
 +            env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LSX, 1);
 +        } else {
 +            error_setg(errp, "'lsx' feature not supported by KVM on this host");
 +            return -ENOTSUP;
 +        }
 +    } else if ((cpu->lsx == ON_OFF_AUTO_AUTO) && kvm_supported) {
 +        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LSX, 1);
 +    }
 +
 +    return 0;
 +}
 +
  static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
  {
      CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          brk_insn = val;
      }
 +    ret = kvm_cpu_check_lsx(cs, &local_err);
 +    if (ret < 0) {
 +        error_report_err(local_err);
 +    }
 +
      ret = kvm_cpu_check_lbt(cs, &local_err);
      if (ret < 0) {
          error_report_err(local_err);
 --
-.31.1
+.43.5

-[PULL v2 7/9] target/loongarch: Fix raise_mmu_exception() set wrong exception_index
+Deleted patch
-When the address is invalid address, We should set exception_index
-according to MMUAccessType, and EXCCODE_ADEF need't update badinstr.
-Otherwise, The system enters an infinite loop. e.g:
-run test.c on system mode
-test.c:
-    #include<stdio.h>
-    void (*func)(int *);
-    int main()
-    {
-        int i = 8;
-        void *ptr = (void *)0x4000000000000000;
-        func = ptr;
-        func(&i);
-        return 0;
-    }
-Signed-off-by: Song Gao <gaosong@loongson.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-ID: <20221101073210.3934280-2-gaosong@loongson.cn>
----
- target/loongarch/cpu.c        | 1 +
- target/loongarch/tlb_helper.c | 5 +++--
-files changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.c
-+++ b/target/loongarch/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
-         }
-         QEMU_FALLTHROUGH;
-     case EXCCODE_PIF:
-+    case EXCCODE_ADEF:
-         cause = cs->exception_index;
-         update_badinstr = 0;
-         break;
-diff --git a/target/loongarch/tlb_helper.c b/target/loongarch/tlb_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/tlb_helper.c
-+++ b/target/loongarch/tlb_helper.c
-@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPULoongArchState *env, target_ulong address,
-     switch (tlb_error) {
-     default:
-     case TLBRET_BADADDR:
--        cs->exception_index = EXCCODE_ADEM;
-+        cs->exception_index = access_type == MMU_INST_FETCH
-+                              ? EXCCODE_ADEF : EXCCODE_ADEM;
-         break;
-     case TLBRET_NOMATCH:
-         /* No TLB match for a mapped address */
-@@ -XXX,XX +XXX,XX @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     CPULoongArchState *env = &cpu->env;
-     hwaddr physical;
-     int prot;
--    int ret = TLBRET_BADADDR;
-+    int ret;
-     /* Data access */
-     ret = get_physical_address(env, &physical, &prot, address,
---
-.31.1

-[PULL v2 9/9] target/loongarch: Fix emulation of float-point disable exception
+[PULL v2 6/6] target/loongarch: Use auto method with LASX feature
-From: Rui Wang <wangrui@loongson.cn>
+Like LSX feature, add type OnOffAuto for LASX feature setting.
-We need to emulate it to generate a floating point disable exception
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-when CSR.EUEN.FPE is zero.
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Song Gao <gaosong@loongson.cn>
 Signed-off-by: Rui Wang <wangrui@loongson.cn>
 Message-Id: <20221104040517.222059-3-wangrui@loongson.cn>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- target/loongarch/cpu.c                        |  2 ++
+ target/loongarch/cpu.c     | 50 +++++++++++++++++++++++------------
- target/loongarch/cpu.h                        |  2 ++
+ target/loongarch/cpu.h     |  2 ++
- .../loongarch/insn_trans/trans_farith.c.inc   | 30 ++++++++++++++++
+ target/loongarch/kvm/kvm.c | 53 ++++++++++++++++++++++++++++++++++++++
- target/loongarch/insn_trans/trans_fcmp.c.inc  | 11 ++++--
+files changed, 89 insertions(+), 16 deletions(-)
  .../loongarch/insn_trans/trans_fmemory.c.inc  | 34 +++++++++++++++----
  target/loongarch/insn_trans/trans_fmov.c.inc  | 29 ++++++++++++++--
 files changed, 97 insertions(+), 11 deletions(-)
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.c
 +++ b/target/loongarch/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const char * const excp_names[] = {
+@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
-     [EXCCODE_BRK] = "Break",
+     uint32_t val;
-     [EXCCODE_INE] = "Instruction Non-Existent",
-     [EXCCODE_IPE] = "Instruction privilege error",
+     cpu->lsx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
-+    [EXCCODE_FPD] = "Floating Point Disabled",
++    if (cpu->lsx == ON_OFF_AUTO_OFF) {
-     [EXCCODE_FPE] = "Floating Point Exception",
++        cpu->lasx = ON_OFF_AUTO_OFF;
-     [EXCCODE_DBP] = "Debug breakpoint",
++        if (cpu->lasx == ON_OFF_AUTO_ON) {
-     [EXCCODE_BCE] = "Bound Check Exception",
++            error_setg(errp, "Failed to disable LSX since LASX is enabled");
-@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
++            return;
-     case EXCCODE_BRK:
++        }
-     case EXCCODE_INE:
++    }
-     case EXCCODE_IPE:
++
-+    case EXCCODE_FPD:
+     if (kvm_enabled()) {
-     case EXCCODE_FPE:
+         /* kvm feature detection in function kvm_arch_init_vcpu */
-     case EXCCODE_BCE:
+         return;
-         env->CSR_BADV = env->pc;
+@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
              error_setg(errp, "Failed to enable LSX in TCG mode");
              return;
          }
 +    } else {
 +        cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, 0);
 +        val = cpu->env.cpucfg[2];
      }
      cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LSX, value);
@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
  static bool loongarch_get_lasx(Object *obj, Error **errp)
  {
 -    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 -    bool ret;
 -
 -    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LASX)) {
 -        ret = true;
 -    } else {
 -        ret = false;
 -    }
 -    return ret;
 +    return LOONGARCH_CPU(obj)->lasx != ON_OFF_AUTO_OFF;
  }
  static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
  {
      LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 +    uint32_t val;
 -    if (value) {
 -    if (!FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
 -            cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LSX, 1);
 -    }
 -        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LASX, 1);
 -    } else {
 -        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LASX, 0);
 +    cpu->lasx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
 +    if ((cpu->lsx == ON_OFF_AUTO_OFF) && (cpu->lasx == ON_OFF_AUTO_ON)) {
 +        error_setg(errp, "Failed to enable LASX since lSX is disabled");
 +        return;
 +    }
 +
 +    if (kvm_enabled()) {
 +        /* kvm feature detection in function kvm_arch_init_vcpu */
 +        return;
      }
 +
 +    /* LASX feature detection in TCG mode */
 +    val = cpu->env.cpucfg[2];
 +    if (cpu->lasx == ON_OFF_AUTO_ON) {
 +        if (FIELD_EX32(val, CPUCFG2, LASX) == 0) {
 +            error_setg(errp, "Failed to enable LASX in TCG mode");
 +            return;
 +        }
 +    }
 +
 +    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, value);
  }
  static bool loongarch_get_lbt(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
      LoongArchCPU *cpu = LOONGARCH_CPU(obj);
      cpu->lsx = ON_OFF_AUTO_AUTO;
 +    cpu->lasx = ON_OFF_AUTO_AUTO;
      object_property_add_bool(obj, "lsx", loongarch_get_lsx,
                               loongarch_set_lsx);
      object_property_add_bool(obj, "lasx", loongarch_get_lasx,
 diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.h
 +++ b/target/loongarch/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPULoongArchState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ typedef struct LoongArchTLB LoongArchTLB;
-  */
- #define HW_FLAGS_PLV_MASK   R_CSR_CRMD_PLV_MASK  /* 0x03 */
+ enum loongarch_features {
- #define HW_FLAGS_CRMD_PG    R_CSR_CRMD_PG_MASK   /* 0x10 */
+     LOONGARCH_FEATURE_LSX,
-+#define HW_FLAGS_EUEN_FPE   0x04
++    LOONGARCH_FEATURE_LASX,
+     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
- static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
+     LOONGARCH_FEATURE_PMU,
-                                         target_ulong *pc,
+ };
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
-     *pc = env->pc;
+     OnOffAuto lbt;
-     *cs_base = 0;
+     OnOffAuto pmu;
-     *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
+     OnOffAuto lsx;
-+    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
++    OnOffAuto lasx;
      /* 'compatible' string for this CPU for Linux device trees */
      const char *dtb_compatible;
 diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/kvm/kvm.c
 +++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
          }
          return false;
 +    case LOONGARCH_FEATURE_LASX:
 +        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
 +        attr.attr = KVM_LOONGARCH_VM_FEAT_LASX;
 +        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
 +        if (ret == 0) {
 +            return true;
 +        }
 +
 +        /* Fallback to old kernel detect interface */
 +        val = 0;
 +        attr.group = KVM_LOONGARCH_VCPU_CPUCFG;
 +        /* Cpucfg2 */
 +        attr.attr  = 2;
 +        attr.addr = (uint64_t)&val;
 +        ret = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, &attr);
 +        if (!ret) {
 +            ret = kvm_vcpu_ioctl(cs, KVM_GET_DEVICE_ATTR, &attr);
 +            if (ret) {
 +                return false;
 +            }
 +
 +            ret = FIELD_EX32((uint32_t)val, CPUCFG2, LASX);
 +            return (ret != 0);
 +        }
 +        return false;
 +
      case LOONGARCH_FEATURE_LBT:
          /*
           * Return all if all the LBT features are supported such as:
@@ -XXX,XX +XXX,XX @@ static int kvm_cpu_check_lsx(CPUState *cs, Error **errp)
      return 0;
  }
- void loongarch_cpu_list(void);
++static int kvm_cpu_check_lasx(CPUState *cs, Error **errp)
-diff --git a/target/loongarch/insn_trans/trans_farith.c.inc b/target/loongarch/insn_trans/trans_farith.c.inc
++{
-index XXXXXXX..XXXXXXX 100644
++    CPULoongArchState *env = cpu_env(cs);
---- a/target/loongarch/insn_trans/trans_farith.c.inc
++    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
-+++ b/target/loongarch/insn_trans/trans_farith.c.inc
++    bool kvm_supported;
@@ -XXX,XX +XXX,XX @@
   * Copyright (c) 2021 Loongson Technology Corporation Limited
   */
 +#ifndef CONFIG_USER_ONLY
 +#define CHECK_FPE do { \
 +    if ((ctx->base.tb->flags & HW_FLAGS_EUEN_FPE) == 0) { \
 +        generate_exception(ctx, EXCCODE_FPD); \
 +        return false; \
 +    } \
 +} while (0)
 +#else
 +#define CHECK_FPE
 +#endif
 +
- static bool gen_fff(DisasContext *ctx, arg_fff *a,
++    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_LASX);
-                     void (*func)(TCGv, TCGv_env, TCGv, TCGv))
++    env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LASX, 0);
 +    if (cpu->lasx == ON_OFF_AUTO_ON) {
 +        if (kvm_supported) {
 +            env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LASX, 1);
 +        } else {
 +            error_setg(errp, "'lasx' feature not supported by KVM on host");
 +            return -ENOTSUP;
 +        }
 +    } else if ((cpu->lasx == ON_OFF_AUTO_AUTO) && kvm_supported) {
 +        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LASX, 1);
 +    }
 +
 +    return 0;
 +}
 +
  static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
  {
-+    CHECK_FPE;
+     CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          error_report_err(local_err);
      }
 +    ret = kvm_cpu_check_lasx(cs, &local_err);
 +    if (ret < 0) {
 +        error_report_err(local_err);
 +    }
 +
-     func(cpu_fpr[a->fd], cpu_env, cpu_fpr[a->fj], cpu_fpr[a->fk]);
+     ret = kvm_cpu_check_lbt(cs, &local_err);
-     return true;
+     if (ret < 0) {
- }
+         error_report_err(local_err);
@@ -XXX,XX +XXX,XX @@ static bool gen_fff(DisasContext *ctx, arg_fff *a,
  static bool gen_ff(DisasContext *ctx, arg_ff *a,
                     void (*func)(TCGv, TCGv_env, TCGv))
  {
 +    CHECK_FPE;
 +
      func(cpu_fpr[a->fd], cpu_env, cpu_fpr[a->fj]);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool gen_muladd(DisasContext *ctx, arg_ffff *a,
                         int flag)
  {
      TCGv_i32 tflag = tcg_constant_i32(flag);
 +
 +    CHECK_FPE;
 +
      func(cpu_fpr[a->fd], cpu_env, cpu_fpr[a->fj],
           cpu_fpr[a->fk], cpu_fpr[a->fa], tflag);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool gen_muladd(DisasContext *ctx, arg_ffff *a,
  static bool trans_fcopysign_s(DisasContext *ctx, arg_fcopysign_s *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_deposit_i64(cpu_fpr[a->fd], cpu_fpr[a->fk], cpu_fpr[a->fj], 0, 31);
      return true;
  }
  static bool trans_fcopysign_d(DisasContext *ctx, arg_fcopysign_d *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_deposit_i64(cpu_fpr[a->fd], cpu_fpr[a->fk], cpu_fpr[a->fj], 0, 63);
      return true;
  }
  static bool trans_fabs_s(DisasContext *ctx, arg_fabs_s *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_andi_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], MAKE_64BIT_MASK(0, 31));
      gen_nanbox_s(cpu_fpr[a->fd], cpu_fpr[a->fd]);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fabs_s(DisasContext *ctx, arg_fabs_s *a)
  static bool trans_fabs_d(DisasContext *ctx, arg_fabs_d *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_andi_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], MAKE_64BIT_MASK(0, 63));
      return true;
  }
  static bool trans_fneg_s(DisasContext *ctx, arg_fneg_s *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_xori_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], 0x80000000);
      gen_nanbox_s(cpu_fpr[a->fd], cpu_fpr[a->fd]);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fneg_s(DisasContext *ctx, arg_fneg_s *a)
  static bool trans_fneg_d(DisasContext *ctx, arg_fneg_d *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_xori_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], 0x8000000000000000LL);
      return true;
  }
 diff --git a/target/loongarch/insn_trans/trans_fcmp.c.inc b/target/loongarch/insn_trans/trans_fcmp.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/insn_trans/trans_fcmp.c.inc
 +++ b/target/loongarch/insn_trans/trans_fcmp.c.inc
@@ -XXX,XX +XXX,XX @@ static uint32_t get_fcmp_flags(int cond)
  static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
  {
 -    TCGv var = tcg_temp_new();
 +    TCGv var;
      uint32_t flags;
      void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 +    CHECK_FPE;
 +
 +    var = tcg_temp_new();
      fn = (a->fcond & 1 ? gen_helper_fcmp_s_s : gen_helper_fcmp_c_s);
      flags = get_fcmp_flags(a->fcond >> 1);
@@ -XXX,XX +XXX,XX @@ static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
  static bool trans_fcmp_cond_d(DisasContext *ctx, arg_fcmp_cond_d *a)
  {
 -    TCGv var = tcg_temp_new();
 +    TCGv var;
      uint32_t flags;
      void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 +
 +    CHECK_FPE;
 +
 +    var = tcg_temp_new();
      fn = (a->fcond & 1 ? gen_helper_fcmp_s_d : gen_helper_fcmp_c_d);
      flags = get_fcmp_flags(a->fcond >> 1);
 diff --git a/target/loongarch/insn_trans/trans_fmemory.c.inc b/target/loongarch/insn_trans/trans_fmemory.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/insn_trans/trans_fmemory.c.inc
 +++ b/target/loongarch/insn_trans/trans_fmemory.c.inc
@@ -XXX,XX +XXX,XX @@ static bool gen_fload_i(DisasContext *ctx, arg_fr_i *a, MemOp mop)
      TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv temp = NULL;
 +    CHECK_FPE;
 +
      if (a->imm) {
          temp = tcg_temp_new();
          tcg_gen_addi_tl(temp, addr, a->imm);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstore_i(DisasContext *ctx, arg_fr_i *a, MemOp mop)
      TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv temp = NULL;
 +    CHECK_FPE;
 +
      if (a->imm) {
          temp = tcg_temp_new();
          tcg_gen_addi_tl(temp, addr, a->imm);
@@ -XXX,XX +XXX,XX @@ static bool gen_floadx(DisasContext *ctx, arg_frr *a, MemOp mop)
  {
      TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 -    TCGv addr = tcg_temp_new();
 +    TCGv addr;
 +    CHECK_FPE;
 +
 +    addr = tcg_temp_new();
      tcg_gen_add_tl(addr, src1, src2);
      tcg_gen_qemu_ld_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
      maybe_nanbox_load(cpu_fpr[a->fd], mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstorex(DisasContext *ctx, arg_frr *a, MemOp mop)
  {
      TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 -    TCGv addr = tcg_temp_new();
 +    TCGv addr;
 +
 +    CHECK_FPE;
 +    addr = tcg_temp_new();
      tcg_gen_add_tl(addr, src1, src2);
      tcg_gen_qemu_st_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
      tcg_temp_free(addr);
@@ -XXX,XX +XXX,XX @@ static bool gen_fload_gt(DisasContext *ctx, arg_frr *a, MemOp mop)
  {
      TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 -    TCGv addr = tcg_temp_new();
 +    TCGv addr;
 +    CHECK_FPE;
 +
 +    addr = tcg_temp_new();
      gen_helper_asrtgt_d(cpu_env, src1, src2);
      tcg_gen_add_tl(addr, src1, src2);
      tcg_gen_qemu_ld_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstore_gt(DisasContext *ctx, arg_frr *a, MemOp mop)
  {
      TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 -    TCGv addr = tcg_temp_new();
 +    TCGv addr;
 +
 +    CHECK_FPE;
 +    addr = tcg_temp_new();
      gen_helper_asrtgt_d(cpu_env, src1, src2);
      tcg_gen_add_tl(addr, src1, src2);
      tcg_gen_qemu_st_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fload_le(DisasContext *ctx, arg_frr *a, MemOp mop)
  {
      TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 -    TCGv addr = tcg_temp_new();
 +    TCGv addr;
 +    CHECK_FPE;
 +
 +    addr = tcg_temp_new();
      gen_helper_asrtle_d(cpu_env, src1, src2);
      tcg_gen_add_tl(addr, src1, src2);
      tcg_gen_qemu_ld_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstore_le(DisasContext *ctx, arg_frr *a, MemOp mop)
  {
      TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
      TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 -    TCGv addr = tcg_temp_new();
 +    TCGv addr;
 +
 +    CHECK_FPE;
 +    addr = tcg_temp_new();
      gen_helper_asrtle_d(cpu_env, src1, src2);
      tcg_gen_add_tl(addr, src1, src2);
      tcg_gen_qemu_st_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
 diff --git a/target/loongarch/insn_trans/trans_fmov.c.inc b/target/loongarch/insn_trans/trans_fmov.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/insn_trans/trans_fmov.c.inc
 +++ b/target/loongarch/insn_trans/trans_fmov.c.inc
@@ -XXX,XX +XXX,XX @@ static const uint32_t fcsr_mask[4] = {
  static bool trans_fsel(DisasContext *ctx, arg_fsel *a)
  {
      TCGv zero = tcg_constant_tl(0);
 -    TCGv cond = tcg_temp_new();
 +    TCGv cond;
 +    CHECK_FPE;
 +
 +    cond = tcg_temp_new();
      tcg_gen_ld8u_tl(cond, cpu_env, offsetof(CPULoongArchState, cf[a->ca]));
      tcg_gen_movcond_tl(TCG_COND_EQ, cpu_fpr[a->fd], cond, zero,
                         cpu_fpr[a->fj], cpu_fpr[a->fk]);
@@ -XXX,XX +XXX,XX @@ static bool gen_f2f(DisasContext *ctx, arg_ff *a,
      TCGv dest = cpu_fpr[a->fd];
      TCGv src = cpu_fpr[a->fj];
 +    CHECK_FPE;
 +
      func(dest, src);
      if (nanbox) {
          gen_nanbox_s(cpu_fpr[a->fd], cpu_fpr[a->fd]);
@@ -XXX,XX +XXX,XX @@ static bool gen_r2f(DisasContext *ctx, arg_fr *a,
  {
      TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
 +    CHECK_FPE;
 +
      func(cpu_fpr[a->fd], src);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool gen_f2r(DisasContext *ctx, arg_rf *a,
  {
      TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
 +    CHECK_FPE;
 +
      func(dest, cpu_fpr[a->fj]);
      gen_set_gpr(a->rd, dest, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_movgr2fcsr(DisasContext *ctx, arg_movgr2fcsr *a)
      uint32_t mask = fcsr_mask[a->fcsrd];
      TCGv Rj = gpr_src(ctx, a->rj, EXT_NONE);
 +    CHECK_FPE;
 +
      if (mask == UINT32_MAX) {
          tcg_gen_st32_i64(Rj, cpu_env, offsetof(CPULoongArchState, fcsr0));
      } else {
@@ -XXX,XX +XXX,XX @@ static bool trans_movfcsr2gr(DisasContext *ctx, arg_movfcsr2gr *a)
  {
      TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
 +    CHECK_FPE;
 +
      tcg_gen_ld32u_i64(dest, cpu_env, offsetof(CPULoongArchState, fcsr0));
      tcg_gen_andi_i64(dest, dest, fcsr_mask[a->fcsrs]);
      gen_set_gpr(a->rd, dest, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static void gen_movfrh2gr_s(TCGv dest, TCGv src)
  static bool trans_movfr2cf(DisasContext *ctx, arg_movfr2cf *a)
  {
 -    TCGv t0 = tcg_temp_new();
 +    TCGv t0;
 +
 +    CHECK_FPE;
 +    t0 = tcg_temp_new();
      tcg_gen_andi_tl(t0, cpu_fpr[a->fj], 0x1);
      tcg_gen_st8_tl(t0, cpu_env, offsetof(CPULoongArchState, cf[a->cd & 0x7]));
      tcg_temp_free(t0);
@@ -XXX,XX +XXX,XX @@ static bool trans_movfr2cf(DisasContext *ctx, arg_movfr2cf *a)
  static bool trans_movcf2fr(DisasContext *ctx, arg_movcf2fr *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_ld8u_tl(cpu_fpr[a->fd], cpu_env,
                      offsetof(CPULoongArchState, cf[a->cj & 0x7]));
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_movcf2fr(DisasContext *ctx, arg_movcf2fr *a)
  static bool trans_movgr2cf(DisasContext *ctx, arg_movgr2cf *a)
  {
 -    TCGv t0 = tcg_temp_new();
 +    TCGv t0;
 +    CHECK_FPE;
 +
 +    t0 = tcg_temp_new();
      tcg_gen_andi_tl(t0, gpr_src(ctx, a->rj, EXT_NONE), 0x1);
      tcg_gen_st8_tl(t0, cpu_env, offsetof(CPULoongArchState, cf[a->cd & 0x7]));
      tcg_temp_free(t0);
@@ -XXX,XX +XXX,XX @@ static bool trans_movgr2cf(DisasContext *ctx, arg_movgr2cf *a)
  static bool trans_movcf2gr(DisasContext *ctx, arg_movcf2gr *a)
  {
 +    CHECK_FPE;
 +
      tcg_gen_ld8u_tl(gpr_dst(ctx, a->rd, EXT_NONE), cpu_env,
                      offsetof(CPULoongArchState, cf[a->cj & 0x7]));
      return true;
 --
-.31.1
+.43.5

The following changes since commit ece5f8374d0416a339f0c0a9399faa2c42d4ad6f:

Merge tag 'linux-user-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-11-03 10:55:05 -0400)

are available in the Git repository at:

https://gitlab.com/gaosong/qemu.git tags/pull-loongarch-20221104

for you to fetch changes up to 2419978cb09e11bc53a07d4de5621424d2a6a86d:

target/loongarch: Fix emulation of float-point disable exception (2022-11-04 17:10:53 +0800)

----------------------------------------------------------------
pull-loongarch-20221104

v2:
 - fix win32/win64 complie error;
 - Add Rui Wang' patches.

----------------------------------------------------------------
Rui Wang (2):
      target/loongarch: Adjust the layout of hardware flags bit fields
      target/loongarch: Fix emulation of float-point disable exception

Song Gao (2):
      target/loongarch: Add exception subcode
      target/loongarch: Fix raise_mmu_exception() set wrong exception_index

Xiaojuan Yang (5):
      hw/intc: Convert the memops to with_attrs in LoongArch extioi
      hw/intc: Fix LoongArch extioi coreisr accessing
      hw/loongarch: Load FDT table into dram memory space
      hw/loongarch: Improve fdt for LoongArch virt machine
      hw/loongarch: Add TPM device for LoongArch virt machine

hw/intc/loongarch_extioi.c                         | 41 +++++++------
 hw/intc/trace-events                               |  3 +-
 hw/loongarch/acpi-build.c                          | 51 +++++++++++++++-
 hw/loongarch/virt.c                                | 53 ++++++++++++++---
 include/hw/loongarch/virt.h                        |  3 -
 include/hw/pci-host/ls7a.h                         |  1 +
 target/loongarch/cpu.c                             | 10 +++-
 target/loongarch/cpu.h                             | 69 +++++++++++++---------
 target/loongarch/insn_trans/trans_farith.c.inc     | 30 ++++++++++
 target/loongarch/insn_trans/trans_fcmp.c.inc       | 11 +++-
 target/loongarch/insn_trans/trans_fmemory.c.inc    | 34 +++++++++--
 target/loongarch/insn_trans/trans_fmov.c.inc       | 29 ++++++++-
 target/loongarch/insn_trans/trans_privileged.c.inc |  2 +-
 target/loongarch/iocsr_helper.c                    | 19 +++---
 target/loongarch/tlb_helper.c                      |  5 +-
 target/loongarch/translate.c                       |  6 +-
 16 files changed, 283 insertions(+), 84 deletions(-)

From: Xiaojuan Yang <yangxiaojuan@loongson.cn>

Converting the MemoryRegionOps read/write handlers to
with_attrs in LoongArch extioi emulation.

Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20221021015307.2570844-2-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c | 31 +++++++++++++++++--------------
 hw/intc/trace-events       |  3 +--
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -XXX,XX +XXX,XX @@ static void extioi_setirq(void *opaque, int irq, int level)
     extioi_update_irq(s, irq, level);
 }
 
-static uint64_t extioi_readw(void *opaque, hwaddr addr, unsigned size)
+static MemTxResult extioi_readw(void *opaque, hwaddr addr, uint64_t *data,
+                                unsigned size, MemTxAttrs attrs)
 {
     LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
     unsigned long offset = addr & 0xffff;
-    uint32_t index, cpu, ret = 0;
+    uint32_t index, cpu;
 
     switch (offset) {
     case EXTIOI_NODETYPE_START ... EXTIOI_NODETYPE_END - 1:
         index = (offset - EXTIOI_NODETYPE_START) >> 2;
-        ret = s->nodetype[index];
+        *data = s->nodetype[index];
         break;
     case EXTIOI_IPMAP_START ... EXTIOI_IPMAP_END - 1:
         index = (offset - EXTIOI_IPMAP_START) >> 2;
-        ret = s->ipmap[index];
+        *data = s->ipmap[index];
         break;
     case EXTIOI_ENABLE_START ... EXTIOI_ENABLE_END - 1:
         index = (offset - EXTIOI_ENABLE_START) >> 2;
-        ret = s->enable[index];
+        *data = s->enable[index];
         break;
     case EXTIOI_BOUNCE_START ... EXTIOI_BOUNCE_END - 1:
         index = (offset - EXTIOI_BOUNCE_START) >> 2;
-        ret = s->bounce[index];
+        *data = s->bounce[index];
         break;
     case EXTIOI_COREISR_START ... EXTIOI_COREISR_END - 1:
         index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
         cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
-        ret = s->coreisr[cpu][index];
+        *data = s->coreisr[cpu][index];
         break;
     case EXTIOI_COREMAP_START ... EXTIOI_COREMAP_END - 1:
         index = (offset - EXTIOI_COREMAP_START) >> 2;
-        ret = s->coremap[index];
+        *data = s->coremap[index];
         break;
     default:
         break;
     }
 
-    trace_loongarch_extioi_readw(addr, ret);
-    return ret;
+    trace_loongarch_extioi_readw(addr, *data);
+    return MEMTX_OK;
 }
 
 static inline void extioi_enable_irq(LoongArchExtIOI *s, int index,\
@@ -XXX,XX +XXX,XX @@ static inline void extioi_enable_irq(LoongArchExtIOI *s, int index,\
     }
 }
 
-static void extioi_writew(void *opaque, hwaddr addr,
-                          uint64_t val, unsigned size)
+static MemTxResult extioi_writew(void *opaque, hwaddr addr,
+                          uint64_t val, unsigned size,
+                          MemTxAttrs attrs)
 {
     LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
     int i, cpu, index, old_data, irq;
@@ -XXX,XX +XXX,XX @@ static void extioi_writew(void *opaque, hwaddr addr,
     default:
         break;
     }
+    return MEMTX_OK;
 }
 
 static const MemoryRegionOps extioi_ops = {
-    .read = extioi_readw,
-    .write = extioi_writew,
+    .read_with_attrs = extioi_readw,
+    .write_with_attrs = extioi_writew,
     .impl.min_access_size = 4,
     .impl.max_access_size = 4,
     .valid.min_access_size = 4,
diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -XXX,XX +XXX,XX @@ loongarch_msi_set_irq(int irq_num) "set msi irq %d"
 
 # loongarch_extioi.c
 loongarch_extioi_setirq(int irq, int level) "set extirq irq %d level %d"
-loongarch_extioi_readw(uint64_t addr, uint32_t val) "addr: 0x%"PRIx64 "val: 0x%x"
+loongarch_extioi_readw(uint64_t addr, uint64_t val) "addr: 0x%"PRIx64 "val: 0x%" PRIx64
 loongarch_extioi_writew(uint64_t addr, uint64_t val) "addr: 0x%"PRIx64 "val: 0x%" PRIx64
-
-- 
2.31.1

From: Xiaojuan Yang <yangxiaojuan@loongson.cn>

1. When cpu read or write extioi COREISR reg, it should access
the reg belonged to itself, so the cpu index of 's->coreisr'
is current cpu number. Using MemTxAttrs' requester_id to get
the cpu index.
2. it need not to mask 0x1f when calculate the coreisr array index.

Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20221021015307.2570844-3-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c      | 10 ++++++----
 target/loongarch/iocsr_helper.c | 19 +++++++++++--------
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult extioi_readw(void *opaque, hwaddr addr, uint64_t *data,
         *data = s->bounce[index];
         break;
     case EXTIOI_COREISR_START ... EXTIOI_COREISR_END - 1:
-        index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
-        cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
+        index = (offset - EXTIOI_COREISR_START) >> 2;
+        /* using attrs to get current cpu index */
+        cpu = attrs.requester_id;
         *data = s->coreisr[cpu][index];
         break;
     case EXTIOI_COREMAP_START ... EXTIOI_COREMAP_END - 1:
@@ -XXX,XX +XXX,XX @@ static MemTxResult extioi_writew(void *opaque, hwaddr addr,
         s->bounce[index] = val;
         break;
     case EXTIOI_COREISR_START ... EXTIOI_COREISR_END - 1:
-        index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
-        cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
+        index = (offset - EXTIOI_COREISR_START) >> 2;
+        /* using attrs to get current cpu index */
+        cpu = attrs.requester_id;
         old_data = s->coreisr[cpu][index];
         s->coreisr[cpu][index] = old_data & ~val;
         /* write 1 to clear interrrupt */
diff --git a/target/loongarch/iocsr_helper.c b/target/loongarch/iocsr_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/iocsr_helper.c
+++ b/target/loongarch/iocsr_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu_ldst.h"
 #include "tcg/tcg-ldst.h"
 
+#define GET_MEMTXATTRS(cas) \
+        ((MemTxAttrs){.requester_id = env_cpu(cas)->cpu_index})
+
 uint64_t helper_iocsrrd_b(CPULoongArchState *env, target_ulong r_addr)
 {
     return address_space_ldub(&env->address_space_iocsr, r_addr,
-                              MEMTXATTRS_UNSPECIFIED, NULL);
+                              GET_MEMTXATTRS(env), NULL);
 }
 
 uint64_t helper_iocsrrd_h(CPULoongArchState *env, target_ulong r_addr)
 {
     return address_space_lduw(&env->address_space_iocsr, r_addr,
-                              MEMTXATTRS_UNSPECIFIED, NULL);
+                              GET_MEMTXATTRS(env), NULL);
 }
 
 uint64_t helper_iocsrrd_w(CPULoongArchState *env, target_ulong r_addr)
 {
     return address_space_ldl(&env->address_space_iocsr, r_addr,
-                             MEMTXATTRS_UNSPECIFIED, NULL);
+                             GET_MEMTXATTRS(env), NULL);
 }
 
 uint64_t helper_iocsrrd_d(CPULoongArchState *env, target_ulong r_addr)
 {
     return address_space_ldq(&env->address_space_iocsr, r_addr,
-                             MEMTXATTRS_UNSPECIFIED, NULL);
+                             GET_MEMTXATTRS(env), NULL);
 }
 
 void helper_iocsrwr_b(CPULoongArchState *env, target_ulong w_addr,
                       target_ulong val)
 {
     address_space_stb(&env->address_space_iocsr, w_addr,
-                      val, MEMTXATTRS_UNSPECIFIED, NULL);
+                      val, GET_MEMTXATTRS(env), NULL);
 }
 
 void helper_iocsrwr_h(CPULoongArchState *env, target_ulong w_addr,
                       target_ulong val)
 {
     address_space_stw(&env->address_space_iocsr, w_addr,
-                      val, MEMTXATTRS_UNSPECIFIED, NULL);
+                      val, GET_MEMTXATTRS(env), NULL);
 }
 
 void helper_iocsrwr_w(CPULoongArchState *env, target_ulong w_addr,
                       target_ulong val)
 {
     address_space_stl(&env->address_space_iocsr, w_addr,
-                      val, MEMTXATTRS_UNSPECIFIED, NULL);
+                      val, GET_MEMTXATTRS(env), NULL);
 }
 
 void helper_iocsrwr_d(CPULoongArchState *env, target_ulong w_addr,
                       target_ulong val)
 {
     address_space_stq(&env->address_space_iocsr, w_addr,
-                      val, MEMTXATTRS_UNSPECIFIED, NULL);
+                      val, GET_MEMTXATTRS(env), NULL);
 }
-- 
2.31.1

From: Xiaojuan Yang <yangxiaojuan@loongson.cn>

Load FDT table into dram memory space, and the addr is 2 MiB.
Since lowmem region starts from 0, FDT base address is located
at 2 MiB to avoid NULL pointer access.

Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Acked-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20221028014007.2718352-2-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c         | 18 +++++++++++-------
 include/hw/loongarch/virt.h |  3 ---
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pcie_node(const LoongArchMachineState *lams)
                                  1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
                                  2, base_mmio, 2, size_mmio);
     g_free(nodename);
-    qemu_fdt_dumpdtb(ms->fdt, lams->fdt_size);
 }
 
 static void fdt_add_irqchip_node(LoongArchMachineState *lams)
@@ -XXX,XX +XXX,XX @@ static void loongarch_init(MachineState *machine)
     MemoryRegion *address_space_mem = get_system_memory();
     LoongArchMachineState *lams = LOONGARCH_MACHINE(machine);
     int i;
+    hwaddr fdt_base;
 
     if (!cpu_model) {
         cpu_model = LOONGARCH_CPU_TYPE_NAME("la464");
@@ -XXX,XX +XXX,XX @@ static void loongarch_init(MachineState *machine)
     lams->machine_done.notify = virt_machine_done;
     qemu_add_machine_init_done_notifier(&lams->machine_done);
     fdt_add_pcie_node(lams);
-
-    /* load fdt */
-    MemoryRegion *fdt_rom = g_new(MemoryRegion, 1);
-    memory_region_init_rom(fdt_rom, NULL, "fdt", VIRT_FDT_SIZE, &error_fatal);
-    memory_region_add_subregion(get_system_memory(), VIRT_FDT_BASE, fdt_rom);
-    rom_add_blob_fixed("fdt", machine->fdt, lams->fdt_size, VIRT_FDT_BASE);
+    /*
+     * Since lowmem region starts from 0, FDT base address is located
+     * at 2 MiB to avoid NULL pointer access.
+     *
+     * Put the FDT into the memory map as a ROM image: this will ensure
+     * the FDT is copied again upon reset, even if addr points into RAM.
+     */
+    fdt_base = 2 * MiB;
+    qemu_fdt_dumpdtb(machine->fdt, lams->fdt_size);
+    rom_add_blob_fixed("fdt", machine->fdt, lams->fdt_size, fdt_base);
 }
 
 bool loongarch_is_acpi_enabled(LoongArchMachineState *lams)
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -XXX,XX +XXX,XX @@
 #define VIRT_GED_MEM_ADDR       (VIRT_GED_EVT_ADDR + ACPI_GED_EVT_SEL_LEN)
 #define VIRT_GED_REG_ADDR       (VIRT_GED_MEM_ADDR + MEMORY_HOTPLUG_IO_LEN)
 
-#define VIRT_FDT_BASE           0x1c400000
-#define VIRT_FDT_SIZE           0x100000
-
 struct LoongArchMachineState {
     /*< private >*/
     MachineState parent_obj;
-- 
2.31.1

From: Xiaojuan Yang <yangxiaojuan@loongson.cn>

Add new items into LoongArch FDT, including rtc and uart info.

Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20221028014007.2718352-3-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c        | 31 +++++++++++++++++++++++++++++++
 include/hw/pci-host/ls7a.h |  1 +
 2 files changed, 32 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/display/ramfb.h"
 #include "hw/mem/pc-dimm.h"
 
+static void fdt_add_rtc_node(LoongArchMachineState *lams)
+{
+    char *nodename;
+    hwaddr base = VIRT_RTC_REG_BASE;
+    hwaddr size = VIRT_RTC_LEN;
+    MachineState *ms = MACHINE(lams);
+
+    nodename = g_strdup_printf("/rtc@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "loongson,ls7a-rtc");
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 0x0, base, size);
+    g_free(nodename);
+}
+
+static void fdt_add_uart_node(LoongArchMachineState *lams)
+{
+    char *nodename;
+    hwaddr base = VIRT_UART_BASE;
+    hwaddr size = VIRT_UART_SIZE;
+    MachineState *ms = MACHINE(lams);
+
+    nodename = g_strdup_printf("/serial@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "ns16550a");
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0, base, 0x0, size);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "clock-frequency", 100000000);
+    g_free(nodename);
+}
+
 static void create_fdt(LoongArchMachineState *lams)
 {
     MachineState *ms = MACHINE(lams);
@@ -XXX,XX +XXX,XX @@ static void loongarch_devices_init(DeviceState *pch_pic, LoongArchMachineState *
                    qdev_get_gpio_in(pch_pic,
                                     VIRT_UART_IRQ - PCH_PIC_IRQ_OFFSET),
                    115200, serial_hd(0), DEVICE_LITTLE_ENDIAN);
+    fdt_add_uart_node(lams);
 
     /* Network init */
     for (i = 0; i < nb_nics; i++) {
@@ -XXX,XX +XXX,XX @@ static void loongarch_devices_init(DeviceState *pch_pic, LoongArchMachineState *
     sysbus_create_simple("ls7a_rtc", VIRT_RTC_REG_BASE,
                          qdev_get_gpio_in(pch_pic,
                          VIRT_RTC_IRQ - PCH_PIC_IRQ_OFFSET));
+    fdt_add_rtc_node(lams);
 
     pm_mem = g_new(MemoryRegion, 1);
     memory_region_init_io(pm_mem, NULL, &loongarch_virt_pm_ops,
diff --git a/include/hw/pci-host/ls7a.h b/include/hw/pci-host/ls7a.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/ls7a.h
+++ b/include/hw/pci-host/ls7a.h
@@ -XXX,XX +XXX,XX @@
 #define VIRT_PCI_IRQS            48
 #define VIRT_UART_IRQ            (PCH_PIC_IRQ_OFFSET + 2)
 #define VIRT_UART_BASE           0x1fe001e0
+#define VIRT_UART_SIZE           0X100
 #define VIRT_RTC_IRQ             (PCH_PIC_IRQ_OFFSET + 3)
 #define VIRT_MISC_REG_BASE       (VIRT_PCH_REG_BASE + 0x00080000)
 #define VIRT_RTC_REG_BASE        (VIRT_MISC_REG_BASE + 0x00050100)
-- 
2.31.1

From: Xiaojuan Yang <yangxiaojuan@loongson.cn>

Add TPM device for LoongArch virt machine, including
establish TPM acpi info and add TYPE_TPM_TIS_SYSBUS
to dynamic_sysbus_devices list.

Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20221028014007.2718352-4-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/acpi-build.c | 51 ++++++++++++++++++++++++++++++++++++++-
 hw/loongarch/virt.c       |  4 +++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/acpi-build.c
+++ b/hw/loongarch/acpi-build.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/acpi/generic_event_device.h"
 #include "hw/pci-host/gpex.h"
+#include "sysemu/tpm.h"
+#include "hw/platform-bus.h"
+#include "hw/acpi/aml-build.h"
 
 #define ACPI_BUILD_ALIGN_SIZE             0x1000
 #define ACPI_BUILD_TABLE_SIZE             0x20000
@@ -XXX,XX +XXX,XX @@ static void build_pci_device_aml(Aml *scope, LoongArchMachineState *lams)
     acpi_dsdt_add_gpex(scope, &cfg);
 }
 
+#ifdef CONFIG_TPM
+static void acpi_dsdt_add_tpm(Aml *scope, LoongArchMachineState *vms)
+{
+    PlatformBusDevice *pbus = PLATFORM_BUS_DEVICE(vms->platform_bus_dev);
+    hwaddr pbus_base = VIRT_PLATFORM_BUS_BASEADDRESS;
+    SysBusDevice *sbdev = SYS_BUS_DEVICE(tpm_find());
+    MemoryRegion *sbdev_mr;
+    hwaddr tpm_base;
+
+    if (!sbdev) {
+        return;
+    }
+
+    tpm_base = platform_bus_get_mmio_addr(pbus, sbdev, 0);
+    assert(tpm_base != -1);
+
+    tpm_base += pbus_base;
+
+    sbdev_mr = sysbus_mmio_get_region(sbdev, 0);
+
+    Aml *dev = aml_device("TPM0");
+    aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
+    aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+
+    Aml *crs = aml_resource_template();
+    aml_append(crs,
+               aml_memory32_fixed(tpm_base,
+                                  (uint32_t)memory_region_size(sbdev_mr),
+                                  AML_READ_WRITE));
+    aml_append(dev, aml_name_decl("_CRS", crs));
+    aml_append(scope, dev);
+}
+#endif
+
 /* build DSDT */
 static void
 build_dsdt(GArray *table_data, BIOSLinker *linker, MachineState *machine)
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, MachineState *machine)
     build_uart_device_aml(dsdt);
     build_pci_device_aml(dsdt, lams);
     build_la_ged_aml(dsdt, machine);
-
+#ifdef CONFIG_TPM
+    acpi_dsdt_add_tpm(dsdt, lams);
+#endif
     /* System State Package */
     scope = aml_scope("\\");
     pkg = aml_package(4);
@@ -XXX,XX +XXX,XX @@ static void acpi_build(AcpiBuildTables *tables, MachineState *machine)
                    lams->oem_table_id);
     }
 
+#ifdef CONFIG_TPM
+    /* TPM info */
+    if (tpm_get_version(tpm_find()) == TPM_VERSION_2_0) {
+        acpi_add_table(table_offsets, tables_blob);
+        build_tpm2(tables_blob, tables->linker,
+                   tables->tcpalog, lams->oem_id,
+                   lams->oem_table_id);
+    }
+#endif
     /* Add tables supplied by user (if any) */
     for (u = acpi_table_first(); u; u = acpi_table_next(u)) {
         unsigned len = acpi_table_len(u);
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/platform-bus.h"
 #include "hw/display/ramfb.h"
 #include "hw/mem/pc-dimm.h"
+#include "sysemu/tpm.h"
 
 static void fdt_add_rtc_node(LoongArchMachineState *lams)
 {
@@ -XXX,XX +XXX,XX @@ static void loongarch_class_init(ObjectClass *oc, void *data)
     object_class_property_set_description(oc, "acpi",
         "Enable ACPI");
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
+#ifdef CONFIG_TPM
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
+#endif
 }
 
 static const TypeInfo loongarch_machine_types[] = {
-- 
2.31.1

We need subcodes to distinguish the same excode cs->exception_indexs,
such as EXCCODE_ADEF/EXCCODE_ADEM.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20221101073210.3934280-1-gaosong@loongson.cn>
---
 target/loongarch/cpu.c |  7 +++--
 target/loongarch/cpu.h | 58 ++++++++++++++++++++++--------------------
 2 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
         env->CSR_TLBRERA = FIELD_DP64(env->CSR_TLBRERA, CSR_TLBRERA,
                                       PC, (env->pc >> 2));
     } else {
-        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ECODE, cause);
+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ECODE,
+                                    EXCODE_MCODE(cause));
+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ESUBCODE,
+                                    EXCODE_SUBCODE(cause));
         env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PPLV,
                                    FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV));
         env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PIE,
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
             env->pc = env->CSR_TLBRENTRY;
         } else {
             env->pc = env->CSR_EENTRY;
-            env->pc += cause * vec_size;
+            env->pc += EXCODE_MCODE(cause) * vec_size;
         }
         qemu_log_mask(CPU_LOG_INT,
                       "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(FCSR0, CAUSE, 24, 5)
 #define FP_DIV0           8
 #define FP_INVALID        16
 
-#define  EXCCODE_EXTERNAL_INT   64   /* plus external interrupt number */
-#define  EXCCODE_INT                 0
-#define  EXCCODE_PIL                 1
-#define  EXCCODE_PIS                 2
-#define  EXCCODE_PIF                 3
-#define  EXCCODE_PME                 4
-#define  EXCCODE_PNR                 5
-#define  EXCCODE_PNX                 6
-#define  EXCCODE_PPI                 7
-#define  EXCCODE_ADEF                8 /* Different exception subcode */
-#define  EXCCODE_ADEM                8
-#define  EXCCODE_ALE                 9
-#define  EXCCODE_BCE                 10
-#define  EXCCODE_SYS                 11
-#define  EXCCODE_BRK                 12
-#define  EXCCODE_INE                 13
-#define  EXCCODE_IPE                 14
-#define  EXCCODE_FPD                 15
-#define  EXCCODE_SXD                 16
-#define  EXCCODE_ASXD                17
-#define  EXCCODE_FPE                 18 /* Different exception subcode */
-#define  EXCCODE_VFPE                18
-#define  EXCCODE_WPEF                19 /* Different exception subcode */
-#define  EXCCODE_WPEM                19
-#define  EXCCODE_BTD                 20
-#define  EXCCODE_BTE                 21
-#define  EXCCODE_DBP                 26 /* Reserved subcode used for debug */
+#define EXCODE(code, subcode) ( ((subcode) << 6) | (code) )
+#define EXCODE_MCODE(code)    ( (code) & 0x3f )
+#define EXCODE_SUBCODE(code)  ( (code) >> 6 )
+
+#define  EXCCODE_EXTERNAL_INT        64   /* plus external interrupt number */
+#define  EXCCODE_INT                 EXCODE(0, 0)
+#define  EXCCODE_PIL                 EXCODE(1, 0)
+#define  EXCCODE_PIS                 EXCODE(2, 0)
+#define  EXCCODE_PIF                 EXCODE(3, 0)
+#define  EXCCODE_PME                 EXCODE(4, 0)
+#define  EXCCODE_PNR                 EXCODE(5, 0)
+#define  EXCCODE_PNX                 EXCODE(6, 0)
+#define  EXCCODE_PPI                 EXCODE(7, 0)
+#define  EXCCODE_ADEF                EXCODE(8, 0) /* Different exception subcode */
+#define  EXCCODE_ADEM                EXCODE(8, 1)
+#define  EXCCODE_ALE                 EXCODE(9, 0)
+#define  EXCCODE_BCE                 EXCODE(10, 0)
+#define  EXCCODE_SYS                 EXCODE(11, 0)
+#define  EXCCODE_BRK                 EXCODE(12, 0)
+#define  EXCCODE_INE                 EXCODE(13, 0)
+#define  EXCCODE_IPE                 EXCODE(14, 0)
+#define  EXCCODE_FPD                 EXCODE(15, 0)
+#define  EXCCODE_SXD                 EXCODE(16, 0)
+#define  EXCCODE_ASXD                EXCODE(17, 0)
+#define  EXCCODE_FPE                 EXCODE(18, 0) /* Different exception subcode */
+#define  EXCCODE_VFPE                EXCODE(18, 1)
+#define  EXCCODE_WPEF                EXCODE(19, 0) /* Different exception subcode */
+#define  EXCCODE_WPEM                EXCODE(19, 1)
+#define  EXCCODE_BTD                 EXCODE(20, 0)
+#define  EXCCODE_BTE                 EXCODE(21, 0)
+#define  EXCCODE_DBP                 EXCODE(26, 0) /* Reserved subcode used for debug */
 
 /* cpucfg[0] bits */
 FIELD(CPUCFG0, PRID, 0, 32)
-- 
2.31.1

When the address is invalid address, We should set exception_index
according to MMUAccessType, and EXCCODE_ADEF need't update badinstr.
Otherwise, The system enters an infinite loop. e.g:
run test.c on system mode
test.c:
    #include<stdio.h>

void (*func)(int *);

int main()
    {
        int i = 8;
        void *ptr = (void *)0x4000000000000000;
        func = ptr;
        func(&i);
        return 0;
    }

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20221101073210.3934280-2-gaosong@loongson.cn>
---
 target/loongarch/cpu.c        | 1 +
 target/loongarch/tlb_helper.c | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
         }
         QEMU_FALLTHROUGH;
     case EXCCODE_PIF:
+    case EXCCODE_ADEF:
         cause = cs->exception_index;
         update_badinstr = 0;
         break;
diff --git a/target/loongarch/tlb_helper.c b/target/loongarch/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tlb_helper.c
+++ b/target/loongarch/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPULoongArchState *env, target_ulong address,
     switch (tlb_error) {
     default:
     case TLBRET_BADADDR:
-        cs->exception_index = EXCCODE_ADEM;
+        cs->exception_index = access_type == MMU_INST_FETCH
+                              ? EXCCODE_ADEF : EXCCODE_ADEM;
         break;
     case TLBRET_NOMATCH:
         /* No TLB match for a mapped address */
@@ -XXX,XX +XXX,XX @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     CPULoongArchState *env = &cpu->env;
     hwaddr physical;
     int prot;
-    int ret = TLBRET_BADADDR;
+    int ret;
 
     /* Data access */
     ret = get_physical_address(env, &physical, &prot, address,
-- 
2.31.1

From: Rui Wang <wangrui@loongson.cn>

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Rui Wang <wangrui@loongson.cn>
Message-Id: <20221104040517.222059-2-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.h                             | 9 ++++++++-
 target/loongarch/insn_trans/trans_privileged.c.inc | 2 +-
 target/loongarch/translate.c                       | 6 +++++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "exec/memory.h"
 #include "hw/sysbus.h"
+#include "cpu-csr.h"
 
 #define IOCSRF_TEMP             0
 #define IOCSRF_NODECNT          1
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPULoongArchState *env, bool ifetch)
 #endif
 }
 
+/*
+ * LoongArch CPUs hardware flags.
+ */
+#define HW_FLAGS_PLV_MASK   R_CSR_CRMD_PLV_MASK  /* 0x03 */
+#define HW_FLAGS_CRMD_PG    R_CSR_CRMD_PG_MASK   /* 0x10 */
+
 static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
                                         target_ulong *pc,
                                         target_ulong *cs_base,
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
 {
     *pc = env->pc;
     *cs_base = 0;
-    *flags = cpu_mmu_index(env, false);
+    *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
 }
 
 void loongarch_cpu_list(void);
diff --git a/target/loongarch/insn_trans/trans_privileged.c.inc b/target/loongarch/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static const CSRInfo csr_info[] = {
 
 static bool check_plv(DisasContext *ctx)
 {
-    if (ctx->base.tb->flags == MMU_USER_IDX) {
+    if (ctx->mem_idx == MMU_USER_IDX) {
         generate_exception(ctx, EXCCODE_IPE);
         return true;
     }
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_tr_init_disas_context(DisasContextBase *dcbase,
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
     ctx->page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
-    ctx->mem_idx = ctx->base.tb->flags;
+    if (ctx->base.tb->flags & HW_FLAGS_CRMD_PG) {
+        ctx->mem_idx = ctx->base.tb->flags & HW_FLAGS_PLV_MASK;
+    } else {
+        ctx->mem_idx = MMU_DA_IDX;
+    }
 
     /* Bound the number of insns to execute to those left on the page.  */
     bound = -(ctx->base.pc_first | TARGET_PAGE_MASK) / 4;
-- 
2.31.1

From: Rui Wang <wangrui@loongson.cn>

We need to emulate it to generate a floating point disable exception
when CSR.EUEN.FPE is zero.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Rui Wang <wangrui@loongson.cn>
Message-Id: <20221104040517.222059-3-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c                        |  2 ++
 target/loongarch/cpu.h                        |  2 ++
 .../loongarch/insn_trans/trans_farith.c.inc   | 30 ++++++++++++++++
 target/loongarch/insn_trans/trans_fcmp.c.inc  | 11 ++++--
 .../loongarch/insn_trans/trans_fmemory.c.inc  | 34 +++++++++++++++----
 target/loongarch/insn_trans/trans_fmov.c.inc  | 29 ++++++++++++++--
 6 files changed, 97 insertions(+), 11 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char * const excp_names[] = {
     [EXCCODE_BRK] = "Break",
     [EXCCODE_INE] = "Instruction Non-Existent",
     [EXCCODE_IPE] = "Instruction privilege error",
+    [EXCCODE_FPD] = "Floating Point Disabled",
     [EXCCODE_FPE] = "Floating Point Exception",
     [EXCCODE_DBP] = "Debug breakpoint",
     [EXCCODE_BCE] = "Bound Check Exception",
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
     case EXCCODE_BRK:
     case EXCCODE_INE:
     case EXCCODE_IPE:
+    case EXCCODE_FPD:
     case EXCCODE_FPE:
     case EXCCODE_BCE:
         env->CSR_BADV = env->pc;
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPULoongArchState *env, bool ifetch)
  */
 #define HW_FLAGS_PLV_MASK   R_CSR_CRMD_PLV_MASK  /* 0x03 */
 #define HW_FLAGS_CRMD_PG    R_CSR_CRMD_PG_MASK   /* 0x10 */
+#define HW_FLAGS_EUEN_FPE   0x04
 
 static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
                                         target_ulong *pc,
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
     *pc = env->pc;
     *cs_base = 0;
     *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
+    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
 }
 
 void loongarch_cpu_list(void);
diff --git a/target/loongarch/insn_trans/trans_farith.c.inc b/target/loongarch/insn_trans/trans_farith.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insn_trans/trans_farith.c.inc
+++ b/target/loongarch/insn_trans/trans_farith.c.inc
@@ -XXX,XX +XXX,XX @@
  * Copyright (c) 2021 Loongson Technology Corporation Limited
  */
 
+#ifndef CONFIG_USER_ONLY
+#define CHECK_FPE do { \
+    if ((ctx->base.tb->flags & HW_FLAGS_EUEN_FPE) == 0) { \
+        generate_exception(ctx, EXCCODE_FPD); \
+        return false; \
+    } \
+} while (0)
+#else
+#define CHECK_FPE
+#endif
+
 static bool gen_fff(DisasContext *ctx, arg_fff *a,
                     void (*func)(TCGv, TCGv_env, TCGv, TCGv))
 {
+    CHECK_FPE;
+
     func(cpu_fpr[a->fd], cpu_env, cpu_fpr[a->fj], cpu_fpr[a->fk]);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool gen_fff(DisasContext *ctx, arg_fff *a,
 static bool gen_ff(DisasContext *ctx, arg_ff *a,
                    void (*func)(TCGv, TCGv_env, TCGv))
 {
+    CHECK_FPE;
+
     func(cpu_fpr[a->fd], cpu_env, cpu_fpr[a->fj]);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool gen_muladd(DisasContext *ctx, arg_ffff *a,
                        int flag)
 {
     TCGv_i32 tflag = tcg_constant_i32(flag);
+
+    CHECK_FPE;
+
     func(cpu_fpr[a->fd], cpu_env, cpu_fpr[a->fj],
          cpu_fpr[a->fk], cpu_fpr[a->fa], tflag);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool gen_muladd(DisasContext *ctx, arg_ffff *a,
 
 static bool trans_fcopysign_s(DisasContext *ctx, arg_fcopysign_s *a)
 {
+    CHECK_FPE;
+
     tcg_gen_deposit_i64(cpu_fpr[a->fd], cpu_fpr[a->fk], cpu_fpr[a->fj], 0, 31);
     return true;
 }
 
 static bool trans_fcopysign_d(DisasContext *ctx, arg_fcopysign_d *a)
 {
+    CHECK_FPE;
+
     tcg_gen_deposit_i64(cpu_fpr[a->fd], cpu_fpr[a->fk], cpu_fpr[a->fj], 0, 63);
     return true;
 }
 
 static bool trans_fabs_s(DisasContext *ctx, arg_fabs_s *a)
 {
+    CHECK_FPE;
+
     tcg_gen_andi_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], MAKE_64BIT_MASK(0, 31));
     gen_nanbox_s(cpu_fpr[a->fd], cpu_fpr[a->fd]);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fabs_s(DisasContext *ctx, arg_fabs_s *a)
 
 static bool trans_fabs_d(DisasContext *ctx, arg_fabs_d *a)
 {
+    CHECK_FPE;
+
     tcg_gen_andi_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], MAKE_64BIT_MASK(0, 63));
     return true;
 }
 
 static bool trans_fneg_s(DisasContext *ctx, arg_fneg_s *a)
 {
+    CHECK_FPE;
+
     tcg_gen_xori_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], 0x80000000);
     gen_nanbox_s(cpu_fpr[a->fd], cpu_fpr[a->fd]);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fneg_s(DisasContext *ctx, arg_fneg_s *a)
 
 static bool trans_fneg_d(DisasContext *ctx, arg_fneg_d *a)
 {
+    CHECK_FPE;
+
     tcg_gen_xori_i64(cpu_fpr[a->fd], cpu_fpr[a->fj], 0x8000000000000000LL);
     return true;
 }
diff --git a/target/loongarch/insn_trans/trans_fcmp.c.inc b/target/loongarch/insn_trans/trans_fcmp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insn_trans/trans_fcmp.c.inc
+++ b/target/loongarch/insn_trans/trans_fcmp.c.inc
@@ -XXX,XX +XXX,XX @@ static uint32_t get_fcmp_flags(int cond)
 
 static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
 {
-    TCGv var = tcg_temp_new();
+    TCGv var;
     uint32_t flags;
     void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 
+    CHECK_FPE;
+
+    var = tcg_temp_new();
     fn = (a->fcond & 1 ? gen_helper_fcmp_s_s : gen_helper_fcmp_c_s);
     flags = get_fcmp_flags(a->fcond >> 1);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
 
 static bool trans_fcmp_cond_d(DisasContext *ctx, arg_fcmp_cond_d *a)
 {
-    TCGv var = tcg_temp_new();
+    TCGv var;
     uint32_t flags;
     void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
+
+    CHECK_FPE;
+
+    var = tcg_temp_new();
     fn = (a->fcond & 1 ? gen_helper_fcmp_s_d : gen_helper_fcmp_c_d);
     flags = get_fcmp_flags(a->fcond >> 1);
 
diff --git a/target/loongarch/insn_trans/trans_fmemory.c.inc b/target/loongarch/insn_trans/trans_fmemory.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insn_trans/trans_fmemory.c.inc
+++ b/target/loongarch/insn_trans/trans_fmemory.c.inc
@@ -XXX,XX +XXX,XX @@ static bool gen_fload_i(DisasContext *ctx, arg_fr_i *a, MemOp mop)
     TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv temp = NULL;
 
+    CHECK_FPE;
+
     if (a->imm) {
         temp = tcg_temp_new();
         tcg_gen_addi_tl(temp, addr, a->imm);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstore_i(DisasContext *ctx, arg_fr_i *a, MemOp mop)
     TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv temp = NULL;
 
+    CHECK_FPE;
+
     if (a->imm) {
         temp = tcg_temp_new();
         tcg_gen_addi_tl(temp, addr, a->imm);
@@ -XXX,XX +XXX,XX @@ static bool gen_floadx(DisasContext *ctx, arg_frr *a, MemOp mop)
 {
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr;
 
+    CHECK_FPE;
+
+    addr = tcg_temp_new();
     tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_ld_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
     maybe_nanbox_load(cpu_fpr[a->fd], mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstorex(DisasContext *ctx, arg_frr *a, MemOp mop)
 {
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr;
+
+    CHECK_FPE;
 
+    addr = tcg_temp_new();
     tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_st_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
     tcg_temp_free(addr);
@@ -XXX,XX +XXX,XX @@ static bool gen_fload_gt(DisasContext *ctx, arg_frr *a, MemOp mop)
 {
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr;
 
+    CHECK_FPE;
+
+    addr = tcg_temp_new();
     gen_helper_asrtgt_d(cpu_env, src1, src2);
     tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_ld_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstore_gt(DisasContext *ctx, arg_frr *a, MemOp mop)
 {
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr;
+
+    CHECK_FPE;
 
+    addr = tcg_temp_new();
     gen_helper_asrtgt_d(cpu_env, src1, src2);
     tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_st_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fload_le(DisasContext *ctx, arg_frr *a, MemOp mop)
 {
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr;
 
+    CHECK_FPE;
+
+    addr = tcg_temp_new();
     gen_helper_asrtle_d(cpu_env, src1, src2);
     tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_ld_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
@@ -XXX,XX +XXX,XX @@ static bool gen_fstore_le(DisasContext *ctx, arg_frr *a, MemOp mop)
 {
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr;
+
+    CHECK_FPE;
 
+    addr = tcg_temp_new();
     gen_helper_asrtle_d(cpu_env, src1, src2);
     tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_st_tl(cpu_fpr[a->fd], addr, ctx->mem_idx, mop);
diff --git a/target/loongarch/insn_trans/trans_fmov.c.inc b/target/loongarch/insn_trans/trans_fmov.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/insn_trans/trans_fmov.c.inc
+++ b/target/loongarch/insn_trans/trans_fmov.c.inc
@@ -XXX,XX +XXX,XX @@ static const uint32_t fcsr_mask[4] = {
 static bool trans_fsel(DisasContext *ctx, arg_fsel *a)
 {
     TCGv zero = tcg_constant_tl(0);
-    TCGv cond = tcg_temp_new();
+    TCGv cond;
 
+    CHECK_FPE;
+
+    cond = tcg_temp_new();
     tcg_gen_ld8u_tl(cond, cpu_env, offsetof(CPULoongArchState, cf[a->ca]));
     tcg_gen_movcond_tl(TCG_COND_EQ, cpu_fpr[a->fd], cond, zero,
                        cpu_fpr[a->fj], cpu_fpr[a->fk]);
@@ -XXX,XX +XXX,XX @@ static bool gen_f2f(DisasContext *ctx, arg_ff *a,
     TCGv dest = cpu_fpr[a->fd];
     TCGv src = cpu_fpr[a->fj];
 
+    CHECK_FPE;
+
     func(dest, src);
     if (nanbox) {
         gen_nanbox_s(cpu_fpr[a->fd], cpu_fpr[a->fd]);
@@ -XXX,XX +XXX,XX @@ static bool gen_r2f(DisasContext *ctx, arg_fr *a,
 {
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
 
+    CHECK_FPE;
+
     func(cpu_fpr[a->fd], src);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool gen_f2r(DisasContext *ctx, arg_rf *a,
 {
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
 
+    CHECK_FPE;
+
     func(dest, cpu_fpr[a->fj]);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_movgr2fcsr(DisasContext *ctx, arg_movgr2fcsr *a)
     uint32_t mask = fcsr_mask[a->fcsrd];
     TCGv Rj = gpr_src(ctx, a->rj, EXT_NONE);
 
+    CHECK_FPE;
+
     if (mask == UINT32_MAX) {
         tcg_gen_st32_i64(Rj, cpu_env, offsetof(CPULoongArchState, fcsr0));
     } else {
@@ -XXX,XX +XXX,XX @@ static bool trans_movfcsr2gr(DisasContext *ctx, arg_movfcsr2gr *a)
 {
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
 
+    CHECK_FPE;
+
     tcg_gen_ld32u_i64(dest, cpu_env, offsetof(CPULoongArchState, fcsr0));
     tcg_gen_andi_i64(dest, dest, fcsr_mask[a->fcsrs]);
     gen_set_gpr(a->rd, dest, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static void gen_movfrh2gr_s(TCGv dest, TCGv src)
 
 static bool trans_movfr2cf(DisasContext *ctx, arg_movfr2cf *a)
 {
-    TCGv t0 = tcg_temp_new();
+    TCGv t0;
+
+    CHECK_FPE;
 
+    t0 = tcg_temp_new();
     tcg_gen_andi_tl(t0, cpu_fpr[a->fj], 0x1);
     tcg_gen_st8_tl(t0, cpu_env, offsetof(CPULoongArchState, cf[a->cd & 0x7]));
     tcg_temp_free(t0);
@@ -XXX,XX +XXX,XX @@ static bool trans_movfr2cf(DisasContext *ctx, arg_movfr2cf *a)
 
 static bool trans_movcf2fr(DisasContext *ctx, arg_movcf2fr *a)
 {
+    CHECK_FPE;
+
     tcg_gen_ld8u_tl(cpu_fpr[a->fd], cpu_env,
                     offsetof(CPULoongArchState, cf[a->cj & 0x7]));
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_movcf2fr(DisasContext *ctx, arg_movcf2fr *a)
 
 static bool trans_movgr2cf(DisasContext *ctx, arg_movgr2cf *a)
 {
-    TCGv t0 = tcg_temp_new();
+    TCGv t0;
 
+    CHECK_FPE;
+
+    t0 = tcg_temp_new();
     tcg_gen_andi_tl(t0, gpr_src(ctx, a->rj, EXT_NONE), 0x1);
     tcg_gen_st8_tl(t0, cpu_env, offsetof(CPULoongArchState, cf[a->cd & 0x7]));
     tcg_temp_free(t0);
@@ -XXX,XX +XXX,XX @@ static bool trans_movgr2cf(DisasContext *ctx, arg_movgr2cf *a)
 
 static bool trans_movcf2gr(DisasContext *ctx, arg_movcf2gr *a)
 {
+    CHECK_FPE;
+
     tcg_gen_ld8u_tl(gpr_dst(ctx, a->rd, EXT_NONE), cpu_env,
                     offsetof(CPULoongArchState, cf[a->cj & 0x7]));
     return true;
-- 
2.31.1

The following changes since commit 38d0939b86e2eef6f6a622c6f1f7befda0146595:

Merge tag 'pull-vfio-20241226' of https://github.com/legoater/qemu into staging (2024-12-26 04:38:38 -0500)

are available in the Git repository at:

https://gitlab.com/bibo-mao/qemu.git tags/pull-loongarch-20241227

for you to fetch changes up to 5e360dabedb1ab1f15cce27a134ccbe4b8e18424:

target/loongarch: Use auto method with LASX feature (2024-12-27 11:33:06 +0800)

----------------------------------------------------------------
pull-loongarch-20241227
v1 ... v2
  1. Modify patch auther inconsistent with SOB

----------------------------------------------------------------
Bibo Mao (5):
      target/loongarch: Use actual operand size with vbsrl check
      hw/loongarch/virt: Create fdt table on machine creation done notification
      hw/loongarch/virt: Improve fdt table creation for CPU object
      target/loongarch: Use auto method with LSX feature
      target/loongarch: Use auto method with LASX feature

Guo Hongyu (1):
      target/loongarch: Fix vldi inst

hw/loongarch/virt.c                             | 142 ++++++++++++++----------
 target/loongarch/cpu.c                          |  86 ++++++++------
 target/loongarch/cpu.h                          |   4 +
 target/loongarch/kvm/kvm.c                      | 107 ++++++++++++++++++
 target/loongarch/tcg/insn_trans/trans_vec.c.inc |   4 +-
 5 files changed, 249 insertions(+), 94 deletions(-)

From: Guo Hongyu <guohongyu24@mails.ucas.ac.cn>

Refer to the link below for a description of the vldi instructions:
https://jia.je/unofficial-loongarch-intrinsics-guide/lsx/misc/#synopsis_88
Fixed errors in vldi instruction implementation.

Signed-off-by: Guo Hongyu <guohongyu24@mails.ucas.ac.cn>
Tested-by: Xianglai Li <lixianglai@loongson.cn>
Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
---
 target/loongarch/tcg/insn_trans/trans_vec.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
@@ -XXX,XX +XXX,XX @@ static uint64_t vldi_get_value(DisasContext *ctx, uint32_t imm)
         break;
     case 1:
         /* data: {2{16'0, imm[7:0], 8'0}} */
-        data = (t << 24) | (t << 8);
+        data = (t << 40) | (t << 8);
         break;
     case 2:
         /* data: {2{8'0, imm[7:0], 16'0}} */
-- 
2.43.5

Hardcoded 32 bytes is used for vbsrl emulation check, there is
problem when options lsx=on,lasx=off is used for vbsrl.v instruction
in TCG mode. It injects LASX exception rather LSX exception.

Here actual operand size is used.

Cc: qemu-stable@nongnu.org
Fixes: df97f338076 ("target/loongarch: Implement xvreplve xvinsve0 xvpickve")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/loongarch/tcg/insn_trans/trans_vec.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vbsrl_v(DisasContext *ctx, arg_vv_i *a, uint32_t oprsz)
 {
     int i, ofs;
 
-    if (!check_vec(ctx, 32)) {
+    if (!check_vec(ctx, oprsz)) {
         return true;
     }
 
-- 
2.43.5

The same with ACPI table, fdt table is created on machine done
notification. Some objects like CPU objects can be created with cold-plug
method with command such as -smp x, -device la464-loongarch-cpu, so all
objects finish to create when machine is done.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 hw/loongarch/virt.c | 103 ++++++++++++++++++++++++--------------------
 1 file changed, 57 insertions(+), 46 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_build_smbios(LoongArchVirtMachineState *lvms)
     }
 }
 
+static void virt_fdt_setup(LoongArchVirtMachineState *lvms)
+{
+    MachineState *machine = MACHINE(lvms);
+    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
+    int i;
+
+    create_fdt(lvms);
+    fdt_add_cpu_nodes(lvms);
+    fdt_add_memory_nodes(machine);
+    fdt_add_fw_cfg_node(lvms);
+    fdt_add_flash_node(lvms);
+
+    /* Add cpu interrupt-controller */
+    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
+    /* Add Extend I/O Interrupt Controller node */
+    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
+    /* Add PCH PIC node */
+    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
+    /* Add PCH MSI node */
+    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
+    /* Add pcie node */
+    fdt_add_pcie_node(lvms, &pch_pic_phandle, &pch_msi_phandle);
+
+    /*
+     * Create uart fdt node in reverse order so that they appear
+     * in the finished device tree lowest address first
+     */
+    for (i = VIRT_UART_COUNT; i-- > 0;) {
+        hwaddr base = VIRT_UART_BASE + i * VIRT_UART_SIZE;
+        int irq = VIRT_UART_IRQ + i - VIRT_GSI_BASE;
+        fdt_add_uart_node(lvms, &pch_pic_phandle, base, irq, i == 0);
+    }
+
+    fdt_add_rtc_node(lvms, &pch_pic_phandle);
+    fdt_add_ged_reset(lvms);
+    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
+                                   VIRT_PLATFORM_BUS_BASEADDRESS,
+                                   VIRT_PLATFORM_BUS_SIZE,
+                                   VIRT_PLATFORM_BUS_IRQ);
+
+    /*
+     * Since lowmem region starts from 0 and Linux kernel legacy start address
+     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
+     * access. FDT size limit with 1 MiB.
+     * Put the FDT into the memory map as a ROM image: this will ensure
+     * the FDT is copied again upon reset, even if addr points into RAM.
+     */
+    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
+    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
+                          &address_space_memory);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
+}
+
 static void virt_done(Notifier *notifier, void *data)
 {
     LoongArchVirtMachineState *lvms = container_of(notifier,
                                       LoongArchVirtMachineState, machine_done);
     virt_build_smbios(lvms);
     loongarch_acpi_setup(lvms);
+    virt_fdt_setup(lvms);
 }
 
 static void virt_powerdown_req(Notifier *notifier, void *opaque)
@@ -XXX,XX +XXX,XX @@ static DeviceState *create_platform_bus(DeviceState *pch_pic)
 }
 
 static void virt_devices_init(DeviceState *pch_pic,
-                                   LoongArchVirtMachineState *lvms,
-                                   uint32_t *pch_pic_phandle,
-                                   uint32_t *pch_msi_phandle)
+                                   LoongArchVirtMachineState *lvms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(lvms);
     DeviceState *gpex_dev;
@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
         gpex_set_irq_num(GPEX_HOST(gpex_dev), i, 16 + i);
     }
 
-    /* Add pcie node */
-    fdt_add_pcie_node(lvms, pch_pic_phandle, pch_msi_phandle);
-
     /*
      * Create uart fdt node in reverse order so that they appear
      * in the finished device tree lowest address first
@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
         serial_mm_init(get_system_memory(), base, 0,
                        qdev_get_gpio_in(pch_pic, irq),
                        115200, serial_hd(i), DEVICE_LITTLE_ENDIAN);
-        fdt_add_uart_node(lvms, pch_pic_phandle, base, irq, i == 0);
     }
 
     /* Network init */
@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
     sysbus_create_simple("ls7a_rtc", VIRT_RTC_REG_BASE,
                          qdev_get_gpio_in(pch_pic,
                          VIRT_RTC_IRQ - VIRT_GSI_BASE));
-    fdt_add_rtc_node(lvms, pch_pic_phandle);
-    fdt_add_ged_reset(lvms);
 
     /* acpi ged */
     lvms->acpi_ged = create_acpi_ged(pch_pic, lvms);
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     CPULoongArchState *env;
     CPUState *cpu_state;
     int cpu, pin, i, start, num;
-    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
 
     /*
      * Extended IRQ model.
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     memory_region_add_subregion(&lvms->system_iocsr, MAIL_SEND_ADDR,
                    sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 1));
 
-    /* Add cpu interrupt-controller */
-    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
-
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         cpu_state = qemu_get_cpu(cpu);
         cpudev = DEVICE(cpu_state);
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
         }
     }
 
-    /* Add Extend I/O Interrupt Controller node */
-    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
-
     pch_pic = qdev_new(TYPE_LOONGARCH_PIC);
     num = VIRT_PCH_PIC_IRQ_NUM;
     qdev_prop_set_uint32(pch_pic, "pch_pic_irq_num", num);
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
         qdev_connect_gpio_out(DEVICE(d), i, qdev_get_gpio_in(extioi, i));
     }
 
-    /* Add PCH PIC node */
-    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
-
     pch_msi = qdev_new(TYPE_LOONGARCH_PCH_MSI);
     start   =  num;
     num = EXTIOI_IRQS - start;
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
                               qdev_get_gpio_in(extioi, i + start));
     }
 
-    /* Add PCH MSI node */
-    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
-
-    virt_devices_init(pch_pic, lvms, &pch_pic_phandle, &pch_msi_phandle);
+    virt_devices_init(pch_pic, lvms);
 }
 
 static void virt_firmware_init(LoongArchVirtMachineState *lvms)
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
         cpu_model = LOONGARCH_CPU_TYPE_NAME("la464");
     }
 
-    create_fdt(lvms);
-
     /* Create IOCSR space */
     memory_region_init_io(&lvms->system_iocsr, OBJECT(machine), NULL,
                           machine, "iocsr", UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
         lacpu = LOONGARCH_CPU(cpu);
         lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
     }
-    fdt_add_cpu_nodes(lvms);
-    fdt_add_memory_nodes(machine);
     fw_cfg_add_memory(machine);
 
     /* Node0 memory */
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
                         memmap_table,
                         sizeof(struct memmap_entry) * (memmap_entries));
     }
-    fdt_add_fw_cfg_node(lvms);
-    fdt_add_flash_node(lvms);
 
     /* Initialize the IO interrupt subsystem */
     virt_irq_init(lvms);
-    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
-                                   VIRT_PLATFORM_BUS_BASEADDRESS,
-                                   VIRT_PLATFORM_BUS_SIZE,
-                                   VIRT_PLATFORM_BUS_IRQ);
     lvms->machine_done.notify = virt_done;
     qemu_add_machine_init_done_notifier(&lvms->machine_done);
      /* connect powerdown request */
     lvms->powerdown_notifier.notify = virt_powerdown_req;
     qemu_register_powerdown_notifier(&lvms->powerdown_notifier);
 
-    /*
-     * Since lowmem region starts from 0 and Linux kernel legacy start address
-     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
-     * access. FDT size limit with 1 MiB.
-     * Put the FDT into the memory map as a ROM image: this will ensure
-     * the FDT is copied again upon reset, even if addr points into RAM.
-     */
-    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
-    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
-                          &address_space_memory);
-    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
-            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
-
     lvms->bootinfo.ram_size = ram_size;
     loongarch_load_kernel(machine, &lvms->bootinfo);
 }
-- 
2.43.5

For CPU object, possible_cpu_arch_ids() function is used rather than
smp.cpus. With command -smp x, -device la464-loongarch-cpu, smp.cpus
is not accurate for all possible CPU objects, possible_cpu_arch_ids()
is used here.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 hw/loongarch/virt.c | 39 +++++++++++++++++++++++++--------------
 1 file changed, 25 insertions(+), 14 deletions(-)

Like LBT feature, add type OnOffAuto for LSX feature setting. Also
add LSX feature detection with new VM ioctl command, fallback to old
method if it is not supported.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 target/loongarch/cpu.c     | 38 +++++++++++++++------------
 target/loongarch/cpu.h     |  2 ++
 target/loongarch/kvm/kvm.c | 54 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+), 17 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_la464_initfn(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
     CPULoongArchState *env = &cpu->env;
+    uint32_t data = 0;
     int i;
 
     for (i = 0; i < 21; i++) {
@@ -XXX,XX +XXX,XX @@ static void loongarch_la464_initfn(Object *obj)
     cpu->dtb_compatible = "loongarch,Loongson-3A5000";
     env->cpucfg[0] = 0x14c010;  /* PRID */
 
-    uint32_t data = 0;
     data = FIELD_DP32(data, CPUCFG1, ARCH, 2);
     data = FIELD_DP32(data, CPUCFG1, PGMMU, 1);
     data = FIELD_DP32(data, CPUCFG1, IOCSR, 1);
@@ -XXX,XX +XXX,XX @@ static void loongarch_la132_initfn(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
     CPULoongArchState *env = &cpu->env;
-
+    uint32_t data = 0;
     int i;
 
     for (i = 0; i < 21; i++) {
@@ -XXX,XX +XXX,XX @@ static void loongarch_la132_initfn(Object *obj)
     cpu->dtb_compatible = "loongarch,Loongson-1C103";
     env->cpucfg[0] = 0x148042;  /* PRID */
 
-    uint32_t data = 0;
     data = FIELD_DP32(data, CPUCFG1, ARCH, 1); /* LA32 */
     data = FIELD_DP32(data, CPUCFG1, PGMMU, 1);
     data = FIELD_DP32(data, CPUCFG1, IOCSR, 1);
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static bool loongarch_get_lsx(Object *obj, Error **errp)
 {
-    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-    bool ret;
-
-    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
-        ret = true;
-    } else {
-        ret = false;
-    }
-    return ret;
+    return LOONGARCH_CPU(obj)->lsx != ON_OFF_AUTO_OFF;
 }
 
 static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+    uint32_t val;
 
-    if (value) {
-        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LSX, 1);
-    } else {
-        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LSX, 0);
-        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LASX, 0);
+    cpu->lsx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+    if (kvm_enabled()) {
+        /* kvm feature detection in function kvm_arch_init_vcpu */
+        return;
     }
+
+    /* LSX feature detection in TCG mode */
+    val = cpu->env.cpucfg[2];
+    if (cpu->lsx == ON_OFF_AUTO_ON) {
+        if (FIELD_EX32(val, CPUCFG2, LSX) == 0) {
+            error_setg(errp, "Failed to enable LSX in TCG mode");
+            return;
+        }
+    }
+
+    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LSX, value);
 }
 
 static bool loongarch_get_lasx(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 
+    cpu->lsx = ON_OFF_AUTO_AUTO;
     object_property_add_bool(obj, "lsx", loongarch_get_lsx,
                              loongarch_set_lsx);
     object_property_add_bool(obj, "lasx", loongarch_get_lasx,
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
 
     } else {
         cpu->lbt = ON_OFF_AUTO_OFF;
+        cpu->pmu = ON_OFF_AUTO_OFF;
     }
 }
 
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct LoongArchTLB LoongArchTLB;
 #endif
 
 enum loongarch_features {
+    LOONGARCH_FEATURE_LSX,
     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
     LOONGARCH_FEATURE_PMU,
 };
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint32_t  phy_id;
     OnOffAuto lbt;
     OnOffAuto pmu;
+    OnOffAuto lsx;
 
     /* 'compatible' string for this CPU for Linux device trees */
     const char *dtb_compatible;
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
 {
     int ret;
     struct kvm_device_attr attr;
+    uint64_t val;
 
     switch (feature) {
+    case LOONGARCH_FEATURE_LSX:
+        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
+        attr.attr = KVM_LOONGARCH_VM_FEAT_LSX;
+        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        if (ret == 0) {
+            return true;
+        }
+
+        /* Fallback to old kernel detect interface */
+        val = 0;
+        attr.group = KVM_LOONGARCH_VCPU_CPUCFG;
+        /* Cpucfg2 */
+        attr.attr  = 2;
+        attr.addr = (uint64_t)&val;
+        ret = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, &attr);
+        if (!ret) {
+            ret = kvm_vcpu_ioctl(cs, KVM_GET_DEVICE_ATTR, &attr);
+            if (ret) {
+                return false;
+            }
+
+            ret = FIELD_EX32((uint32_t)val, CPUCFG2, LSX);
+            return (ret != 0);
+        }
+        return false;
+
     case LOONGARCH_FEATURE_LBT:
         /*
          * Return all if all the LBT features are supported such as:
@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
     return false;
 }
 
+static int kvm_cpu_check_lsx(CPUState *cs, Error **errp)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    bool kvm_supported;
+
+    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_LSX);
+    env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LSX, 0);
+    if (cpu->lsx == ON_OFF_AUTO_ON) {
+        if (kvm_supported) {
+            env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LSX, 1);
+        } else {
+            error_setg(errp, "'lsx' feature not supported by KVM on this host");
+            return -ENOTSUP;
+        }
+    } else if ((cpu->lsx == ON_OFF_AUTO_AUTO) && kvm_supported) {
+        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LSX, 1);
+    }
+
+    return 0;
+}
+
 static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
 {
     CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         brk_insn = val;
     }
 
+    ret = kvm_cpu_check_lsx(cs, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+
     ret = kvm_cpu_check_lbt(cs, &local_err);
     if (ret < 0) {
         error_report_err(local_err);
-- 
2.43.5

Like LSX feature, add type OnOffAuto for LASX feature setting.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 target/loongarch/cpu.c     | 50 +++++++++++++++++++++++------------
 target/loongarch/cpu.h     |  2 ++
 target/loongarch/kvm/kvm.c | 53 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 89 insertions(+), 16 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
     uint32_t val;
 
     cpu->lsx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+    if (cpu->lsx == ON_OFF_AUTO_OFF) {
+        cpu->lasx = ON_OFF_AUTO_OFF;
+        if (cpu->lasx == ON_OFF_AUTO_ON) {
+            error_setg(errp, "Failed to disable LSX since LASX is enabled");
+            return;
+        }
+    }
+
     if (kvm_enabled()) {
         /* kvm feature detection in function kvm_arch_init_vcpu */
         return;
@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
             error_setg(errp, "Failed to enable LSX in TCG mode");
             return;
         }
+    } else {
+        cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, 0);
+        val = cpu->env.cpucfg[2];
     }
 
     cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LSX, value);
@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
 
 static bool loongarch_get_lasx(Object *obj, Error **errp)
 {
-    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-    bool ret;
-
-    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LASX)) {
-        ret = true;
-    } else {
-        ret = false;
-    }
-    return ret;
+    return LOONGARCH_CPU(obj)->lasx != ON_OFF_AUTO_OFF;
 }
 
 static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+    uint32_t val;
 
-    if (value) {
-	if (!FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
-            cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LSX, 1);
-	}
-        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LASX, 1);
-    } else {
-        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, LASX, 0);
+    cpu->lasx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+    if ((cpu->lsx == ON_OFF_AUTO_OFF) && (cpu->lasx == ON_OFF_AUTO_ON)) {
+        error_setg(errp, "Failed to enable LASX since lSX is disabled");
+        return;
+    }
+
+    if (kvm_enabled()) {
+        /* kvm feature detection in function kvm_arch_init_vcpu */
+        return;
     }
+
+    /* LASX feature detection in TCG mode */
+    val = cpu->env.cpucfg[2];
+    if (cpu->lasx == ON_OFF_AUTO_ON) {
+        if (FIELD_EX32(val, CPUCFG2, LASX) == 0) {
+            error_setg(errp, "Failed to enable LASX in TCG mode");
+            return;
+        }
+    }
+
+    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, value);
 }
 
 static bool loongarch_get_lbt(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
 
     cpu->lsx = ON_OFF_AUTO_AUTO;
+    cpu->lasx = ON_OFF_AUTO_AUTO;
     object_property_add_bool(obj, "lsx", loongarch_get_lsx,
                              loongarch_set_lsx);
     object_property_add_bool(obj, "lasx", loongarch_get_lasx,
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct LoongArchTLB LoongArchTLB;
 
 enum loongarch_features {
     LOONGARCH_FEATURE_LSX,
+    LOONGARCH_FEATURE_LASX,
     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
     LOONGARCH_FEATURE_PMU,
 };
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     OnOffAuto lbt;
     OnOffAuto pmu;
     OnOffAuto lsx;
+    OnOffAuto lasx;
 
     /* 'compatible' string for this CPU for Linux device trees */
     const char *dtb_compatible;
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
         }
         return false;
 
+    case LOONGARCH_FEATURE_LASX:
+        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
+        attr.attr = KVM_LOONGARCH_VM_FEAT_LASX;
+        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        if (ret == 0) {
+            return true;
+        }
+
+        /* Fallback to old kernel detect interface */
+        val = 0;
+        attr.group = KVM_LOONGARCH_VCPU_CPUCFG;
+        /* Cpucfg2 */
+        attr.attr  = 2;
+        attr.addr = (uint64_t)&val;
+        ret = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, &attr);
+        if (!ret) {
+            ret = kvm_vcpu_ioctl(cs, KVM_GET_DEVICE_ATTR, &attr);
+            if (ret) {
+                return false;
+            }
+
+            ret = FIELD_EX32((uint32_t)val, CPUCFG2, LASX);
+            return (ret != 0);
+        }
+        return false;
+
     case LOONGARCH_FEATURE_LBT:
         /*
          * Return all if all the LBT features are supported such as:
@@ -XXX,XX +XXX,XX @@ static int kvm_cpu_check_lsx(CPUState *cs, Error **errp)
     return 0;
 }
 
+static int kvm_cpu_check_lasx(CPUState *cs, Error **errp)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    bool kvm_supported;
+
+    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_LASX);
+    env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LASX, 0);
+    if (cpu->lasx == ON_OFF_AUTO_ON) {
+        if (kvm_supported) {
+            env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LASX, 1);
+        } else {
+            error_setg(errp, "'lasx' feature not supported by KVM on host");
+            return -ENOTSUP;
+        }
+    } else if ((cpu->lasx == ON_OFF_AUTO_AUTO) && kvm_supported) {
+        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LASX, 1);
+    }
+
+    return 0;
+}
+
 static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
 {
     CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         error_report_err(local_err);
     }
 
+    ret = kvm_cpu_check_lasx(cs, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+
     ret = kvm_cpu_check_lbt(cs, &local_err);
     if (ret < 0) {
         error_report_err(local_err);
-- 
2.43.5