Series comparison

-[PULL 00/65] riscv-to-apply queue
+[PULL 00/39] riscv-to-apply queue
-The following changes since commit 9468484fe904ab4691de6d9c34616667f377ceac:
+The following changes since commit 8032c78e556cd0baec111740a6c636863f9bd7c8:
-  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2024-01-09 10:32:23 +0000)
+  Merge tag 'firmware-20241216-pull-request' of https://gitlab.com/kraxel/qemu into staging (2024-12-16 14:20:33 -0500)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240110
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20241219-1
-for you to fetch changes up to 71b76da33a1558bcd59100188f5753737ef6fa21:
+for you to fetch changes up to 5632d271be16b5e769342d54198c4359658abcb7:
-  target/riscv: Ensure mideleg is set correctly on reset (2024-01-10 18:47:47 +1000)
+  target/riscv: add support for RV64 Xiangshan Nanhu CPU (2024-12-18 11:07:59 +1000)
 ----------------------------------------------------------------
-RISC-V PR for 9.0
+RISC-V PR for 10.0
-* Make vector whole-register move (vmv) depend on vtype register
+* Correct the validness check of iova
-* Fix th.dcache.cval1 priviledge check
+* Fix APLIC in_clrip and clripnum write emulation
-* Don't allow write mstatus_vs without RVV
+* Support riscv-iommu-sys device
-* Use hwaddr instead of target_ulong for RV32
+* Add Tenstorrent Ascalon CPU
-* Fix machine IDs QOM getters\
+* Add AIA userspace irqchip_split support
-* Fix KVM reg id sizes
+* Add Microblaze V generic board
-* ACPI: Enable AIA, PLIC and update RHCT
+* Upgrade ACPI SPCR table to support SPCR table revision 4 format
-* Fix the interrupts-extended property format of PLIC
+* Remove tswap64() calls from HTIF
-* Add support for Zacas extension
+* Support 64-bit address of initrd
-* Add amocas.[w,d,q] instructions
+* Introduce svukte ISA extension
-* Document acpi parameter of virt machine
+* Support ssstateen extension
-* RVA22 profiles support
+* Support for RV64 Xiangshan Nanhu CPU
 * Remove group setting of KVM AIA if the machine only has 1 socket
 * Add RVV CSRs to KVM
 * sifive_u: Update S-mode U-Boot image build instructions
 * Upgrade OpenSBI from v1.3.1 to v1.4
 * pmp: Ignore writes when RW=01 and MML=0
 * Assert that the CSR numbers will be correct
 * Don't adjust vscause for exceptions
 * Ensure mideleg is set correctly on reset
 ----------------------------------------------------------------
-Alistair Francis (3):
+Anton Blanchard (1):
-      target/riscv: Assert that the CSR numbers will be correct
+      target/riscv: Add Tenstorrent Ascalon CPU
       target/riscv: Don't adjust vscause for exceptions
       target/riscv: Ensure mideleg is set correctly on reset
-Bin Meng (2):
+Daniel Henrique Barboza (15):
-      docs/system/riscv: sifive_u: Update S-mode U-Boot image build instructions
+      hw/riscv/riscv-iommu.c: add riscv_iommu_instance_init()
-      roms/opensbi: Upgrade from v1.3.1 to v1.4
+      hw/riscv/riscv-iommu: parametrize CAP.IGS
       hw/riscv/virt.c, riscv-iommu-sys.c: add MSIx support
       hw/riscv/riscv-iommu: implement reset protocol
       docs/specs: add riscv-iommu-sys information
       hw/intc/riscv_aplic: rename is_kvm_aia()
       hw/riscv/virt.c: reduce virt_use_kvm_aia() usage
       hw/riscv/virt.c: rename helper to virt_use_kvm_aia_aplic_imsic()
       target/riscv/kvm: consider irqchip_split() in aia_create()
       hw/riscv/virt.c, riscv_aplic.c: add 'emulated_aplic' helpers
       hw/intc/riscv_aplic: add kvm_msicfgaddr for split mode aplic-imsic
       target/riscv/kvm: remove irqchip_split() restriction
       docs: update riscv/virt.rst with kernel-irqchip=split support
       target/riscv/tcg: hide warn for named feats when disabling via priv_ver
       target/riscv: add ssstateen
-Daniel Henrique Barboza (36):
+Fea.Wang (6):
-      target/riscv/cpu.c: fix machine IDs getters
+      target/riscv: Add svukte extension capability variable
-      target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
+      target/riscv: Support senvcfg[UKTE] bit when svukte extension is enabled
-      target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
+      target/riscv: Support hstatus[HUKTE] bit when svukte extension is enabled
-      target/riscv/kvm: change timer regs size to u64
+      target/riscv: Check memory access to meet svukte rule
-      target/riscv/kvm: add RISCV_CONFIG_REG()
+      target/riscv: Expose svukte ISA extension
-      target/riscv/kvm: rename riscv_reg_id() to riscv_reg_id_ulong()
+      target/riscv: Check svukte is not enabled in RV32
       target/riscv: create TYPE_RISCV_VENDOR_CPU
       target/riscv/tcg: do not use "!generic" CPU checks
       target/riscv/tcg: update priv_ver on user_set extensions
       target/riscv: add rv64i CPU
       target/riscv: add zicbop extension flag
       target/riscv/tcg: add 'zic64b' support
       riscv-qmp-cmds.c: expose named features in cpu_model_expansion
       target/riscv: add rva22u64 profile definition
       target/riscv/kvm: add 'rva22u64' flag as unavailable
       target/riscv/tcg: add user flag for profile support
       target/riscv/tcg: add MISA user options hash
       target/riscv/tcg: add riscv_cpu_write_misa_bit()
       target/riscv/tcg: handle profile MISA bits
       target/riscv/tcg: add hash table insert helpers
       target/riscv/tcg: honor user choice for G MISA bits
       target/riscv/tcg: validate profiles during finalize
       riscv-qmp-cmds.c: add profile flags in cpu-model-expansion
       target/riscv: add 'rva22u64' CPU
       target/riscv: implement svade
       target/riscv: add priv ver restriction to profiles
       target/riscv/cpu.c: finalize satp_mode earlier
       target/riscv/cpu.c: add riscv_cpu_is_32bit()
       target/riscv: add satp_mode profile support
       target/riscv: add 'parent' in profile description
       target/riscv: add RVA22S64 profile
       target/riscv: add rva22s64 cpu
       linux-headers: Update to Linux v6.7-rc5
       linux-headers: riscv: add ptrace.h
       target/riscv/kvm: do PR_RISCV_V_SET_CONTROL during realize()
       target/riscv/kvm: add RVV and Vector CSR regs
-Heinrich Schuchardt (1):
+Jason Chien (1):
-      docs/system/riscv: document acpi parameter of virt machine
+      hw/riscv/riscv-iommu.c: Correct the validness check of iova
-Ivan Klokov (2):
+Jim Shu (3):
-      target/riscv/pmp: Use hwaddr instead of target_ulong for RV32
+      hw/riscv: Support to load DTB after 3GB memory on 64-bit system.
-      target/riscv: pmp: Ignore writes when RW=01 and MML=0
+      hw/riscv: Add a new struct RISCVBootInfo
       hw/riscv: Add the checking if DTB overlaps to kernel or initrd
-LIU Zhiwei (2):
+MollyChen (1):
-      target/riscv: Fix th.dcache.cval1 priviledge check
+      target/riscv: add support for RV64 Xiangshan Nanhu CPU
       target/riscv: Not allow write mstatus_vs without RVV
-Max Chou (2):
+Philippe Mathieu-Daudé (5):
-      target/riscv: Add vill check for whole vector register move instructions
+      MAINTAINERS: Cover RISC-V HTIF interface
-      target/riscv: The whole vector register move instructions depend on vsew
+      hw/char/riscv_htif: Explicit little-endian implementation
       hw/char/riscv_htif: Clarify MemoryRegionOps expect 32-bit accesses
       target/riscv: Include missing headers in 'vector_internals.h'
       target/riscv: Include missing headers in 'internals.h'
-Rob Bradford (1):
+Sai Pavan Boddu (1):
-      disas/riscv: Add amocas.[w,d,q] instructions
+      hw/riscv: Add Microblaze V generic board
-Sunil V L (13):
+Sia Jee Heng (3):
-      hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
+      qtest: allow SPCR acpi table changes
-      hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
+      hw/acpi: Upgrade ACPI SPCR table to support SPCR table revision 4 format
-      hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
+      tests/qtest/bios-tables-test: Update virt SPCR golden reference for RISC-V
       hw/riscv: virt: Make few IMSIC macros and functions public
       hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
       hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
       hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
       hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
       hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
       hw/pci-host/gpex: Define properties for MMIO ranges
       hw/riscv/virt: Update GPEX MMIO related properties
       hw/riscv/virt-acpi-build.c: Add IO controllers and devices
       hw/riscv/virt-acpi-build.c: Add PLIC in MADT
-Weiwei Li (1):
+Sunil V L (1):
-      target/riscv: Add support for Zacas extension
+      hw/riscv/virt: Add IOMMU as platform device if the option is set
-Yong-Xuan Wang (2):
+Tomasz Jeznach (1):
-      hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
+      hw/riscv: add riscv-iommu-sys platform device
       target/riscv/kvm.c: remove group setting of KVM AIA if the machine only has 1 socket
- docs/system/riscv/sifive_u.rst                 |  33 +-
+Yong-Xuan Wang (1):
- docs/system/riscv/virt.rst                     |   5 +
+      hw/intc/riscv_aplic: Fix APLIC in_clrip and clripnum write emulation
- include/hw/nvram/fw_cfg_acpi.h                 |  15 +
- include/hw/pci-host/gpex.h                     |  28 +-
+ MAINTAINERS                                |   8 +
- include/hw/riscv/virt.h                        |  26 ++
+ docs/specs/index.rst                       |   1 +
- include/hw/virtio/virtio-acpi.h                |  16 +
+ docs/specs/riscv-aia.rst                   |  83 ++++++++++
- include/standard-headers/drm/drm_fourcc.h      |   2 +
+ docs/specs/riscv-iommu.rst                 |  30 +++-
- include/standard-headers/linux/pci_regs.h      |  24 +-
+ docs/system/riscv/microblaze-v-generic.rst |  42 +++++
- include/standard-headers/linux/vhost_types.h   |   7 +
+ docs/system/riscv/virt.rst                 |  17 ++
- include/standard-headers/linux/virtio_config.h |   5 +
+ docs/system/target-riscv.rst               |   1 +
- include/standard-headers/linux/virtio_pci.h    |  11 +
+ hw/riscv/riscv-iommu-bits.h                |   6 +
- linux-headers/asm-arm64/kvm.h                  |  32 ++
+ hw/riscv/riscv-iommu.h                     |   5 +
- linux-headers/asm-generic/unistd.h             |  14 +-
+ include/hw/acpi/acpi-defs.h                |   7 +-
- linux-headers/asm-loongarch/bitsperlong.h      |   1 +
+ include/hw/acpi/aml-build.h                |   2 +-
- linux-headers/asm-loongarch/kvm.h              | 108 ++++++
+ include/hw/intc/riscv_aplic.h              |   8 +
- linux-headers/asm-loongarch/mman.h             |   1 +
+ include/hw/riscv/boot.h                    |  28 +++-
- linux-headers/asm-loongarch/unistd.h           |   5 +
+ include/hw/riscv/iommu.h                   |  10 +-
- linux-headers/asm-mips/unistd_n32.h            |   4 +
+ include/hw/riscv/virt.h                    |   6 +-
- linux-headers/asm-mips/unistd_n64.h            |   4 +
+ target/riscv/cpu-qom.h                     |   2 +
- linux-headers/asm-mips/unistd_o32.h            |   4 +
+ target/riscv/cpu_bits.h                    |   2 +
- linux-headers/asm-powerpc/unistd_32.h          |   4 +
+ target/riscv/cpu_cfg.h                     |   2 +
- linux-headers/asm-powerpc/unistd_64.h          |   4 +
+ target/riscv/internals.h                   |   3 +
- linux-headers/asm-riscv/kvm.h                  |  12 +
+ target/riscv/vector_internals.h            |   1 +
- linux-headers/asm-riscv/ptrace.h               | 132 +++++++
+ hw/acpi/aml-build.c                        |  20 ++-
- linux-headers/asm-s390/unistd_32.h             |   4 +
+ hw/arm/virt-acpi-build.c                   |   8 +-
- linux-headers/asm-s390/unistd_64.h             |   4 +
+ hw/char/riscv_htif.c                       |  15 +-
- linux-headers/asm-x86/unistd_32.h              |   4 +
+ hw/intc/riscv_aplic.c                      |  74 +++++++--
- linux-headers/asm-x86/unistd_64.h              |   3 +
+ hw/loongarch/acpi-build.c                  |   6 +-
- linux-headers/asm-x86/unistd_x32.h             |   3 +
+ hw/riscv/boot.c                            | 100 +++++++----
- linux-headers/linux/iommufd.h                  | 180 +++++++++-
+ hw/riscv/microblaze-v-generic.c            | 184 +++++++++++++++++++++
- linux-headers/linux/kvm.h                      |  11 +
+ hw/riscv/microchip_pfsoc.c                 |  13 +-
- linux-headers/linux/psp-sev.h                  |   1 +
+ hw/riscv/opentitan.c                       |   4 +-
- linux-headers/linux/stddef.h                   |   9 +-
+ hw/riscv/riscv-iommu-pci.c                 |  21 +++
- linux-headers/linux/userfaultfd.h              |   9 +-
+ hw/riscv/riscv-iommu-sys.c                 | 256 +++++++++++++++++++++++++++++
- linux-headers/linux/vfio.h                     |  47 ++-
+ hw/riscv/riscv-iommu.c                     | 137 ++++++++++-----
- linux-headers/linux/vhost.h                    |   8 +
+ hw/riscv/sifive_e.c                        |   4 +-
- target/riscv/cpu-qom.h                         |   5 +
+ hw/riscv/sifive_u.c                        |  18 +-
- target/riscv/cpu.h                             |  18 +
+ hw/riscv/spike.c                           |  14 +-
- target/riscv/cpu_cfg.h                         |   5 +
+ hw/riscv/virt-acpi-build.c                 |  12 +-
- target/riscv/pmp.h                             |   8 +-
+ hw/riscv/virt.c                            | 159 +++++++++++++++---
- target/riscv/insn32.decode                     |   6 +
+ target/riscv/cpu.c                         | 101 ++++++++++++
- disas/riscv.c                                  |   9 +
+ target/riscv/cpu_helper.c                  |  55 +++++++
- hw/arm/virt-acpi-build.c                       |  51 +--
+ target/riscv/csr.c                         |   7 +
- hw/i386/acpi-microvm.c                         |  15 +-
+ target/riscv/kvm/kvm-cpu.c                 |  43 ++---
- hw/nvram/fw_cfg-acpi.c                         |  23 ++
+ target/riscv/tcg/tcg-cpu.c                 |  27 ++-
- hw/pci-host/gpex-acpi.c                        |  13 +
+ hw/riscv/Kconfig                           |   8 +
- hw/pci-host/gpex.c                             |  12 +
+ hw/riscv/meson.build                       |   3 +-
- hw/riscv/virt-acpi-build.c                     | 323 ++++++++++++++++--
+ hw/riscv/trace-events                      |   4 +
- hw/riscv/virt.c                                | 124 +++----
+ tests/data/acpi/riscv64/virt/SPCR          | Bin 80 -> 90 bytes
- hw/virtio/virtio-acpi.c                        |  33 ++
+files changed, 1380 insertions(+), 177 deletions(-)
- target/riscv/cpu.c                             | 223 ++++++++++--
+ create mode 100644 docs/specs/riscv-aia.rst
- target/riscv/cpu_helper.c                      |   4 +-
+ create mode 100644 docs/system/riscv/microblaze-v-generic.rst
- target/riscv/csr.c                             |  10 +-
+ create mode 100644 hw/riscv/microblaze-v-generic.c
- target/riscv/kvm/kvm-cpu.c                     | 250 ++++++++++----
+ create mode 100644 hw/riscv/riscv-iommu-sys.c
- target/riscv/pmp.c                             |  28 +-
  target/riscv/riscv-qmp-cmds.c                  |  44 ++-
  target/riscv/tcg/tcg-cpu.c                     | 455 ++++++++++++++++++++++---
  target/riscv/translate.c                       |   1 +
  target/riscv/insn_trans/trans_rvv.c.inc        |   8 +-
  target/riscv/insn_trans/trans_rvzacas.c.inc    | 150 ++++++++
  target/riscv/insn_trans/trans_xthead.c.inc     |   2 +-
  hw/nvram/meson.build                           |   1 +
  hw/riscv/Kconfig                               |   1 +
  hw/virtio/meson.build                          |   1 +
  pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 135376 -> 267416 bytes
  pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 138368 -> 270808 bytes
  roms/opensbi                                   |   2 +-
  scripts/update-linux-headers.sh                |   3 +
 files changed, 2248 insertions(+), 360 deletions(-)
  create mode 100644 include/hw/nvram/fw_cfg_acpi.h
  create mode 100644 include/hw/virtio/virtio-acpi.h
  create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
  create mode 100644 linux-headers/asm-loongarch/kvm.h
  create mode 100644 linux-headers/asm-loongarch/mman.h
  create mode 100644 linux-headers/asm-loongarch/unistd.h
  create mode 100644 linux-headers/asm-riscv/ptrace.h
  create mode 100644 hw/nvram/fw_cfg-acpi.c
  create mode 100644 hw/virtio/virtio-acpi.c
  create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc

-[PULL 60/65] docs/system/riscv: sifive_u: Update S-mode U-Boot image build instructions
+[PULL 01/39] hw/riscv/riscv-iommu.c: Correct the validness check of iova
-From: Bin Meng <bmeng@tinylab.org>
+From: Jason Chien <jason.chien@sifive.com>
-Currently, the documentation outlines the process for building the
+From RISCV IOMMU spec section 2.1.3:
-S-mode U-Boot image using `make menuconfig` and manual actions within
+When SXL is 1, the following rules apply:
-the menuconfig UI. However, this approach is fragile due to Kconfig
+- If the first-stage is not Bare, then a page fault corresponding to the
-options potentially changing across different releases. For example,
+original access type occurs if the IOVA has bits beyond bit 31 set to 1.
-CONFIG_OF_PRIOR_STAGE has been replaced by CONFIG_BOARD since v2022.01
+- If the second-stage is not Bare, then a guest page fault corresponding
-release, and CONFIG_TEXT_BASE has been moved to the 'General setup'
+to the original access type occurs if the incoming GPA has bits beyond bit
-menu from the 'Boot options' menu in v2024.01 release.
+set to 1.
-This update aims to make the S-mode U-Boot image build instructions
+From RISCV IOMMU spec section 2.3 step 17:
-future-proof. It leverages the 'config' script provided in the U-Boot
+Use the process specified in Section "Two-Stage Address Translation" of
-source tree to edit the .config file, followed by a `make olddefconfig`.
+the RISC-V Privileged specification to determine the GPA accessed by the
 transaction.
-Validated with U-Boot v2024.01 release.
+From RISCV IOMMU spec section 2.3 step 19:
 Use the second-stage address translation process specified in Section
 "Two-Stage Address Translation" of the RISC-V Privileged specification
 to translate the GPA A to determine the SPA accessed by the transaction.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+This commit adds the iova check with the following rules:
 - For Sv32, Sv32x4, Sv39x4, Sv48x4 and Sv57x4, the iova must be zero
 extended.
 - For Sv39, Sv48 and Sv57, the iova must be signed extended with most
 significant bit.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-Message-ID: <20240104071523.273702-1-bmeng@tinylab.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20241114065617.25133-1-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/sifive_u.rst | 33 ++++++++++++---------------------
+ hw/riscv/riscv-iommu.c | 23 ++++++++++++++++++++---
-file changed, 12 insertions(+), 21 deletions(-)
+file changed, 20 insertions(+), 3 deletions(-)
-diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/sifive_u.rst
+--- a/hw/riscv/riscv-iommu.c
-+++ b/docs/system/riscv/sifive_u.rst
++++ b/hw/riscv/riscv-iommu.c
-@@ -XXX,XX +XXX,XX @@ command line options with ``qemu-system-riscv32``.
+@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
- Running U-Boot
- --------------
+         /* Address range check before first level lookup */
+         if (!sc[pass].step) {
--U-Boot mainline v2021.07 release is tested at the time of writing. To build a
+-            const uint64_t va_mask = (1ULL << (va_skip + va_bits)) - 1;
-+U-Boot mainline v2024.01 release is tested at the time of writing. To build a
+-            if ((addr & va_mask) != addr) {
- U-Boot mainline bootloader that can be booted by the ``sifive_u`` machine, use
+-                return RISCV_IOMMU_FQ_CAUSE_DMA_DISABLED;
- the sifive_unleashed_defconfig with similar commands as described above for
++            const uint64_t va_len = va_skip + va_bits;
- Linux:
++            const uint64_t va_mask = (1ULL << va_len) - 1;
-@@ -XXX,XX +XXX,XX @@ configuration of U-Boot:
++
++            if (pass == S_STAGE && va_len > 32) {
-   $ export CROSS_COMPILE=riscv64-linux-
++                target_ulong mask, masked_msbs;
-   $ make sifive_unleashed_defconfig
++
--  $ make menuconfig
++                mask = (1L << (TARGET_LONG_BITS - (va_len - 1))) - 1;
--
++                masked_msbs = (addr >> (va_len - 1)) & mask;
--then manually select the following configuration:
++
--
++                if (masked_msbs != 0 && masked_msbs != mask) {
--  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
++                    return (iotlb->perm & IOMMU_WO) ?
--
++                                RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S :
--and unselect the following configuration:
++                                RISCV_IOMMU_FQ_CAUSE_RD_FAULT_S;
--
++                }
--  * Library routines ---> Allow access to binman information in the device tree
++            } else {
-+  $ ./scripts/config --enable OF_BOARD
++                if ((addr & va_mask) != addr) {
-+  $ ./scripts/config --disable BINMAN_FDT
++                    return (iotlb->perm & IOMMU_WO) ?
-+  $ ./scripts/config --disable SPL
++                                RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS :
-+  $ make olddefconfig
++                                RISCV_IOMMU_FQ_CAUSE_RD_FAULT_VS;
++                }
- This changes U-Boot to use the QEMU generated device tree blob, and bypass
+             }
- running the U-Boot SPL stage.
+         }
@@ -XXX,XX +XXX,XX @@ It's possible to create a 32-bit U-Boot S-mode image as well.
    $ export CROSS_COMPILE=riscv64-linux-
    $ make sifive_unleashed_defconfig
 -  $ make menuconfig
 -
 -then manually update the following configuration in U-Boot:
 -
 -  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
 -  * RISC-V architecture ---> Base ISA ---> RV32I
 -  * Boot options ---> Boot images ---> Text Base ---> 0x80400000
 -
 -and unselect the following configuration:
 -
 -  * Library routines ---> Allow access to binman information in the device tree
 +  $ ./scripts/config --disable ARCH_RV64I
 +  $ ./scripts/config --enable ARCH_RV32I
 +  $ ./scripts/config --set-val TEXT_BASE 0x80400000
 +  $ ./scripts/config --enable OF_BOARD
 +  $ ./scripts/config --disable BINMAN_FDT
 +  $ ./scripts/config --disable SPL
 +  $ make olddefconfig
  Use the same command line options to boot the 32-bit U-Boot S-mode image:
 --
-.43.0
+.47.1

-[PULL 31/65] target/riscv/tcg: update priv_ver on user_set extensions
+[PULL 02/39] hw/intc/riscv_aplic: Fix APLIC in_clrip and clripnum write emulation
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-We'll add a new bare CPU type that won't have any default priv_ver. This
+In the section "4.7 Precise effects on interrupt-pending bits"
-means that the CPU will default to priv_ver = 0, i.e. 1.10.0.
+of the RISC-V AIA specification defines that:
-At the same we'll allow these CPUs to enable extensions at will, but
+"If the source mode is Level1 or Level0 and the interrupt domain
-then, if the extension has a priv_ver newer than 1.10, we'll end up
+is configured in MSI delivery mode (domaincfg.DM = 1):
-disabling it. Users will then need to manually set priv_ver to something
+The pending bit is cleared whenever the rectified input value is
-other than 1.10 to enable the extensions they want, which is not ideal.
+low, when the interrupt is forwarded by MSI, or by a relevant
 write to an in_clrip register or to clripnum."
-Change the setter() of extensions to allow user enabled extensions to
+Update the riscv_aplic_set_pending() to match the spec.
 bump the priv_ver of the CPU. This will make it convenient for users to
 enable extensions for CPUs that doesn't set a default priv_ver.
-This change does not affect any existing CPU: vendor CPUs does not allow
+Fixes: bf31cf06eb ("hw/intc/riscv_aplic: Fix setipnum_le write emulation for APLIC MSI-mode")
-extensions to be enabled, and generic CPUs are already set to priv_ver
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-LATEST.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20241029085349.30412-1-yongxuan.wang@sifive.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++++++++++++++++
+ hw/intc/riscv_aplic.c | 6 +++++-
-file changed, 32 insertions(+)
+file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
-     g_assert_not_reached();
- }
+     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
+         (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
-+static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
+-        if (!aplic->msimode || (aplic->msimode && !pending)) {
-+                                        uint32_t ext_offset)
++        if (!aplic->msimode) {
 +{
 +    int ext_priv_ver;
 +
 +    if (env->priv_ver == PRIV_VERSION_LATEST) {
 +        return;
 +    }
 +
 +    ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
 +
 +    if (env->priv_ver < ext_priv_ver) {
 +        /*
 +         * Note: the 'priv_spec' command line option, if present,
 +         * will take precedence over this priv_ver bump.
 +         */
 +        env->priv_ver = ext_priv_ver;
 +    }
 +}
 +
  static void cpu_cfg_ext_auto_update(RISCVCPU *cpu, uint32_t ext_offset,
                                      bool value)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
              return;
          }
++        if (aplic->msimode && !pending) {
-+        if (misa_bit == RVH && env->priv_ver < PRIV_VERSION_1_12_0) {
++            goto noskip_write_pending;
 +            /*
 +             * Note: the 'priv_spec' command line option, if present,
 +             * will take precedence over this priv_ver bump.
 +             */
 +            env->priv_ver = PRIV_VERSION_1_12_0;
 +        }
-+
+         if ((aplic->state[irq] & APLIC_ISTATE_INPUT) &&
-         env->misa_ext |= misa_bit;
+             (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
-         env->misa_ext_mask |= misa_bit;
+             return;
-     } else {
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
+         }
          return;
      }
-+    if (value) {
++noskip_write_pending:
-+        cpu_bump_multi_ext_priv_ver(&cpu->env, multi_ext_cfg->offset);
+     riscv_aplic_set_pending_raw(aplic, irq, pending);
 +    }
 +
      isa_ext_update_enabled(cpu, multi_ext_cfg->offset, value);
  }
 --
-.43.0
+.47.1

-[PULL 53/65] target/riscv: add RVA22S64 profile
+[PULL 03/39] hw/riscv/riscv-iommu.c: add riscv_iommu_instance_init()
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The RVA22S64 profile consists of the following:
+Move all the static initializion of the device to an init() function,
 leaving only the dynamic initialization to be done during realize.
-- all mandatory extensions of RVA22U64;
+With this change s->cap is initialized with RISCV_IOMMU_CAP_DBG during
-- priv spec v1.12.0;
+init(), and realize() will increment s->cap with the extra caps.
 - satp mode sv39;
 - Ssccptr, a cache related named feature that we're assuming always
   enable since we don't implement a cache;
 - Other named features already implemented: Sstvecd, Sstvala,
   Sscounterenw;
 - the new Svade named feature that was recently added.
-Most of the work is already done, so this patch is enough to implement
+This will allow callers to add IOMMU capabilities before the
-the profile.
+realization.
 After this patch, the 'rva22s64' user flag alone can be used with the
 rva64i CPU to boot Linux:
 -cpu rv64i,rva22s64=true
 This is the /proc/cpuinfo with this profile enabled:
  # cat /proc/cpuinfo
 processor    : 0
 hart        : 0
 isa        : rv64imafdc_zicbom_zicbop_zicboz_zicntr_zicsr_zifencei_zihintpause_zihpm_zfhmin_zca_zcd_zba_zbb_zbs_zkt_svinval_svpbmt
 mmu        : sv39
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-26-dbarboza@ventanamicro.com>
+Message-ID: <20241106133407.604587-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
+ hw/riscv/riscv-iommu.c | 71 +++++++++++++++++++++++-------------------
-file changed, 32 insertions(+)
+file changed, 39 insertions(+), 32 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/hw/riscv/riscv-iommu.c
-+++ b/target/riscv/cpu.c
++++ b/hw/riscv/riscv-iommu.c
-@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps riscv_iommu_trap_ops = {
      }
  };
-+/*
++static void riscv_iommu_instance_init(Object *obj)
-+ * As with RVA22U64, RVA22S64 also defines 'named features'.
++{
-+ *
++    RISCVIOMMUState *s = RISCV_IOMMU(obj);
 + * Cache related features that we consider enabled since we don't
 + * implement cache: Ssccptr
 + *
 + * Other named features that we already implement: Sstvecd, Sstvala,
 + * Sscounterenw
 + *
 + * Named features that we need to enable: svade
 + *
 + * The remaining features/extensions comes from RVA22U64.
 + */
 +static RISCVCPUProfile RVA22S64 = {
 +    .parent = &RVA22U64,
 +    .name = "rva22s64",
 +    .misa_ext = RVS,
 +    .priv_spec = PRIV_VERSION_1_12_0,
 +    .satp_mode = VM_1_10_SV39,
 +    .ext_offsets = {
 +        /* rva22s64 exts */
 +        CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
 +        CPU_CFG_OFFSET(ext_svinval),
 +
-+        /* rva22s64 named features */
++    /* Enable translation debug interface */
-+        CPU_CFG_OFFSET(svade),
++    s->cap = RISCV_IOMMU_CAP_DBG;
 +
-+        RISCV_PROFILE_EXT_LIST_END
++    /* Report QEMU target physical address space limits */
-+    }
++    s->cap = set_field(s->cap, RISCV_IOMMU_CAP_PAS,
-+};
++                       TARGET_PHYS_ADDR_SPACE_BITS);
 +
- RISCVCPUProfile *riscv_profiles[] = {
++    /* TODO: method to report supported PID bits */
-     &RVA22U64,
++    s->pid_bits = 8; /* restricted to size of MemTxAttrs.pid */
-+    &RVA22S64,
++    s->cap |= RISCV_IOMMU_CAP_PD8;
-     NULL,
++
 +    /* register storage */
 +    s->regs_rw = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
 +    s->regs_ro = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
 +    s->regs_wc = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
 +
 +     /* Mark all registers read-only */
 +    memset(s->regs_ro, 0xff, RISCV_IOMMU_REG_SIZE);
 +
 +    /* Device translation context cache */
 +    s->ctx_cache = g_hash_table_new_full(riscv_iommu_ctx_hash,
 +                                         riscv_iommu_ctx_equal,
 +                                         g_free, NULL);
 +
 +    s->iot_cache = g_hash_table_new_full(riscv_iommu_iot_hash,
 +                                         riscv_iommu_iot_equal,
 +                                         g_free, NULL);
 +
 +    s->iommus.le_next = NULL;
 +    s->iommus.le_prev = NULL;
 +    QLIST_INIT(&s->spaces);
 +}
 +
  static void riscv_iommu_realize(DeviceState *dev, Error **errp)
  {
      RISCVIOMMUState *s = RISCV_IOMMU(dev);
 -    s->cap = s->version & RISCV_IOMMU_CAP_VERSION;
 +    s->cap |= s->version & RISCV_IOMMU_CAP_VERSION;
      if (s->enable_msi) {
          s->cap |= RISCV_IOMMU_CAP_MSI_FLAT | RISCV_IOMMU_CAP_MSI_MRIF;
      }
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
          s->cap |= RISCV_IOMMU_CAP_SV32X4 | RISCV_IOMMU_CAP_SV39X4 |
                    RISCV_IOMMU_CAP_SV48X4 | RISCV_IOMMU_CAP_SV57X4;
      }
 -    /* Enable translation debug interface */
 -    s->cap |= RISCV_IOMMU_CAP_DBG;
 -
 -    /* Report QEMU target physical address space limits */
 -    s->cap = set_field(s->cap, RISCV_IOMMU_CAP_PAS,
 -                       TARGET_PHYS_ADDR_SPACE_BITS);
 -
 -    /* TODO: method to report supported PID bits */
 -    s->pid_bits = 8; /* restricted to size of MemTxAttrs.pid */
 -    s->cap |= RISCV_IOMMU_CAP_PD8;
      /* Out-of-reset translation mode: OFF (DMA disabled) BARE (passthrough) */
      s->ddtp = set_field(0, RISCV_IOMMU_DDTP_MODE, s->enable_off ?
                          RISCV_IOMMU_DDTP_MODE_OFF : RISCV_IOMMU_DDTP_MODE_BARE);
 -    /* register storage */
 -    s->regs_rw = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
 -    s->regs_ro = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
 -    s->regs_wc = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
 -
 -     /* Mark all registers read-only */
 -    memset(s->regs_ro, 0xff, RISCV_IOMMU_REG_SIZE);
 -
      /*
       * Register complete MMIO space, including MSI/PBA registers.
       * Note, PCIDevice implementation will add overlapping MR for MSI/PBA,
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
      memory_region_init_io(&s->trap_mr, OBJECT(dev), &riscv_iommu_trap_ops, s,
              "riscv-iommu-trap", ~0ULL);
      address_space_init(&s->trap_as, &s->trap_mr, "riscv-iommu-trap-as");
 -
 -    /* Device translation context cache */
 -    s->ctx_cache = g_hash_table_new_full(riscv_iommu_ctx_hash,
 -                                         riscv_iommu_ctx_equal,
 -                                         g_free, NULL);
 -
 -    s->iot_cache = g_hash_table_new_full(riscv_iommu_iot_hash,
 -                                         riscv_iommu_iot_equal,
 -                                         g_free, NULL);
 -
 -    s->iommus.le_next = NULL;
 -    s->iommus.le_prev = NULL;
 -    QLIST_INIT(&s->spaces);
  }
  static void riscv_iommu_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_iommu_info = {
      .name = TYPE_RISCV_IOMMU,
      .parent = TYPE_DEVICE,
      .instance_size = sizeof(RISCVIOMMUState),
 +    .instance_init = riscv_iommu_instance_init,
      .class_init = riscv_iommu_class_init,
  };
 --
-.43.0
+.47.1

-[PULL 58/65] target/riscv/kvm: do PR_RISCV_V_SET_CONTROL during realize()
+[PULL 04/39] hw/riscv/riscv-iommu: parametrize CAP.IGS
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Linux RISC-V vector documentation (Document/arch/riscv/vector.rst)
+Interrupt Generation Support (IGS) is a capability that is tied to the
-mandates a prctl() in order to allow an userspace thread to use the
+interrupt deliver mechanism, not with the core IOMMU emulation. We
-Vector extension from the host.
+should allow device implementations to set IGS as they wish.
-This is something to be done in realize() time, after init(), when we
+A new helper is added to make it easier for device impls to set IGS. Use
-already decided whether we're using RVV or not. We don't have a
+it in our existing IOMMU device (riscv-iommu-pci) to set
-realize() callback for KVM yet, so add kvm_cpu_realize() and enable RVV
+RISCV_IOMMU_CAPS_IGS_MSI.
 for the thread via PR_RISCV_V_SET_CONTROL.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-4-dbarboza@ventanamicro.com>
+Message-ID: <20241106133407.604587-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 29 +++++++++++++++++++++++++++++
+ hw/riscv/riscv-iommu-bits.h | 6 ++++++
-file changed, 29 insertions(+)
+ hw/riscv/riscv-iommu.h      | 4 ++++
  hw/riscv/riscv-iommu-pci.c  | 1 +
  hw/riscv/riscv-iommu.c      | 5 +++++
 files changed, 16 insertions(+)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/hw/riscv/riscv-iommu-bits.h
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/hw/riscv/riscv-iommu-bits.h
@@ -XXX,XX +XXX,XX @@ struct riscv_iommu_pq_record {
  #define RISCV_IOMMU_CAP_PD17            BIT_ULL(39)
  #define RISCV_IOMMU_CAP_PD20            BIT_ULL(40)
 +enum riscv_iommu_igs_modes {
 +    RISCV_IOMMU_CAP_IGS_MSI = 0,
 +    RISCV_IOMMU_CAP_IGS_WSI,
 +    RISCV_IOMMU_CAP_IGS_BOTH
 +};
 +
  /* 5.4 Features control register (32bits) */
  #define RISCV_IOMMU_REG_FCTL            0x0008
  #define RISCV_IOMMU_FCTL_BE             BIT(0)
 diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu.h
 +++ b/hw/riscv/riscv-iommu.h
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
+ #include "qom/object.h"
- #include <sys/ioctl.h>
+ #include "hw/riscv/iommu.h"
-+#include <sys/prctl.h>
++#include "hw/riscv/riscv-iommu-bits.h"
  #include <linux/kvm.h>
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/runstate.h"
  #include "hw/riscv/numa.h"
 +#define PR_RISCV_V_SET_CONTROL            69
 +#define PR_RISCV_V_VSTATE_CTRL_ON          2
 +
- void riscv_kvm_aplic_request(void *opaque, int irq, int level)
++typedef enum riscv_iommu_igs_modes riscv_iommu_igs_mode;
- {
-     kvm_set_irq(kvm_state, irq, !!level);
+ struct RISCVIOMMUState {
-@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_instance_init(CPUState *cs)
+     /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
  void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
           Error **errp);
 +void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
  /* private helpers */
 diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu-pci.c
 +++ b/hw/riscv/riscv-iommu-pci.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_pci_init(Object *obj)
      qdev_alias_all_properties(DEVICE(iommu), obj);
      iommu->icvec_avail_vectors = RISCV_IOMMU_PCI_ICVEC_VECTORS;
 +    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_MSI);
  }
  static const Property riscv_iommu_pci_properties[] = {
 diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu.c
 +++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps riscv_iommu_trap_ops = {
      }
- }
+ };
-+/*
++void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode)
 + * We'll get here via the following path:
 + *
 + * riscv_cpu_realize()
 + *   -> cpu_exec_realizefn()
 + *      -> kvm_cpu_realize() (via accel_cpu_common_realize())
 + */
 +static bool kvm_cpu_realize(CPUState *cs, Error **errp)
 +{
-+    RISCVCPU *cpu = RISCV_CPU(cs);
++    s->cap = set_field(s->cap, RISCV_IOMMU_CAP_IGS, mode);
 +    int ret;
 +
 +    if (riscv_has_ext(&cpu->env, RVV)) {
 +        ret = prctl(PR_RISCV_V_SET_CONTROL, PR_RISCV_V_VSTATE_CTRL_ON);
 +        if (ret) {
 +            error_setg(errp, "Error in prctl PR_RISCV_V_SET_CONTROL, code: %s",
 +                       strerrorname_np(errno));
 +            return false;
 +        }
 +    }
 +
 +   return true;
 +}
 +
- static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
+ static void riscv_iommu_instance_init(Object *obj)
  {
-     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
+     RISCVIOMMUState *s = RISCV_IOMMU(obj);
      acc->cpu_instance_init = kvm_cpu_instance_init;
 +    acc->cpu_target_realize = kvm_cpu_realize;
  }
  static const TypeInfo kvm_cpu_accel_type_info = {
 --
-.43.0
+.47.1

-[PULL 56/65] linux-headers: Update to Linux v6.7-rc5
+[PULL 05/39] hw/riscv: add riscv-iommu-sys platform device
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
-We'll add a new RISC-V linux-header file, but first let's update all
+This device models the RISC-V IOMMU as a sysbus device. The same design
-headers.
+decisions taken in the riscv-iommu-pci device were kept, namely the
+existence of 4 vectors are available for each interrupt cause.
-Headers for 'asm-loongarch' were added in this update.
+The WSIs are emitted using the input of the s->notify() callback as a
 index to an IRQ list. The IRQ list starts at 'base_irq' and goes until
 base_irq + 3. This means that boards must have 4 contiguous IRQ lines
 available, starting from 'base_irq'.
 Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-2-dbarboza@ventanamicro.com>
+Message-ID: <20241106133407.604587-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/standard-headers/drm/drm_fourcc.h     |   2 +
+ include/hw/riscv/iommu.h   |   4 ++
- include/standard-headers/linux/pci_regs.h     |  24 ++-
+ hw/riscv/riscv-iommu-sys.c | 128 +++++++++++++++++++++++++++++++++++++
- include/standard-headers/linux/vhost_types.h  |   7 +
+ hw/riscv/riscv-iommu.c     |   3 +-
- .../standard-headers/linux/virtio_config.h    |   5 +
+ hw/riscv/meson.build       |   2 +-
- include/standard-headers/linux/virtio_pci.h   |  11 ++
+files changed, 134 insertions(+), 3 deletions(-)
- linux-headers/asm-arm64/kvm.h                 |  32 ++++
+ create mode 100644 hw/riscv/riscv-iommu-sys.c
- linux-headers/asm-generic/unistd.h            |  14 +-
- linux-headers/asm-loongarch/bitsperlong.h     |   1 +
+diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
  linux-headers/asm-loongarch/kvm.h             | 108 +++++++++++
  linux-headers/asm-loongarch/mman.h            |   1 +
  linux-headers/asm-loongarch/unistd.h          |   5 +
  linux-headers/asm-mips/unistd_n32.h           |   4 +
  linux-headers/asm-mips/unistd_n64.h           |   4 +
  linux-headers/asm-mips/unistd_o32.h           |   4 +
  linux-headers/asm-powerpc/unistd_32.h         |   4 +
  linux-headers/asm-powerpc/unistd_64.h         |   4 +
  linux-headers/asm-riscv/kvm.h                 |  12 ++
  linux-headers/asm-s390/unistd_32.h            |   4 +
  linux-headers/asm-s390/unistd_64.h            |   4 +
  linux-headers/asm-x86/unistd_32.h             |   4 +
  linux-headers/asm-x86/unistd_64.h             |   3 +
  linux-headers/asm-x86/unistd_x32.h            |   3 +
  linux-headers/linux/iommufd.h                 | 180 +++++++++++++++++-
  linux-headers/linux/kvm.h                     |  11 ++
  linux-headers/linux/psp-sev.h                 |   1 +
  linux-headers/linux/stddef.h                  |   9 +-
  linux-headers/linux/userfaultfd.h             |   9 +-
  linux-headers/linux/vfio.h                    |  47 +++--
  linux-headers/linux/vhost.h                   |   8 +
 files changed, 498 insertions(+), 27 deletions(-)
  create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
  create mode 100644 linux-headers/asm-loongarch/kvm.h
  create mode 100644 linux-headers/asm-loongarch/mman.h
  create mode 100644 linux-headers/asm-loongarch/unistd.h
 diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/drm/drm_fourcc.h
+--- a/include/hw/riscv/iommu.h
-+++ b/include/standard-headers/drm/drm_fourcc.h
++++ b/include/hw/riscv/iommu.h
-@@ -XXX,XX +XXX,XX @@ extern "C" {
+@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUSpace RISCVIOMMUSpace;
-  * index 1 = Cr:Cb plane, [39:0] Cr1:Cb1:Cr0:Cb0 little endian
+ OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStatePci, RISCV_IOMMU_PCI)
-  */
+ typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
- #define DRM_FORMAT_NV15        fourcc_code('N', 'V', '1', '5') /* 2x2 subsampled Cr:Cb plane */
-+#define DRM_FORMAT_NV20        fourcc_code('N', 'V', '2', '0') /* 2x1 subsampled Cr:Cb plane */
++#define TYPE_RISCV_IOMMU_SYS "riscv-iommu-device"
-+#define DRM_FORMAT_NV30        fourcc_code('N', 'V', '3', '0') /* non-subsampled Cr:Cb plane */
++OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
++typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
- /*
++
   * 2 plane YCbCr MSB aligned
 diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/pci_regs.h
 +++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
  #define  PCI_HEADER_TYPE_NORMAL        0
  #define  PCI_HEADER_TYPE_BRIDGE        1
  #define  PCI_HEADER_TYPE_CARDBUS    2
 +#define  PCI_HEADER_TYPE_MFD        0x80    /* Multi-Function Device (possible) */
  #define PCI_BIST        0x0f    /* 8 bits */
  #define  PCI_BIST_CODE_MASK    0x0f    /* Return result */
@@ -XXX,XX +XXX,XX @@
  #define PCI_EXP_RTCAP        0x1e    /* Root Capabilities */
  #define  PCI_EXP_RTCAP_CRSVIS    0x0001    /* CRS Software Visibility capability */
  #define PCI_EXP_RTSTA        0x20    /* Root Status */
 +#define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
  #define  PCI_EXP_RTSTA_PME    0x00010000 /* PME status */
  #define  PCI_EXP_RTSTA_PENDING    0x00020000 /* PME pending */
  /*
@@ -XXX,XX +XXX,XX @@
  /* Process Address Space ID */
  #define PCI_PASID_CAP        0x04    /* PASID feature register */
 -#define  PCI_PASID_CAP_EXEC    0x02    /* Exec permissions Supported */
 -#define  PCI_PASID_CAP_PRIV    0x04    /* Privilege Mode Supported */
 +#define  PCI_PASID_CAP_EXEC    0x0002    /* Exec permissions Supported */
 +#define  PCI_PASID_CAP_PRIV    0x0004    /* Privilege Mode Supported */
 +#define  PCI_PASID_CAP_WIDTH    0x1f00
  #define PCI_PASID_CTRL        0x06    /* PASID control register */
 -#define  PCI_PASID_CTRL_ENABLE    0x01    /* Enable bit */
 -#define  PCI_PASID_CTRL_EXEC    0x02    /* Exec permissions Enable */
 -#define  PCI_PASID_CTRL_PRIV    0x04    /* Privilege Mode Enable */
 +#define  PCI_PASID_CTRL_ENABLE    0x0001    /* Enable bit */
 +#define  PCI_PASID_CTRL_EXEC    0x0002    /* Exec permissions Enable */
 +#define  PCI_PASID_CTRL_PRIV    0x0004    /* Privilege Mode Enable */
  #define PCI_EXT_CAP_PASID_SIZEOF    8
  /* Single Root I/O Virtualization */
@@ -XXX,XX +XXX,XX @@
  #define  PCI_LTR_VALUE_MASK    0x000003ff
  #define  PCI_LTR_SCALE_MASK    0x00001c00
  #define  PCI_LTR_SCALE_SHIFT    10
 +#define  PCI_LTR_NOSNOOP_VALUE    0x03ff0000 /* Max No-Snoop Latency Value */
 +#define  PCI_LTR_NOSNOOP_SCALE    0x1c000000 /* Scale for Max Value */
  #define PCI_EXT_CAP_LTR_SIZEOF    8
  /* Access Control Service */
@@ -XXX,XX +XXX,XX @@
  #define PCI_EXP_DPC_STATUS        0x08    /* DPC Status */
  #define  PCI_EXP_DPC_STATUS_TRIGGER        0x0001 /* Trigger Status */
  #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN        0x0006 /* Trigger Reason */
 +#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_UNCOR  0x0000 /* Uncorrectable error */
 +#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_NFE    0x0002 /* Rcvd ERR_NONFATAL */
 +#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_FE     0x0004 /* Rcvd ERR_FATAL */
 +#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_IN_EXT 0x0006 /* Reason in Trig Reason Extension field */
  #define  PCI_EXP_DPC_STATUS_INTERRUPT        0x0008 /* Interrupt Status */
  #define  PCI_EXP_DPC_RP_BUSY            0x0010 /* Root Port Busy */
  #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_EXT 0x0060 /* Trig Reason Extension */
 +#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_RP_PIO        0x0000    /* RP PIO error */
 +#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_SW_TRIGGER    0x0020    /* DPC SW Trigger bit */
 +#define  PCI_EXP_DPC_RP_PIO_FEP            0x1f00 /* RP PIO First Err Ptr */
  #define PCI_EXP_DPC_SOURCE_ID         0x0A    /* DPC Source Identifier */
@@ -XXX,XX +XXX,XX @@
  #define  PCI_L1SS_CTL1_LTR_L12_TH_VALUE    0x03ff0000  /* LTR_L1.2_THRESHOLD_Value */
  #define  PCI_L1SS_CTL1_LTR_L12_TH_SCALE    0xe0000000  /* LTR_L1.2_THRESHOLD_Scale */
  #define PCI_L1SS_CTL2        0x0c    /* Control 2 Register */
 +#define  PCI_L1SS_CTL2_T_PWR_ON_SCALE    0x00000003  /* T_POWER_ON Scale */
 +#define  PCI_L1SS_CTL2_T_PWR_ON_VALUE    0x000000f8  /* T_POWER_ON Value */
  /* Designated Vendor-Specific (DVSEC, PCI_EXT_CAP_ID_DVSEC) */
  #define PCI_DVSEC_HEADER1        0x4 /* Designated Vendor-Specific Header1 */
 diff --git a/include/standard-headers/linux/vhost_types.h b/include/standard-headers/linux/vhost_types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/vhost_types.h
 +++ b/include/standard-headers/linux/vhost_types.h
@@ -XXX,XX +XXX,XX @@ struct vhost_vdpa_iova_range {
   * DRIVER_OK
   */
  #define VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK  0x6
 +/* Device may expose the virtqueue's descriptor area, driver area and
 + * device area to a different group for ASID binding than where its
 + * buffers may reside. Requires VHOST_BACKEND_F_IOTLB_ASID.
 + */
 +#define VHOST_BACKEND_F_DESC_ASID    0x7
 +/* IOTLB don't flush memory mapping across device reset */
 +#define VHOST_BACKEND_F_IOTLB_PERSIST  0x8
  #endif
-diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
+diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/virtio_config.h
 +++ b/include/standard-headers/linux/virtio_config.h
@@ -XXX,XX +XXX,XX @@
   */
  #define VIRTIO_F_NOTIFICATION_DATA    38
 +/* This feature indicates that the driver uses the data provided by the device
 + * as a virtqueue identifier in available buffer notifications.
 + */
 +#define VIRTIO_F_NOTIF_CONFIG_DATA    39
 +
  /*
   * This feature indicates that the driver can reset a queue individually.
   */
 diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/virtio_pci.h
 +++ b/include/standard-headers/linux/virtio_pci.h
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_common_cfg {
      uint32_t queue_used_hi;        /* read-write */
  };
 +/*
 + * Warning: do not use sizeof on this: use offsetofend for
 + * specific fields you need.
 + */
 +struct virtio_pci_modern_common_cfg {
 +    struct virtio_pci_common_cfg cfg;
 +
 +    uint16_t queue_notify_data;    /* read-write */
 +    uint16_t queue_reset;        /* read-write */
 +};
 +
  /* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
  struct virtio_pci_cfg_cap {
      struct virtio_pci_cap cap;
 diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-arm64/kvm.h
 +++ b/linux-headers/asm-arm64/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_smccc_filter {
  #define KVM_HYPERCALL_EXIT_SMC        (1U << 0)
  #define KVM_HYPERCALL_EXIT_16BIT    (1U << 1)
 +/*
 + * Get feature ID registers userspace writable mask.
 + *
 + * From DDI0487J.a, D19.2.66 ("ID_AA64MMFR2_EL1, AArch64 Memory Model
 + * Feature Register 2"):
 + *
 + * "The Feature ID space is defined as the System register space in
 + * AArch64 with op0==3, op1=={0, 1, 3}, CRn==0, CRm=={0-7},
 + * op2=={0-7}."
 + *
 + * This covers all currently known R/O registers that indicate
 + * anything useful feature wise, including the ID registers.
 + *
 + * If we ever need to introduce a new range, it will be described as
 + * such in the range field.
 + */
 +#define KVM_ARM_FEATURE_ID_RANGE_IDX(op0, op1, crn, crm, op2)        \
 +    ({                                \
 +        __u64 __op1 = (op1) & 3;                \
 +        __op1 -= (__op1 == 3);                    \
 +        (__op1 << 6 | ((crm) & 7) << 3 | (op2));        \
 +    })
 +
 +#define KVM_ARM_FEATURE_ID_RANGE    0
 +#define KVM_ARM_FEATURE_ID_RANGE_SIZE    (3 * 8 * 8)
 +
 +struct reg_mask_range {
 +    __u64 addr;        /* Pointer to mask array */
 +    __u32 range;        /* Requested range */
 +    __u32 reserved[13];
 +};
 +
  #endif
  #endif /* __ARM_KVM_H__ */
 diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-generic/unistd.h
 +++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fremovexattr, sys_fremovexattr)
  #define __NR_getcwd 17
  __SYSCALL(__NR_getcwd, sys_getcwd)
  #define __NR_lookup_dcookie 18
 -__SC_COMP(__NR_lookup_dcookie, sys_lookup_dcookie, compat_sys_lookup_dcookie)
 +__SYSCALL(__NR_lookup_dcookie, sys_ni_syscall)
  #define __NR_eventfd2 19
  __SYSCALL(__NR_eventfd2, sys_eventfd2)
  #define __NR_epoll_create1 20
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_process_mrelease, sys_process_mrelease)
  __SYSCALL(__NR_futex_waitv, sys_futex_waitv)
  #define __NR_set_mempolicy_home_node 450
  __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node)
 -
  #define __NR_cachestat 451
  __SYSCALL(__NR_cachestat, sys_cachestat)
 -
  #define __NR_fchmodat2 452
  __SYSCALL(__NR_fchmodat2, sys_fchmodat2)
 +#define __NR_map_shadow_stack 453
 +__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack)
 +#define __NR_futex_wake 454
 +__SYSCALL(__NR_futex_wake, sys_futex_wake)
 +#define __NR_futex_wait 455
 +__SYSCALL(__NR_futex_wait, sys_futex_wait)
 +#define __NR_futex_requeue 456
 +__SYSCALL(__NR_futex_requeue, sys_futex_requeue)
  #undef __NR_syscalls
 -#define __NR_syscalls 453
 +#define __NR_syscalls 457
  /*
   * 32 bit systems traditionally used different
 diff --git a/linux-headers/asm-loongarch/bitsperlong.h b/linux-headers/asm-loongarch/bitsperlong.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/linux-headers/asm-loongarch/bitsperlong.h
++++ b/hw/riscv/riscv-iommu-sys.c
@@ -0,0 +1 @@
 +#include <asm-generic/bitsperlong.h>
 diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/linux-headers/asm-loongarch/kvm.h
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 +/*
-+ * Copyright (C) 2020-2023 Loongson Technology Corporation Limited
++ * QEMU emulation of an RISC-V IOMMU Platform Device
 + *
 + * Copyright (C) 2022-2023 Rivos Inc.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef __UAPI_ASM_LOONGARCH_KVM_H
++#include "qemu/osdep.h"
-+#define __UAPI_ASM_LOONGARCH_KVM_H
++#include "hw/irq.h"
-+
++#include "hw/pci/pci_bus.h"
-+#include <linux/types.h>
++#include "hw/qdev-properties.h"
-+
++#include "hw/sysbus.h"
-+/*
++#include "qapi/error.h"
-+ * KVM LoongArch specific structures and definitions.
++#include "qemu/error-report.h"
-+ *
++#include "qemu/host-utils.h"
-+ * Some parts derived from the x86 version of this file.
++#include "qemu/module.h"
-+ */
++#include "qom/object.h"
 +
-+#define __KVM_HAVE_READONLY_MEM
++#include "riscv-iommu.h"
 +
-+#define KVM_COALESCED_MMIO_PAGE_OFFSET    1
++#define RISCV_IOMMU_SYSDEV_ICVEC_VECTORS 0x3333
-+#define KVM_DIRTY_LOG_PAGE_OFFSET    64
++
-+
++/* RISC-V IOMMU System Platform Device Emulation */
-+/*
++
-+ * for KVM_GET_REGS and KVM_SET_REGS
++struct RISCVIOMMUStateSys {
-+ */
++    SysBusDevice     parent;
-+struct kvm_regs {
++    uint64_t         addr;
-+    /* out (KVM_GET_REGS) / in (KVM_SET_REGS) */
++    uint32_t         base_irq;
-+    __u64 gpr[32];
++    DeviceState      *irqchip;
-+    __u64 pc;
++    RISCVIOMMUState  iommu;
 +    qemu_irq         irqs[RISCV_IOMMU_INTR_COUNT];
 +};
 +
-+/*
++static void riscv_iommu_sysdev_notify(RISCVIOMMUState *iommu,
-+ * for KVM_GET_FPU and KVM_SET_FPU
++                                      unsigned vector)
-+ */
++{
-+struct kvm_fpu {
++    RISCVIOMMUStateSys *s = container_of(iommu, RISCVIOMMUStateSys, iommu);
-+    __u32 fcsr;
++    uint32_t fctl =  riscv_iommu_reg_get32(iommu, RISCV_IOMMU_REG_FCTL);
-+    __u64 fcc;    /* 8x8 */
++
-+    struct kvm_fpureg {
++    /* We do not support MSIs yet */
-+        __u64 val64[4];
++    if (!(fctl & RISCV_IOMMU_FCTL_WSI)) {
-+    } fpr[32];
++        return;
 +    }
 +
 +    qemu_irq_pulse(s->irqs[vector]);
 +}
 +
 +static void riscv_iommu_sys_realize(DeviceState *dev, Error **errp)
 +{
 +    RISCVIOMMUStateSys *s = RISCV_IOMMU_SYS(dev);
 +    SysBusDevice *sysdev = SYS_BUS_DEVICE(s);
 +    PCIBus *pci_bus;
 +    qemu_irq irq;
 +
 +    qdev_realize(DEVICE(&s->iommu), NULL, errp);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iommu.regs_mr);
 +    if (s->addr) {
 +        sysbus_mmio_map(SYS_BUS_DEVICE(s), 0, s->addr);
 +    }
 +
 +    pci_bus = (PCIBus *) object_resolve_path_type("", TYPE_PCI_BUS, NULL);
 +    if (pci_bus) {
 +        riscv_iommu_pci_setup_iommu(&s->iommu, pci_bus, errp);
 +    }
 +
 +    s->iommu.notify = riscv_iommu_sysdev_notify;
 +
 +    /* 4 IRQs are defined starting from s->base_irq */
 +    for (int i = 0; i < RISCV_IOMMU_INTR_COUNT; i++) {
 +        sysbus_init_irq(sysdev, &s->irqs[i]);
 +        irq = qdev_get_gpio_in(s->irqchip, s->base_irq + i);
 +        sysbus_connect_irq(sysdev, i, irq);
 +    }
 +}
 +
 +static void riscv_iommu_sys_init(Object *obj)
 +{
 +    RISCVIOMMUStateSys *s = RISCV_IOMMU_SYS(obj);
 +    RISCVIOMMUState *iommu = &s->iommu;
 +
 +    object_initialize_child(obj, "iommu", iommu, TYPE_RISCV_IOMMU);
 +    qdev_alias_all_properties(DEVICE(iommu), obj);
 +
 +    iommu->icvec_avail_vectors = RISCV_IOMMU_SYSDEV_ICVEC_VECTORS;
 +    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_WSI);
 +}
 +
 +static Property riscv_iommu_sys_properties[] = {
 +    DEFINE_PROP_UINT64("addr", RISCVIOMMUStateSys, addr, 0),
 +    DEFINE_PROP_UINT32("base-irq", RISCVIOMMUStateSys, base_irq, 0),
 +    DEFINE_PROP_LINK("irqchip", RISCVIOMMUStateSys, irqchip,
 +                     TYPE_DEVICE, DeviceState *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
-+/*
++static void riscv_iommu_sys_class_init(ObjectClass *klass, void *data)
-+ * For LoongArch, we use KVM_SET_ONE_REG and KVM_GET_ONE_REG to access various
++{
-+ * registers.  The id field is broken down as follows:
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+ *
++    dc->realize = riscv_iommu_sys_realize;
-+ *  bits[63..52] - As per linux/kvm.h
++    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-+ *  bits[51..32] - Must be zero.
++    device_class_set_props(dc, riscv_iommu_sys_properties);
-+ *  bits[31..16] - Register set.
++}
-+ *
++
-+ * Register set = 0: GP registers from kvm_regs (see definitions below).
++static const TypeInfo riscv_iommu_sys = {
-+ *
++    .name          = TYPE_RISCV_IOMMU_SYS,
-+ * Register set = 1: CSR registers.
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+ *
++    .class_init    = riscv_iommu_sys_class_init,
-+ * Register set = 2: KVM specific registers (see definitions below).
++    .instance_init = riscv_iommu_sys_init,
-+ *
++    .instance_size = sizeof(RISCVIOMMUStateSys),
 + * Register set = 3: FPU / SIMD registers (see definitions below).
 + *
 + * Other sets registers may be added in the future.  Each set would
 + * have its own identifier in bits[31..16].
 + */
 +
 +#define KVM_REG_LOONGARCH_GPR        (KVM_REG_LOONGARCH | 0x00000ULL)
 +#define KVM_REG_LOONGARCH_CSR        (KVM_REG_LOONGARCH | 0x10000ULL)
 +#define KVM_REG_LOONGARCH_KVM        (KVM_REG_LOONGARCH | 0x20000ULL)
 +#define KVM_REG_LOONGARCH_FPSIMD    (KVM_REG_LOONGARCH | 0x30000ULL)
 +#define KVM_REG_LOONGARCH_CPUCFG    (KVM_REG_LOONGARCH | 0x40000ULL)
 +#define KVM_REG_LOONGARCH_MASK        (KVM_REG_LOONGARCH | 0x70000ULL)
 +#define KVM_CSR_IDX_MASK        0x7fff
 +#define KVM_CPUCFG_IDX_MASK        0x7fff
 +
 +/*
 + * KVM_REG_LOONGARCH_KVM - KVM specific control registers.
 + */
 +
 +#define KVM_REG_LOONGARCH_COUNTER    (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 1)
 +#define KVM_REG_LOONGARCH_VCPU_RESET    (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 2)
 +
 +#define LOONGARCH_REG_SHIFT        3
 +#define LOONGARCH_REG_64(TYPE, REG)    (TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
 +#define KVM_IOC_CSRID(REG)        LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
 +#define KVM_IOC_CPUCFG(REG)        LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
 +
 +struct kvm_debug_exit_arch {
 +};
 +
-+/* for KVM_SET_GUEST_DEBUG */
++static void riscv_iommu_register_sys(void)
-+struct kvm_guest_debug_arch {
++{
-+};
++    type_register_static(&riscv_iommu_sys);
-+
++}
-+/* definition of registers in kvm_run */
++
-+struct kvm_sync_regs {
++type_init(riscv_iommu_register_sys)
-+};
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 +
 +/* dummy definition */
 +struct kvm_sregs {
 +};
 +
 +struct kvm_iocsr_entry {
 +    __u32 addr;
 +    __u32 pad;
 +    __u64 data;
 +};
 +
 +#define KVM_NR_IRQCHIPS        1
 +#define KVM_IRQCHIP_NUM_PINS    64
 +#define KVM_MAX_CORES        256
 +
 +#endif /* __UAPI_ASM_LOONGARCH_KVM_H */
 diff --git a/linux-headers/asm-loongarch/mman.h b/linux-headers/asm-loongarch/mman.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/linux-headers/asm-loongarch/mman.h
@@ -0,0 +1 @@
 +#include <asm-generic/mman.h>
 diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/linux-headers/asm-loongarch/unistd.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 +#define __ARCH_WANT_SYS_CLONE
 +#define __ARCH_WANT_SYS_CLONE3
 +
 +#include <asm-generic/unistd.h>
 diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
 index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-mips/unistd_n32.h
+--- a/hw/riscv/riscv-iommu.c
-+++ b/linux-headers/asm-mips/unistd_n32.h
++++ b/hw/riscv/riscv-iommu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint8_t riscv_iommu_get_icvec_vector(uint32_t icvec, uint32_t vec_type)
- #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
- #define __NR_cachestat (__NR_Linux + 451)
+ static void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type)
- #define __NR_fchmodat2 (__NR_Linux + 452)
+ {
-+#define __NR_map_shadow_stack (__NR_Linux + 453)
+-    const uint32_t fctl = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_FCTL);
-+#define __NR_futex_wake (__NR_Linux + 454)
+     uint32_t ipsr, icvec, vector;
-+#define __NR_futex_wait (__NR_Linux + 455)
-+#define __NR_futex_requeue (__NR_Linux + 456)
+-    if (fctl & RISCV_IOMMU_FCTL_WSI || !s->notify) {
++    if (!s->notify) {
- #endif /* _ASM_UNISTD_N32_H */
+         return;
-diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
+     }
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/asm-mips/unistd_n64.h
+--- a/hw/riscv/meson.build
-+++ b/linux-headers/asm-mips/unistd_n64.h
++++ b/hw/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
- #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+ riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
- #define __NR_cachestat (__NR_Linux + 451)
+ riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
- #define __NR_fchmodat2 (__NR_Linux + 452)
+ riscv_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
-+#define __NR_map_shadow_stack (__NR_Linux + 453)
+-riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files('riscv-iommu.c', 'riscv-iommu-pci.c'))
-+#define __NR_futex_wake (__NR_Linux + 454)
++riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files('riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c'))
-+#define __NR_futex_wait (__NR_Linux + 455)
-+#define __NR_futex_requeue (__NR_Linux + 456)
+ hw_arch += {'riscv': riscv_ss}
  #endif /* _ASM_UNISTD_N64_H */
 diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_o32.h
 +++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
  #define __NR_cachestat (__NR_Linux + 451)
  #define __NR_fchmodat2 (__NR_Linux + 452)
 +#define __NR_map_shadow_stack (__NR_Linux + 453)
 +#define __NR_futex_wake (__NR_Linux + 454)
 +#define __NR_futex_wait (__NR_Linux + 455)
 +#define __NR_futex_requeue (__NR_Linux + 456)
  #endif /* _ASM_UNISTD_O32_H */
 diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/unistd_32.h
 +++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node 450
  #define __NR_cachestat 451
  #define __NR_fchmodat2 452
 +#define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
  #endif /* _ASM_UNISTD_32_H */
 diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/unistd_64.h
 +++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node 450
  #define __NR_cachestat 451
  #define __NR_fchmodat2 452
 +#define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
  #endif /* _ASM_UNISTD_64_H */
 diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-riscv/kvm.h
 +++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_csr {
      unsigned long sip;
      unsigned long satp;
      unsigned long scounteren;
 +    unsigned long senvcfg;
  };
  /* AIA CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_aia_csr {
      unsigned long iprio2h;
  };
 +/* Smstateen CSR for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
 +struct kvm_riscv_smstateen_csr {
 +    unsigned long sstateen0;
 +};
 +
  /* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
  struct kvm_riscv_timer {
      __u64 frequency;
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
      KVM_RISCV_ISA_EXT_ZICSR,
      KVM_RISCV_ISA_EXT_ZIFENCEI,
      KVM_RISCV_ISA_EXT_ZIHPM,
 +    KVM_RISCV_ISA_EXT_SMSTATEEN,
 +    KVM_RISCV_ISA_EXT_ZICOND,
      KVM_RISCV_ISA_EXT_MAX,
  };
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
      KVM_RISCV_SBI_EXT_PMU,
      KVM_RISCV_SBI_EXT_EXPERIMENTAL,
      KVM_RISCV_SBI_EXT_VENDOR,
 +    KVM_RISCV_SBI_EXT_DBCN,
      KVM_RISCV_SBI_EXT_MAX,
  };
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
  #define KVM_REG_RISCV_CSR        (0x03 << KVM_REG_RISCV_TYPE_SHIFT)
  #define KVM_REG_RISCV_CSR_GENERAL    (0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
  #define KVM_REG_RISCV_CSR_AIA        (0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 +#define KVM_REG_RISCV_CSR_SMSTATEEN    (0x2 << KVM_REG_RISCV_SUBTYPE_SHIFT)
  #define KVM_REG_RISCV_CSR_REG(name)    \
          (offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
  #define KVM_REG_RISCV_CSR_AIA_REG(name)    \
      (offsetof(struct kvm_riscv_aia_csr, name) / sizeof(unsigned long))
 +#define KVM_REG_RISCV_CSR_SMSTATEEN_REG(name)  \
 +    (offsetof(struct kvm_riscv_smstateen_csr, name) / sizeof(unsigned long))
  /* Timer registers are mapped as type 4 */
  #define KVM_REG_RISCV_TIMER        (0x04 << KVM_REG_RISCV_TYPE_SHIFT)
 diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/unistd_32.h
 +++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node 450
  #define __NR_cachestat 451
  #define __NR_fchmodat2 452
 +#define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
  #endif /* _ASM_S390_UNISTD_32_H */
 diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/unistd_64.h
 +++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node 450
  #define __NR_cachestat 451
  #define __NR_fchmodat2 452
 +#define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
  #endif /* _ASM_S390_UNISTD_64_H */
 diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_32.h
 +++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node 450
  #define __NR_cachestat 451
  #define __NR_fchmodat2 452
 +#define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
  #endif /* _ASM_UNISTD_32_H */
 diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_64.h
 +++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_cachestat 451
  #define __NR_fchmodat2 452
  #define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
  #endif /* _ASM_UNISTD_64_H */
 diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_x32.h
 +++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
  #define __NR_cachestat (__X32_SYSCALL_BIT + 451)
  #define __NR_fchmodat2 (__X32_SYSCALL_BIT + 452)
 +#define __NR_futex_wake (__X32_SYSCALL_BIT + 454)
 +#define __NR_futex_wait (__X32_SYSCALL_BIT + 455)
 +#define __NR_futex_requeue (__X32_SYSCALL_BIT + 456)
  #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
  #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
  #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
 diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/iommufd.h
 +++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@ enum {
      IOMMUFD_CMD_VFIO_IOAS,
      IOMMUFD_CMD_HWPT_ALLOC,
      IOMMUFD_CMD_GET_HW_INFO,
 +    IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
 +    IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
  };
  #define IOMMU_VFIO_IOAS _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VFIO_IOAS)
 +/**
 + * enum iommufd_hwpt_alloc_flags - Flags for HWPT allocation
 + * @IOMMU_HWPT_ALLOC_NEST_PARENT: If set, allocate a HWPT that can serve as
 + *                                the parent HWPT in a nesting configuration.
 + * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
 + *                                   enforced on device attachment
 + */
 +enum iommufd_hwpt_alloc_flags {
 +    IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
 +    IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
 +};
 +
 +/**
 + * enum iommu_hwpt_vtd_s1_flags - Intel VT-d stage-1 page table
 + *                                entry attributes
 + * @IOMMU_VTD_S1_SRE: Supervisor request
 + * @IOMMU_VTD_S1_EAFE: Extended access enable
 + * @IOMMU_VTD_S1_WPE: Write protect enable
 + */
 +enum iommu_hwpt_vtd_s1_flags {
 +    IOMMU_VTD_S1_SRE = 1 << 0,
 +    IOMMU_VTD_S1_EAFE = 1 << 1,
 +    IOMMU_VTD_S1_WPE = 1 << 2,
 +};
 +
 +/**
 + * struct iommu_hwpt_vtd_s1 - Intel VT-d stage-1 page table
 + *                            info (IOMMU_HWPT_DATA_VTD_S1)
 + * @flags: Combination of enum iommu_hwpt_vtd_s1_flags
 + * @pgtbl_addr: The base address of the stage-1 page table.
 + * @addr_width: The address width of the stage-1 page table
 + * @__reserved: Must be 0
 + */
 +struct iommu_hwpt_vtd_s1 {
 +    __aligned_u64 flags;
 +    __aligned_u64 pgtbl_addr;
 +    __u32 addr_width;
 +    __u32 __reserved;
 +};
 +
 +/**
 + * enum iommu_hwpt_data_type - IOMMU HWPT Data Type
 + * @IOMMU_HWPT_DATA_NONE: no data
 + * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
 + */
 +enum iommu_hwpt_data_type {
 +    IOMMU_HWPT_DATA_NONE,
 +    IOMMU_HWPT_DATA_VTD_S1,
 +};
 +
  /**
   * struct iommu_hwpt_alloc - ioctl(IOMMU_HWPT_ALLOC)
   * @size: sizeof(struct iommu_hwpt_alloc)
 - * @flags: Must be 0
 + * @flags: Combination of enum iommufd_hwpt_alloc_flags
   * @dev_id: The device to allocate this HWPT for
 - * @pt_id: The IOAS to connect this HWPT to
 + * @pt_id: The IOAS or HWPT to connect this HWPT to
   * @out_hwpt_id: The ID of the new HWPT
   * @__reserved: Must be 0
 + * @data_type: One of enum iommu_hwpt_data_type
 + * @data_len: Length of the type specific data
 + * @data_uptr: User pointer to the type specific data
   *
   * Explicitly allocate a hardware page table object. This is the same object
   * type that is returned by iommufd_device_attach() and represents the
   * underlying iommu driver's iommu_domain kernel object.
   *
 - * A HWPT will be created with the IOVA mappings from the given IOAS.
 + * A kernel-managed HWPT will be created with the mappings from the given
 + * IOAS via the @pt_id. The @data_type for this allocation must be set to
 + * IOMMU_HWPT_DATA_NONE. The HWPT can be allocated as a parent HWPT for a
 + * nesting configuration by passing IOMMU_HWPT_ALLOC_NEST_PARENT via @flags.
 + *
 + * A user-managed nested HWPT will be created from a given parent HWPT via
 + * @pt_id, in which the parent HWPT must be allocated previously via the
 + * same ioctl from a given IOAS (@pt_id). In this case, the @data_type
 + * must be set to a pre-defined type corresponding to an I/O page table
 + * type supported by the underlying IOMMU hardware.
 + *
 + * If the @data_type is set to IOMMU_HWPT_DATA_NONE, @data_len and
 + * @data_uptr should be zero. Otherwise, both @data_len and @data_uptr
 + * must be given.
   */
  struct iommu_hwpt_alloc {
      __u32 size;
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_alloc {
      __u32 pt_id;
      __u32 out_hwpt_id;
      __u32 __reserved;
 +    __u32 data_type;
 +    __u32 data_len;
 +    __aligned_u64 data_uptr;
  };
  #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
 +/**
 + * enum iommu_hw_info_vtd_flags - Flags for VT-d hw_info
 + * @IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17: If set, disallow read-only mappings
 + *                                         on a nested_parent domain.
 + *                                         https://www.intel.com/content/www/us/en/content-details/772415/content-details.html
 + */
 +enum iommu_hw_info_vtd_flags {
 +    IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 = 1 << 0,
 +};
 +
  /**
   * struct iommu_hw_info_vtd - Intel VT-d hardware information
   *
 - * @flags: Must be 0
 + * @flags: Combination of enum iommu_hw_info_vtd_flags
   * @__reserved: Must be 0
   *
   * @cap_reg: Value of Intel VT-d capability register defined in VT-d spec
@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
      IOMMU_HW_INFO_TYPE_INTEL_VTD,
  };
 +/**
 + * enum iommufd_hw_capabilities
 + * @IOMMU_HW_CAP_DIRTY_TRACKING: IOMMU hardware support for dirty tracking
 + *                               If available, it means the following APIs
 + *                               are supported:
 + *
 + *                                   IOMMU_HWPT_GET_DIRTY_BITMAP
 + *                                   IOMMU_HWPT_SET_DIRTY_TRACKING
 + *
 + */
 +enum iommufd_hw_capabilities {
 +    IOMMU_HW_CAP_DIRTY_TRACKING = 1 << 0,
 +};
 +
  /**
   * struct iommu_hw_info - ioctl(IOMMU_GET_HW_INFO)
   * @size: sizeof(struct iommu_hw_info)
@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
   *             the iommu type specific hardware information data
   * @out_data_type: Output the iommu hardware info type as defined in the enum
   *                 iommu_hw_info_type.
 + * @out_capabilities: Output the generic iommu capability info type as defined
 + *                    in the enum iommu_hw_capabilities.
   * @__reserved: Must be 0
   *
   * Query an iommu type specific hardware information data from an iommu behind
@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info {
      __aligned_u64 data_uptr;
      __u32 out_data_type;
      __u32 __reserved;
 +    __aligned_u64 out_capabilities;
  };
  #define IOMMU_GET_HW_INFO _IO(IOMMUFD_TYPE, IOMMUFD_CMD_GET_HW_INFO)
 +
 +/*
 + * enum iommufd_hwpt_set_dirty_tracking_flags - Flags for steering dirty
 + *                                              tracking
 + * @IOMMU_HWPT_DIRTY_TRACKING_ENABLE: Enable dirty tracking
 + */
 +enum iommufd_hwpt_set_dirty_tracking_flags {
 +    IOMMU_HWPT_DIRTY_TRACKING_ENABLE = 1,
 +};
 +
 +/**
 + * struct iommu_hwpt_set_dirty_tracking - ioctl(IOMMU_HWPT_SET_DIRTY_TRACKING)
 + * @size: sizeof(struct iommu_hwpt_set_dirty_tracking)
 + * @flags: Combination of enum iommufd_hwpt_set_dirty_tracking_flags
 + * @hwpt_id: HW pagetable ID that represents the IOMMU domain
 + * @__reserved: Must be 0
 + *
 + * Toggle dirty tracking on an HW pagetable.
 + */
 +struct iommu_hwpt_set_dirty_tracking {
 +    __u32 size;
 +    __u32 flags;
 +    __u32 hwpt_id;
 +    __u32 __reserved;
 +};
 +#define IOMMU_HWPT_SET_DIRTY_TRACKING _IO(IOMMUFD_TYPE, \
 +                      IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING)
 +
 +/**
 + * enum iommufd_hwpt_get_dirty_bitmap_flags - Flags for getting dirty bits
 + * @IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR: Just read the PTEs without clearing
 + *                                        any dirty bits metadata. This flag
 + *                                        can be passed in the expectation
 + *                                        where the next operation is an unmap
 + *                                        of the same IOVA range.
 + *
 + */
 +enum iommufd_hwpt_get_dirty_bitmap_flags {
 +    IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR = 1,
 +};
 +
 +/**
 + * struct iommu_hwpt_get_dirty_bitmap - ioctl(IOMMU_HWPT_GET_DIRTY_BITMAP)
 + * @size: sizeof(struct iommu_hwpt_get_dirty_bitmap)
 + * @hwpt_id: HW pagetable ID that represents the IOMMU domain
 + * @flags: Combination of enum iommufd_hwpt_get_dirty_bitmap_flags
 + * @__reserved: Must be 0
 + * @iova: base IOVA of the bitmap first bit
 + * @length: IOVA range size
 + * @page_size: page size granularity of each bit in the bitmap
 + * @data: bitmap where to set the dirty bits. The bitmap bits each
 + *        represent a page_size which you deviate from an arbitrary iova.
 + *
 + * Checking a given IOVA is dirty:
 + *
 + *  data[(iova / page_size) / 64] & (1ULL << ((iova / page_size) % 64))
 + *
 + * Walk the IOMMU pagetables for a given IOVA range to return a bitmap
 + * with the dirty IOVAs. In doing so it will also by default clear any
 + * dirty bit metadata set in the IOPTE.
 + */
 +struct iommu_hwpt_get_dirty_bitmap {
 +    __u32 size;
 +    __u32 hwpt_id;
 +    __u32 flags;
 +    __u32 __reserved;
 +    __aligned_u64 iova;
 +    __aligned_u64 length;
 +    __aligned_u64 page_size;
 +    __aligned_u64 data;
 +};
 +#define IOMMU_HWPT_GET_DIRTY_BITMAP _IO(IOMMUFD_TYPE, \
 +                    IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP)
 +
  #endif
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
  #define KVM_EXIT_RISCV_SBI        35
  #define KVM_EXIT_RISCV_CSR        36
  #define KVM_EXIT_NOTIFY           37
 +#define KVM_EXIT_LOONGARCH_IOCSR  38
  /* For KVM_EXIT_INTERNAL_ERROR */
  /* Emulate instruction failed. */
@@ -XXX,XX +XXX,XX @@ struct kvm_run {
              __u32 len;
              __u8  is_write;
          } mmio;
 +        /* KVM_EXIT_LOONGARCH_IOCSR */
 +        struct {
 +            __u64 phys_addr;
 +            __u8  data[8];
 +            __u32 len;
 +            __u8  is_write;
 +        } iocsr_io;
          /* KVM_EXIT_HYPERCALL */
          struct {
              __u64 nr;
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
  #define KVM_CAP_COUNTER_OFFSET 227
  #define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
  #define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
 +#define KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES 230
  #ifdef KVM_CAP_IRQ_ROUTING
@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
  #define KVM_REG_ARM64        0x6000000000000000ULL
  #define KVM_REG_MIPS        0x7000000000000000ULL
  #define KVM_REG_RISCV        0x8000000000000000ULL
 +#define KVM_REG_LOONGARCH    0x9000000000000000ULL
  #define KVM_REG_SIZE_SHIFT    52
  #define KVM_REG_SIZE_MASK    0x00f0000000000000ULL
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
  #define KVM_ARM_MTE_COPY_TAGS      _IOR(KVMIO,  0xb4, struct kvm_arm_copy_mte_tags)
  /* Available with KVM_CAP_COUNTER_OFFSET */
  #define KVM_ARM_SET_COUNTER_OFFSET _IOW(KVMIO,  0xb5, struct kvm_arm_counter_offset)
 +#define KVM_ARM_GET_REG_WRITABLE_MASKS _IOR(KVMIO,  0xb6, struct reg_mask_range)
  /* ioctl for vm fd */
  #define KVM_CREATE_DEVICE      _IOWR(KVMIO,  0xe0, struct kvm_create_device)
 diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/psp-sev.h
 +++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      SEV_RET_INVALID_PARAM,
      SEV_RET_RESOURCE_LIMIT,
      SEV_RET_SECURE_DATA_INVALID,
 +    SEV_RET_INVALID_KEY = 0x27,
      SEV_RET_MAX,
  } sev_ret_code;
 diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/stddef.h
 +++ b/linux-headers/linux/stddef.h
@@ -XXX,XX +XXX,XX @@
      union { \
          struct { MEMBERS } ATTRS; \
          struct TAG { MEMBERS } ATTRS NAME; \
 -    }
 +    } ATTRS
 +#ifdef __cplusplus
 +/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */
 +#define __DECLARE_FLEX_ARRAY(T, member)    \
 +    T member[0]
 +#else
  /**
   * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
   *
@@ -XXX,XX +XXX,XX @@
  #ifndef __counted_by
  #define __counted_by(m)
  #endif
 +
 +#endif /* _LINUX_STDDEF_H */
 diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/userfaultfd.h
 +++ b/linux-headers/linux/userfaultfd.h
@@ -XXX,XX +XXX,XX @@
                 UFFD_FEATURE_EXACT_ADDRESS |        \
                 UFFD_FEATURE_WP_HUGETLBFS_SHMEM |    \
                 UFFD_FEATURE_WP_UNPOPULATED |    \
 -               UFFD_FEATURE_POISON)
 +               UFFD_FEATURE_POISON |        \
 +               UFFD_FEATURE_WP_ASYNC)
  #define UFFD_API_IOCTLS                \
      ((__u64)1 << _UFFDIO_REGISTER |        \
       (__u64)1 << _UFFDIO_UNREGISTER |    \
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
       * (i.e. empty ptes).  This will be the default behavior for shmem
       * & hugetlbfs, so this flag only affects anonymous memory behavior
       * when userfault write-protection mode is registered.
 +     *
 +     * UFFD_FEATURE_WP_ASYNC indicates that userfaultfd write-protection
 +     * asynchronous mode is supported in which the write fault is
 +     * automatically resolved and write-protection is un-set.
 +     * It implies UFFD_FEATURE_WP_UNPOPULATED.
       */
  #define UFFD_FEATURE_PAGEFAULT_FLAG_WP        (1<<0)
  #define UFFD_FEATURE_EVENT_FORK            (1<<1)
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
  #define UFFD_FEATURE_WP_HUGETLBFS_SHMEM        (1<<12)
  #define UFFD_FEATURE_WP_UNPOPULATED        (1<<13)
  #define UFFD_FEATURE_POISON            (1<<14)
 +#define UFFD_FEATURE_WP_ASYNC            (1<<15)
      __u64 features;
      __u64 ioctls;
 diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/vfio.h
 +++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
  #define VFIO_REGION_INFO_FLAG_CAPS    (1 << 3) /* Info supports caps */
      __u32    index;        /* Region index */
      __u32    cap_offset;    /* Offset within info struct of first cap */
 -    __u64    size;        /* Region size (bytes) */
 -    __u64    offset;        /* Region offset from start of device fd */
 +    __aligned_u64    size;    /* Region size (bytes) */
 +    __aligned_u64    offset;    /* Region offset from start of device fd */
  };
  #define VFIO_DEVICE_GET_REGION_INFO    _IO(VFIO_TYPE, VFIO_BASE + 8)
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
  #define VFIO_REGION_INFO_CAP_SPARSE_MMAP    1
  struct vfio_region_sparse_mmap_area {
 -    __u64    offset;    /* Offset of mmap'able area within region */
 -    __u64    size;    /* Size of mmap'able area */
 +    __aligned_u64    offset;    /* Offset of mmap'able area within region */
 +    __aligned_u64    size;    /* Size of mmap'able area */
  };
  struct vfio_region_info_cap_sparse_mmap {
@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
                           VFIO_DEVICE_STATE_V1_RESUMING)
      __u32 reserved;
 -    __u64 pending_bytes;
 -    __u64 data_offset;
 -    __u64 data_size;
 +    __aligned_u64 pending_bytes;
 +    __aligned_u64 data_offset;
 +    __aligned_u64 data_size;
  };
  /*
@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
  struct vfio_region_info_cap_nvlink2_ssatgt {
      struct vfio_info_cap_header header;
 -    __u64 tgt;
 +    __aligned_u64 tgt;
  };
  /*
@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
      __u32 drm_plane_type;    /* type of plane: DRM_PLANE_TYPE_* */
      /* out */
      __u32 drm_format;    /* drm format of plane */
 -    __u64 drm_format_mod;   /* tiled mode */
 +    __aligned_u64 drm_format_mod;   /* tiled mode */
      __u32 width;    /* width of plane */
      __u32 height;    /* height of plane */
      __u32 stride;    /* stride of plane */
@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
          __u32 region_index;    /* region index */
          __u32 dmabuf_id;    /* dma-buf id */
      };
 +    __u32 reserved;
  };
  #define VFIO_DEVICE_QUERY_GFX_PLANE _IO(VFIO_TYPE, VFIO_BASE + 14)
@@ -XXX,XX +XXX,XX @@ struct vfio_device_ioeventfd {
  #define VFIO_DEVICE_IOEVENTFD_32    (1 << 2) /* 4-byte write */
  #define VFIO_DEVICE_IOEVENTFD_64    (1 << 3) /* 8-byte write */
  #define VFIO_DEVICE_IOEVENTFD_SIZE_MASK    (0xf)
 -    __u64    offset;            /* device fd offset of write */
 -    __u64    data;            /* data to be written */
 +    __aligned_u64    offset;        /* device fd offset of write */
 +    __aligned_u64    data;        /* data to be written */
      __s32    fd;            /* -1 for de-assignment */
 +    __u32    reserved;
  };
  #define VFIO_DEVICE_IOEVENTFD        _IO(VFIO_TYPE, VFIO_BASE + 16)
@@ -XXX,XX +XXX,XX @@ struct vfio_device_feature_mig_data_size {
  #define VFIO_DEVICE_FEATURE_MIG_DATA_SIZE 9
 +/**
 + * Upon VFIO_DEVICE_FEATURE_SET, set or clear the BUS mastering for the device
 + * based on the operation specified in op flag.
 + *
 + * The functionality is incorporated for devices that needs bus master control,
 + * but the in-band device interface lacks the support. Consequently, it is not
 + * applicable to PCI devices, as bus master control for PCI devices is managed
 + * in-band through the configuration space. At present, this feature is supported
 + * only for CDX devices.
 + * When the device's BUS MASTER setting is configured as CLEAR, it will result in
 + * blocking all incoming DMA requests from the device. On the other hand, configuring
 + * the device's BUS MASTER setting as SET (enable) will grant the device the
 + * capability to perform DMA to the host memory.
 + */
 +struct vfio_device_feature_bus_master {
 +    __u32 op;
 +#define        VFIO_DEVICE_FEATURE_CLEAR_MASTER    0    /* Clear Bus Master */
 +#define        VFIO_DEVICE_FEATURE_SET_MASTER        1    /* Set Bus Master */
 +};
 +#define VFIO_DEVICE_FEATURE_BUS_MASTER 10
 +
  /* -------- API for Type1 VFIO IOMMU -------- */
  /**
@@ -XXX,XX +XXX,XX @@ struct vfio_iommu_type1_info {
      __u32    flags;
  #define VFIO_IOMMU_INFO_PGSIZES (1 << 0)    /* supported page sizes info */
  #define VFIO_IOMMU_INFO_CAPS    (1 << 1)    /* Info supports caps */
 -    __u64    iova_pgsizes;    /* Bitmap of supported page sizes */
 +    __aligned_u64    iova_pgsizes;        /* Bitmap of supported page sizes */
      __u32   cap_offset;    /* Offset within info struct of first cap */
      __u32   pad;
  };
 diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/vhost.h
 +++ b/linux-headers/linux/vhost.h
@@ -XXX,XX +XXX,XX @@
   */
  #define VHOST_VDPA_RESUME        _IO(VHOST_VIRTIO, 0x7E)
 +/* Get the group for the descriptor table including driver & device areas
 + * of a virtqueue: read index, write group in num.
 + * The virtqueue index is stored in the index field of vhost_vring_state.
 + * The group ID of the descriptor table for this specific virtqueue
 + * is returned via num field of vhost_vring_state.
 + */
 +#define VHOST_VDPA_GET_VRING_DESC_GROUP    _IOWR(VHOST_VIRTIO, 0x7F,    \
 +                          struct vhost_vring_state)
  #endif
 --
-.43.0
+.47.1

-[PULL 22/65] hw/riscv/virt: Update GPEX MMIO related properties
+[PULL 06/39] hw/riscv/virt: Add IOMMU as platform device if the option is set
 From: Sunil V L <sunilvl@ventanamicro.com>
-Update the GPEX host bridge properties related to MMIO ranges with
+Add a new machine option called 'iommu-sys' that enables a
-values set for the virt machine.
+riscv-iommu-sys platform device for the 'virt' machine. The option is
+default 'off'.
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
 The device will use IRQs 36 to 39.
 We will not support both riscv-iommu-sys and riscv-iommu-pci devices in
 the same board in this first implementation. If a riscv-iommu-pci device
 is added in the command line we will disable the riscv-iommu-sys device.
 Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20241106133407.604587-5-dbarboza@ventanamicro.com>
 Message-ID: <20231218150247.466427-12-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  1 +
+ include/hw/riscv/iommu.h |   2 +
- hw/riscv/virt.c         | 47 ++++++++++++++++++++++++++++-------------
+ include/hw/riscv/virt.h  |   6 ++-
-files changed, 33 insertions(+), 15 deletions(-)
+ hw/riscv/virt.c          | 104 ++++++++++++++++++++++++++++++++++++++-
+files changed, 109 insertions(+), 3 deletions(-)
 diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/riscv/iommu.h
 +++ b/include/hw/riscv/iommu.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
  OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
  typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
 +#define FDT_IRQ_TYPE_EDGE_LOW 1
 +
  #endif
 diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/riscv/virt.h
 +++ b/include/hw/riscv/virt.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
-     char *oem_table_id;
      OnOffAuto acpi;
      const MemMapEntry *memmap;
-+    struct GPEXHost *gpex_host;
+     struct GPEXHost *gpex_host;
 +    OnOffAuto iommu_sys;
  };
  enum {
+@@ -XXX,XX +XXX,XX @@ enum {
+     VIRT_PCIE_MMIO,
+     VIRT_PCIE_PIO,
+     VIRT_PLATFORM_BUS,
+-    VIRT_PCIE_ECAM
++    VIRT_PCIE_ECAM,
++    VIRT_IOMMU_SYS,
+ };
+ enum {
+@@ -XXX,XX +XXX,XX @@ enum {
+     VIRTIO_IRQ = 1, /* 1 to 8 */
+     VIRTIO_COUNT = 8,
+     PCIE_IRQ = 0x20, /* 32 to 35 */
++    IOMMU_SYS_IRQ = 0x24, /* 36-39 */
+     VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 95 */
+ };
+@@ -XXX,XX +XXX,XX @@ enum {
++ FDT_APLIC_INT_CELLS)
+ bool virt_is_acpi_enabled(RISCVVirtState *s);
++bool virt_is_iommu_sys_enabled(RISCVVirtState *s);
+ void virt_acpi_setup(RISCVVirtState *vms);
+ uint32_t imsic_num_bits(uint32_t count);
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
+@@ -XXX,XX +XXX,XX @@
- }
+ #include "target/riscv/pmu.h"
+ #include "hw/riscv/riscv_hart.h"
- static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
+ #include "hw/riscv/iommu.h"
--                                          hwaddr ecam_base, hwaddr ecam_size,
++#include "hw/riscv/riscv-iommu-bits.h"
--                                          hwaddr mmio_base, hwaddr mmio_size,
+ #include "hw/riscv/virt.h"
--                                          hwaddr high_mmio_base,
+ #include "hw/riscv/boot.h"
--                                          hwaddr high_mmio_size,
+ #include "hw/riscv/numa.h"
--                                          hwaddr pio_base,
+@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
--                                          DeviceState *irqchip)
+     [VIRT_CLINT] =        {  0x2000000,       0x10000 },
-+                                          DeviceState *irqchip,
+     [VIRT_ACLINT_SSWI] =  {  0x2F00000,        0x4000 },
-+                                          RISCVVirtState *s)
+     [VIRT_PCIE_PIO] =     {  0x3000000,       0x10000 },
- {
++    [VIRT_IOMMU_SYS] =    {  0x3010000,        0x1000 },
-     DeviceState *dev;
+     [VIRT_PLATFORM_BUS] = {  0x4000000,     0x2000000 },
-     MemoryRegion *ecam_alias, *ecam_reg;
+     [VIRT_PLIC] =         {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
-     MemoryRegion *mmio_alias, *high_mmio_alias, *mmio_reg;
+     [VIRT_APLIC_M] =      {  0xc000000, APLIC_SIZE(VIRT_CPUS_MAX) },
-+    hwaddr ecam_base = s->memmap[VIRT_PCIE_ECAM].base;
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
-+    hwaddr ecam_size = s->memmap[VIRT_PCIE_ECAM].size;
-+    hwaddr mmio_base = s->memmap[VIRT_PCIE_MMIO].base;
+ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
-+    hwaddr mmio_size = s->memmap[VIRT_PCIE_MMIO].size;
+                             uint32_t irq_pcie_phandle,
-+    hwaddr high_mmio_base = virt_high_pcie_memmap.base;
+-                            uint32_t msi_pcie_phandle)
-+    hwaddr high_mmio_size = virt_high_pcie_memmap.size;
++                            uint32_t msi_pcie_phandle,
-+    hwaddr pio_base = s->memmap[VIRT_PCIE_PIO].base;
++                            uint32_t iommu_sys_phandle)
-+    hwaddr pio_size = s->memmap[VIRT_PCIE_PIO].size;
+ {
-     qemu_irq irq;
+     g_autofree char *name = NULL;
-     int i;
+     MachineState *ms = MACHINE(s);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
-     dev = qdev_new(TYPE_GPEX_HOST);
+, virt_high_pcie_memmap.base,
+, virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
-+    /* Set GPEX object properties for the virt machine */
-+    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_BASE,
++    if (virt_is_iommu_sys_enabled(s)) {
-+                            ecam_base, NULL);
++        qemu_fdt_setprop_cells(ms->fdt, name, "iommu-map",
-+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_SIZE,
++                               0, iommu_sys_phandle, 0, 0, 0,
-+                            ecam_size, NULL);
++                               iommu_sys_phandle, 0, 0xffff);
-+    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
++    }
-+                             PCI_HOST_BELOW_4G_MMIO_BASE,
++
-+                             mmio_base, NULL);
+     create_pcie_irq_map(s, ms->fdt, name, irq_pcie_phandle);
-+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_BELOW_4G_MMIO_SIZE,
+ }
-+                            mmio_size, NULL);
-+    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
-+                             PCI_HOST_ABOVE_4G_MMIO_BASE,
+                            bdf + 1, iommu_phandle, bdf + 1, 0xffff - bdf);
-+                             high_mmio_base, NULL);
+ }
-+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ABOVE_4G_MMIO_SIZE,
-+                            high_mmio_size, NULL);
++static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
-+    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_BASE,
++                                 uint32_t *iommu_sys_phandle)
-+                            pio_base, NULL);
++{
-+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_SIZE,
++    const char comp[] = "riscv,iommu";
-+                            pio_size, NULL);
++    void *fdt = MACHINE(s)->fdt;
-+
++    uint32_t iommu_phandle;
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
++    g_autofree char *iommu_node = NULL;
++    hwaddr addr = s->memmap[VIRT_IOMMU_SYS].base;
-     ecam_alias = g_new0(MemoryRegion, 1);
++    hwaddr size = s->memmap[VIRT_IOMMU_SYS].size;
-@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
++    uint32_t iommu_irq_map[RISCV_IOMMU_INTR_COUNT] = {
-         gpex_set_irq_num(GPEX_HOST(dev), i, PCIE_IRQ + i);
++        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_CQ,
 +        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_FQ,
 +        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_PM,
 +        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_PQ,
 +    };
 +
 +    iommu_node = g_strdup_printf("/soc/iommu@%x",
 +                               (unsigned int) s->memmap[VIRT_IOMMU_SYS].base);
 +    iommu_phandle = qemu_fdt_alloc_phandle(fdt);
 +    qemu_fdt_add_subnode(fdt, iommu_node);
 +
 +    qemu_fdt_setprop(fdt, iommu_node, "compatible", comp, sizeof(comp));
 +    qemu_fdt_setprop_cell(fdt, iommu_node, "#iommu-cells", 1);
 +    qemu_fdt_setprop_cell(fdt, iommu_node, "phandle", iommu_phandle);
 +
 +    qemu_fdt_setprop_cells(fdt, iommu_node, "reg",
 +                           addr >> 32, addr, size >> 32, size);
 +    qemu_fdt_setprop_cell(fdt, iommu_node, "interrupt-parent", irq_chip);
 +
 +    qemu_fdt_setprop_cells(fdt, iommu_node, "interrupts",
 +        iommu_irq_map[0], FDT_IRQ_TYPE_EDGE_LOW,
 +        iommu_irq_map[1], FDT_IRQ_TYPE_EDGE_LOW,
 +        iommu_irq_map[2], FDT_IRQ_TYPE_EDGE_LOW,
 +        iommu_irq_map[3], FDT_IRQ_TYPE_EDGE_LOW);
 +
 +    *iommu_sys_phandle = iommu_phandle;
 +}
 +
  static void create_fdt_iommu(RISCVVirtState *s, uint16_t bdf)
  {
      const char comp[] = "riscv,pci-iommu";
@@ -XXX,XX +XXX,XX @@ static void finalize_fdt(RISCVVirtState *s)
  {
      uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
      uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
 +    uint32_t iommu_sys_phandle = 1;
      create_fdt_sockets(s, virt_memmap, &phandle, &irq_mmio_phandle,
                         &irq_pcie_phandle, &irq_virtio_phandle,
@@ -XXX,XX +XXX,XX @@ static void finalize_fdt(RISCVVirtState *s)
      create_fdt_virtio(s, virt_memmap, irq_virtio_phandle);
 -    create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle);
 +    if (virt_is_iommu_sys_enabled(s)) {
 +        create_fdt_iommu_sys(s, irq_mmio_phandle, &iommu_sys_phandle);
 +    }
 +    create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle,
 +                    iommu_sys_phandle);
      create_fdt_reset(s, virt_memmap, &phandle);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          create_fdt(s, memmap);
      }
-+    GPEX_HOST(dev)->gpex_cfg.bus = PCI_HOST_BRIDGE(GPEX_HOST(dev))->bus;
++    if (virt_is_iommu_sys_enabled(s)) {
-     return dev;
++        DeviceState *iommu_sys = qdev_new(TYPE_RISCV_IOMMU_SYS);
- }
++
++        object_property_set_uint(OBJECT(iommu_sys), "addr",
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
++                                 s->memmap[VIRT_IOMMU_SYS].base,
-             qdev_get_gpio_in(virtio_irqchip, VIRTIO_IRQ + i));
++                                 &error_fatal);
 +        object_property_set_uint(OBJECT(iommu_sys), "base-irq",
 +                                 IOMMU_SYS_IRQ,
 +                                 &error_fatal);
 +        object_property_set_link(OBJECT(iommu_sys), "irqchip",
 +                                 OBJECT(mmio_irqchip),
 +                                 &error_fatal);
 +
 +        sysbus_realize_and_unref(SYS_BUS_DEVICE(iommu_sys), &error_fatal);
 +    }
 +
      s->machine_done.notify = virt_machine_done;
      qemu_add_machine_init_done_notifier(&s->machine_done);
  }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
      s->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
      s->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
      s->acpi = ON_OFF_AUTO_AUTO;
 +    s->iommu_sys = ON_OFF_AUTO_AUTO;
  }
  static char *virt_get_aia_guests(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void virt_set_aclint(Object *obj, bool value, Error **errp)
      s->have_aclint = value;
  }
 +bool virt_is_iommu_sys_enabled(RISCVVirtState *s)
 +{
 +    return s->iommu_sys == ON_OFF_AUTO_ON;
 +}
 +
 +static void virt_get_iommu_sys(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
 +    OnOffAuto iommu_sys = s->iommu_sys;
 +
 +    visit_type_OnOffAuto(v, name, &iommu_sys, errp);
 +}
 +
 +static void virt_set_iommu_sys(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
 +
 +    visit_type_OnOffAuto(v, name, &s->iommu_sys, errp);
 +}
 +
  bool virt_is_acpi_enabled(RISCVVirtState *s)
  {
      return s->acpi != ON_OFF_AUTO_OFF;
@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
                                                          DeviceState *dev)
  {
      MachineClass *mc = MACHINE_GET_CLASS(machine);
 +    RISCVVirtState *s = RISCV_VIRT_MACHINE(machine);
      if (device_is_dynamic_sysbus(mc, dev) ||
          object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI) ||
          object_dynamic_cast(OBJECT(dev), TYPE_RISCV_IOMMU_PCI)) {
 +        s->iommu_sys = ON_OFF_AUTO_OFF;
          return HOTPLUG_HANDLER(machine);
      }
--    gpex_pcie_init(system_memory,
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
--                   memmap[VIRT_PCIE_ECAM].base,
--                   memmap[VIRT_PCIE_ECAM].size,
+     if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_IOMMU_PCI)) {
--                   memmap[VIRT_PCIE_MMIO].base,
+         create_fdt_iommu(s, pci_get_bdf(PCI_DEVICE(dev)));
--                   memmap[VIRT_PCIE_MMIO].size,
++        s->iommu_sys = ON_OFF_AUTO_OFF;
--                   virt_high_pcie_memmap.base,
+     }
--                   virt_high_pcie_memmap.size,
+ }
--                   memmap[VIRT_PCIE_PIO].base,
--                   pcie_irqchip);
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
-+    gpex_pcie_init(system_memory, pcie_irqchip, s);
+                               NULL, NULL);
+     object_class_property_set_description(oc, "acpi",
-     create_platform_bus(s, mmio_irqchip);
+                                           "Enable ACPI");
++
 +    object_class_property_add(oc, "iommu-sys", "OnOffAuto",
 +                              virt_get_iommu_sys, virt_set_iommu_sys,
 +                              NULL, NULL);
 +    object_class_property_set_description(oc, "iommu-sys",
 +                                          "Enable IOMMU platform device");
  }
  static const TypeInfo virt_machine_typeinfo = {
 --
-.43.0
+.47.1

-[PULL 30/65] target/riscv/tcg: do not use "!generic" CPU checks
+[PULL 07/39] hw/riscv/virt.c, riscv-iommu-sys.c: add MSIx support
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Our current logic in get/setters of MISA and multi-letter extensions
+MSIx support is added in the RISC-V IOMMU platform device by including
-works because we have only 2 CPU types, generic and vendor, and by using
+the required MSIx facilities to alow software to properly setup the MSIx
-"!generic" we're implying that we're talking about vendor CPUs. When adding
+subsystem.
-a third CPU type this logic will break so let's handle it beforehand.
+We took inspiration of what is being done in the riscv-iommu-pci device,
-In set_misa_ext_cfg() and set_multi_ext_cfg(), check for "vendor" cpu instead
+mainly msix_init() and msix_notify(), while keeping in mind that
-of "not generic". The "generic CPU" checks remaining are from
+riscv-iommu-sys isn't a true PCI device and we don't need to copy/paste
-riscv_cpu_add_misa_properties() and cpu_add_multi_ext_prop() before
+all the contents of these MSIx functions.
-applying default values for the extensions.
+Two extra MSI MemoryRegions were added: 'msix-table' and 'msix-pba'.
-This leaves us with:
+They are used to manage r/w of the MSI table and Pending Bit Array (PBA)
+respectively. Both are subregions of the main IOMMU memory region,
-- vendor CPUs will not allow extension enablement, all other CPUs will;
+iommu->regs_mr, initialized during riscv_iommu_realize(), and each one
+has their own handlers for MSIx reads and writes.
-- generic CPUs will inherit default values for extensions, all others
-  won't.
+This is the expected memory map when using this device in the 'virt'
+machine:
-And now we can add a new, third CPU type, that will allow extensions to
-be enabled and will not inherit defaults, without changing the existing
+    0000000003010000-0000000003010fff (prio 0, i/o): riscv-iommu-regs
-logic.
+      0000000003010300-000000000301034f (prio 0, i/o): msix-table
       0000000003010400-0000000003010407 (prio 0, i/o): msix-pba
 We're now able to set IGS to RISCV_IOMMU_CAP_IGS_BOTH, and userspace is
 free to decide which interrupt model to use.
 Enabling MSIx support for this device in the 'virt' machine requires
 adding 'msi-parent' in the iommu-sys DT.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20241106133407.604587-6-dbarboza@ventanamicro.com>
 Message-ID: <20231218125334.37184-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 13 +++++++++----
+ hw/riscv/riscv-iommu-sys.c | 116 +++++++++++++++++++++++++++++++++++--
-file changed, 9 insertions(+), 4 deletions(-)
+ hw/riscv/virt.c            |   6 +-
+ hw/riscv/trace-events      |   2 +
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+files changed, 119 insertions(+), 5 deletions(-)
 diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/hw/riscv/riscv-iommu-sys.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/hw/riscv/riscv-iommu-sys.c
-@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_is_generic(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@
-     return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
+ #include "qemu/host-utils.h"
- }
+ #include "qemu/module.h"
+ #include "qom/object.h"
-+static bool riscv_cpu_is_vendor(Object *cpu_obj)
++#include "exec/exec-all.h"
-+{
++#include "trace.h"
-+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_VENDOR_CPU) != NULL;
-+}
+ #include "riscv-iommu.h"
-+
- /*
+ #define RISCV_IOMMU_SYSDEV_ICVEC_VECTORS 0x3333
-  * We'll get here via the following path:
-  *
++#define RISCV_IOMMU_PCI_MSIX_VECTORS 5
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
++
-     target_ulong misa_bit = misa_ext_cfg->misa_bit;
+ /* RISC-V IOMMU System Platform Device Emulation */
-     RISCVCPU *cpu = RISCV_CPU(obj);
-     CPURISCVState *env = &cpu->env;
+ struct RISCVIOMMUStateSys {
--    bool generic_cpu = riscv_cpu_is_generic(obj);
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUStateSys {
-+    bool vendor_cpu = riscv_cpu_is_vendor(obj);
+     uint32_t         base_irq;
-     bool prev_val, value;
+     DeviceState      *irqchip;
+     RISCVIOMMUState  iommu;
-     if (!visit_type_bool(v, name, &value, errp)) {
++
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
++    /* Wired int support */
-     }
+     qemu_irq         irqs[RISCV_IOMMU_INTR_COUNT];
++
-     if (value) {
++    /* Memory Regions for MSIX table and pending bit entries. */
--        if (!generic_cpu) {
++    MemoryRegion msix_table_mmio;
-+        if (vendor_cpu) {
++    MemoryRegion msix_pba_mmio;
-             g_autofree char *cpuname = riscv_cpu_get_name(cpu);
++    uint8_t *msix_table;
-             error_setg(errp, "'%s' CPU does not allow enabling extensions",
++    uint8_t *msix_pba;
-                        cpuname);
++};
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
++
 +static uint64_t msix_table_mmio_read(void *opaque, hwaddr addr,
 +                                     unsigned size)
 +{
 +    RISCVIOMMUStateSys *s = opaque;
 +
 +    g_assert(addr + size <= RISCV_IOMMU_PCI_MSIX_VECTORS * PCI_MSIX_ENTRY_SIZE);
 +    return pci_get_long(s->msix_table + addr);
 +}
 +
 +static void msix_table_mmio_write(void *opaque, hwaddr addr,
 +                                  uint64_t val, unsigned size)
 +{
 +    RISCVIOMMUStateSys *s = opaque;
 +
 +    g_assert(addr + size <= RISCV_IOMMU_PCI_MSIX_VECTORS * PCI_MSIX_ENTRY_SIZE);
 +    pci_set_long(s->msix_table + addr, val);
 +}
 +
 +static const MemoryRegionOps msix_table_mmio_ops = {
 +    .read = msix_table_mmio_read,
 +    .write = msix_table_mmio_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 8,
 +    },
 +    .impl = {
 +        .max_access_size = 4,
 +    },
 +};
 +
 +static uint64_t msix_pba_mmio_read(void *opaque, hwaddr addr,
 +                                   unsigned size)
 +{
 +    RISCVIOMMUStateSys *s = opaque;
 +
 +    return pci_get_long(s->msix_pba + addr);
 +}
 +
 +static void msix_pba_mmio_write(void *opaque, hwaddr addr,
 +                                uint64_t val, unsigned size)
 +{
 +}
 +
 +static const MemoryRegionOps msix_pba_mmio_ops = {
 +    .read = msix_pba_mmio_read,
 +    .write = msix_pba_mmio_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 8,
 +    },
 +    .impl = {
 +        .max_access_size = 4,
 +    },
  };
 +static void riscv_iommu_sysdev_init_msi(RISCVIOMMUStateSys *s,
 +                                        uint32_t n_vectors)
 +{
 +    RISCVIOMMUState *iommu = &s->iommu;
 +    uint32_t table_size = table_size = n_vectors * PCI_MSIX_ENTRY_SIZE;
 +    uint32_t table_offset = RISCV_IOMMU_REG_MSI_CONFIG;
 +    uint32_t pba_size = QEMU_ALIGN_UP(n_vectors, 64) / 8;
 +    uint32_t pba_offset = RISCV_IOMMU_REG_MSI_CONFIG + 256;
 +
 +    s->msix_table = g_malloc0(table_size);
 +    s->msix_pba = g_malloc0(pba_size);
 +
 +    memory_region_init_io(&s->msix_table_mmio, OBJECT(s), &msix_table_mmio_ops,
 +                          s, "msix-table", table_size);
 +    memory_region_add_subregion(&iommu->regs_mr, table_offset,
 +                                &s->msix_table_mmio);
 +
 +    memory_region_init_io(&s->msix_pba_mmio, OBJECT(s), &msix_pba_mmio_ops, s,
 +                          "msix-pba", pba_size);
 +    memory_region_add_subregion(&iommu->regs_mr, pba_offset,
 +                                &s->msix_pba_mmio);
 +}
 +
 +static void riscv_iommu_sysdev_send_MSI(RISCVIOMMUStateSys *s,
 +                                        uint32_t vector)
 +{
 +    uint8_t *table_entry = s->msix_table + vector * PCI_MSIX_ENTRY_SIZE;
 +    uint64_t msi_addr = pci_get_quad(table_entry + PCI_MSIX_ENTRY_LOWER_ADDR);
 +    uint32_t msi_data = pci_get_long(table_entry + PCI_MSIX_ENTRY_DATA);
 +    MemTxResult result;
 +
 +    address_space_stl_le(&address_space_memory, msi_addr,
 +                         msi_data, MEMTXATTRS_UNSPECIFIED, &result);
 +    trace_riscv_iommu_sys_msi_sent(vector, msi_addr, msi_data, result);
 +}
 +
  static void riscv_iommu_sysdev_notify(RISCVIOMMUState *iommu,
                                        unsigned vector)
  {
-     const RISCVCPUMultiExtConfig *multi_ext_cfg = opaque;
+     RISCVIOMMUStateSys *s = container_of(iommu, RISCVIOMMUStateSys, iommu);
-     RISCVCPU *cpu = RISCV_CPU(obj);
+     uint32_t fctl =  riscv_iommu_reg_get32(iommu, RISCV_IOMMU_REG_FCTL);
--    bool generic_cpu = riscv_cpu_is_generic(obj);
-+    bool vendor_cpu = riscv_cpu_is_vendor(obj);
+-    /* We do not support MSIs yet */
-     bool prev_val, value;
+-    if (!(fctl & RISCV_IOMMU_FCTL_WSI)) {
++    if (fctl & RISCV_IOMMU_FCTL_WSI) {
-     if (!visit_type_bool(v, name, &value, errp)) {
++        qemu_irq_pulse(s->irqs[vector]);
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
++        trace_riscv_iommu_sys_irq_sent(vector);
          return;
      }
--    if (value && !generic_cpu) {
+-    qemu_irq_pulse(s->irqs[vector]);
-+    if (value && vendor_cpu) {
++    riscv_iommu_sysdev_send_MSI(s, vector);
-         g_autofree char *cpuname = riscv_cpu_get_name(cpu);
+ }
-         error_setg(errp, "'%s' CPU does not allow enabling extensions",
-                    cpuname);
+ static void riscv_iommu_sys_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_sys_realize(DeviceState *dev, Error **errp)
          irq = qdev_get_gpio_in(s->irqchip, s->base_irq + i);
          sysbus_connect_irq(sysdev, i, irq);
      }
 +
 +    riscv_iommu_sysdev_init_msi(s, RISCV_IOMMU_PCI_MSIX_VECTORS);
  }
  static void riscv_iommu_sys_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_sys_init(Object *obj)
      qdev_alias_all_properties(DEVICE(iommu), obj);
      iommu->icvec_avail_vectors = RISCV_IOMMU_SYSDEV_ICVEC_VECTORS;
 -    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_WSI);
 +    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_BOTH);
  }
  static Property riscv_iommu_sys_properties[] = {
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
  }
  static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
 +                                 uint32_t msi_phandle,
                                   uint32_t *iommu_sys_phandle)
  {
      const char comp[] = "riscv,iommu";
@@ -XXX,XX +XXX,XX @@ static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
          iommu_irq_map[2], FDT_IRQ_TYPE_EDGE_LOW,
          iommu_irq_map[3], FDT_IRQ_TYPE_EDGE_LOW);
 +    qemu_fdt_setprop_cell(fdt, iommu_node, "msi-parent", msi_phandle);
 +
      *iommu_sys_phandle = iommu_phandle;
  }
@@ -XXX,XX +XXX,XX @@ static void finalize_fdt(RISCVVirtState *s)
      create_fdt_virtio(s, virt_memmap, irq_virtio_phandle);
      if (virt_is_iommu_sys_enabled(s)) {
 -        create_fdt_iommu_sys(s, irq_mmio_phandle, &iommu_sys_phandle);
 +        create_fdt_iommu_sys(s, irq_mmio_phandle, msi_pcie_phandle,
 +                             &iommu_sys_phandle);
      }
      create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle,
                      iommu_sys_phandle);
 diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/trace-events
 +++ b/hw/riscv/trace-events
@@ -XXX,XX +XXX,XX @@ riscv_iommu_icvec_write(uint32_t orig, uint32_t actual) "ICVEC write: incoming 0
  riscv_iommu_ats(const char *id, unsigned b, unsigned d, unsigned f, uint64_t iova) "%s: translate request %04x:%02x.%u iova: 0x%"PRIx64
  riscv_iommu_ats_inval(const char *id) "%s: dev-iotlb invalidate"
  riscv_iommu_ats_prgr(const char *id) "%s: dev-iotlb page request group response"
 +riscv_iommu_sys_irq_sent(uint32_t vector) "IRQ sent to vector %u"
 +riscv_iommu_sys_msi_sent(uint32_t vector, uint64_t msi_addr, uint32_t msi_data, uint32_t result) "MSI sent to vector %u msi_addr 0x%lx msi_data 0x%x result %u"
 --
-.43.0
+.47.1

-[PULL 34/65] target/riscv/tcg: add 'zic64b' support
+[PULL 08/39] hw/riscv/riscv-iommu: implement reset protocol
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-zic64b is defined in the RVA22U64 profile [1] as a named feature for
+Add a riscv_iommu_reset() helper in the base emulation code that
-"Cache blocks must be 64 bytes in size, naturally aligned in the address
+implements the expected reset behavior as defined by the riscv-iommu
-space". It's a fantasy name for 64 bytes cache blocks. The RVA22U64
+spec.
-profile mandates this feature, meaning that applications using this
-profile expects 64 bytes cache blocks.
+Devices can then use this helper in their own reset callbacks.
 To make the upcoming RVA22U64 implementation complete, we'll zic64b as
 a 'named feature', not a regular extension. This means that:
 - it won't be exposed to users;
 - it won't be written in riscv,isa.
 This will be extended to other named extensions in the future, so we're
 creating some common boilerplate for them as well.
 zic64b is default to 'true' since we're already using 64 bytes blocks.
 If any cache block size (cbo{m,p,z}_blocksize) is changed to something
 different than 64, zic64b is set to 'false'.
 Our profile implementation will then be able to check the current state
 of zic64b and take the appropriate action (e.g. throw a warning).
 [1] https://github.com/riscv/riscv-profiles/releases/download/v1.0/profiles.pdf
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20241106133407.604587-7-dbarboza@ventanamicro.com>
 Message-ID: <20231218125334.37184-7-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  1 +
+ hw/riscv/riscv-iommu.h     |  1 +
- target/riscv/cpu_cfg.h     |  1 +
+ include/hw/riscv/iommu.h   |  6 ++++--
- target/riscv/cpu.c         |  6 ++++++
+ hw/riscv/riscv-iommu-pci.c | 20 ++++++++++++++++++++
- target/riscv/tcg/tcg-cpu.c | 26 ++++++++++++++++++++++++++
+ hw/riscv/riscv-iommu-sys.c | 20 ++++++++++++++++++++
-files changed, 34 insertions(+)
+ hw/riscv/riscv-iommu.c     | 35 +++++++++++++++++++++++++++++++++++
+ hw/riscv/trace-events      |  2 ++
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+files changed, 82 insertions(+), 2 deletions(-)
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
-+++ b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ typedef struct RISCVCPUMultiExtConfig {
+--- a/hw/riscv/riscv-iommu.h
- extern const RISCVCPUMultiExtConfig riscv_cpu_extensions[];
++++ b/hw/riscv/riscv-iommu.h
- extern const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[];
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
- extern const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[];
+ void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
-+extern const RISCVCPUMultiExtConfig riscv_cpu_named_features[];
+          Error **errp);
- extern const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[];
+ void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
- extern Property riscv_cpu_options[];
++void riscv_iommu_reset(RISCVIOMMUState *s);
-diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+ /* private helpers */
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_cfg.h
+diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
-+++ b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+--- a/include/hw/riscv/iommu.h
-     bool ext_smepmp;
++++ b/include/hw/riscv/iommu.h
-     bool rvv_ta_all_1s;
+@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUState RISCVIOMMUState;
-     bool rvv_ma_all_1s;
+ typedef struct RISCVIOMMUSpace RISCVIOMMUSpace;
-+    bool zic64b;
+ #define TYPE_RISCV_IOMMU_PCI "riscv-iommu-pci"
-     uint32_t mvendorid;
+-OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStatePci, RISCV_IOMMU_PCI)
-     uint64_t marchid;
++OBJECT_DECLARE_TYPE(RISCVIOMMUStatePci, RISCVIOMMUPciClass, RISCV_IOMMU_PCI)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+ typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
-index XXXXXXX..XXXXXXX 100644
++typedef struct RISCVIOMMUPciClass RISCVIOMMUPciClass;
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
+ #define TYPE_RISCV_IOMMU_SYS "riscv-iommu-device"
-@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+-OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
 +OBJECT_DECLARE_TYPE(RISCVIOMMUStateSys, RISCVIOMMUSysClass, RISCV_IOMMU_SYS)
  typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
 +typedef struct RISCVIOMMUSysClass RISCVIOMMUSysClass;
  #define FDT_IRQ_TYPE_EDGE_LOW 1
 diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu-pci.c
 +++ b/hw/riscv/riscv-iommu-pci.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu_bits.h"
  #include "riscv-iommu.h"
  #include "riscv-iommu-bits.h"
 +#include "trace.h"
  /* RISC-V IOMMU PCI Device Emulation */
  #define RISCV_PCI_CLASS_SYSTEM_IOMMU     0x0806
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUStatePci {
      RISCVIOMMUState  iommu;   /* common IOMMU state */
  } RISCVIOMMUStatePci;
 +struct RISCVIOMMUPciClass {
 +    /*< public >*/
 +    DeviceRealize parent_realize;
 +    ResettablePhases parent_phases;
 +};
 +
  /* interrupt delivery callback */
  static void riscv_iommu_pci_notify(RISCVIOMMUState *iommu, unsigned vector)
  {
@@ -XXX,XX +XXX,XX @@ static const Property riscv_iommu_pci_properties[] = {
      DEFINE_PROP_END_OF_LIST(),
  };
-+const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
++static void riscv_iommu_pci_reset_hold(Object *obj, ResetType type)
-+    MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
++{
-+
++    RISCVIOMMUStatePci *pci = RISCV_IOMMU_PCI(obj);
-+    DEFINE_PROP_END_OF_LIST(),
++    RISCVIOMMUState *iommu = &pci->iommu;
 +
 +    riscv_iommu_reset(iommu);
 +
 +    trace_riscv_iommu_pci_reset_hold(type);
 +}
 +
  static void riscv_iommu_pci_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    rc->phases.hold = riscv_iommu_pci_reset_hold;
      k->realize = riscv_iommu_pci_realize;
      k->exit = riscv_iommu_pci_exit;
 diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu-sys.c
 +++ b/hw/riscv/riscv-iommu-sys.c
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUStateSys {
      uint8_t *msix_pba;
  };
 +struct RISCVIOMMUSysClass {
 +    /*< public >*/
 +    DeviceRealize parent_realize;
 +    ResettablePhases parent_phases;
 +};
 +
- /* Deprecated entries marked for future removal */
+ static uint64_t msix_table_mmio_read(void *opaque, hwaddr addr,
- const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[] = {
+                                      unsigned size)
-     MULTI_EXT_CFG_BOOL("Zifencei", ext_zifencei, true),
+ {
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ static Property riscv_iommu_sys_properties[] = {
-index XXXXXXX..XXXXXXX 100644
+     DEFINE_PROP_END_OF_LIST(),
---- a/target/riscv/tcg/tcg-cpu.c
+ };
-+++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
++static void riscv_iommu_sys_reset_hold(Object *obj, ResetType type)
-     g_assert_not_reached();
++{
 +    RISCVIOMMUStateSys *sys = RISCV_IOMMU_SYS(obj);
 +    RISCVIOMMUState *iommu = &sys->iommu;
 +
 +    riscv_iommu_reset(iommu);
 +
 +    trace_riscv_iommu_sys_reset_hold(type);
 +}
 +
  static void riscv_iommu_sys_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    rc->phases.hold = riscv_iommu_sys_reset_hold;
 +
      dc->realize = riscv_iommu_sys_realize;
      set_bit(DEVICE_CATEGORY_MISC, dc->categories);
      device_class_set_props(dc, riscv_iommu_sys_properties);
 diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu.c
 +++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_unrealize(DeviceState *dev)
      g_hash_table_unref(s->ctx_cache);
  }
-+static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
++void riscv_iommu_reset(RISCVIOMMUState *s)
 +{
-+    const RISCVCPUMultiExtConfig *feat;
++    uint32_t reg_clr;
-+
++    int ddtp_mode;
-+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
++
-+        if (feat->offset == ext_offset) {
++    /*
-+            return true;
++     * Clear DDTP while setting DDTP_mode back to user
-+        }
++     * initial setting.
-+    }
++     */
-+
++    ddtp_mode = s->enable_off ?
-+    return false;
++                RISCV_IOMMU_DDTP_MODE_OFF : RISCV_IOMMU_DDTP_MODE_BARE;
 +    s->ddtp = set_field(0, RISCV_IOMMU_DDTP_MODE, ddtp_mode);
 +    riscv_iommu_reg_set64(s, RISCV_IOMMU_REG_DDTP, s->ddtp);
 +
 +    reg_clr = RISCV_IOMMU_CQCSR_CQEN | RISCV_IOMMU_CQCSR_CIE |
 +              RISCV_IOMMU_CQCSR_CQON | RISCV_IOMMU_CQCSR_BUSY;
 +    riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_CQCSR, 0, reg_clr);
 +
 +    reg_clr = RISCV_IOMMU_FQCSR_FQEN | RISCV_IOMMU_FQCSR_FIE |
 +              RISCV_IOMMU_FQCSR_FQON | RISCV_IOMMU_FQCSR_BUSY;
 +    riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_FQCSR, 0, reg_clr);
 +
 +    reg_clr = RISCV_IOMMU_PQCSR_PQEN | RISCV_IOMMU_PQCSR_PIE |
 +              RISCV_IOMMU_PQCSR_PQON | RISCV_IOMMU_PQCSR_BUSY;
 +    riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_PQCSR, 0, reg_clr);
 +
 +    riscv_iommu_reg_mod64(s, RISCV_IOMMU_REG_TR_REQ_CTL, 0,
 +                          RISCV_IOMMU_TR_REQ_CTL_GO_BUSY);
 +
 +    riscv_iommu_reg_set32(s, RISCV_IOMMU_REG_IPSR, 0);
 +
 +    g_hash_table_remove_all(s->ctx_cache);
 +    g_hash_table_remove_all(s->iot_cache);
 +}
 +
- static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
+ static const Property riscv_iommu_properties[] = {
-                                         uint32_t ext_offset)
+     DEFINE_PROP_UINT32("version", RISCVIOMMUState, version,
- {
+         RISCV_IOMMU_SPEC_DOT_VER),
-@@ -XXX,XX +XXX,XX @@ static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
+diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
-         return;
+index XXXXXXX..XXXXXXX 100644
-     }
+--- a/hw/riscv/trace-events
++++ b/hw/riscv/trace-events
-+    if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+@@ -XXX,XX +XXX,XX @@ riscv_iommu_ats_inval(const char *id) "%s: dev-iotlb invalidate"
-+        return;
+ riscv_iommu_ats_prgr(const char *id) "%s: dev-iotlb page request group response"
-+    }
+ riscv_iommu_sys_irq_sent(uint32_t vector) "IRQ sent to vector %u"
-+
+ riscv_iommu_sys_msi_sent(uint32_t vector, uint64_t msi_addr, uint32_t msi_data, uint32_t result) "MSI sent to vector %u msi_addr 0x%lx msi_data 0x%x result %u"
-     ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
++riscv_iommu_sys_reset_hold(int reset_type) "reset type %d"
++riscv_iommu_pci_reset_hold(int reset_type) "reset type %d"
      if (env->priv_ver < ext_priv_ver) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
      }
  }
 +static void riscv_cpu_update_named_features(RISCVCPU *cpu)
 +{
 +    cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
 +                      cpu->cfg.cbop_blocksize == 64 &&
 +                      cpu->cfg.cboz_blocksize == 64;
 +}
 +
  /*
   * Check consistency between chosen extensions while setting
   * cpu->cfg accordingly.
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    riscv_cpu_update_named_features(cpu);
 +
      if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
          /*
           * Enhanced PMP should only be available
 --
-.43.0
+.47.1

-[PULL 39/65] target/riscv/tcg: add MISA user options hash
+[PULL 09/39] docs/specs: add riscv-iommu-sys information
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We already track user choice for multi-letter extensions because we
-needed to honor user choice when enabling/disabling extensions during
-realize(). We refrained from adding the same mechanism for MISA
-extensions since we didn't need it.
-Profile support requires tne need to check for user choice for MISA
-extensions, so let's add the corresponding hash now. It works like the
-existing multi-letter hash (multi_ext_user_opts) but tracking MISA bits
-options in the cpu_set_misa_ext_cfg() callback.
-Note that we can't re-use the same hash from multi-letter extensions
-because that hash uses cpu->cfg offsets as keys, while for MISA
-extensions we're using MISA bits as keys.
-After adding the user hash in cpu_set_misa_ext_cfg(), setting default
-values with object_property_set_bool() in add_misa_properties() will end
-up marking the user choice hash with them. Set the default value
-manually to avoid it.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20241106133407.604587-8-dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-12-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 15 ++++++++++++++-
+ docs/specs/riscv-iommu.rst | 30 +++++++++++++++++++++++++++---
-file changed, 14 insertions(+), 1 deletion(-)
+ docs/system/riscv/virt.rst | 10 ++++++++++
 files changed, 37 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/docs/specs/riscv-iommu.rst b/docs/specs/riscv-iommu.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/docs/specs/riscv-iommu.rst
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/docs/specs/riscv-iommu.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ RISC-V IOMMU support for RISC-V machines
+ QEMU implements a RISC-V IOMMU emulation based on the RISC-V IOMMU spec
- /* Hash that stores user set extensions */
+ version 1.0 `iommu1.0`_.
- static GHashTable *multi_ext_user_opts;
-+static GHashTable *misa_ext_user_opts;
+-The emulation includes a PCI reference device, riscv-iommu-pci, that QEMU
+-RISC-V boards can use.  The 'virt' RISC-V machine is compatible with this
- static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+-device.
- {
++The emulation includes a PCI reference device (riscv-iommu-pci) and a platform
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
++bus device (riscv-iommu-sys) that QEMU RISC-V boards can use.  The 'virt'
-         return;
++RISC-V machine is compatible with both devices.
-     }
+ riscv-iommu-pci reference device
-+    g_hash_table_insert(misa_ext_user_opts,
+ --------------------------------
-+                        GUINT_TO_POINTER(misa_bit),
+@@ -XXX,XX +XXX,XX @@ Several options are available to control the capabilities of the device, namely:
-+                        (gpointer)value);
+ - "s-stage": enable s-stage support
  - "g-stage": enable g-stage support
 +riscv-iommu-sys device
 +----------------------
 +
-     prev_val = env->misa_ext & misa_bit;
++This device implements the RISC-V IOMMU emulation as a platform bus device that
++RISC-V boards can use.
-     if (value == prev_val) {
++
-@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
++For the 'virt' board the device is disabled by default.  To enable it use the
-  */
++'iommu-sys' machine option:
- static void riscv_cpu_add_misa_properties(Object *cpu_obj)
++
- {
++.. code-block:: bash
-+    CPURISCVState *env = &RISCV_CPU(cpu_obj)->env;
++
-     bool use_def_vals = riscv_cpu_is_generic(cpu_obj);
++  $ qemu-system-riscv64 -M virt,iommu-sys=on (...)
-     int i;
++
++There is no options to configure the capabilities of this device in the 'virt'
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
++board using the QEMU command line.  The device is configured with the following
-                             NULL, (void *)misa_cfg);
++riscv-iommu options:
-         object_property_set_description(cpu_obj, name, desc);
++
-         if (use_def_vals) {
++- "ioatc-limit": default value (2Mb)
--            object_property_set_bool(cpu_obj, name, misa_cfg->enabled, NULL);
++- "intremap": enabled
-+            if (misa_cfg->enabled) {
++- "ats": enabled
-+                env->misa_ext |= bit;
++- "off": on (DMA disabled)
-+                env->misa_ext_mask |= bit;
++- "s-stage": enabled
-+            } else {
++- "g-stage": enabled
-+                env->misa_ext &= ~bit;
++
-+                env->misa_ext_mask &= ~bit;
+ .. _iommu1.0: https://github.com/riscv-non-isa/riscv-iommu/releases/download/v1.0/riscv-iommu.pdf
-+            }
-         }
+ .. _linux-v8: https://lore.kernel.org/linux-riscv/cover.1718388908.git.tjeznach@rivosinc.com/
-     }
+diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
- }
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static void tcg_cpu_instance_init(CPUState *cs)
+--- a/docs/system/riscv/virt.rst
-     RISCVCPU *cpu = RISCV_CPU(cs);
++++ b/docs/system/riscv/virt.rst
-     Object *obj = OBJECT(cpu);
+@@ -XXX,XX +XXX,XX @@ command line:
-+    misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
+   $ qemu-system-riscv64 -M virt -device riscv-iommu-pci (...)
-     multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
-     riscv_cpu_add_user_properties(obj);
++It also has support for the riscv-iommu-sys platform device:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-riscv64 -M virt,iommu-sys=on (...)
 +
  Refer to :ref:`riscv-iommu` for more information on how the RISC-V IOMMU support
  works.
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
    having AIA IMSIC (i.e. "aia=aplic-imsic" selected). When not specified,
    the default number of per-HART VS-level AIA IMSIC pages is 0.
 +- iommu-sys=[on|off]
 +
 +  Enables the riscv-iommu-sys platform device. Defaults to 'off'.
 +
  Running Linux kernel
  --------------------
 --
-.43.0
+.47.1

-[PULL 29/65] target/riscv: create TYPE_RISCV_VENDOR_CPU
+[PULL 10/39] target/riscv: Add Tenstorrent Ascalon CPU
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Anton Blanchard <antonb@tenstorrent.com>
-We want to add a new CPU type for bare CPUs that will inherit specific
+Add a CPU entry for the Tenstorrent Ascalon CPU, a series of 2 wide to
-traits of the 2 existing types:
+wide RV64 cores. More details can be found at
 https://tenstorrent.com/ip/tt-ascalon
-- it will allow for extensions to be enabled/disabled, like generic
+Signed-off-by: Anton Blanchard <antonb@tenstorrent.com>
-  CPUs;
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-- it will NOT inherit defaults, like vendor CPUs.
+Message-ID: <20241113110459.1607299-1-antonb@tenstorrent.com>
 We can make this conditions met by adding an explicit type for the
 existing vendor CPUs and change the existing logic to not imply that
 "not generic" means vendor CPUs.
 Let's add the "vendor" CPU type first.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu-qom.h |  1 +
- target/riscv/cpu.c     | 30 +++++++++++++++++++++---------
+ target/riscv/cpu.c     | 67 ++++++++++++++++++++++++++++++++++++++++++
-files changed, 22 insertions(+), 9 deletions(-)
+files changed, 68 insertions(+)
 diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu-qom.h
 +++ b/target/riscv/cpu-qom.h
 @@ -XXX,XX +XXX,XX @@
+ #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
- #define TYPE_RISCV_CPU "riscv-cpu"
+ #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
- #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
+ #define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
-+#define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
++#define TYPE_RISCV_CPU_TT_ASCALON       RISCV_CPU_TYPE_NAME("tt-ascalon")
+ #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
- #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
- #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
+ OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
-         .instance_init = initfn               \
+ #endif
-     }
+ }
-+#define DEFINE_VENDOR_CPU(type_name, initfn) \
++/* Tenstorrent Ascalon */
-+    {                                        \
++static void rv64_tt_ascalon_cpu_init(Object *obj)
-+        .name = type_name,                   \
++{
-+        .parent = TYPE_RISCV_VENDOR_CPU,     \
++    CPURISCVState *env = &RISCV_CPU(obj)->env;
-+        .instance_init = initfn              \
++    RISCVCPU *cpu = RISCV_CPU(obj);
 +    }
 +
- static const TypeInfo riscv_cpu_type_infos[] = {
++    riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU | RVH | RVV);
-     {
++    env->priv_ver = PRIV_VERSION_1_13_0;
-         .name = TYPE_RISCV_CPU,
++
 +    /* Enable ISA extensions */
 +    cpu->cfg.mmu = true;
 +    cpu->cfg.vlenb = 256 >> 3;
 +    cpu->cfg.elen = 64;
 +    cpu->env.vext_ver = VEXT_VERSION_1_00_0;
 +    cpu->cfg.rvv_ma_all_1s = true;
 +    cpu->cfg.rvv_ta_all_1s = true;
 +    cpu->cfg.misa_w = true;
 +    cpu->cfg.pmp = true;
 +    cpu->cfg.cbom_blocksize = 64;
 +    cpu->cfg.cbop_blocksize = 64;
 +    cpu->cfg.cboz_blocksize = 64;
 +    cpu->cfg.ext_zic64b = true;
 +    cpu->cfg.ext_zicbom = true;
 +    cpu->cfg.ext_zicbop = true;
 +    cpu->cfg.ext_zicboz = true;
 +    cpu->cfg.ext_zicntr = true;
 +    cpu->cfg.ext_zicond = true;
 +    cpu->cfg.ext_zicsr = true;
 +    cpu->cfg.ext_zifencei = true;
 +    cpu->cfg.ext_zihintntl = true;
 +    cpu->cfg.ext_zihintpause = true;
 +    cpu->cfg.ext_zihpm = true;
 +    cpu->cfg.ext_zimop = true;
 +    cpu->cfg.ext_zawrs = true;
 +    cpu->cfg.ext_zfa = true;
 +    cpu->cfg.ext_zfbfmin = true;
 +    cpu->cfg.ext_zfh = true;
 +    cpu->cfg.ext_zfhmin = true;
 +    cpu->cfg.ext_zcb = true;
 +    cpu->cfg.ext_zcmop = true;
 +    cpu->cfg.ext_zba = true;
 +    cpu->cfg.ext_zbb = true;
 +    cpu->cfg.ext_zbs = true;
 +    cpu->cfg.ext_zkt = true;
 +    cpu->cfg.ext_zvbb = true;
 +    cpu->cfg.ext_zvbc = true;
 +    cpu->cfg.ext_zvfbfmin = true;
 +    cpu->cfg.ext_zvfbfwma = true;
 +    cpu->cfg.ext_zvfh = true;
 +    cpu->cfg.ext_zvfhmin = true;
 +    cpu->cfg.ext_zvkng = true;
 +    cpu->cfg.ext_smaia = true;
 +    cpu->cfg.ext_smstateen = true;
 +    cpu->cfg.ext_ssaia = true;
 +    cpu->cfg.ext_sscofpmf = true;
 +    cpu->cfg.ext_sstc = true;
 +    cpu->cfg.ext_svade = true;
 +    cpu->cfg.ext_svinval = true;
 +    cpu->cfg.ext_svnapot = true;
 +    cpu->cfg.ext_svpbmt = true;
 +
 +#ifndef CONFIG_USER_ONLY
 +    set_satp_mode_max_supported(cpu, VM_1_10_SV57);
 +#endif
 +}
 +
  #ifdef CONFIG_TCG
  static void rv128_base_cpu_init(Object *obj)
  {
 @@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
-         .parent = TYPE_RISCV_CPU,
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54, MXL_RV64,  rv64_sifive_u_cpu_init),
-         .abstract = true,
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,   MXL_RV64,  rv64_sifive_u_cpu_init),
-     },
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
-+    {
++    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
-+        .name = TYPE_RISCV_VENDOR_CPU,
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
-+        .parent = TYPE_RISCV_CPU,
+ #ifdef CONFIG_TCG
-+        .abstract = true,
+     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
 +    },
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
  #if defined(TARGET_RISCV32)
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,   rv32_base_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,       rv32_sifive_e_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,       rv32_imafcu_nommu_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,       rv32_sifive_u_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,        rv32_ibex_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31,  rv32_sifive_e_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34,  rv32_imafcu_nommu_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34,  rv32_sifive_u_cpu_init),
  #elif defined(TARGET_RISCV64)
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,       rv64_sifive_e_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
 -    DEFINE_CPU(TYPE_RISCV_CPU_VEYRON_V1,        rv64_veyron_v1_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51,  rv64_sifive_e_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54,  rv64_sifive_u_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,    rv64_sifive_u_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
 +    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
  #endif
  };
 --
-.43.0
+.47.1

-[PULL 59/65] target/riscv/kvm: add RVV and Vector CSR regs
+[PULL 11/39] hw/intc/riscv_aplic: rename is_kvm_aia()
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Add support for RVV and Vector CSR KVM regs vstart, vl and vtype.
+The helper is_kvm_aia() is checking not only for AIA, but for
 aplic-imsic (i.e. "aia=aplic-imsic" in 'virt' RISC-V machine) with an
 in-kernel chip present.
-Support for vregs[] requires KVM side changes and an extra reg (vlenb)
+Rename it to be a bit clear what the helper is doing since we'll add
-and will be added later.
+more AIA helpers in the next patches.
 Make the helper public because the 'virt' machine will use it as well.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-5-dbarboza@ventanamicro.com>
+Message-ID: <20241119191706.718860-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 74 ++++++++++++++++++++++++++++++++++++++
+ include/hw/intc/riscv_aplic.h | 1 +
-file changed, 74 insertions(+)
+ hw/intc/riscv_aplic.c         | 8 ++++----
 files changed, 5 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+diff --git a/include/hw/intc/riscv_aplic.h b/include/hw/intc/riscv_aplic.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
+--- a/include/hw/intc/riscv_aplic.h
-+++ b/target/riscv/kvm/kvm-cpu.c
++++ b/include/hw/intc/riscv_aplic.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
+@@ -XXX,XX +XXX,XX @@ struct RISCVAPLICState {
  #define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
 +#define RISCV_VECTOR_CSR_REG(env, name) \
 +    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_VECTOR, \
 +                           KVM_REG_RISCV_VECTOR_CSR_REG(name))
 +
  #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
      do { \
          int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_misa_ext_cfgs[] = {
      KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
      KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
      KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
 +    KVM_MISA_CFG(RVV, KVM_RISCV_ISA_EXT_V),
  };
- static void kvm_cpu_get_misa_ext_cfg(Object *obj, Visitor *v,
+ void riscv_aplic_add_child(DeviceState *parent, DeviceState *child);
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
++bool riscv_is_kvm_aia_aplic_imsic(bool msimode);
-     env->kvm_timer_dirty = false;
  DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
 diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_aplic.c
 +++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
   * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
   * APLIC Wired.
   */
 -static bool is_kvm_aia(bool msimode)
 +bool riscv_is_kvm_aia_aplic_imsic(bool msimode)
  {
      return kvm_irqchip_in_kernel() && msimode;
  }
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-+static int kvm_riscv_get_regs_vector(CPUState *cs)
+     uint32_t i;
-+{
+     RISCVAPLICState *aplic = RISCV_APLIC(dev);
-+    CPURISCVState *env = &RISCV_CPU(cs)->env;
-+    target_ulong reg;
+-    if (!is_kvm_aia(aplic->msimode)) {
-+    int ret = 0;
++    if (!riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
-+
+         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-+    if (!riscv_has_ext(env, RVV)) {
+         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-+        return 0;
+         aplic->state = g_new0(uint32_t, aplic->num_irqs);
-+    }
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-+
+      * have IRQ lines delegated by their parent APLIC.
-+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+      */
-+    if (ret) {
+     if (!aplic->parent) {
-+        return ret;
+-        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
-+    }
++        if (kvm_enabled() && riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
-+    env->vstart = reg;
+             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
-+
+         } else {
-+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
-+    if (ret) {
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
-+        return ret;
-+    }
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+    env->vl = reg;
-+
+-    if (!is_kvm_aia(msimode)) {
-+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
++    if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
-+    if (ret) {
+         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +        return ret;
 +    }
 +    env->vtype = reg;
 +
 +    return 0;
 +}
 +
 +static int kvm_riscv_put_regs_vector(CPUState *cs)
 +{
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +    target_ulong reg;
 +    int ret = 0;
 +
 +    if (!riscv_has_ext(env, RVV)) {
 +        return 0;
 +    }
 +
 +    reg = env->vstart;
 +    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    reg = env->vl;
 +    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    reg = env->vtype;
 +    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
 +
 +    return ret;
 +}
 +
  typedef struct KVMScratchCPU {
      int kvmfd;
      int vmfd;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          return ret;
      }
-+    ret = kvm_riscv_get_regs_vector(cs);
-+    if (ret) {
-+        return ret;
-+    }
-+
-     return ret;
- }
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-         return ret;
-     }
-+    ret = kvm_riscv_put_regs_vector(cs);
-+    if (ret) {
-+        return ret;
-+    }
-+
-     if (KVM_PUT_RESET_STATE == level) {
-         RISCVCPU *cpu = RISCV_CPU(cs);
-         if (cs->cpu_index == 0) {
 --
-.43.0
+.47.1

-[PULL 33/65] target/riscv: add zicbop extension flag
+[PULL 12/39] hw/riscv/virt.c: reduce virt_use_kvm_aia() usage
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-QEMU already implements zicbom (Cache Block Management Operations) and
+In create_fdt_sockets() we have the following pattern:
 zicboz (Cache Block Zero Operations). Commit 59cb29d6a5 ("target/riscv:
 add Zicbop cbo.prefetch{i, r, m} placeholder") added placeholders for
 what would be the instructions for zicbop (Cache Block Prefetch
 Operations), which are now no-ops.
-The RVA22U64 profile mandates zicbop, which means that applications that
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-run with this profile might expect zicbop to be present in the riscv,isa
+        (... do stuff ...)
-DT and might behave badly if it's absent.
+    } else {
         (... do other stuff ...)
     }
     if (kvm_enabled() && virt_use_kvm_aia(s)) {
         (... do more stuff ...)
     } else {
         (... do more other stuff)
     }
-Adding zicbop as an extension will make our future RVA22U64
+Do everything in a single if/else clause to reduce the usage of
-implementation more in line with what userspace expects and, if/when
+virt_use_kvm_aia() helper and to make the code a bit less repetitive.
 cache block prefetch operations became relevant to QEMU, we already have
 the extension flag to turn then on/off as needed.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-6-dbarboza@ventanamicro.com>
+Message-ID: <20241119191706.718860-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h | 2 ++
+ hw/riscv/virt.c | 10 ++++------
- hw/riscv/virt.c        | 5 +++++
+file changed, 4 insertions(+), 6 deletions(-)
  target/riscv/cpu.c     | 3 +++
 files changed, 10 insertions(+)
-diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zicntr;
-     bool ext_zicsr;
-     bool ext_zicbom;
-+    bool ext_zicbop;
-     bool ext_zicboz;
-     bool ext_zicond;
-     bool ext_zihintntl;
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     uint16_t vlen;
-     uint16_t elen;
-     uint16_t cbom_blocksize;
-+    uint16_t cbop_blocksize;
-     uint16_t cboz_blocksize;
-     bool mmu;
-     bool pmp;
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-                                   cpu_ptr->cfg.cboz_blocksize);
+                                 msi_m_phandle, msi_s_phandle, phandle,
                                  &intc_phandles[0], xplic_phandles,
                                  ms->smp.cpus);
 +
 +        *irq_mmio_phandle = xplic_phandles[0];
 +        *irq_virtio_phandle = xplic_phandles[0];
 +        *irq_pcie_phandle = xplic_phandles[0];
      } else {
          phandle_pos = ms->smp.cpus;
          for (socket = (socket_count - 1); socket >= 0; socket--) {
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                          s->soc[socket].num_harts);
              }
          }
+-    }
-+        if (cpu_ptr->cfg.ext_zicbop) {
-+            qemu_fdt_setprop_cell(ms->fdt, cpu_name, "riscv,cbop-block-size",
+-    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-+                                  cpu_ptr->cfg.cbop_blocksize);
+-        *irq_mmio_phandle = xplic_phandles[0];
-+        }
+-        *irq_virtio_phandle = xplic_phandles[0];
-+
+-        *irq_pcie_phandle = xplic_phandles[0];
-         qemu_fdt_setprop_string(ms->fdt, cpu_name, "compatible", "riscv");
+-    } else {
-         qemu_fdt_setprop_string(ms->fdt, cpu_name, "status", "okay");
+         for (socket = 0; socket < socket_count; socket++) {
-         qemu_fdt_setprop_cell(ms->fdt, cpu_name, "reg",
+             if (socket == 0) {
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+                 *irq_mmio_phandle = xplic_phandles[socket];
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
   */
  const RISCVIsaExtData isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
 +    ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
      ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
      ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
      ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("zhinxmin", ext_zhinxmin, false),
      MULTI_EXT_CFG_BOOL("zicbom", ext_zicbom, true),
 +    MULTI_EXT_CFG_BOOL("zicbop", ext_zicbop, true),
      MULTI_EXT_CFG_BOOL("zicboz", ext_zicboz, true),
      MULTI_EXT_CFG_BOOL("zmmul", ext_zmmul, false),
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
      DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
      DEFINE_PROP_UINT16("cbom_blocksize", RISCVCPU, cfg.cbom_blocksize, 64),
 +    DEFINE_PROP_UINT16("cbop_blocksize", RISCVCPU, cfg.cbop_blocksize, 64),
      DEFINE_PROP_UINT16("cboz_blocksize", RISCVCPU, cfg.cboz_blocksize, 64),
      DEFINE_PROP_END_OF_LIST(),
 --
-.43.0
+.47.1

-[PULL 42/65] target/riscv/tcg: add hash table insert helpers
+[PULL 13/39] hw/riscv/virt.c: rename helper to virt_use_kvm_aia_aplic_imsic()
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Previous patches added several g_hash_table_insert() patterns. Add two
+Similar to the riscv_is_kvm_aia_aplic_imsic() helper from riscv_aplic.c,
-helpers, one for each user hash, to make the code cleaner.
+the existing virt_use_kvm_aia() is testing for KVM aia=aplic-imsic with
 in-kernel irqchip enabled. It is not checking for a generic AIA support.
 Rename the helper to virt_use_kvm_aia_aplic_imsic() to reflect what the
 helper is doing, and use the existing riscv_is_kvm_aia_aplic_imsic() to
 obscure details such as the presence of the in-kernel irqchip.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-15-dbarboza@ventanamicro.com>
+Message-ID: <20241119191706.718860-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 28 ++++++++++++++++------------
+ hw/riscv/virt.c | 12 +++++++-----
-file changed, 16 insertions(+), 12 deletions(-)
+file changed, 7 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/hw/riscv/virt.c
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@
-                                  GUINT_TO_POINTER(ext_offset));
+ #include "hw/virtio/virtio-iommu.h"
  /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 -static bool virt_use_kvm_aia(RISCVVirtState *s)
 +static bool virt_use_kvm_aia_aplic_imsic(RISCVVirtAIAType aia_type)
  {
 -    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +
 +    return riscv_is_kvm_aia_aplic_imsic(msimode);
  }
-+static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
+ static bool virt_aclint_allowed(void)
-+{
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-+    g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
+         *msi_pcie_phandle = msi_s_phandle;
 +                        (gpointer)value);
 +}
 +
 +static void cpu_misa_ext_add_user_opt(uint32_t bit, bool value)
 +{
 +    g_hash_table_insert(misa_ext_user_opts, GUINT_TO_POINTER(bit),
 +                        (gpointer)value);
 +}
 +
  static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
                                       bool enabled)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
          return;
      }
--    g_hash_table_insert(misa_ext_user_opts,
+-    /* KVM AIA only has one APLIC instance */
--                        GUINT_TO_POINTER(misa_bit),
+-    if (kvm_enabled() && virt_use_kvm_aia(s)) {
--                        (gpointer)value);
++    /* KVM AIA aplic-imsic only has one APLIC instance */
-+    cpu_misa_ext_add_user_opt(misa_bit, value);
++    if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
+         create_fdt_socket_aplic(s, memmap, 0,
-     prev_val = env->misa_ext & misa_bit;
+                                 msi_m_phandle, msi_s_phandle, phandle,
+                                 &intc_phandles[0], xplic_phandles,
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
              continue;
          }
--        g_hash_table_insert(misa_ext_user_opts,
--                            GUINT_TO_POINTER(bit),
--                            (gpointer)value);
-+        cpu_misa_ext_add_user_opt(bit, profile->enabled);
-         riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
      }
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+-    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-             cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
++    if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
-         }
+         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
+                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
--        g_hash_table_insert(multi_ext_user_opts,
+                              memmap[VIRT_APLIC_S].base,
 -                            GUINT_TO_POINTER(ext_offset),
 -                            (gpointer)profile->enabled);
 +        cpu_cfg_ext_add_user_opt(ext_offset, profile->enabled);
          isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
                      multi_ext_cfg->name, lower);
      }
 -    g_hash_table_insert(multi_ext_user_opts,
 -                        GUINT_TO_POINTER(multi_ext_cfg->offset),
 -                        (gpointer)value);
 +    cpu_cfg_ext_add_user_opt(multi_ext_cfg->offset, value);
      prev_val = isa_ext_is_enabled(cpu, multi_ext_cfg->offset);
 --
-.43.0
+.47.1

-[PULL 55/65] target/riscv/kvm.c: remove group setting of KVM AIA if the machine only has 1 socket
+[PULL 14/39] target/riscv/kvm: consider irqchip_split() in aia_create()
-From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The emulated AIA within the Linux kernel restores the HART index
+Before adding support to kernel-irqchip=split when using KVM AIA we need
-of the IMSICs according to the configured AIA settings. During
+to change how we create the in-kernel AIA device.
 this process, the group setting is used only when the machine
 partitions harts into groups. It's unnecessary to set the group
 configuration if the machine has only one socket, as its address
 space might not contain the group shift.
-Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+In the use case we have so far, i.e. in-kernel irqchip without split
-Reviewed-by: Jim Shu <jim.shu@sifive.com>
+mode, both the s-mode APLIC and IMSIC controllers are provided by the
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+irqchip. In irqchip_split() mode we'll emulate the s-mode APLIC
-Message-ID: <20231218090543.22353-2-yongxuan.wang@sifive.com>
+controller, which will send MSIs to the in-kernel IMSIC controller. To
 do that we need to change kvm_riscv_aia_create() to not create the
 in-kernel s-mode APLIC controller.
 In the kernel source arch/riscv/kvm/aia_aplic.c, function
 kvm_riscv_aia_aplic_init(), we verify that the APLIC controller won't be
 instantiated by KVM if we do not set 'nr_sources', which is set via
 KVM_DEV_RISCV_AIA_CONFIG_SRCS. For QEMU this means that we should not
 set 'aia_irq_num' during kvm_riscv_aia_create() in irqchip_split() mode.
 In this same condition, skip KVM_DEV_RISCV_AIA_ADDR_APLIC as well since
 it is used to set the base address for the in-kernel APLIC controller.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20241119191706.718860-5-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 31 +++++++++++++++++--------------
+ target/riscv/kvm/kvm-cpu.c | 38 +++++++++++++++++++++++---------------
-file changed, 17 insertions(+), 14 deletions(-)
+file changed, 23 insertions(+), 15 deletions(-)
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
 @@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-         exit(1);
+         }
      }
--    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 -    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
--                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+-                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
--                            &socket_bits, true, NULL);
+-                            &aia_irq_num, true, NULL);
 -    if (ret < 0) {
--        error_report("KVM AIA: failed to set group_bits");
+-        error_report("KVM AIA: failed to set number of input irq lines");
 -        exit(1);
 -    }
++    /*
--    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
++     * Skip APLIC creation in KVM if we're running split mode.
--                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
++     * This is done by leaving KVM_DEV_RISCV_AIA_CONFIG_SRCS
--                            &group_shift, true, NULL);
++     * unset. We can also skip KVM_DEV_RISCV_AIA_ADDR_APLIC
--    if (ret < 0) {
++     * since KVM won't be using it.
--        error_report("KVM AIA: failed to set group_shift");
++     */
--        exit(1);
++    if (!kvm_kernel_irqchip_split()) {
 +    if (socket_count > 1) {
 +        socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 +        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
++                                KVM_DEV_RISCV_AIA_CONFIG_SRCS,
-+                                &socket_bits, true, NULL);
++                                &aia_irq_num, true, NULL);
 +        if (ret < 0) {
-+            error_report("KVM AIA: failed to set group_bits");
++            error_report("KVM AIA: failed to set number of input irq lines");
 +            exit(1);
 +        }
 +
-+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
++        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
-+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
++                                KVM_DEV_RISCV_AIA_ADDR_APLIC,
-+                                &group_shift, true, NULL);
++                                &aplic_base, true, NULL);
 +        if (ret < 0) {
-+            error_report("KVM AIA: failed to set group_shift");
++            error_report("KVM AIA: failed to set the base address of APLIC");
 +            exit(1);
 +        }
++     }
+     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                             KVM_DEV_RISCV_AIA_CONFIG_IDS,
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+         exit(1);
      }
-     guest_bits = guest_num == 0 ? 0 :
+-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 -                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
 -                            &aplic_base, true, NULL);
 -    if (ret < 0) {
 -        error_report("KVM AIA: failed to set the base address of APLIC");
 -        exit(1);
 -    }
 -
      for (socket = 0; socket < socket_count; socket++) {
          socket_imsic_base = imsic_base + socket * (1U << group_shift);
          hart_count = riscv_socket_hart_count(machine, socket);
 --
-.43.0
+.47.1

-[PULL 44/65] target/riscv/tcg: validate profiles during finalize
+[PULL 15/39] hw/riscv/virt.c, riscv_aplic.c: add 'emulated_aplic' helpers
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Enabling a profile and then disabling some of its mandatory extensions
+The current logic to determine if we don't need an emulated APLIC
-is a valid use. It can be useful for debugging and testing. But the
+controller, i.e. KVM will provide for us, is to determine if we're
-common expected use of enabling a profile is to enable all its mandatory
+running KVM, with in-kernel irqchip support, and running
-extensions.
+aia=aplic-imsic. This is modelled by riscv_is_kvm_aia_aplic_imsic() and
 virt_use_kvm_aia_aplic_imsic().
-Add an user warning when mandatory extensions from an enabled profile
+This won't suffice to support irqchip_split() mode: it will match
-are disabled in the command line. We're also going to disable the
+exactly the same conditions as the one above, but setting the irqchip to
-profile flag in this case since the profile must include all the
+'split' mode will now require us to emulate an APLIC s-mode controller,
-mandatory extensions. This flag can be exposed by QMP to indicate the
+like we're doing with 'aia=aplic'.
 actual profile state after the CPU is realized.
-After this patch, this will throw warnings:
+Create a new riscv_use_emulated_aplic() helper that will encapsulate
+this logic. Replace the uses of "riscv_is_kvm_aia_aplic_imsic()" with
--cpu rv64,rva22u64=true,zihintpause=false,zicbom=false,zicboz=false
+this helper every time we're taking a decision on emulate an APLIC
+controller or not. Do the same in virt.c with virt_use_emulated_aplic().
 qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zihintpause
 qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicbom
 qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicboz
 Note that the following will NOT throw warnings because the profile is
 being enabled last, hence all its mandatory extensions will be enabled:
 -cpu rv64,zihintpause=false,zicbom=false,zicboz=false,rva22u64=true
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-17-dbarboza@ventanamicro.com>
+Message-ID: <20241119191706.718860-6-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 69 ++++++++++++++++++++++++++++++++++++++
+ include/hw/intc/riscv_aplic.h |  1 +
-file changed, 69 insertions(+)
+ hw/intc/riscv_aplic.c         | 24 +++++++++++++++++++++---
  hw/riscv/virt.c               | 14 ++++++++++++--
 files changed, 34 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+diff --git a/include/hw/intc/riscv_aplic.h b/include/hw/intc/riscv_aplic.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
+--- a/include/hw/intc/riscv_aplic.h
-+++ b/target/riscv/tcg/tcg-cpu.c
++++ b/include/hw/intc/riscv_aplic.h
-@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ struct RISCVAPLICState {
-     g_assert_not_reached();
  void riscv_aplic_add_child(DeviceState *parent, DeviceState *child);
  bool riscv_is_kvm_aia_aplic_imsic(bool msimode);
 +bool riscv_use_emulated_aplic(bool msimode);
  DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
 diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_aplic.c
 +++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
  #include "target/riscv/cpu.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 +#include "sysemu/tcg.h"
  #include "kvm/kvm_riscv.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ bool riscv_is_kvm_aia_aplic_imsic(bool msimode)
      return kvm_irqchip_in_kernel() && msimode;
  }
-+static const char *cpu_cfg_ext_get_name(uint32_t ext_offset)
++bool riscv_use_emulated_aplic(bool msimode)
 +{
-+    const RISCVCPUMultiExtConfig *feat;
++#ifdef CONFIG_KVM
-+    const RISCVIsaExtData *edata;
++    if (tcg_enabled()) {
-+
++        return true;
 +    for (edata = isa_edata_arr; edata->name != NULL; edata++) {
 +        if (edata->ext_enable_offset == ext_offset) {
 +            return edata->name;
 +        }
 +    }
 +
-+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
++    if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
-+        if (feat->offset == ext_offset) {
++        return true;
 +            return feat->name;
 +        }
 +    }
 +
-+    g_assert_not_reached();
++    return kvm_kernel_irqchip_split();
 +#else
 +    return true;
 +#endif
 +}
 +
- static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
+ static bool riscv_aplic_irq_rectified_val(RISCVAPLICState *aplic,
                                            uint32_t irq)
  {
-     const RISCVCPUMultiExtConfig *feat;
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+     uint32_t i;
-     riscv_cpu_disable_priv_spec_isa_exts(cpu);
+     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 -    if (!riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
 +    if (riscv_use_emulated_aplic(aplic->msimode)) {
          aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
          aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
          aplic->state = g_new0(uint32_t, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        if (kvm_enabled() && riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
 +        if (kvm_enabled() && !riscv_use_emulated_aplic(aplic->msimode)) {
              qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
          } else {
              qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
 +    if (riscv_use_emulated_aplic(msimode)) {
          sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
      }
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static bool virt_use_kvm_aia_aplic_imsic(RISCVVirtAIAType aia_type)
      return riscv_is_kvm_aia_aplic_imsic(msimode);
  }
-+static void riscv_cpu_validate_profile(RISCVCPU *cpu,
++static bool virt_use_emulated_aplic(RISCVVirtAIAType aia_type)
 +                                       RISCVCPUProfile *profile)
 +{
-+    const char *warn_msg = "Profile %s mandates disabled extension %s";
++    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +    bool send_warn = profile->user_set && profile->enabled;
 +    bool profile_impl = true;
 +    int i;
 +
-+    for (i = 0; misa_bits[i] != 0; i++) {
++    return riscv_use_emulated_aplic(msimode);
 +        uint32_t bit = misa_bits[i];
 +
 +        if (!(profile->misa_ext & bit)) {
 +            continue;
 +        }
 +
 +        if (!riscv_has_ext(&cpu->env, bit)) {
 +            profile_impl = false;
 +
 +            if (send_warn) {
 +                warn_report(warn_msg, profile->name,
 +                            riscv_get_misa_ext_name(bit));
 +            }
 +        }
 +    }
 +
 +    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
 +        int ext_offset = profile->ext_offsets[i];
 +
 +        if (!isa_ext_is_enabled(cpu, ext_offset)) {
 +            profile_impl = false;
 +
 +            if (send_warn) {
 +                warn_report(warn_msg, profile->name,
 +                            cpu_cfg_ext_get_name(ext_offset));
 +            }
 +        }
 +    }
 +
 +    profile->enabled = profile_impl;
 +}
 +
-+static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
+ static bool virt_aclint_allowed(void)
 +{
 +    for (int i = 0; riscv_profiles[i] != NULL; i++) {
 +        riscv_cpu_validate_profile(cpu, riscv_profiles[i]);
 +    }
 +}
 +
  void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
  {
-     CPURISCVState *env = &cpu->env;
+     return tcg_enabled() || qtest_enabled();
-@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
          *msi_pcie_phandle = msi_s_phandle;
      }
-     riscv_cpu_update_named_features(cpu);
+-    /* KVM AIA aplic-imsic only has one APLIC instance */
-+    riscv_cpu_validate_profiles(cpu);
+-    if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
++    /*
-     if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
++     * With KVM AIA aplic-imsic, using an irqchip without split
-         /*
++     * mode, we'll use only one APLIC instance.
 +     */
 +    if (!virt_use_emulated_aplic(s->aia_type)) {
          create_fdt_socket_aplic(s, memmap, 0,
                                  msi_m_phandle, msi_s_phandle, phandle,
                                  &intc_phandles[0], xplic_phandles,
 --
-.43.0
+.47.1

-[PULL 46/65] target/riscv: add 'rva22u64' CPU
+[PULL 16/39] hw/intc/riscv_aplic: add kvm_msicfgaddr for split mode aplic-imsic
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This CPU was suggested by Alistair [1] and others during the profile
+The last step to enable KVM AIA aplic-imsic with irqchip in split mode
-design discussions. It consists of the bare 'rv64i' CPU with rva22u64
+is to deal with how MSIs are going to be sent. In our current design we
-enabled by default, like an alias of '-cpu rv64i,rva22u64=true'.
+don't allow an APLIC controller to send MSIs unless it's on m-mode. And
 we also do not allow Supervisor MSI address configuration via the
 'smsiaddrcfg' and 'smsiaddrcfgh' registers unless it's also a m-mode
 APLIC controller.
-Users now have an even easier way of consuming this user-mode profile by
+Add a new RISCVACPLICState attribute called 'kvm_msicfgaddr'. This
-doing '-cpu rva22u64'. Extensions can be enabled/disabled at will on top
+attribute represents the base configuration address for MSIs, in our
-of it.
+case the base addr of the IMSIC controller. This attribute is being set
 only when running irqchip_split() mode with aia=aplic-imsic.
-We can boot Linux with this "user-mode" CPU by doing:
+During riscv_aplic_msi_send() we'll check if the attribute was set to
+skip the check for a m-mode APLIC controller and to change the resulting
--cpu rva22u64,sv39=true,s=true,zifencei=true
+MSI addr by adding kvm_msicfgaddr right before address_space_stl_le().
 [1] https://lore.kernel.org/qemu-riscv/CAKmqyKP7xzZ9Sx=-Lbx2Ob0qCfB7Z+JO944FQ2TQ+49mqo0q_Q@mail.gmail.com/
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20241119191706.718860-7-dbarboza@ventanamicro.com>
 Message-ID: <20231218125334.37184-19-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h     |  1 +
+ include/hw/intc/riscv_aplic.h |  6 +++++
- target/riscv/cpu.c         | 17 +++++++++++++++++
+ hw/intc/riscv_aplic.c         | 42 +++++++++++++++++++++++++++--------
- target/riscv/tcg/tcg-cpu.c |  9 +++++++++
+ hw/riscv/virt.c               |  6 ++++-
-files changed, 27 insertions(+)
+files changed, 44 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
+diff --git a/include/hw/intc/riscv_aplic.h b/include/hw/intc/riscv_aplic.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
+--- a/include/hw/intc/riscv_aplic.h
-+++ b/target/riscv/cpu-qom.h
++++ b/include/hw/intc/riscv_aplic.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct RISCVAPLICState {
- #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
+     uint32_t num_irqs;
- #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
+     bool msimode;
- #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
+     bool mmode;
-+#define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
++
- #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
++    /* To support KVM aia=aplic-imsic with irqchip split mode */
- #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
++    bool kvm_splitmode;
- #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
++    uint32_t kvm_msicfgaddr;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
++    uint32_t kvm_msicfgaddrH;
  };
  void riscv_aplic_add_child(DeviceState *parent, DeviceState *child);
  bool riscv_is_kvm_aia_aplic_imsic(bool msimode);
  bool riscv_use_emulated_aplic(bool msimode);
 +void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr);
  DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
 diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/target/riscv/cpu.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ bool riscv_use_emulated_aplic(bool msimode)
-     DEFINE_PROP_END_OF_LIST(),
+ #endif
- };
+ }
-+#if defined(TARGET_RISCV64)
++void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr)
 +static void rva22u64_profile_cpu_init(Object *obj)
 +{
-+    rv64i_bare_cpu_init(obj);
++#ifdef CONFIG_KVM
 +    if (riscv_use_emulated_aplic(aplic->msimode)) {
 +        aplic->kvm_msicfgaddr = extract64(addr, 0, 32);
 +        aplic->kvm_msicfgaddrH = extract64(addr, 32, 32);
 +    }
 +#endif
 +}
 +
-+    RVA22U64.enabled = true;
+ static bool riscv_aplic_irq_rectified_val(RISCVAPLICState *aplic,
-+}
+                                           uint32_t irq)
-+#endif
+ {
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
      uint32_t lhxs, lhxw, hhxs, hhxw, group_idx, msicfgaddr, msicfgaddrH;
      aplic_m = aplic;
 -    while (aplic_m && !aplic_m->mmode) {
 -        aplic_m = aplic_m->parent;
 -    }
 -    if (!aplic_m) {
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
 -                      __func__);
 -        return;
 +
- static const gchar *riscv_gdb_arch_name(CPUState *cs)
++    if (!aplic->kvm_splitmode) {
- {
++        while (aplic_m && !aplic_m->mmode) {
-     RISCVCPU *cpu = RISCV_CPU(cs);
++            aplic_m = aplic_m->parent;
-@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
++        }
-         .instance_init = initfn            \
++        if (!aplic_m) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
 +                          __func__);
 +            return;
 +        }
      }
-+#define DEFINE_PROFILE_CPU(type_name, initfn) \
+     if (aplic->mmode) {
-+    {                                         \
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
-+        .name = type_name,                    \
+     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
-+        .parent = TYPE_RISCV_BARE_CPU,        \
+     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
-+        .instance_init = initfn               \
 +    if (aplic->kvm_splitmode) {
 +        addr |= aplic->kvm_msicfgaddr;
 +        addr |= ((uint64_t)aplic->kvm_msicfgaddrH << 32);
 +    }
 +
- static const TypeInfo riscv_cpu_type_infos[] = {
+     address_space_stl_le(&address_space_memory, addr,
-     {
+                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
-         .name = TYPE_RISCV_CPU,
+     if (result != MEMTX_OK) {
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
+         memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
-     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
+                               aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
-     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
+         sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
  #endif
  };
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_profiles(Object *cpu_obj)
          object_property_add(cpu_obj, profile->name, "bool",
                              cpu_get_profile, cpu_set_profile,
                              NULL, (void *)profile);
 +
-+        /*
++        if (kvm_enabled()) {
-+         * CPUs might enable a profile right from the start.
++            aplic->kvm_splitmode = true;
 +         * Enable its mandatory extensions right away in this
 +         * case.
 +         */
 +        if (profile->enabled) {
 +            object_property_set_bool(cpu_obj, profile->name, true, NULL);
 +        }
      }
+     /*
+@@ -XXX,XX +XXX,XX @@ static const Property riscv_aplic_properties[] = {
+ static const VMStateDescription vmstate_riscv_aplic = {
+     .name = "riscv_aplic",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
++    .version_id = 2,
++    .minimum_version_id = 2,
+     .fields = (const VMStateField[]) {
+             VMSTATE_UINT32(domaincfg, RISCVAPLICState),
+             VMSTATE_UINT32(mmsicfgaddr, RISCVAPLICState),
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_riscv_aplic = {
+             VMSTATE_UINT32(smsicfgaddr, RISCVAPLICState),
+             VMSTATE_UINT32(smsicfgaddrH, RISCVAPLICState),
+             VMSTATE_UINT32(genmsi, RISCVAPLICState),
++            VMSTATE_UINT32(kvm_msicfgaddr, RISCVAPLICState),
++            VMSTATE_UINT32(kvm_msicfgaddrH, RISCVAPLICState),
+             VMSTATE_VARRAY_UINT32(sourcecfg, RISCVAPLICState,
+                                   num_irqs, 0,
+                                   vmstate_info_uint32, uint32_t),
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/virt.c
++++ b/hw/riscv/virt.c
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
+                                     int base_hartid, int hart_count)
+ {
+     int i;
+-    hwaddr addr;
++    hwaddr addr = 0;
+     uint32_t guest_bits;
+     DeviceState *aplic_s = NULL;
+     DeviceState *aplic_m = NULL;
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
+                                  VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                  msimode, false, aplic_m);
++    if (kvm_enabled() && msimode) {
++        riscv_aplic_set_kvm_msicfgaddr(RISCV_APLIC(aplic_s), addr);
++    }
++
+     return kvm_enabled() ? aplic_s : aplic_m;
  }
 --
-.43.0
+.47.1

-[PULL 37/65] target/riscv/kvm: add 'rva22u64' flag as unavailable
+[PULL 17/39] target/riscv/kvm: remove irqchip_split() restriction
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM does not have the means to support enabling the rva22u64 profile.
+Remove the 'irqchip_split()' restriction in kvm_arch_init() now that
-The main reasons are:
+we have support for "-accel kvm,kernel-irqchip=split".
 - we're missing support for some mandatory rva22u64 extensions in the
   KVM module;
 - we can't make promises about enabling a profile since it all depends
   on host support in the end.
 We'll revisit this decision in the future if needed. For now mark the
 'rva22u64' profile as unavailable when running a KVM CPU:
 $ qemu-system-riscv64 -machine virt,accel=kvm -cpu rv64,rva22u64=true
 qemu-system-riscv64: can't apply global rv64-riscv-cpu.rva22u64=true:
     'rva22u64' is not available with KVM
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20241119191706.718860-8-dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-10-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm/kvm-cpu.c | 7 ++++++-
+ target/riscv/kvm/kvm-cpu.c | 5 -----
-file changed, 6 insertions(+), 1 deletion(-)
+file changed, 5 deletions(-)
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
-     }
+ int kvm_arch_irqchip_create(KVMState *s)
-     if (value) {
+ {
--        error_setg(errp, "extension %s is not available with KVM",
+-    if (kvm_kernel_irqchip_split()) {
-+        error_setg(errp, "'%s' is not available with KVM",
+-        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
-                    propname);
+-        exit(1);
-     }
+-    }
- }
+-
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+     /*
-     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_extensions);
+      * We can create the VAIA using the newer device control API.
-     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_vendor_exts);
+      */
      riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_experimental_exts);
 +
 +   /* We don't have the needed KVM support for profiles */
 +    for (i = 0; riscv_profiles[i] != NULL; i++) {
 +        riscv_cpu_add_kvm_unavail_prop(cpu_obj, riscv_profiles[i]->name);
 +    }
  }
  static int kvm_riscv_get_regs_core(CPUState *cs)
 --
-.43.0
+.47.1

-[PULL 57/65] linux-headers: riscv: add ptrace.h
+[PULL 18/39] docs: update riscv/virt.rst with kernel-irqchip=split support
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM vector support for RISC-V requires the linux-header ptrace.h.
+Also add a new page, docs/specs/riscv-aia.rst, where we're documenting
 the state of AIA support in QEMU w.r.t the controllers being emulated or
 not depending on the AIA and accelerator settings.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218204321.75757-3-dbarboza@ventanamicro.com>
+Message-ID: <20241119191706.718860-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- linux-headers/asm-riscv/ptrace.h | 132 +++++++++++++++++++++++++++++++
+ docs/specs/index.rst       |  1 +
- scripts/update-linux-headers.sh  |   3 +
+ docs/specs/riscv-aia.rst   | 83 ++++++++++++++++++++++++++++++++++++++
-files changed, 135 insertions(+)
+ docs/system/riscv/virt.rst |  7 ++++
- create mode 100644 linux-headers/asm-riscv/ptrace.h
+files changed, 91 insertions(+)
  create mode 100644 docs/specs/riscv-aia.rst
-diff --git a/linux-headers/asm-riscv/ptrace.h b/linux-headers/asm-riscv/ptrace.h
+diff --git a/docs/specs/index.rst b/docs/specs/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/specs/index.rst
 +++ b/docs/specs/index.rst
@@ -XXX,XX +XXX,XX @@ guest hardware that is specific to QEMU.
     rapl-msr
     rocker
     riscv-iommu
 +   riscv-aia
 diff --git a/docs/specs/riscv-aia.rst b/docs/specs/riscv-aia.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/linux-headers/asm-riscv/ptrace.h
++++ b/docs/specs/riscv-aia.rst
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++.. _riscv-aia:
 +/*
 + * Copyright (C) 2012 Regents of the University of California
 + */
 +
-+#ifndef _ASM_RISCV_PTRACE_H
++RISC-V AIA support for RISC-V machines
-+#define _ASM_RISCV_PTRACE_H
++======================================
 +
-+#ifndef __ASSEMBLY__
++AIA (Advanced Interrupt Architecture) support is implemented in the ``virt``
 +RISC-V machine for TCG and KVM accelerators.
 +
-+#include <linux/types.h>
++The support consists of two main modes:
 +
-+#define PTRACE_GETFDPIC        33
++- "aia=aplic": adds one or more APLIC (Advanced Platform Level Interrupt Controller)
 +  devices
 +- "aia=aplic-imsic": adds one or more APLIC device and an IMSIC (Incoming MSI
 +   Controller) device for each CPU
 +
-+#define PTRACE_GETFDPIC_EXEC    0
++From an user standpoint, these modes will behave the same regardless of the accelerator
-+#define PTRACE_GETFDPIC_INTERP    1
++used.  From a developer standpoint the accelerator settings will change what it being
 +emulated in userspace versus what is being emulated by an in-kernel irqchip.
 +
-+/*
++When running TCG, all controllers are emulated in userspace, including machine mode
-+ * User-mode register state for core dumps, ptrace, sigcontext
++(m-mode) APLIC and IMSIC (when applicable).
 + *
 + * This decouples struct pt_regs from the userspace ABI.
 + * struct user_regs_struct must form a prefix of struct pt_regs.
 + */
 +struct user_regs_struct {
 +    unsigned long pc;
 +    unsigned long ra;
 +    unsigned long sp;
 +    unsigned long gp;
 +    unsigned long tp;
 +    unsigned long t0;
 +    unsigned long t1;
 +    unsigned long t2;
 +    unsigned long s0;
 +    unsigned long s1;
 +    unsigned long a0;
 +    unsigned long a1;
 +    unsigned long a2;
 +    unsigned long a3;
 +    unsigned long a4;
 +    unsigned long a5;
 +    unsigned long a6;
 +    unsigned long a7;
 +    unsigned long s2;
 +    unsigned long s3;
 +    unsigned long s4;
 +    unsigned long s5;
 +    unsigned long s6;
 +    unsigned long s7;
 +    unsigned long s8;
 +    unsigned long s9;
 +    unsigned long s10;
 +    unsigned long s11;
 +    unsigned long t3;
 +    unsigned long t4;
 +    unsigned long t5;
 +    unsigned long t6;
 +};
 +
-+struct __riscv_f_ext_state {
++When running KVM:
 +    __u32 f[32];
 +    __u32 fcsr;
 +};
 +
-+struct __riscv_d_ext_state {
++- no m-mode is provided, so there is no m-mode APLIC or IMSIC emulation regardless of
-+    __u64 f[32];
++  the AIA mode chosen
-+    __u32 fcsr;
++- with "aia=aplic", s-mode APLIC will be emulated by userspace
-+};
++- with "aia=aplic-imsic" there are two possibilities.  If no additional KVM option
 +  is provided there will be no APLIC or IMSIC emulation in userspace, and the virtual
 +  machine will use the provided in-kernel APLIC and IMSIC controllers.  If the user
 +  chooses to use the irqchip in split mode via "-accel kvm,kernel-irqchip=split",
 +  s-mode APLIC will be emulated while using the s-mode IMSIC from the irqchip
 +
-+struct __riscv_q_ext_state {
++The following table summarizes how the AIA and accelerator options defines what
-+    __u64 f[64] __attribute__((aligned(16)));
++we will emulate in userspace:
 +    __u32 fcsr;
 +    /*
 +     * Reserved for expansion of sigcontext structure.  Currently zeroed
 +     * upon signal, and must be zero upon sigreturn.
 +     */
 +    __u32 reserved[3];
 +};
 +
-+struct __riscv_ctx_hdr {
-+    __u32 magic;
-+    __u32 size;
-+};
 +
-+struct __riscv_extra_ext_header {
++.. list-table:: How AIA and accel options changes controller emulation
-+    __u32 __padding[129] __attribute__((aligned(16)));
++   :widths: 25 25 25 25 25 25 25
-+    /*
++   :header-rows: 1
 +     * Reserved for expansion of sigcontext structure.  Currently zeroed
 +     * upon signal, and must be zero upon sigreturn.
 +     */
 +    __u32 reserved;
 +    struct __riscv_ctx_hdr hdr;
 +};
 +
-+union __riscv_fp_state {
++   * - Accel
-+    struct __riscv_f_ext_state f;
++     - Accel props
-+    struct __riscv_d_ext_state d;
++     - AIA type
-+    struct __riscv_q_ext_state q;
++     - APLIC m-mode
-+};
++     - IMSIC m-mode
 +     - APLIC s-mode
 +     - IMSIC s-mode
 +   * - tcg
 +     - ---
 +     - aplic
 +     - emul
 +     - n/a
 +     - emul
 +     - n/a
 +   * - tcg
 +     - ---
 +     - aplic-imsic
 +     - emul
 +     - emul
 +     - emul
 +     - emul
 +   * - kvm
 +     - ---
 +     - aplic
 +     - n/a
 +     - n/a
 +     - emul
 +     - n/a
 +   * - kvm
 +     - none
 +     - aplic-imsic
 +     - n/a
 +     - n/a
 +     - in-kernel
 +     - in-kernel
 +   * - kvm
 +     - irqchip=split
 +     - aplic-imsic
 +     - n/a
 +     - n/a
 +     - emul
 +     - in-kernel
 diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/riscv/virt.rst
 +++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
    MSIs. When not specified, this option is assumed to be "none" which selects
    SiFive PLIC to handle wired interrupts.
 +  This option also interacts with '-accel kvm'.  When using "aia=aplic-imsic"
 +  with KVM, it is possible to set the use of the kernel irqchip in split mode
 +  by using "-accel kvm,kernel-irqchip=split".  In this case the ``virt`` machine
 +  will emulate the APLIC controller instead of using the APLIC controller from
 +  the irqchip.  See :ref:`riscv-aia` for more details on all available AIA
 +  modes.
 +
-+struct __riscv_v_ext_state {
+ - aia-guests=nnn
-+    unsigned long vstart;
-+    unsigned long vl;
+   The number of per-HART VS-level AIA IMSIC pages to be emulated for a guest
 +    unsigned long vtype;
 +    unsigned long vcsr;
 +    unsigned long vlenb;
 +    void *datap;
 +    /*
 +     * In signal handler, datap will be set a correct user stack offset
 +     * and vector registers will be copied to the address of datap
 +     * pointer.
 +     */
 +};
 +
 +struct __riscv_v_regset_state {
 +    unsigned long vstart;
 +    unsigned long vl;
 +    unsigned long vtype;
 +    unsigned long vcsr;
 +    unsigned long vlenb;
 +    char vreg[];
 +};
 +
 +/*
 + * According to spec: The number of bits in a single vector register,
 + * VLEN >= ELEN, which must be a power of 2, and must be no greater than
 + * 2^16 = 65536bits = 8192bytes
 + */
 +#define RISCV_MAX_VLENB (8192)
 +
 +#endif /* __ASSEMBLY__ */
 +
 +#endif /* _ASM_RISCV_PTRACE_H */
 diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
 index XXXXXXX..XXXXXXX 100755
 --- a/scripts/update-linux-headers.sh
 +++ b/scripts/update-linux-headers.sh
@@ -XXX,XX +XXX,XX @@ for arch in $ARCHLIST; do
          cp_portable "$tmpdir/bootparam.h" \
                      "$output/include/standard-headers/asm-$arch"
      fi
 +    if [ $arch = riscv ]; then
 +        cp "$tmpdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
 +    fi
  done
  rm -rf "$output/linux-headers/linux"
 --
-.43.0
+.47.1

-[PULL 13/65] hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
+[PULL 19/39] hw/riscv: Add Microblaze V generic board
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
-RISC-V also needs to create the virtio in DSDT in the same way as ARM.
+Add a basic board with interrupt controller (intc), timer, serial
-So, instead of duplicating the code, move this function to the device
+(uartlite), small memory called LMB@0 (128kB) and DDR@0x80000000
-specific file which is common across architectures.
+(configured via command line eg. -m 2g).
+This is basic configuration which matches HW generated out of AMD Vivado
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
+(design tools). But initial configuration is going beyond what it is
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+configured by default because validation should be done on other
 configurations too. That's why wire also additional uart16500, axi
 ethernet(with axi dma).
 GPIOs, i2c and qspi is also listed for completeness.
 IRQ map is: (addr)
 - timer (0x41c00000)
 - uartlite (0x40600000)
 - i2c (0x40800000)
 - qspi (0x44a00000)
 - uart16550 (0x44a10000)
 - emaclite (0x40e00000)
 - timer2 (0x41c10000)
 - axi emac (0x40c00000)
 - axi dma (0x41e00000)
 - axi dma
 - gpio (0x40000000)
 - gpio2 (0x40010000)
 - gpio3 (0x40020000)
 Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
 Signed-off-by: Michal Simek <michal.simek@amd.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20241125134739.18189-1-sai.pavan.boddu@amd.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-3-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/virtio/virtio-acpi.h | 16 ++++++++++++++++
+ MAINTAINERS                                |   6 +
- hw/arm/virt-acpi-build.c        | 32 ++++----------------------------
+ docs/system/riscv/microblaze-v-generic.rst |  42 +++++
- hw/virtio/virtio-acpi.c         | 33 +++++++++++++++++++++++++++++++++
+ docs/system/target-riscv.rst               |   1 +
- hw/virtio/meson.build           |  1 +
+ hw/riscv/microblaze-v-generic.c            | 184 +++++++++++++++++++++
-files changed, 54 insertions(+), 28 deletions(-)
+ hw/riscv/Kconfig                           |   8 +
- create mode 100644 include/hw/virtio/virtio-acpi.h
+ hw/riscv/meson.build                       |   1 +
- create mode 100644 hw/virtio/virtio-acpi.c
+files changed, 242 insertions(+)
+ create mode 100644 docs/system/riscv/microblaze-v-generic.rst
-diff --git a/include/hw/virtio/virtio-acpi.h b/include/hw/virtio/virtio-acpi.h
+ create mode 100644 hw/riscv/microblaze-v-generic.c
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: docs/system/riscv/sifive_u.rst
  F: hw/*/*sifive*.c
  F: include/hw/*/*sifive*.h
 +AMD Microblaze-V Generic Board
 +M: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
 +S: Maintained
 +F: hw/riscv/microblaze-v-generic.c
 +F: docs/system/riscv/microblaze-v-generic.rst
 +
  RX Machines
  -----------
  rx-gdbsim
 diff --git a/docs/system/riscv/microblaze-v-generic.rst b/docs/system/riscv/microblaze-v-generic.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/virtio/virtio-acpi.h
++++ b/docs/system/riscv/microblaze-v-generic.rst
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0+ */
++Microblaze-V generic board (``amd-microblaze-v-generic``)
-+/*
++=========================================================
-+ * ACPI support for virtio
++The AMD MicroBlaze™ V processor is a soft-core RISC-V processor IP for AMD
-+ */
++adaptive SoCs and FPGAs. The MicroBlaze™ V processor is based on the 32-bit (or
-+
++64-bit) RISC-V instruction set architecture (ISA) and contains interfaces
-+#ifndef VIRTIO_ACPI_H
++compatible with the classic MicroBlaze™ V processor (i.e it is a drop in
-+#define VIRTIO_ACPI_H
++replacement for the classic MicroBlaze™ processor in existing RTL designs).
-+
++More information can be found in below document.
-+#include "qemu/osdep.h"
++
-+#include "exec/hwaddr.h"
++https://docs.amd.com/r/en-US/ug1629-microblaze-v-user-guide/MicroBlaze-V-Architecture
 +
-+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr virtio_mmio_base,
++The MicroBlaze™ V generic board in QEMU has following supported devices:
-+                          const hwaddr virtio_mmio_size, uint32_t mmio_irq,
++
-+                          long int start_index, int num);
++    - timer
-+
++    - uartlite
-+#endif
++    - uart16550
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
++    - emaclite
 +    - timer2
 +    - axi emac
 +    - axi dma
 +
 +The MicroBlaze™ V core in QEMU has the following configuration:
 +
 +    - RV32I base integer instruction set
 +    - "Zicsr" Control and Status register instructions
 +    - "Zifencei" instruction-fetch
 +    - Extensions: m, a, f, c
 +
 +Running
 +"""""""
 +Below is an example command line for launching mainline U-boot
 +(xilinx_mbv32_defconfig) on the Microblaze-V generic board.
 +
 +.. code-block:: bash
 +
 +   $ qemu-system-riscv32 -M amd-microblaze-v-generic \
 +     -display none \
 +     -device loader,addr=0x80000000,file=u-boot-spl.bin,cpu-num=0 \
 +     -device loader,addr=0x80200000,file=u-boot.img \
 +     -serial mon:stdio \
 +     -device loader,addr=0x83000000,file=system.dtb \
 +     -m 2g
 diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/docs/system/target-riscv.rst
-+++ b/hw/arm/virt-acpi-build.c
++++ b/docs/system/target-riscv.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
- #include "migration/vmstate.h"
+ .. toctree::
- #include "hw/acpi/ghes.h"
+    :maxdepth: 1
- #include "hw/acpi/viot.h"
-+#include "hw/virtio/virtio-acpi.h"
++   riscv/microblaze-v-generic
+    riscv/microchip-icicle-kit
- #define ARM_SPI_BASE 32
+    riscv/shakti-c
+    riscv/sifive_u
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
+diff --git a/hw/riscv/microblaze-v-generic.c b/hw/riscv/microblaze-v-generic.c
      aml_append(scope, dev);
  }
 -static void acpi_dsdt_add_virtio(Aml *scope,
 -                                 const MemMapEntry *virtio_mmio_memmap,
 -                                 uint32_t mmio_irq, int num)
 -{
 -    hwaddr base = virtio_mmio_memmap->base;
 -    hwaddr size = virtio_mmio_memmap->size;
 -    int i;
 -
 -    for (i = 0; i < num; i++) {
 -        uint32_t irq = mmio_irq + i;
 -        Aml *dev = aml_device("VR%02u", i);
 -        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
 -        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
 -        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
 -
 -        Aml *crs = aml_resource_template();
 -        aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
 -        aml_append(crs,
 -                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
 -                                 AML_EXCLUSIVE, &irq, 1));
 -        aml_append(dev, aml_name_decl("_CRS", crs));
 -        aml_append(scope, dev);
 -        base += size;
 -    }
 -}
 -
  static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
                                uint32_t irq, VirtMachineState *vms)
  {
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
          acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
      }
      fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
 -    acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
 -                    (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
 +    virtio_acpi_dsdt_add(scope, memmap[VIRT_MMIO].base, memmap[VIRT_MMIO].size,
 +                         (irqmap[VIRT_MMIO] + ARM_SPI_BASE),
 +                         0, NUM_VIRTIO_TRANSPORTS);
      acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
      if (vms->acpi_dev) {
          build_ged_aml(scope, "\\_SB."GED_DEVICE,
 diff --git a/hw/virtio/virtio-acpi.c b/hw/virtio/virtio-acpi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/virtio/virtio-acpi.c
++++ b/hw/riscv/microblaze-v-generic.c
 @@ -XXX,XX +XXX,XX @@
-+// SPDX-License-Identifier: GPL-2.0+
 +/*
-+ * virtio ACPI Support
++ * QEMU model of Microblaze V generic board.
 + *
++ * based on hw/microblaze/petalogix_ml605_mmu.c
++ *
++ * Copyright (c) 2011 Michal Simek <monstr@monstr.eu>
++ * Copyright (c) 2011 PetaLogix
++ * Copyright (c) 2009 Edgar E. Iglesias.
++ * Copyright (C) 2024, Advanced Micro Devices, Inc.
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Written by Sai Pavan Boddu <sai.pavan.boddu@amd.com
++ *     and by Michal Simek <michal.simek@amd.com>.
 + */
 +
-+#include "hw/virtio/virtio-acpi.h"
++#include "qemu/osdep.h"
-+#include "hw/acpi/aml-build.h"
++#include "qemu/units.h"
-+
++#include "qapi/error.h"
-+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr base, const hwaddr size,
++#include "cpu.h"
-+                          uint32_t mmio_irq, long int start_index, int num)
++#include "hw/sysbus.h"
 +#include "sysemu/sysemu.h"
 +#include "net/net.h"
 +#include "hw/boards.h"
 +#include "hw/char/serial-mm.h"
 +#include "exec/address-spaces.h"
 +#include "hw/char/xilinx_uartlite.h"
 +#include "hw/misc/unimp.h"
 +
 +#define LMB_BRAM_SIZE (128 * KiB)
 +#define MEMORY_BASEADDR 0x80000000
 +#define INTC_BASEADDR 0x41200000
 +#define TIMER_BASEADDR 0x41c00000
 +#define TIMER_BASEADDR2 0x41c10000
 +#define UARTLITE_BASEADDR 0x40600000
 +#define ETHLITE_BASEADDR 0x40e00000
 +#define UART16550_BASEADDR 0x44a10000
 +#define AXIENET_BASEADDR 0x40c00000
 +#define AXIDMA_BASEADDR 0x41e00000
 +#define GPIO_BASEADDR 0x40000000
 +#define GPIO_BASEADDR2 0x40010000
 +#define GPIO_BASEADDR3 0x40020000
 +#define I2C_BASEADDR 0x40800000
 +#define QSPI_BASEADDR 0x44a00000
 +
 +#define TIMER_IRQ           0
 +#define UARTLITE_IRQ        1
 +#define UART16550_IRQ       4
 +#define ETHLITE_IRQ         5
 +#define TIMER_IRQ2          6
 +#define AXIENET_IRQ         7
 +#define AXIDMA_IRQ1         8
 +#define AXIDMA_IRQ0         9
 +
 +static void mb_v_generic_init(MachineState *machine)
 +{
-+    hwaddr virtio_base = base;
++    ram_addr_t ram_size = machine->ram_size;
-+    uint32_t irq = mmio_irq;
++    DeviceState *dev, *dma, *eth0;
-+    long int i;
++    Object *ds, *cs;
-+
++    int i;
-+    for (i = start_index; i < start_index + num; i++) {
++    RISCVCPU *cpu;
-+        Aml *dev = aml_device("VR%02u", (unsigned)i);
++    hwaddr ddr_base = MEMORY_BASEADDR;
-+        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
++    MemoryRegion *phys_lmb_bram = g_new(MemoryRegion, 1);
-+        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
++    MemoryRegion *phys_ram = g_new(MemoryRegion, 1);
-+        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
++    qemu_irq irq[32];
-+
++    MemoryRegion *sysmem = get_system_memory();
-+        Aml *crs = aml_resource_template();
++
-+        aml_append(crs, aml_memory32_fixed(virtio_base, size, AML_READ_WRITE));
++    cpu = RISCV_CPU(object_new(machine->cpu_type));
-+        aml_append(crs,
++    object_property_set_bool(OBJECT(cpu), "h", false, NULL);
-+                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
++    object_property_set_bool(OBJECT(cpu), "d", false, NULL);
-+                                 AML_EXCLUSIVE, &irq, 1));
++    qdev_realize(DEVICE(cpu), NULL, &error_abort);
-+        aml_append(dev, aml_name_decl("_CRS", crs));
++    /* Attach emulated BRAM through the LMB.  */
-+        aml_append(scope, dev);
++    memory_region_init_ram(phys_lmb_bram, NULL,
-+        virtio_base += size;
++                           "mb_v.lmb_bram", LMB_BRAM_SIZE,
-+        irq++;
++                           &error_fatal);
 +    memory_region_add_subregion(sysmem, 0x00000000, phys_lmb_bram);
 +
 +    memory_region_init_ram(phys_ram, NULL, "mb_v.ram",
 +                           ram_size, &error_fatal);
 +    memory_region_add_subregion(sysmem, ddr_base, phys_ram);
 +
 +    dev = qdev_new("xlnx.xps-intc");
 +    qdev_prop_set_uint32(dev, "kind-of-intr",
 +                         1 << UARTLITE_IRQ);
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, INTC_BASEADDR);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(DEVICE(cpu), 11));
 +    for (i = 0; i < 32; i++) {
 +        irq[i] = qdev_get_gpio_in(dev, i);
 +    }
++
++    /* Uartlite */
++    dev = qdev_new(TYPE_XILINX_UARTLITE);
++    qdev_prop_set_chr(dev, "chardev", serial_hd(0));
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
++    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, UARTLITE_BASEADDR);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[UARTLITE_IRQ]);
++
++    /* Full uart */
++    serial_mm_init(sysmem, UART16550_BASEADDR + 0x1000, 2,
++                   irq[UART16550_IRQ], 115200, serial_hd(1),
++                   DEVICE_LITTLE_ENDIAN);
++
++    /* 2 timers at irq 0 @ 100 Mhz.  */
++    dev = qdev_new("xlnx.xps-timer");
++    qdev_prop_set_uint32(dev, "one-timer-only", 0);
++    qdev_prop_set_uint32(dev, "clock-frequency", 100000000);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
++    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, TIMER_BASEADDR);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[TIMER_IRQ]);
++
++    /* 2 timers at irq 3 @ 100 Mhz.  */
++    dev = qdev_new("xlnx.xps-timer");
++    qdev_prop_set_uint32(dev, "one-timer-only", 0);
++    qdev_prop_set_uint32(dev, "clock-frequency", 100000000);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
++    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, TIMER_BASEADDR2);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[TIMER_IRQ2]);
++
++    /* Emaclite */
++    dev = qdev_new("xlnx.xps-ethernetlite");
++    qemu_configure_nic_device(dev, true, NULL);
++    qdev_prop_set_uint32(dev, "tx-ping-pong", 0);
++    qdev_prop_set_uint32(dev, "rx-ping-pong", 0);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
++    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, ETHLITE_BASEADDR);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[ETHLITE_IRQ]);
++
++    /* axi ethernet and dma initialization. */
++    eth0 = qdev_new("xlnx.axi-ethernet");
++    dma = qdev_new("xlnx.axi-dma");
++
++    /* FIXME: attach to the sysbus instead */
++    object_property_add_child(qdev_get_machine(), "xilinx-eth", OBJECT(eth0));
++    object_property_add_child(qdev_get_machine(), "xilinx-dma", OBJECT(dma));
++
++    ds = object_property_get_link(OBJECT(dma),
++                                  "axistream-connected-target", NULL);
++    cs = object_property_get_link(OBJECT(dma),
++                                  "axistream-control-connected-target", NULL);
++    qemu_configure_nic_device(eth0, true, NULL);
++    qdev_prop_set_uint32(eth0, "rxmem", 0x1000);
++    qdev_prop_set_uint32(eth0, "txmem", 0x1000);
++    object_property_set_link(OBJECT(eth0), "axistream-connected", ds,
++                             &error_abort);
++    object_property_set_link(OBJECT(eth0), "axistream-control-connected", cs,
++                             &error_abort);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(eth0), &error_fatal);
++    sysbus_mmio_map(SYS_BUS_DEVICE(eth0), 0, AXIENET_BASEADDR);
++    sysbus_connect_irq(SYS_BUS_DEVICE(eth0), 0, irq[AXIENET_IRQ]);
++
++    ds = object_property_get_link(OBJECT(eth0),
++                                  "axistream-connected-target", NULL);
++    cs = object_property_get_link(OBJECT(eth0),
++                                  "axistream-control-connected-target", NULL);
++    qdev_prop_set_uint32(dma, "freqhz", 100000000);
++    object_property_set_link(OBJECT(dma), "axistream-connected", ds,
++                             &error_abort);
++    object_property_set_link(OBJECT(dma), "axistream-control-connected", cs,
++                             &error_abort);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(dma), &error_fatal);
++    sysbus_mmio_map(SYS_BUS_DEVICE(dma), 0, AXIDMA_BASEADDR);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dma), 0, irq[AXIDMA_IRQ0]);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dma), 1, irq[AXIDMA_IRQ1]);
++
++    /* unimplemented devices */
++    create_unimplemented_device("gpio", GPIO_BASEADDR, 0x10000);
++    create_unimplemented_device("gpio2", GPIO_BASEADDR2, 0x10000);
++    create_unimplemented_device("gpio3", GPIO_BASEADDR3, 0x10000);
++    create_unimplemented_device("i2c", I2C_BASEADDR, 0x10000);
++    create_unimplemented_device("qspi", QSPI_BASEADDR, 0x10000);
 +}
-diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
++
 +static void mb_v_generic_machine_init(MachineClass *mc)
 +{
 +    mc->desc = "AMD Microblaze-V generic platform";
 +    mc->init = mb_v_generic_init;
 +    mc->min_cpus = 1;
 +    mc->max_cpus = 1;
 +    mc->default_cpu_type = TYPE_RISCV_CPU_BASE;
 +    mc->default_cpus = 1;
 +}
 +
 +DEFINE_MACHINE("amd-microblaze-v-generic", mb_v_generic_machine_init)
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/meson.build
+--- a/hw/riscv/Kconfig
-+++ b/hw/virtio/meson.build
++++ b/hw/riscv/Kconfig
-@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('virtio-stub.c'))
+@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
- system_ss.add(files('virtio-hmp-cmds.c'))
+     select SIFIVE_PLIC
+     select UNIMP
- specific_ss.add_all(when: 'CONFIG_VIRTIO', if_true: specific_virtio_ss)
-+system_ss.add(when: 'CONFIG_ACPI', if_true: files('virtio-acpi.c'))
++config MICROBLAZE_V
 +    bool
 +    default y
 +    depends on RISCV32 || RISCV64
 +    select XILINX
 +    select XILINX_AXI
 +    select XILINX_ETHLITE
 +
  config OPENTITAN
      bool
      default y
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
  riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
  riscv_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
  riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files('riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c'))
 +riscv_ss.add(when: 'CONFIG_MICROBLAZE_V', if_true: files('microblaze-v-generic.c'))
  hw_arch += {'riscv': riscv_ss}
 --
-.43.0
+.47.1

-[PULL 65/65] target/riscv: Ensure mideleg is set correctly on reset
+[PULL 20/39] qtest: allow SPCR acpi table changes
-From: Alistair Francis <alistair23@gmail.com>
+From: Sia Jee Heng <jeeheng.sia@starfivetech.com>
-Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor is
+Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
-enabled. We currently only set them on accesses to mideleg, but they
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
-aren't correctly set on reset. Let's ensure they are always the correct
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-value.
+Message-ID: <20241028015744.624943-2-jeeheng.sia@starfivetech.com>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1617
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20240108001328.280222-4-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 8 ++++++++
+ tests/qtest/bios-tables-test-allowed-diff.h | 1 +
-file changed, 8 insertions(+)
+file changed, 1 insertion(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/target/riscv/cpu.c
++++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+@@ -1 +1,2 @@
-     /* mmte is supposed to have pm.current hardwired to 1 */
+ /* List of comma-separated changed AML files to ignore */
-     env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
++"tests/data/acpi/riscv64/virt/SPCR",
 +    /*
 +     * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
 +     * extension is enabled.
 +     */
 +    if (riscv_has_ext(env, RVH)) {
 +        env->mideleg |= HS_MODE_INTERRUPTS;
 +    }
 +
      /*
       * Clear mseccfg and unlock all the PMP entries upon reset.
       * This is allowed as per the priv and smepmp specifications
 --
-.43.0
+.47.1

-[PULL 12/65] hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
+[PULL 21/39] hw/acpi: Upgrade ACPI SPCR table to support SPCR table revision 4 format
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Sia Jee Heng <jeeheng.sia@starfivetech.com>
-RISC-V also needs to use the same code to create fw_cfg in DSDT. So,
+Update the SPCR table to accommodate the SPCR Table revision 4 [1].
-avoid code duplication by moving the code in arm and riscv to a device
+The SPCR table has been modified to adhere to the revision 4 format [2].
 specific file.
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
+[1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+[2]: https://github.com/acpica/acpica/pull/931
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-2-sunilvl@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Message-ID: <20241028015744.624943-3-jeeheng.sia@starfivetech.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/nvram/fw_cfg_acpi.h | 15 +++++++++++++++
+ include/hw/acpi/acpi-defs.h |  7 +++++--
- hw/arm/virt-acpi-build.c       | 19 ++-----------------
+ include/hw/acpi/aml-build.h |  2 +-
- hw/nvram/fw_cfg-acpi.c         | 23 +++++++++++++++++++++++
+ hw/acpi/aml-build.c         | 20 ++++++++++++++++----
- hw/riscv/virt-acpi-build.c     | 19 ++-----------------
+ hw/arm/virt-acpi-build.c    |  8 ++++++--
- hw/nvram/meson.build           |  1 +
+ hw/loongarch/acpi-build.c   |  6 +++++-
-files changed, 43 insertions(+), 34 deletions(-)
+ hw/riscv/virt-acpi-build.c  | 12 +++++++++---
- create mode 100644 include/hw/nvram/fw_cfg_acpi.h
+files changed, 42 insertions(+), 13 deletions(-)
  create mode 100644 hw/nvram/fw_cfg-acpi.c
-diff --git a/include/hw/nvram/fw_cfg_acpi.h b/include/hw/nvram/fw_cfg_acpi.h
+diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/include/hw/acpi/acpi-defs.h
---- /dev/null
++++ b/include/hw/acpi/acpi-defs.h
-+++ b/include/hw/nvram/fw_cfg_acpi.h
+@@ -XXX,XX +XXX,XX @@ typedef struct AcpiSpcrData {
-@@ -XXX,XX +XXX,XX @@
+     uint8_t flow_control;
-+/* SPDX-License-Identifier: GPL-2.0+ */
+     uint8_t terminal_type;
-+/*
+     uint8_t language;
-+ * ACPI support for fw_cfg
+-    uint8_t reserved1;
-+ *
+     uint16_t pci_device_id;    /* Must be 0xffff if not PCI device */
-+ */
+     uint16_t pci_vendor_id;    /* Must be 0xffff if not PCI device */
-+
+     uint8_t pci_bus;
-+#ifndef FW_CFG_ACPI_H
+@@ -XXX,XX +XXX,XX @@ typedef struct AcpiSpcrData {
-+#define FW_CFG_ACPI_H
+     uint8_t pci_function;
-+
+     uint32_t pci_flags;
-+#include "qemu/osdep.h"
+     uint8_t pci_segment;
-+#include "exec/hwaddr.h"
+-    uint32_t reserved2;
-+
++    uint32_t uart_clk_freq;
-+void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap);
++    uint32_t precise_baudrate;
-+
++    uint32_t namespace_string_length;
-+#endif
++    uint32_t namespace_string_offset;
 +    char namespace_string[];
  } AcpiSpcrData;
  #define ACPI_FADT_ARM_PSCI_COMPLIANT  (1 << 0)
 diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/acpi/aml-build.h
 +++ b/include/hw/acpi/aml-build.h
@@ -XXX,XX +XXX,XX @@ void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog,
  void build_spcr(GArray *table_data, BIOSLinker *linker,
                  const AcpiSpcrData *f, const uint8_t rev,
 -                const char *oem_id, const char *oem_table_id);
 +                const char *oem_id, const char *oem_table_id, const char *name);
  #endif
 diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/acpi/aml-build.c
 +++ b/hw/acpi/aml-build.c
@@ -XXX,XX +XXX,XX @@ static void build_processor_hierarchy_node(GArray *tbl, uint32_t flags,
  void build_spcr(GArray *table_data, BIOSLinker *linker,
                  const AcpiSpcrData *f, const uint8_t rev,
 -                const char *oem_id, const char *oem_table_id)
 +                const char *oem_id, const char *oem_table_id, const char *name)
  {
      AcpiTable table = { .sig = "SPCR", .rev = rev, .oem_id = oem_id,
                          .oem_table_id = oem_table_id };
@@ -XXX,XX +XXX,XX @@ void build_spcr(GArray *table_data, BIOSLinker *linker,
      build_append_int_noprefix(table_data, f->pci_flags, 4);
      /* PCI Segment */
      build_append_int_noprefix(table_data, f->pci_segment, 1);
 -    /* Reserved */
 -    build_append_int_noprefix(table_data, 0, 4);
 -
 +    if (rev < 4) {
 +        /* Reserved */
 +        build_append_int_noprefix(table_data, 0, 4);
 +    } else {
 +        /* UartClkFreq */
 +        build_append_int_noprefix(table_data, f->uart_clk_freq, 4);
 +        /* PreciseBaudrate */
 +        build_append_int_noprefix(table_data, f->precise_baudrate, 4);
 +        /* NameSpaceStringLength */
 +        build_append_int_noprefix(table_data, f->namespace_string_length, 2);
 +        /* NameSpaceStringOffset */
 +        build_append_int_noprefix(table_data, f->namespace_string_offset, 2);
 +        /* NamespaceString[] */
 +        g_array_append_vals(table_data, name, f->namespace_string_length);
 +    }
      acpi_table_end(linker, &table);
  }
  /*
 diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt-acpi-build.c
 +++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ spcr_setup(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
- #include "target/arm/cpu.h"
+         .pci_flags = 0,
- #include "hw/acpi/acpi-defs.h"
+         .pci_segment = 0,
- #include "hw/acpi/acpi.h"
+     };
--#include "hw/nvram/fw_cfg.h"
+-
-+#include "hw/nvram/fw_cfg_acpi.h"
+-    build_spcr(table_data, linker, &serial, 2, vms->oem_id, vms->oem_table_id);
- #include "hw/acpi/bios-linker-loader.h"
++    /*
- #include "hw/acpi/aml-build.h"
++     * Passing NULL as the SPCR Table for Revision 2 doesn't support
- #include "hw/acpi/utils.h"
++     * NameSpaceString.
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
++     */
-     aml_append(scope, dev);
++    build_spcr(table_data, linker, &serial, 2, vms->oem_id, vms->oem_table_id,
 +               NULL);
  }
--static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
+ /*
--{
+diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/acpi-build.c
--    Aml *dev = aml_device("FWCF");
+index XXXXXXX..XXXXXXX 100644
--    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
+--- a/hw/loongarch/acpi-build.c
--    /* device present, functioning, decoding, not shown in UI */
++++ b/hw/loongarch/acpi-build.c
--    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+@@ -XXX,XX +XXX,XX @@ spcr_setup(GArray *table_data, BIOSLinker *linker, MachineState *machine)
--    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+     };
--
--    Aml *crs = aml_resource_template();
+     lvms = LOONGARCH_VIRT_MACHINE(machine);
--    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
++    /*
--                                       fw_cfg_memmap->size, AML_READ_WRITE));
++     * Passing NULL as the SPCR Table for Revision 2 doesn't support
--    aml_append(dev, aml_name_decl("_CRS", crs));
++     * NameSpaceString.
--    aml_append(scope, dev);
++     */
--}
+     build_spcr(table_data, linker, &serial, 2, lvms->oem_id,
--
+-               lvms->oem_table_id);
- static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
++               lvms->oem_table_id, NULL);
- {
+ }
-     Aml *dev, *crs;
-@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+ typedef
      if (vmc->acpi_expose_flash) {
          acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
      }
 -    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
 +    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
      acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
                      (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
      acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
 diff --git a/hw/nvram/fw_cfg-acpi.c b/hw/nvram/fw_cfg-acpi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/nvram/fw_cfg-acpi.c
@@ -XXX,XX +XXX,XX @@
 +// SPDX-License-Identifier: GPL-2.0+
 +/*
 + * Add fw_cfg device in DSDT
 + *
 + */
 +
 +#include "hw/nvram/fw_cfg_acpi.h"
 +#include "hw/acpi/aml-build.h"
 +
 +void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap)
 +{
 +    Aml *dev = aml_device("FWCF");
 +    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
 +    /* device present, functioning, decoding, not shown in UI */
 +    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
 +    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
 +
 +    Aml *crs = aml_resource_template();
 +    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
 +                                       fw_cfg_memmap->size, AML_READ_WRITE));
 +    aml_append(dev, aml_name_decl("_CRS", crs));
 +    aml_append(scope, dev);
 +}
 diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt-acpi-build.c
 +++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
- #include "hw/acpi/acpi.h"
- #include "hw/acpi/aml-build.h"
+ /*
- #include "hw/acpi/utils.h"
+  * Serial Port Console Redirection Table (SPCR)
-+#include "hw/nvram/fw_cfg_acpi.h"
+- * Rev: 1.07
- #include "qapi/error.h"
++ * Rev: 1.10
- #include "qemu/error-report.h"
+  */
- #include "sysemu/reset.h"
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
+ static void
-     }
+ spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
  {
 +    const char name[] = ".";
      AcpiSpcrData serial = {
 -        .interface_type = 0,       /* 16550 compatible */
 +        .interface_type = 0x12,       /* 16550 compatible */
          .base_addr.id = AML_AS_SYSTEM_MEMORY,
          .base_addr.width = 32,
          .base_addr.offset = 0,
@@ -XXX,XX +XXX,XX @@ spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
          .pci_function = 0,
          .pci_flags = 0,
          .pci_segment = 0,
 +        .uart_clk_freq = 0,
 +        .precise_baudrate = 0,
 +        .namespace_string_length = sizeof(name),
 +        .namespace_string_offset = 88,
      };
 -    build_spcr(table_data, linker, &serial, 2, s->oem_id, s->oem_table_id);
 +    build_spcr(table_data, linker, &serial, 4, s->oem_id, s->oem_table_id,
 +               name);
  }
--static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
--{
--    Aml *dev = aml_device("FWCF");
--    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
--
--    /* device present, functioning, decoding, not shown in UI */
--    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
--    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
--
--    Aml *crs = aml_resource_template();
--    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
--                                       fw_cfg_memmap->size, AML_READ_WRITE));
--    aml_append(dev, aml_name_decl("_CRS", crs));
--    aml_append(scope, dev);
--}
--
  /* RHCT Node[N] starts at offset 56 */
- #define RHCT_NODE_ARRAY_OFFSET 56
-@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
-     scope = aml_scope("\\_SB");
-     acpi_dsdt_add_cpus(scope, s);
--    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
-+    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
-     aml_append(dsdt, scope);
-diff --git a/hw/nvram/meson.build b/hw/nvram/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/nvram/meson.build
-+++ b/hw/nvram/meson.build
-@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_XLNX_EFUSE_ZYNQMP', if_true: files(
- system_ss.add(when: 'CONFIG_XLNX_BBRAM', if_true: files('xlnx-bbram.c'))
- specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_nvram.c'))
-+specific_ss.add(when: 'CONFIG_ACPI', if_true: files('fw_cfg-acpi.c'))
 --
-.43.0
+.47.1

-[PULL 64/65] target/riscv: Don't adjust vscause for exceptions
+[PULL 22/39] tests/qtest/bios-tables-test: Update virt SPCR golden reference for RISC-V
-From: Alistair Francis <alistair23@gmail.com>
+From: Sia Jee Heng <jeeheng.sia@starfivetech.com>
-We have been incorrectly adjusting both the interrupt and exception
+Update the virt SPCR golden reference file for RISC-V to accommodate the
-cause when using the hypervisor extension and trapping to VS-mode. This
+SPCR Table revision 4 [1], utilizing the iasl binary compiled from the
-patch changes the conditional to ensure we only adjust the cause for
+latest ACPICA repository. The SPCR table has been modified to
-interrupts and not exceptions.
+adhere to the revision 4 format [2].
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1708
+[1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+[2]: https://github.com/acpica/acpica/pull/931
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20240108001328.280222-3-alistair.francis@wdc.com>
+Diffs from iasl:
 /*
   * Intel ACPI Component Architecture
   * AML/ASL+ Disassembler version 20200925 (64-bit version)
   * Copyright (c) 2000 - 2020 Intel Corporation
   *
 - * Disassembly of tests/data/acpi/riscv64/virt/SPCR, Wed Aug 28 18:28:19 2024
 + * Disassembly of /tmp/aml-MN0NS2, Wed Aug 28 18:28:19 2024
   *
   * ACPI Data Table [SPCR]
   *
   * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
   */
  [000h 0000   4]                    Signature : "SPCR"    [Serial Port Console Redirection table]
 -[004h 0004   4]                 Table Length : 00000050
 -[008h 0008   1]                     Revision : 02
 -[009h 0009   1]                     Checksum : B9
 +[004h 0004   4]                 Table Length : 0000005A
 +[008h 0008   1]                     Revision : 04
 +[009h 0009   1]                     Checksum : 13
  [00Ah 0010   6]                       Oem ID : "BOCHS "
  [010h 0016   8]                 Oem Table ID : "BXPC    "
  [018h 0024   4]                 Oem Revision : 00000001
  [01Ch 0028   4]              Asl Compiler ID : "BXPC"
  [020h 0032   4]        Asl Compiler Revision : 00000001
 -[024h 0036   1]               Interface Type : 00
 +[024h 0036   1]               Interface Type : 12
  [025h 0037   3]                     Reserved : 000000
  [028h 0040  12]         Serial Port Register : [Generic Address Structure]
  [028h 0040   1]                     Space ID : 00 [SystemMemory]
  [029h 0041   1]                    Bit Width : 20
  [02Ah 0042   1]                   Bit Offset : 00
  [02Bh 0043   1]         Encoded Access Width : 01 [Byte Access:8]
  [02Ch 0044   8]                      Address : 0000000010000000
  [034h 0052   1]               Interrupt Type : 10
  [035h 0053   1]          PCAT-compatible IRQ : 00
  [036h 0054   4]                    Interrupt : 0000000A
  [03Ah 0058   1]                    Baud Rate : 07
  [03Bh 0059   1]                       Parity : 00
  [03Ch 0060   1]                    Stop Bits : 01
  [03Dh 0061   1]                 Flow Control : 00
  [03Eh 0062   1]                Terminal Type : 00
  [04Ch 0076   1]                     Reserved : 00
  [040h 0064   2]                PCI Device ID : FFFF
  [042h 0066   2]                PCI Vendor ID : FFFF
  [044h 0068   1]                      PCI Bus : 00
  [045h 0069   1]                   PCI Device : 00
  [046h 0070   1]                 PCI Function : 00
  [047h 0071   4]                    PCI Flags : 00000000
  [04Bh 0075   1]                  PCI Segment : 00
 -[04Ch 0076   4]                     Reserved : 00000000
 +[04Ch 0076 004h]             Uart Clock Freq : 00000000
 +[050h 0080 004h]           Precise Baud rate : 00000000
 +[054h 0084 002h]       NameSpaceStringLength : 0002
 +[056h 0086 002h]       NameSpaceStringOffset : 0058
 +[058h 0088 002h]             NamespaceString : "."
 -Raw Table Data: Length 80 (0x50)
 +Raw Table Data: Length 90 (0x5A)
 -    0000: 53 50 43 52 50 00 00 00 02 B9 42 4F 43 48 53 20  // SPCRP.....BOCHS
 +    0000: 53 50 43 52 5A 00 00 00 04 13 42 4F 43 48 53 20  // SPCRZ.....BOCHS
 : 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
 -    0020: 01 00 00 00 00 00 00 00 00 20 00 01 00 00 00 10  // ......... ......
 +    0020: 01 00 00 00 12 00 00 00 00 20 00 01 00 00 00 10  // ......... ......
 : 00 00 00 00 10 00 0A 00 00 00 07 00 01 00 00 03  // ................
 : FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00  // ................
 +    0050: 00 00 00 00 02 00 58 00 2E 00                    // ......X...
 Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
 Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
 Message-ID: <20241028015744.624943-4-jeeheng.sia@starfivetech.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 4 ++--
+ tests/qtest/bios-tables-test-allowed-diff.h |   1 -
-file changed, 2 insertions(+), 2 deletions(-)
+ tests/data/acpi/riscv64/virt/SPCR           | Bin 80 -> 90 bytes
 files changed, 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/target/riscv/cpu_helper.c
++++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
+@@ -1,2 +1 @@
-                  * See if we need to adjust cause. Yes if its VS mode interrupt
+ /* List of comma-separated changed AML files to ignore */
-                  * no if hypervisor has delegated one of hs mode's interrupt
+-"tests/data/acpi/riscv64/virt/SPCR",
-                  */
+diff --git a/tests/data/acpi/riscv64/virt/SPCR b/tests/data/acpi/riscv64/virt/SPCR
--                if (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
+index XXXXXXX..XXXXXXX 100644
--                    cause == IRQ_VS_EXT) {
+Binary files a/tests/data/acpi/riscv64/virt/SPCR and b/tests/data/acpi/riscv64/virt/SPCR differ
 +                if (async && (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
 +                              cause == IRQ_VS_EXT)) {
                      cause = cause - 1;
                  }
                  write_gva = false;
 --
-.43.0
+.47.1

-[PULL 50/65] target/riscv/cpu.c: add riscv_cpu_is_32bit()
+[PULL 23/39] MAINTAINERS: Cover RISC-V HTIF interface
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Next patch will need to retrieve if a given RISCVCPU is 32 or 64 bit.
+The HTIF interface is RISC-V specific, add
-The existing helper riscv_is_32bit() (hw/riscv/boot.c) will always check
+it within the MAINTAINERS section covering
-the first CPU of a given hart array, not any given CPU.
+hw/riscv/.
-Create a helper to retrieve the info for any given CPU, not the first
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 CPU of the hart array. The helper is using the same 32 bit check that
 riscv_cpu_satp_mode_finalize() was doing.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-23-dbarboza@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20241129154304.34946-2-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 1 +
+ MAINTAINERS | 2 ++
- target/riscv/cpu.c | 7 ++++++-
+file changed, 2 insertions(+)
 files changed, 7 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/MAINTAINERS
-+++ b/target/riscv/cpu.h
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+@@ -XXX,XX +XXX,XX @@ S: Supported
-                           uint64_t *cs_base, uint32_t *pflags);
+ F: configs/targets/riscv*
+ F: docs/system/target-riscv.rst
- void riscv_cpu_update_mask(CPURISCVState *env);
+ F: target/riscv/
-+bool riscv_cpu_is_32bit(RISCVCPU *cpu);
++F: hw/char/riscv_htif.c
+ F: hw/riscv/
- RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
+ F: hw/intc/riscv*
-                            target_ulong *ret_value,
++F: include/hw/char/riscv_htif.h
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+ F: include/hw/riscv/
-index XXXXXXX..XXXXXXX 100644
+ F: linux-user/host/riscv32/
---- a/target/riscv/cpu.c
+ F: linux-user/host/riscv64/
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
  #define BYTE(x)   (x)
  #endif
 +bool riscv_cpu_is_32bit(RISCVCPU *cpu)
 +{
 +    return riscv_cpu_mxl(&cpu->env) == MXL_RV32;
 +}
 +
  #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
      {#_name, _min_ver, CPU_CFG_OFFSET(_prop)}
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
  #ifndef CONFIG_USER_ONLY
  static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
  {
 -    bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
 +    bool rv32 = riscv_cpu_is_32bit(cpu);
      uint8_t satp_mode_map_max, satp_mode_supported_max;
      /* The CPU wants the OS to decide which satp mode to use */
 --
-.43.0
+.47.1

-[PULL 27/65] disas/riscv: Add amocas.[w,d,q] instructions
+[PULL 24/39] hw/char/riscv_htif: Explicit little-endian implementation
-From: Rob Bradford <rbradford@rivosinc.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
+Since our RISC-V system emulation is only built for little
 endian, the HTIF device aims to interface with little endian
 memory accesses, thus we can explicit htif_mm_ops:endianness
 being DEVICE_LITTLE_ENDIAN.
 In that case tswap64() is equivalent to le64_to_cpu(), as in
 "convert this 64-bit little-endian value into host cpu order".
 Replace to simplify.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231207153842.32401-3-rbradford@rivosinc.com>
+Message-ID: <20241129154304.34946-3-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- disas/riscv.c | 9 +++++++++
+ hw/char/riscv_htif.c | 11 ++++++-----
-file changed, 9 insertions(+)
+file changed, 6 insertions(+), 5 deletions(-)
-diff --git a/disas/riscv.c b/disas/riscv.c
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
+--- a/hw/char/riscv_htif.c
-+++ b/disas/riscv.c
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@
-     rv_op_vwsll_vv = 872,
+ #include "qemu/timer.h"
-     rv_op_vwsll_vx = 873,
+ #include "qemu/error-report.h"
-     rv_op_vwsll_vi = 874,
+ #include "exec/address-spaces.h"
-+    rv_op_amocas_w = 875,
+-#include "exec/tswap.h"
-+    rv_op_amocas_d = 876,
++#include "qemu/bswap.h"
-+    rv_op_amocas_q = 877,
+ #include "sysemu/dma.h"
- } rv_op;
+ #include "sysemu/runstate.h"
- /* register names */
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
+             } else {
-     { "vwsll.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
+                 uint64_t syscall[8];
-     { "vwsll.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
+                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-     { "vwsll.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+-                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
-+    { "amocas.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
+-                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
-+    { "amocas.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
+-                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
-+    { "amocas.q", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
++                if (le64_to_cpu(syscall[0]) == PK_SYS_WRITE &&
 +                    le64_to_cpu(syscall[1]) == HTIF_DEV_CONSOLE &&
 +                    le64_to_cpu(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                      uint8_t ch;
 -                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
 +                    cpu_physical_memory_read(le64_to_cpu(syscall[2]), &ch, 1);
                      /*
                       * XXX this blocks entire thread. Rewrite to use
                       * qemu_chr_fe_write and background I/O callbacks
@@ -XXX,XX +XXX,XX @@ static void htif_mm_write(void *opaque, hwaddr addr,
  static const MemoryRegionOps htif_mm_ops = {
      .read = htif_mm_read,
      .write = htif_mm_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
  };
- /* CSR names */
+ HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
              case 34: op = rv_op_amoxor_w; break;
              case 35: op = rv_op_amoxor_d; break;
              case 36: op = rv_op_amoxor_q; break;
 +            case 42: op = rv_op_amocas_w; break;
 +            case 43: op = rv_op_amocas_d; break;
 +            case 44: op = rv_op_amocas_q; break;
              case 66: op = rv_op_amoor_w; break;
              case 67: op = rv_op_amoor_d; break;
              case 68: op = rv_op_amoor_q; break;
 --
-.43.0
+.47.1

-[PULL 54/65] target/riscv: add rva22s64 cpu
+[PULL 25/39] hw/char/riscv_htif: Clarify MemoryRegionOps expect 32-bit accesses
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Add a new profile CPU 'rva22s64' to work as an alias of
+Looking at htif_mm_ops[] read/write handlers, we notice they
 expect 32-bit values to accumulate into to the 'fromhost' and
 'tohost' 64-bit variables. Explicit by setting the .impl
 min/max fields.
--cpu rv64i,rva22s64
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Like the existing rva22u64 CPU already does with the RVA22U64 profile.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20241129154304.34946-4-philmd@linaro.org>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-27-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h | 1 +
+ hw/char/riscv_htif.c | 4 ++++
- target/riscv/cpu.c     | 8 ++++++++
+file changed, 4 insertions(+)
 files changed, 9 insertions(+)
-diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu-qom.h
+--- a/hw/char/riscv_htif.c
-+++ b/target/riscv/cpu-qom.h
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps htif_mm_ops = {
- #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
+     .read = htif_mm_read,
- #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
+     .write = htif_mm_write,
- #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
+     .endianness = DEVICE_LITTLE_ENDIAN,
-+#define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
++    .impl = {
- #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
++        .min_access_size = 4,
- #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
++        .max_access_size = 4,
- #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
++    },
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rva22u64_profile_cpu_init(Object *obj)
      RVA22U64.enabled = true;
  }
 +
 +static void rva22s64_profile_cpu_init(Object *obj)
 +{
 +    rv64i_bare_cpu_init(obj);
 +
 +    RVA22S64.enabled = true;
 +}
  #endif
  static const gchar *riscv_gdb_arch_name(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
      DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
      DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
 +    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64, rva22s64_profile_cpu_init),
  #endif
  };
+ HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
 --
-.43.0
+.47.1

-[PULL 15/65] hw/riscv: virt: Make few IMSIC macros and functions public
+[PULL 26/39] hw/riscv: Support to load DTB after 3GB memory on 64-bit system.
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Jim Shu <jim.shu@sifive.com>
-Some macros and static function related to IMSIC are defined in virt.c.
+Larger initrd image will overlap the DTB at 3GB address. Since 64-bit
-They are required in virt-acpi-build.c. So, make them public.
+system doesn't have 32-bit addressable issue, we just load DTB to the end
 of dram in 64-bit system.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20241120153935.24706-2-jim.shu@sifive.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+[ Changes by AF
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+ -  Store fdt_load_addr_hi32 in the reset vector
-Message-ID: <20231218150247.466427-5-sunilvl@ventanamicro.com>
+]
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h | 25 +++++++++++++++++++++++++
+ include/hw/riscv/boot.h    |  2 +-
- hw/riscv/virt.c         | 25 +------------------------
+ hw/riscv/boot.c            | 14 +++++++++-----
-files changed, 26 insertions(+), 24 deletions(-)
+ hw/riscv/microchip_pfsoc.c |  4 ++--
  hw/riscv/sifive_u.c        |  8 +++++---
  hw/riscv/spike.c           |  4 ++--
  hw/riscv/virt.c            |  2 +-
 files changed, 20 insertions(+), 14 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/include/hw/riscv/boot.h
-+++ b/include/hw/riscv/virt.h
++++ b/include/hw/riscv/boot.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(MachineState *machine,
- #include "hw/riscv/riscv_hart.h"
+                                bool load_initrd,
- #include "hw/sysbus.h"
+                                symbol_fn_t sym_cb);
- #include "hw/block/flash.h"
+ uint64_t riscv_compute_fdt_addr(hwaddr dram_start, uint64_t dram_size,
-+#include "hw/intc/riscv_imsic.h"
+-                                MachineState *ms);
++                                MachineState *ms, RISCVHartArrayState *harts);
- #define VIRT_CPUS_MAX_BITS             9
+ void riscv_load_fdt(hwaddr fdt_addr, void *fdt);
- #define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
+ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts,
-@@ -XXX,XX +XXX,XX @@ enum {
+                                hwaddr saddr,
+diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
- bool virt_is_acpi_enabled(RISCVVirtState *s);
+index XXXXXXX..XXXXXXX 100644
- void virt_acpi_setup(RISCVVirtState *vms);
+--- a/hw/riscv/boot.c
-+uint32_t imsic_num_bits(uint32_t count);
++++ b/hw/riscv/boot.c
-+
+@@ -XXX,XX +XXX,XX @@ out:
-+/*
+  * The FDT is fdt_packed() during the calculation.
-+ * The virt machine physical address space used by some of the devices
+  */
-+ * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
+ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
-+ * number of CPUs, and number of IMSIC guest files.
+-                                MachineState *ms)
-+ *
++                                MachineState *ms, RISCVHartArrayState *harts)
-+ * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
+ {
-+ * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
+     int ret = fdt_pack(ms->fdt);
-+ * of virt machine physical address space.
+     hwaddr dram_end, temp;
-+ */
+@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
-+
-+#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
+     /*
-+#if VIRT_IMSIC_GROUP_MAX_SIZE < \
+      * We should put fdt as far as possible to avoid kernel/initrd overwriting
-+    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
+-     * its content. But it should be addressable by 32 bit system as well.
-+#error "Can't accomodate single IMSIC group in address space"
+-     * Thus, put it at an 2MB aligned address that less than fdt size from the
-+#endif
+-     * end of dram or 3GB whichever is lesser.
-+
++     * its content. But it should be addressable by 32 bit system as well in RV32.
-+#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
++     * Thus, put it near to the end of dram in RV64, and put it near to the end
-+                                        VIRT_IMSIC_GROUP_MAX_SIZE)
++     * of dram or 3GB whichever is lesser in RV32.
-+#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
+      */
-+#error "Can't accomodate all IMSIC groups in address space"
+-    temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
-+#endif
++    if (!riscv_is_32bit(harts)) {
-+
++        temp = dram_end;
- #endif
++    } else {
 +        temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
 +    }
      return QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
  }
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
      bool kernel_as_payload = false;
      target_ulong firmware_end_addr, kernel_start_addr;
      uint64_t kernel_entry;
 -    uint32_t fdt_load_addr;
 +    uint64_t fdt_load_addr;
      DriveInfo *dinfo = drive_get(IF_SD, 0, 0);
      /* Sanity check on RAM size */
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
          /* Compute the fdt load address in dram */
          fdt_load_addr = riscv_compute_fdt_addr(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
                                                 memmap[MICROCHIP_PFSOC_DRAM_LO].size,
 -                                               machine);
 +                                               machine, &s->soc.u_cpus);
          riscv_load_fdt(fdt_load_addr, machine->fdt);
          /* Load the reset vector */
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      target_ulong firmware_end_addr, kernel_start_addr;
      const char *firmware_name;
      uint32_t start_addr_hi32 = 0x00000000;
 +    uint32_t fdt_load_addr_hi32 = 0x00000000;
      int i;
 -    uint32_t fdt_load_addr;
 +    uint64_t fdt_load_addr;
      uint64_t kernel_entry;
      DriveInfo *dinfo;
      BlockBackend *blk;
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      fdt_load_addr = riscv_compute_fdt_addr(memmap[SIFIVE_U_DEV_DRAM].base,
                                             memmap[SIFIVE_U_DEV_DRAM].size,
 -                                           machine);
 +                                           machine, &s->soc.u_cpus);
      riscv_load_fdt(fdt_load_addr, machine->fdt);
      if (!riscv_is_32bit(&s->soc.u_cpus)) {
          start_addr_hi32 = (uint64_t)start_addr >> 32;
 +        fdt_load_addr_hi32 = fdt_load_addr >> 32;
      }
      /* reset vector */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
          start_addr,                    /* start: .dword */
          start_addr_hi32,
          fdt_load_addr,                 /* fdt_laddr: .dword */
 -        0x00000000,
 +        fdt_load_addr_hi32,
 x00000000,
                                         /* fw_dyn: */
      };
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      hwaddr firmware_load_addr = memmap[SPIKE_DRAM].base;
      target_ulong kernel_start_addr;
      char *firmware_name;
 -    uint32_t fdt_load_addr;
 +    uint64_t fdt_load_addr;
      uint64_t kernel_entry;
      char *soc_name;
      int i, base_hartid, hart_count;
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      fdt_load_addr = riscv_compute_fdt_addr(memmap[SPIKE_DRAM].base,
                                             memmap[SPIKE_DRAM].size,
 -                                           machine);
 +                                           machine, &s->soc[0]);
      riscv_load_fdt(fdt_load_addr, machine->fdt);
      /* load the reset vector */
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
- #include "kvm/kvm_riscv.h"
- #include "hw/intc/riscv_aclint.h"
+     fdt_load_addr = riscv_compute_fdt_addr(memmap[VIRT_DRAM].base,
- #include "hw/intc/riscv_aplic.h"
+                                            memmap[VIRT_DRAM].size,
--#include "hw/intc/riscv_imsic.h"
+-                                           machine);
- #include "hw/intc/sifive_plic.h"
++                                           machine, &s->soc[0]);
- #include "hw/misc/sifive_test.h"
+     riscv_load_fdt(fdt_load_addr, machine->fdt);
- #include "hw/platform-bus.h"
-@@ -XXX,XX +XXX,XX @@
+     /* load the reset vector */
  #include "hw/acpi/aml-build.h"
  #include "qapi/qapi-visit-common.h"
 -/*
 - * The virt machine physical address space used by some of the devices
 - * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
 - * number of CPUs, and number of IMSIC guest files.
 - *
 - * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
 - * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
 - * of virt machine physical address space.
 - */
 -
 -#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
 -#if VIRT_IMSIC_GROUP_MAX_SIZE < \
 -    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
 -#error "Can't accommodate single IMSIC group in address space"
 -#endif
 -
 -#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
 -                                        VIRT_IMSIC_GROUP_MAX_SIZE)
 -#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
 -#error "Can't accommodate all IMSIC groups in address space"
 -#endif
 -
  /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
  static bool virt_use_kvm_aia(RISCVVirtState *s)
  {
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
      g_free(plic_cells);
  }
 -static uint32_t imsic_num_bits(uint32_t count)
 +uint32_t imsic_num_bits(uint32_t count)
  {
      uint32_t ret = 0;
 --
-.43.0
+.47.1

-[PULL 35/65] riscv-qmp-cmds.c: expose named features in cpu_model_expansion
+[PULL 27/39] hw/riscv: Add a new struct RISCVBootInfo
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Jim Shu <jim.shu@sifive.com>
-Named features (zic64b the sole example at this moment) aren't expose to
+Add a new struct RISCVBootInfo to sync boot information between multiple
-users, thus we need another way to expose them.
+boot functions.
-Go through each named feature, get its boolean value, do the needed
+Signed-off-by: Jim Shu <jim.shu@sifive.com>
 conversions (bool to qbool, qbool to QObject) and add it to output dict.
 Another adjustment is needed: named features are evaluated during
 finalize(), so riscv_cpu_finalize_features() needs to be mandatory
 regardless of whether we have an input dict or not. Otherwise zic64b
 will always return 'false', which is incorrect: the default values of
 cache blocksizes ([cbom/cbop/cboz]_blocksize) are set to 64, satisfying
 the conditions for zic64b.
 Here's an API usage example after this patch:
  $ ./build/qemu-system-riscv64 -S -M virt -display none
     -qmp tcp:localhost:1234,server,wait=off
  $ ./scripts/qmp/qmp-shell localhost:1234
 Welcome to the QMP low-level shell!
 Connected to QEMU 8.1.50
 (QEMU) query-cpu-model-expansion type=full model={"name":"rv64"}
 {"return": {"model":
     {"name": "rv64", "props": {... "zic64b": true, ...}}}}
 zic64b is set to 'true', as expected, since all cache sizes are 64
 bytes by default.
 If we change one of the cache blocksizes, zic64b is returned as 'false':
 (QEMU) query-cpu-model-expansion type=full model={"name":"rv64","props":{"cbom_blocksize":128}}
 {"return": {"model":
     {"name": "rv64", "props": {... "zic64b": false, ...}}}}
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-8-dbarboza@ventanamicro.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20241120153935.24706-3-jim.shu@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/riscv-qmp-cmds.c | 30 +++++++++++++++++++++++++-----
+ include/hw/riscv/boot.h    | 25 ++++++++++-----
-file changed, 25 insertions(+), 5 deletions(-)
+ hw/riscv/boot.c            | 65 ++++++++++++++++++++++----------------
  hw/riscv/microchip_pfsoc.c | 11 ++++---
  hw/riscv/opentitan.c       |  4 ++-
  hw/riscv/sifive_e.c        |  4 ++-
  hw/riscv/sifive_u.c        | 12 ++++---
  hw/riscv/spike.c           | 12 ++++---
  hw/riscv/virt.c            | 13 +++++---
 files changed, 90 insertions(+), 56 deletions(-)
-diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
+diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/riscv-qmp-cmds.c
+--- a/include/hw/riscv/boot.h
-+++ b/target/riscv/riscv-qmp-cmds.c
++++ b/include/hw/riscv/boot.h
 @@ -XXX,XX +XXX,XX @@
+ #define RISCV32_BIOS_BIN    "opensbi-riscv32-generic-fw_dynamic.bin"
- #include "qapi/error.h"
+ #define RISCV64_BIOS_BIN    "opensbi-riscv64-generic-fw_dynamic.bin"
- #include "qapi/qapi-commands-machine-target.h"
-+#include "qapi/qmp/qbool.h"
++typedef struct RISCVBootInfo {
- #include "qapi/qmp/qdict.h"
++    ssize_t kernel_size;
- #include "qapi/qmp/qerror.h"
++    hwaddr image_low_addr;
- #include "qapi/qobject-input-visitor.h"
++    hwaddr image_high_addr;
-@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_multiext_props(Object *obj, QDict *qdict_out,
++
-     }
++    bool is_32bit;
 +} RISCVBootInfo;
 +
  bool riscv_is_32bit(RISCVHartArrayState *harts);
  char *riscv_plic_hart_config_string(int hart_count);
 -target_ulong riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
 +void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts);
 +target_ulong riscv_calc_kernel_start_addr(RISCVBootInfo *info,
                                            target_ulong firmware_end_addr);
  target_ulong riscv_find_and_load_firmware(MachineState *machine,
                                            const char *default_machine_firmware,
@@ -XXX,XX +XXX,XX @@ char *riscv_find_firmware(const char *firmware_filename,
  target_ulong riscv_load_firmware(const char *firmware_filename,
                                   hwaddr *firmware_load_addr,
                                   symbol_fn_t sym_cb);
 -target_ulong riscv_load_kernel(MachineState *machine,
 -                               RISCVHartArrayState *harts,
 -                               target_ulong firmware_end_addr,
 -                               bool load_initrd,
 -                               symbol_fn_t sym_cb);
 -uint64_t riscv_compute_fdt_addr(hwaddr dram_start, uint64_t dram_size,
 -                                MachineState *ms, RISCVHartArrayState *harts);
 +void riscv_load_kernel(MachineState *machine,
 +                       RISCVBootInfo *info,
 +                       target_ulong kernel_start_addr,
 +                       bool load_initrd,
 +                       symbol_fn_t sym_cb);
 +uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
 +                                MachineState *ms, RISCVBootInfo *info);
  void riscv_load_fdt(hwaddr fdt_addr, void *fdt);
  void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts,
                                 hwaddr saddr,
 diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/boot.c
 +++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ char *riscv_plic_hart_config_string(int hart_count)
      return g_strjoinv(",", (char **)vals);
  }
-+static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
+-target_ulong riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
 +void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts)
 +{
-+    const RISCVCPUMultiExtConfig *named_cfg;
++    info->kernel_size = 0;
-+    RISCVCPU *cpu = RISCV_CPU(obj);
++    info->is_32bit = riscv_is_32bit(harts);
 +    QObject *value;
 +    bool flag_val;
 +
 +    for (int i = 0; riscv_cpu_named_features[i].name != NULL; i++) {
 +        named_cfg = &riscv_cpu_named_features[i];
 +        flag_val = isa_ext_is_enabled(cpu, named_cfg->offset);
 +        value = QOBJECT(qbool_from_bool(flag_val));
 +
 +        qdict_put_obj(qdict_out, named_cfg->name, value);
 +    }
 +}
 +
- static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
++target_ulong riscv_calc_kernel_start_addr(RISCVBootInfo *info,
-                                            const QDict *qdict_in,
+                                           target_ulong firmware_end_addr) {
-                                            Error **errp)
+-    if (riscv_is_32bit(harts)) {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
++    if (info->is_32bit) {
-         goto err;
+         return QEMU_ALIGN_UP(firmware_end_addr, 4 * MiB);
-     }
+     } else {
+         return QEMU_ALIGN_UP(firmware_end_addr, 2 * MiB);
--    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
+@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_firmware(const char *firmware_filename,
--    if (local_err) {
+     exit(1);
--        goto err;
+ }
--    }
 -static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
 +static void riscv_load_initrd(MachineState *machine, RISCVBootInfo *info)
  {
      const char *filename = machine->initrd_filename;
      uint64_t mem_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
       * halfway into RAM, and for boards with 1GB of RAM or more we put
       * the initrd at 512MB.
       */
 -    start = kernel_entry + MIN(mem_size / 2, 512 * MiB);
 +    start = info->image_low_addr + MIN(mem_size / 2, 512 * MiB);
      size = load_ramdisk(filename, start, mem_size - start);
      if (size == -1) {
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
      }
  }
 -target_ulong riscv_load_kernel(MachineState *machine,
 -                               RISCVHartArrayState *harts,
 -                               target_ulong kernel_start_addr,
 -                               bool load_initrd,
 -                               symbol_fn_t sym_cb)
 +void riscv_load_kernel(MachineState *machine,
 +                       RISCVBootInfo *info,
 +                       target_ulong kernel_start_addr,
 +                       bool load_initrd,
 +                       symbol_fn_t sym_cb)
  {
      const char *kernel_filename = machine->kernel_filename;
 -    uint64_t kernel_load_base, kernel_entry;
 +    ssize_t kernel_size;
      void *fdt = machine->fdt;
      g_assert(kernel_filename != NULL);
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(MachineState *machine,
       * the (expected) load address load address. This allows kernels to have
       * separate SBI and ELF entry points (used by FreeBSD, for example).
       */
 -    if (load_elf_ram_sym(kernel_filename, NULL, NULL, NULL,
 -                         NULL, &kernel_load_base, NULL, NULL, 0,
 -                         EM_RISCV, 1, 0, NULL, true, sym_cb) > 0) {
 -        kernel_entry = kernel_load_base;
 +    kernel_size = load_elf_ram_sym(kernel_filename, NULL, NULL, NULL, NULL,
 +                                   &info->image_low_addr, &info->image_high_addr,
 +                                   NULL, 0, EM_RISCV, 1, 0, NULL, true, sym_cb);
 +    if (kernel_size > 0) {
 +        info->kernel_size = kernel_size;
          goto out;
      }
 -    if (load_uimage_as(kernel_filename, &kernel_entry, NULL, NULL,
 -                       NULL, NULL, NULL) > 0) {
 +    kernel_size = load_uimage_as(kernel_filename, &info->image_low_addr,
 +                                 NULL, NULL, NULL, NULL, NULL);
 +    if (kernel_size > 0) {
 +        info->kernel_size = kernel_size;
 +        info->image_high_addr = info->image_low_addr + kernel_size;
          goto out;
      }
 -    if (load_image_targphys_as(kernel_filename, kernel_start_addr,
 -                               current_machine->ram_size, NULL) > 0) {
 -        kernel_entry = kernel_start_addr;
 +    kernel_size = load_image_targphys_as(kernel_filename, kernel_start_addr,
 +                                         current_machine->ram_size, NULL);
 +    if (kernel_size > 0) {
 +        info->kernel_size = kernel_size;
 +        info->image_low_addr = kernel_start_addr;
 +        info->image_high_addr = info->image_low_addr + kernel_size;
          goto out;
      }
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(MachineState *machine,
  out:
      /*
 -     * For 32 bit CPUs 'kernel_entry' can be sign-extended by
 +     * For 32 bit CPUs 'image_low_addr' can be sign-extended by
       * load_elf_ram_sym().
       */
 -    if (riscv_is_32bit(harts)) {
 -        kernel_entry = extract64(kernel_entry, 0, 32);
 +    if (info->is_32bit) {
 +        info->image_low_addr = extract64(info->image_low_addr, 0, 32);
      }
      if (load_initrd && machine->initrd_filename) {
 -        riscv_load_initrd(machine, kernel_entry);
 +        riscv_load_initrd(machine, info);
      }
      if (fdt && machine->kernel_cmdline && *machine->kernel_cmdline) {
          qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
                                  machine->kernel_cmdline);
      }
 -
-     visit_end_struct(visitor, NULL);
+-    return kernel_entry;
+ }
- err:
-@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+ /*
@@ -XXX,XX +XXX,XX @@ out:
   * The FDT is fdt_packed() during the calculation.
   */
  uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
 -                                MachineState *ms, RISCVHartArrayState *harts)
 +                                MachineState *ms, RISCVBootInfo *info)
  {
      int ret = fdt_pack(ms->fdt);
      hwaddr dram_end, temp;
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
       * Thus, put it near to the end of dram in RV64, and put it near to the end
       * of dram or 3GB whichever is lesser in RV32.
       */
 -    if (!riscv_is_32bit(harts)) {
 +    if (!info->is_32bit) {
          temp = dram_end;
      } else {
          temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
      uint64_t kernel_entry;
      uint64_t fdt_load_addr;
      DriveInfo *dinfo = drive_get(IF_SD, 0, 0);
 +    RISCVBootInfo boot_info;
      /* Sanity check on RAM size */
      if (machine->ram_size < mc->default_ram_size) {
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
      firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
                                                       &firmware_load_addr, NULL);
 +    riscv_boot_info_init(&boot_info, &s->soc.u_cpus);
      if (kernel_as_payload) {
 -        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc.u_cpus,
 +        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                           firmware_end_addr);
 -        kernel_entry = riscv_load_kernel(machine, &s->soc.u_cpus,
 -                                         kernel_start_addr, true, NULL);
 +        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
 +                          true, NULL);
 +        kernel_entry = boot_info.image_low_addr;
          /* Compute the fdt load address in dram */
          fdt_load_addr = riscv_compute_fdt_addr(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
                                                 memmap[MICROCHIP_PFSOC_DRAM_LO].size,
 -                                               machine, &s->soc.u_cpus);
 +                                               machine, &boot_info);
          riscv_load_fdt(fdt_load_addr, machine->fdt);
          /* Load the reset vector */
 diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/opentitan.c
 +++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void opentitan_machine_init(MachineState *machine)
      OpenTitanState *s = OPENTITAN_MACHINE(machine);
      const MemMapEntry *memmap = ibex_memmap;
      MemoryRegion *sys_mem = get_system_memory();
 +    RISCVBootInfo boot_info;
      if (machine->ram_size != mc->default_ram_size) {
          char *sz = size_to_str(mc->default_ram_size);
@@ -XXX,XX +XXX,XX @@ static void opentitan_machine_init(MachineState *machine)
          riscv_load_firmware(machine->firmware, &firmware_load_addr, NULL);
      }
 +    riscv_boot_info_init(&boot_info, &s->soc.cpus);
      if (machine->kernel_filename) {
 -        riscv_load_kernel(machine, &s->soc.cpus,
 +        riscv_load_kernel(machine, &boot_info,
                            memmap[IBEX_DEV_RAM].base,
                            false, NULL);
      }
 diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_e.c
 +++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_machine_init(MachineState *machine)
      SiFiveEState *s = RISCV_E_MACHINE(machine);
      MemoryRegion *sys_mem = get_system_memory();
      int i;
 +    RISCVBootInfo boot_info;
      if (machine->ram_size != mc->default_ram_size) {
          char *sz = size_to_str(mc->default_ram_size);
@@ -XXX,XX +XXX,XX @@ static void sifive_e_machine_init(MachineState *machine)
      rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                            memmap[SIFIVE_E_DEV_MROM].base, &address_space_memory);
 +    riscv_boot_info_init(&boot_info, &s->soc.cpus);
      if (machine->kernel_filename) {
 -        riscv_load_kernel(machine, &s->soc.cpus,
 +        riscv_load_kernel(machine, &boot_info,
                            memmap[SIFIVE_E_DEV_DTIM].base,
                            false, NULL);
      }
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      BlockBackend *blk;
      DeviceState *flash_dev, *sd_dev, *card_dev;
      qemu_irq flash_cs, sd_cs;
 +    RISCVBootInfo boot_info;
      /* Initialize SoC */
      object_initialize_child(OBJECT(machine), "soc", &s->soc, TYPE_RISCV_U_SOC);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
                                                       &start_addr, NULL);
 +    riscv_boot_info_init(&boot_info, &s->soc.u_cpus);
      if (machine->kernel_filename) {
 -        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc.u_cpus,
 +        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                           firmware_end_addr);
 -
 -        kernel_entry = riscv_load_kernel(machine, &s->soc.u_cpus,
 -                                         kernel_start_addr, true, NULL);
 +        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
 +                          true, NULL);
 +        kernel_entry = boot_info.image_low_addr;
      } else {
         /*
          * If dynamic firmware is used, it doesn't know where is the next mode
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      fdt_load_addr = riscv_compute_fdt_addr(memmap[SIFIVE_U_DEV_DRAM].base,
                                             memmap[SIFIVE_U_DEV_DRAM].size,
 -                                           machine, &s->soc.u_cpus);
 +                                           machine, &boot_info);
      riscv_load_fdt(fdt_load_addr, machine->fdt);
      if (!riscv_is_32bit(&s->soc.u_cpus)) {
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      char *soc_name;
      int i, base_hartid, hart_count;
      bool htif_custom_base = false;
 +    RISCVBootInfo boot_info;
      /* Check socket count limit */
      if (SPIKE_SOCKETS_MAX < riscv_socket_count(machine)) {
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      create_fdt(s, memmap, riscv_is_32bit(&s->soc[0]), htif_custom_base);
      /* Load kernel */
 +    riscv_boot_info_init(&boot_info, &s->soc[0]);
      if (machine->kernel_filename) {
 -        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
 +        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                           firmware_end_addr);
 -        kernel_entry = riscv_load_kernel(machine, &s->soc[0],
 -                                         kernel_start_addr,
 -                                         true, htif_symbol_callback);
 +        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
 +                          true, htif_symbol_callback);
 +        kernel_entry = boot_info.image_low_addr;
      } else {
         /*
          * If dynamic firmware is used, it doesn't know where is the next mode
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      fdt_load_addr = riscv_compute_fdt_addr(memmap[SPIKE_DRAM].base,
                                             memmap[SPIKE_DRAM].size,
 -                                           machine, &s->soc[0]);
 +                                           machine, &boot_info);
      riscv_load_fdt(fdt_load_addr, machine->fdt);
      /* load the reset vector */
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
      uint64_t fdt_load_addr;
      uint64_t kernel_entry = 0;
      BlockBackend *pflash_blk0;
 +    RISCVBootInfo boot_info;
      /*
       * An user provided dtb must include everything, including
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
          }
      }
-+    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
++    riscv_boot_info_init(&boot_info, &s->soc[0]);
 +    if (local_err) {
 +        error_propagate(errp, local_err);
 +        object_unref(obj);
 +        return NULL;
 +    }
 +
-     expansion_info = g_new0(CpuModelExpansionInfo, 1);
+     if (machine->kernel_filename && !kernel_entry) {
-     expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
+-        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
-     expansion_info->model->name = g_strdup(model->name);
++        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
-@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                                                          firmware_end_addr);
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_extensions);
+-
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
+-        kernel_entry = riscv_load_kernel(machine, &s->soc[0],
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
+-                                         kernel_start_addr, true, NULL);
-+    riscv_obj_add_named_feats_qdict(obj, qdict_out);
++        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
++                          true, NULL);
-     /* Add our CPU boolean options too */
++        kernel_entry = boot_info.image_low_addr;
-     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
+     }
      fdt_load_addr = riscv_compute_fdt_addr(memmap[VIRT_DRAM].base,
                                             memmap[VIRT_DRAM].size,
 -                                           machine, &s->soc[0]);
 +                                           machine, &boot_info);
      riscv_load_fdt(fdt_load_addr, machine->fdt);
      /* load the reset vector */
 --
-.43.0
+.47.1

-[PULL 17/65] hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
+[PULL 28/39] hw/riscv: Add the checking if DTB overlaps to kernel or initrd
-From: Sunil V L <sunilvl@ventanamicro.com>
+From: Jim Shu <jim.shu@sifive.com>
-Add IMSIC structure in MADT when IMSIC is configured.
+DTB is placed to the end of memory, so we will check if the start
 address of DTB overlaps to the address of kernel/initrd.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20241120153935.24706-4-jim.shu@sifive.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Message-ID: <20231218150247.466427-7-sunilvl@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt-acpi-build.c | 35 +++++++++++++++++++++++++++++++++++
+ include/hw/riscv/boot.h |  3 +++
-file changed, 35 insertions(+)
+ hw/riscv/boot.c         | 25 ++++++++++++++++++++++++-
 files changed, 27 insertions(+), 1 deletion(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
+diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
+--- a/include/hw/riscv/boot.h
-+++ b/hw/riscv/virt-acpi-build.c
++++ b/include/hw/riscv/boot.h
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
+@@ -XXX,XX +XXX,XX @@ typedef struct RISCVBootInfo {
-     MachineClass *mc = MACHINE_GET_CLASS(s);
+     hwaddr image_low_addr;
-     MachineState *ms = MACHINE(s);
+     hwaddr image_high_addr;
-     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
-+    uint8_t  group_index_bits = imsic_num_bits(riscv_socket_count(ms));
++    hwaddr initrd_start;
-+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
++    ssize_t initrd_size;
 +    uint16_t imsic_max_hart_per_socket = 0;
 +    uint8_t  hart_index_bits;
 +    uint8_t  socket;
 +
-+    for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+     bool is_32bit;
-+        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
+ } RISCVBootInfo;
-+            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-+        }
+diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/boot.c
 +++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ char *riscv_plic_hart_config_string(int hart_count)
  void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts)
  {
      info->kernel_size = 0;
 +    info->initrd_size = 0;
      info->is_32bit = riscv_is_32bit(harts);
  }
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, RISCVBootInfo *info)
          }
      }
 +    info->initrd_start = start;
 +    info->initrd_size = size;
 +
      /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
      if (fdt) {
          end = start + size;
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
      int ret = fdt_pack(ms->fdt);
      hwaddr dram_end, temp;
      int fdtsize;
 +    uint64_t dtb_start, dtb_start_limit;
      /* Should only fail if we've built a corrupted tree */
      g_assert(ret == 0);
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
          exit(1);
      }
 +    if (info->initrd_size) {
 +        /* If initrd is successfully loaded, place DTB after it. */
 +        dtb_start_limit = info->initrd_start + info->initrd_size;
 +    } else if (info->kernel_size) {
 +        /* If only kernel is successfully loaded, place DTB after it. */
 +        dtb_start_limit = info->image_high_addr;
 +    } else {
 +        /* Otherwise, do not check DTB overlapping */
 +        dtb_start_limit = 0;
 +    }
 +
-+    hart_index_bits = imsic_num_bits(imsic_max_hart_per_socket);
+     /*
+      * A dram_size == 0, usually from a MemMapEntry[].size element,
-     AcpiTable table = { .sig = "APIC", .rev = 6, .oem_id = s->oem_id,
+      * means that the DRAM block goes all the way to ms->ram_size.
-                         .oem_table_id = s->oem_table_id };
+@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
+         temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
          riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
      }
-+    /* IMSIC */
+-    return QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
++    dtb_start = QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
-+        /* IMSIC */
++
-+        build_append_int_noprefix(table_data, 0x19, 1);     /* Type */
++    if (dtb_start_limit && (dtb_start < dtb_start_limit)) {
-+        build_append_int_noprefix(table_data, 16, 1);       /* Length */
++        error_report("No enough memory to place DTB after kernel/initrd");
-+        build_append_int_noprefix(table_data, 1, 1);        /* Version */
++        exit(1);
 +        build_append_int_noprefix(table_data, 0, 1);        /* Reserved */
 +        build_append_int_noprefix(table_data, 0, 4);        /* Flags */
 +        /* Number of supervisor mode Interrupt Identities */
 +        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
 +        /* Number of guest mode Interrupt Identities */
 +        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
 +        /* Guest Index Bits */
 +        build_append_int_noprefix(table_data, guest_index_bits, 1);
 +        /* Hart Index Bits */
 +        build_append_int_noprefix(table_data, hart_index_bits, 1);
 +        /* Group Index Bits */
 +        build_append_int_noprefix(table_data, group_index_bits, 1);
 +        /* Group Index Shift */
 +        build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
 +    }
 +
-     acpi_table_end(linker, &table);
++    return dtb_start;
  }
+ /*
 --
-.43.0
+.47.1

-[PULL 26/65] target/riscv: Add support for Zacas extension
+[PULL 29/39] target/riscv: Add svukte extension capability variable
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: "Fea.Wang" <fea.wang@sifive.com>
-Add support for amocas.w/d/q instructions which are part of the ratified
+Refer to the draft of svukte extension from:
-Zacas extension: https://github.com/riscv/riscv-zacas
+https://github.com/riscv/riscv-isa-manual/pull/1564
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Svukte provides a means to make user-mode accesses to supervisor memory
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+raise page faults in constant time, mitigating attacks that attempt to
-Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
+discover the supervisor software's address-space layout.
 Signed-off-by: Fea.Wang <fea.wang@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231207153842.32401-2-rbradford@rivosinc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20241203034932.25185-2-fea.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_cfg.h                      |   1 +
+ target/riscv/cpu_cfg.h | 1 +
- target/riscv/insn32.decode                  |   6 +
+file changed, 1 insertion(+)
  target/riscv/cpu.c                          |   2 +
  target/riscv/tcg/tcg-cpu.c                  |   5 +
  target/riscv/translate.c                    |   1 +
  target/riscv/insn_trans/trans_rvzacas.c.inc | 150 ++++++++++++++++++++
 files changed, 165 insertions(+)
  create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_svnapot;
      bool ext_svpbmt;
+     bool ext_svvptc;
++    bool ext_svukte;
      bool ext_zdinx;
-+    bool ext_zacas;
+     bool ext_zaamo;
-     bool ext_zawrs;
+     bool ext_zacas;
      bool ext_zfa;
      bool ext_zfbfmin;
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
  vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
  vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +
 +# *** RV32 Zacas Standard Extension ***
 +amocas_w    00101 . . ..... ..... 010 ..... 0101111 @atom_st
 +amocas_d    00101 . . ..... ..... 011 ..... 0101111 @atom_st
 +# *** RV64 Zacas Standard Extension ***
 +amocas_q    00101 . . ..... ..... 100 ..... 0101111 @atom_st
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
      ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
      ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
 +    ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
      ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
      ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
      ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true),
      MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
      MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
 +    MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
      MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
      MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
      MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    if ((cpu->cfg.ext_zacas) && !riscv_has_ext(env, RVA)) {
 +        error_setg(errp, "Zacas extension requires A extension");
 +        return;
 +    }
 +
      if ((cpu->cfg.ext_zawrs) && !riscv_has_ext(env, RVA)) {
          error_setg(errp, "Zawrs extension requires A extension");
          return;
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
  #include "insn_trans/trans_rvv.c.inc"
  #include "insn_trans/trans_rvb.c.inc"
  #include "insn_trans/trans_rvzicond.c.inc"
 +#include "insn_trans/trans_rvzacas.c.inc"
  #include "insn_trans/trans_rvzawrs.c.inc"
  #include "insn_trans/trans_rvzicbo.c.inc"
  #include "insn_trans/trans_rvzfa.c.inc"
 diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V translation routines for the RV64 Zacas Standard Extension.
 + *
 + * Copyright (c) 2020-2023 PLCT Lab
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#define REQUIRE_ZACAS(ctx) do {          \
 +    if (!ctx->cfg_ptr->ext_zacas) {      \
 +        return false;                     \
 +    }                                     \
 +} while (0)
 +
 +static bool gen_cmpxchg(DisasContext *ctx, arg_atomic *a, MemOp mop)
 +{
 +    TCGv dest = get_gpr(ctx, a->rd, EXT_NONE);
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
 +    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 +
 +    decode_save_opc(ctx);
 +    tcg_gen_atomic_cmpxchg_tl(dest, src1, dest, src2, ctx->mem_idx, mop);
 +
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +static bool trans_amocas_w(DisasContext *ctx, arg_amocas_w *a)
 +{
 +    REQUIRE_ZACAS(ctx);
 +    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TESL);
 +}
 +
 +static TCGv_i64 get_gpr_pair(DisasContext *ctx, int reg_num)
 +{
 +    TCGv_i64 t;
 +
 +    assert(get_ol(ctx) == MXL_RV32);
 +
 +    if (reg_num == 0) {
 +        return tcg_constant_i64(0);
 +    }
 +
 +    t = tcg_temp_new_i64();
 +    tcg_gen_concat_tl_i64(t, cpu_gpr[reg_num], cpu_gpr[reg_num + 1]);
 +    return t;
 +}
 +
 +static void gen_set_gpr_pair(DisasContext *ctx, int reg_num, TCGv_i64 t)
 +{
 +    assert(get_ol(ctx) == MXL_RV32);
 +
 +    if (reg_num != 0) {
 +#ifdef TARGET_RISCV32
 +        tcg_gen_extr_i64_i32(cpu_gpr[reg_num], cpu_gpr[reg_num + 1], t);
 +#else
 +        tcg_gen_ext32s_i64(cpu_gpr[reg_num], t);
 +        tcg_gen_sari_i64(cpu_gpr[reg_num + 1], t, 32);
 +#endif
 +
 +        if (get_xl_max(ctx) == MXL_RV128) {
 +            tcg_gen_sari_tl(cpu_gprh[reg_num], cpu_gpr[reg_num], 63);
 +            tcg_gen_sari_tl(cpu_gprh[reg_num + 1], cpu_gpr[reg_num + 1], 63);
 +        }
 +    }
 +}
 +
 +static bool gen_cmpxchg64(DisasContext *ctx, arg_atomic *a, MemOp mop)
 +{
 +    /*
 +     * Encodings with odd numbered registers specified in rs2 and rd are
 +     * reserved.
 +     */
 +    if ((a->rs2 | a->rd) & 1) {
 +        return false;
 +    }
 +
 +    TCGv_i64 dest = get_gpr_pair(ctx, a->rd);
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
 +    TCGv_i64 src2 = get_gpr_pair(ctx, a->rs2);
 +
 +    decode_save_opc(ctx);
 +    tcg_gen_atomic_cmpxchg_i64(dest, src1, dest, src2, ctx->mem_idx, mop);
 +
 +    gen_set_gpr_pair(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +static bool trans_amocas_d(DisasContext *ctx, arg_amocas_d *a)
 +{
 +    REQUIRE_ZACAS(ctx);
 +    switch (get_ol(ctx)) {
 +    case MXL_RV32:
 +        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TEUQ);
 +    case MXL_RV64:
 +    case MXL_RV128:
 +        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TEUQ);
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
 +{
 +    REQUIRE_ZACAS(ctx);
 +    REQUIRE_64BIT(ctx);
 +
 +    /*
 +     * Encodings with odd numbered registers specified in rs2 and rd are
 +     * reserved.
 +     */
 +    if ((a->rs2 | a->rd) & 1) {
 +        return false;
 +    }
 +
 +#ifdef TARGET_RISCV64
 +    TCGv_i128 dest = tcg_temp_new_i128();
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
 +    TCGv_i128 src2 = tcg_temp_new_i128();
 +    TCGv_i64 src2l = get_gpr(ctx, a->rs2, EXT_NONE);
 +    TCGv_i64 src2h = get_gpr(ctx, a->rs2 == 0 ? 0 : a->rs2 + 1, EXT_NONE);
 +    TCGv_i64 destl = get_gpr(ctx, a->rd, EXT_NONE);
 +    TCGv_i64 desth = get_gpr(ctx, a->rd == 0 ? 0 : a->rd + 1, EXT_NONE);
 +
 +    tcg_gen_concat_i64_i128(src2, src2l, src2h);
 +    tcg_gen_concat_i64_i128(dest, destl, desth);
 +    decode_save_opc(ctx);
 +    tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx,
 +                                (MO_ALIGN | MO_TEUO));
 +
 +    tcg_gen_extr_i128_i64(destl, desth, dest);
 +
 +    if (a->rd != 0) {
 +        gen_set_gpr(ctx, a->rd, destl);
 +        gen_set_gpr(ctx, a->rd + 1, desth);
 +    }
 +#endif
 +
 +    return true;
 +}
 --
-.43.0
+.47.1

-[PULL 63/65] target/riscv: Assert that the CSR numbers will be correct
+[PULL 30/39] target/riscv: Support senvcfg[UKTE] bit when svukte extension is enabled
-From: Alistair Francis <alistair23@gmail.com>
+From: "Fea.Wang" <fea.wang@sifive.com>
-The CSRs will always be between either CSR_MHPMCOUNTER3 and
+Svukte extension add UKTE bit, bit[8] in senvcfg CSR. The bit will be
-CSR_MHPMCOUNTER31 or CSR_MHPMCOUNTER3H and CSR_MHPMCOUNTER31H.
+supported when the svukte extension is enabled.
-So although ctr_index can't be negative, Coverity doesn't know this and
+When senvcfg[UKTE] bit is set, the memory access from U-mode should do
-it isn't obvious to human readers either. Let's add an assert to ensure
+the svukte check only except HLV/HLVX/HSV H-mode instructions which
-that Coverity knows the values will be within range.
+depend on hstatus[HUKTE].
-To simplify the code let's also change the RV32 adjustment.
+Signed-off-by: Fea.Wang <fea.wang@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Fixes: Coverity CID 1523910
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20240108001328.280222-2-alistair.francis@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20241203034932.25185-3-fea.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 5 ++++-
+ target/riscv/cpu_bits.h | 1 +
-file changed, 4 insertions(+), 1 deletion(-)
+ target/riscv/csr.c      | 4 ++++
 files changed, 5 insertions(+)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define SENVCFG_CBIE                       MENVCFG_CBIE
+ #define SENVCFG_CBCFE                      MENVCFG_CBCFE
+ #define SENVCFG_CBZE                       MENVCFG_CBZE
++#define SENVCFG_UKTE                       BIT(8)
+ #define HENVCFG_FIOM                       MENVCFG_FIOM
+ #define HENVCFG_LPE                        MENVCFG_LPE
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException mctr(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
+         mask |= SENVCFG_SSE;
      if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
          /* Offset for RV32 mhpmcounternh counters */
 -        base_csrno += 0x80;
 +        csrno -= 0x80;
      }
++    if (env_archcpu(env)->cfg.ext_svukte) {
++        mask |= SENVCFG_UKTE;
++    }
 +
-+    g_assert(csrno >= CSR_MHPMCOUNTER3 && csrno <= CSR_MHPMCOUNTER31);
+     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
-+
+     return RISCV_EXCP_NONE;
-     ctr_index = csrno - base_csrno;
+ }
      if ((BIT(ctr_index) & pmu_avail_ctrs >> 3) == 0) {
          /* The PMU is not enabled or counter is out of range */
 --
-.43.0
+.47.1

-[PULL 04/65] target/riscv: Not allow write mstatus_vs without RVV
+[PULL 31/39] target/riscv: Support hstatus[HUKTE] bit when svukte extension is enabled
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: "Fea.Wang" <fea.wang@sifive.com>
-If CPU does not implement the Vector extension, it usually means
+Svukte extension add HUKTE bit, bit[24] in hstatus CSR. The written
-mstatus vs hardwire to zero. So we should not allow write a
+value will be masked when the svukte extension is not enabled.
 non-zero value to this field.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+When hstatus[HUKTE] bit is set, HLV/HLVX/HSV work in the U-mode should
 do svukte check.
 Signed-off-by: Fea.Wang <fea.wang@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231215023313.1708-1-zhiwei_liu@linux.alibaba.com>
+Message-ID: <20241203034932.25185-4-fea.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 5 ++++-
+ target/riscv/cpu_bits.h | 1 +
-file changed, 4 insertions(+), 1 deletion(-)
+ target/riscv/csr.c      | 3 +++
 files changed, 4 insertions(+)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+ #define HSTATUS_VTVM         0x00100000
+ #define HSTATUS_VTW          0x00200000
+ #define HSTATUS_VTSR         0x00400000
++#define HSTATUS_HUKTE        0x01000000
+ #define HSTATUS_VSXL         0x300000000
+ #define HSTATUS32_WPRI       0xFF8FF87E
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
-     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
+ static RISCVException write_hstatus(CPURISCVState *env, int csrno,
-         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
+                                     target_ulong val)
-         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
+ {
--        MSTATUS_TW | MSTATUS_VS;
++    if (!env_archcpu(env)->cfg.ext_svukte) {
-+        MSTATUS_TW;
++        val = val & (~HSTATUS_HUKTE);
      if (riscv_has_ext(env, RVF)) {
          mask |= MSTATUS_FS;
      }
 +    if (riscv_has_ext(env, RVV)) {
 +        mask |= MSTATUS_VS;
 +    }
+     env->hstatus = val;
-     if (xl != MXL_RV32 || env->debugger) {
+     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
-         if (riscv_has_ext(env, RVH)) {
+         qemu_log_mask(LOG_UNIMP,
 --
-.43.0
+.47.1

-[PULL 51/65] target/riscv: add satp_mode profile support
+[PULL 32/39] target/riscv: Check memory access to meet svukte rule
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: "Fea.Wang" <fea.wang@sifive.com>
-'satp_mode' is a requirement for supervisor profiles like RVA22S64.
+Follow the Svukte spec, do the memory access address checking
 User-mode/application profiles like RVA22U64 doesn't care.
-Add 'satp_mode' to the profile description. If a profile requires it,
+. Include instruction fetches or explicit memory accesses
-set it during cpu_set_profile(). We'll also check it during finalize()
+. System run in effective privilege U or VU
-to validate if the running config implements the profile.
+. Check senvcfg[UKTE] being set, or hstatus[HUKTE] being set if
 instruction is HLV, HLVX, HSV and execute from U mode to VU mode
 . Depend on Sv39 and check virtual addresses bit[SXLEN-1]
 . Raises a page-fault exception corresponding to the original access
 type.
+Ref: https://github.com/riscv/riscv-isa-manual/pull/1564/files
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Fea.Wang <fea.wang@sifive.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231218125334.37184-24-dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20241203034932.25185-5-fea.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  1 +
+ target/riscv/cpu_helper.c | 55 +++++++++++++++++++++++++++++++++++++++
- target/riscv/cpu.c         |  1 +
+file changed, 55 insertions(+)
  target/riscv/tcg/tcg-cpu.c | 40 ++++++++++++++++++++++++++++++++++++++
 files changed, 42 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
+@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot, hwaddr addr,
-     bool enabled;
+     return TRANSLATE_SUCCESS;
      bool user_set;
      int priv_spec;
 +    int satp_mode;
      const int32_t ext_offsets[];
  } RISCVCPUProfile;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
      .name = "rva22u64",
      .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
      .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
 +    .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
      .ext_offsets = {
          CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
          CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      riscv_cpu_disable_priv_spec_isa_exts(cpu);
  }
-+#ifndef CONFIG_USER_ONLY
++/* Returns 'true' if a svukte address check is needed */
-+static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
++static bool do_svukte_check(CPURISCVState *env, bool first_stage,
-+                                            RISCVCPUProfile *profile,
++                             int mode, bool virt)
 +                                            bool send_warn)
 +{
-+    int satp_max = satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
++    /* Svukte extension depends on Sv39. */
 +    if (!(env_archcpu(env)->cfg.ext_svukte ||
 +        !first_stage ||
 +        VM_1_10_SV39 != get_field(env->satp, SATP64_MODE))) {
 +        return false;
 +    }
 +
-+    if (profile->satp_mode > satp_max) {
++    /*
-+        if (send_warn) {
++     * Check hstatus.HUKTE if the effective mode is switched to VU-mode by
-+            bool is_32bit = riscv_cpu_is_32bit(cpu);
++     * executing HLV/HLVX/HSV in U-mode.
-+            const char *req_satp = satp_mode_str(profile->satp_mode, is_32bit);
++     * For other cases, check senvcfg.UKTE.
-+            const char *cur_satp = satp_mode_str(satp_max, is_32bit);
++     */
 +    if (env->priv == PRV_U && !env->virt_enabled && virt) {
 +        if (!get_field(env->hstatus, HSTATUS_HUKTE)) {
 +            return false;
 +        }
 +    } else if (!get_field(env->senvcfg, SENVCFG_UKTE)) {
 +        return false;
 +    }
 +
-+            warn_report("Profile %s requires satp mode %s, "
++    /*
-+                        "but satp mode %s was set", profile->name,
++     * Svukte extension is qualified only in U or VU-mode.
-+                        req_satp, cur_satp);
++     *
-+        }
++     * Effective mode can be switched to U or VU-mode by:
-+
++     *   - M-mode + mstatus.MPRV=1 + mstatus.MPP=U-mode.
 +     *   - Execute HLV/HLVX/HSV from HS-mode + hstatus.SPVP=0.
 +     *   - U-mode.
 +     *   - VU-mode.
 +     *   - Execute HLV/HLVX/HSV from U-mode + hstatus.HU=1.
 +     */
 +    if (mode != PRV_U) {
 +        return false;
 +    }
 +
 +    return true;
 +}
-+#endif
 +
- static void riscv_cpu_validate_profile(RISCVCPU *cpu,
++static bool check_svukte_addr(CPURISCVState *env, vaddr addr)
-                                        RISCVCPUProfile *profile)
++{
- {
++    /* svukte extension excludes RV32 */
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
++    uint32_t sxlen = 32 * riscv_cpu_sxl(env);
-     bool profile_impl = true;
++    uint64_t high_bit = addr & (1UL << (sxlen - 1));
-     int i;
++    return !high_bit;
++}
-+#ifndef CONFIG_USER_ONLY
++
-+    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+ /*
-+        profile_impl = riscv_cpu_validate_profile_satp(cpu, profile,
+  * get_physical_address - get the physical address for this virtual address
-+                                                       send_warn);
+  *
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      MemTxResult res;
      MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
      int mode = mmuidx_priv(mmu_idx);
 +    bool virt = mmuidx_2stage(mmu_idx);
      bool use_background = false;
      hwaddr ppn;
      int napot_bits = 0;
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      bool is_sstack_idx = ((mmu_idx & MMU_IDX_SS_WRITE) == MMU_IDX_SS_WRITE);
      bool sstack_page = false;
 +    if (do_svukte_check(env, first_stage, mode, virt) &&
 +        !check_svukte_addr(env, addr)) {
 +        return TRANSLATE_FAIL;
 +    }
-+#endif
 +
-     if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
+     /*
-         profile->priv_spec != env->priv_ver) {
+      * Check if we should use the background registers for the two
-         profile_impl = false;
+      * stage translation. We don't need to check if we actually need
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
          cpu->env.priv_ver = profile->priv_spec;
      }
 +#ifndef CONFIG_USER_ONLY
 +    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
 +        const char *satp_prop = satp_mode_str(profile->satp_mode,
 +                                              riscv_cpu_is_32bit(cpu));
 +        object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
 +    }
 +#endif
 +
      for (i = 0; misa_bits[i] != 0; i++) {
          uint32_t bit = misa_bits[i];
 --
-.43.0
+.47.1

-[PULL 36/65] target/riscv: add rva22u64 profile definition
+[PULL 33/39] target/riscv: Expose svukte ISA extension
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: "Fea.Wang" <fea.wang@sifive.com>
-The rva22U64 profile, described in:
+Add "svukte" in the ISA string when svukte extension is enabled.
-https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc#rva22-profiles
+Signed-off-by: Fea.Wang <fea.wang@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Contains a set of CPU extensions aimed for 64-bit userspace
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-applications. Enabling this set to be enabled via a single user flag
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-makes it convenient to enable a predictable set of features for the CPU,
+Message-ID: <20241203034932.25185-6-fea.wang@sifive.com>
 giving users more predicability when running/testing their workloads.
 QEMU implements all possible extensions of this profile. All the so
 called 'synthetic extensions' described in the profile that are cache
 related are ignored/assumed enabled (Za64rs, Zic64b, Ziccif, Ziccrse,
 Ziccamoa, Zicclsm) since we do not implement a cache model.
 An abstraction called RISCVCPUProfile is created to store the profile.
 'ext_offsets' contains mandatory extensions that QEMU supports. Same
 thing with the 'misa_ext' mask. Optional extensions must be enabled
 manually in the command line if desired.
 The design here is to use the common target/riscv/cpu.c file to store
 the profile declaration and export it to the accelerator files. Each
 accelerator is then responsible to expose it (or not) to users and how
 to enable the extensions.
 Next patches will implement the profile for TCG and KVM.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 12 ++++++++++++
+ target/riscv/cpu.c | 2 ++
- target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
+file changed, 2 insertions(+)
 files changed, 44 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
- #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
-+typedef struct riscv_cpu_profile {
-+    const char *name;
-+    uint32_t misa_ext;
-+    bool enabled;
-+    bool user_set;
-+    const int32_t ext_offsets[];
-+} RISCVCPUProfile;
-+
-+#define RISCV_PROFILE_EXT_LIST_END -1
-+
-+extern RISCVCPUProfile *riscv_profiles[];
-+
- /* Privileged specification version */
- enum {
-     PRIV_VERSION_1_10_0 = 0,
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
      ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
      ISA_EXT_DATA_ENTRY(svpbmt, PRIV_VERSION_1_12_0, ext_svpbmt),
 +    ISA_EXT_DATA_ENTRY(svukte, PRIV_VERSION_1_13_0, ext_svukte),
      ISA_EXT_DATA_ENTRY(svvptc, PRIV_VERSION_1_13_0, ext_svvptc),
      ISA_EXT_DATA_ENTRY(xtheadba, PRIV_VERSION_1_11_0, ext_xtheadba),
      ISA_EXT_DATA_ENTRY(xtheadbb, PRIV_VERSION_1_11_0, ext_xtheadbb),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[] = {
  /* These are experimental so mark with 'x-' */
  const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
 +    MULTI_EXT_CFG_BOOL("x-svukte", ext_svukte, false),
      DEFINE_PROP_END_OF_LIST(),
  };
-+/*
-+ * RVA22U64 defines some 'named features' or 'synthetic extensions'
-+ * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
-+ * and Zicclsm. We do not implement caching in QEMU so we'll consider
-+ * all these named features as always enabled.
-+ *
-+ * There's no riscv,isa update for them (nor for zic64b, despite it
-+ * having a cfg offset) at this moment.
-+ */
-+static RISCVCPUProfile RVA22U64 = {
-+    .name = "rva22u64",
-+    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
-+    .ext_offsets = {
-+        CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
-+        CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
-+        CPU_CFG_OFFSET(ext_zbs), CPU_CFG_OFFSET(ext_zfhmin),
-+        CPU_CFG_OFFSET(ext_zkt), CPU_CFG_OFFSET(ext_zicntr),
-+        CPU_CFG_OFFSET(ext_zihpm), CPU_CFG_OFFSET(ext_zicbom),
-+        CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
-+
-+        /* mandatory named features for this profile */
-+        CPU_CFG_OFFSET(zic64b),
-+
-+        RISCV_PROFILE_EXT_LIST_END
-+    }
-+};
-+
-+RISCVCPUProfile *riscv_profiles[] = {
-+    &RVA22U64,
-+    NULL,
-+};
-+
- static Property riscv_cpu_properties[] = {
-     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 --
-.43.0
+.47.1

-[PULL 38/65] target/riscv/tcg: add user flag for profile support
+[PULL 34/39] target/riscv: Check svukte is not enabled in RV32
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: "Fea.Wang" <fea.wang@sifive.com>
-The TCG emulation implements all the extensions described in the
+The spec explicitly says svukte doesn't support RV32. So check that it
-RVA22U64 profile, both mandatory and optional. The mandatory extensions
+is not enabled in RV32.
 will be enabled via the profile flag. We'll leave the optional
 extensions to be enabled by hand.
-Given that this is the first profile we're implementing in TCG we'll
+Signed-off-by: Fea.Wang <fea.wang@sifive.com>
 need some ground work first:
 - all profiles declared in riscv_profiles[] will be exposed to users.
 TCG is the main accelerator we're considering when adding profile
 support in QEMU, so for now it's safe to assume that all profiles in
 riscv_profiles[] will be relevant to TCG;
 - we'll not support user profile settings for vendor CPUs. The flags
 will still be exposed but users won't be able to change them;
 - profile support, albeit available for all non-vendor CPUs, will be
 based on top of the new 'rv64i' CPU. Setting a profile to 'true' means
 enable all mandatory extensions of this profile, setting it to 'false'
 will disable all mandatory profile extensions of the CPU, which will
 obliterate preset defaults. This is not a problem for a bare CPU like
 rv64i but it can allow for silly scenarios when using other CPUs. E.g.
 an user can do "-cpu rv64,rva22u64=false" and have a bunch of default
 rv64 extensions disabled. The recommended way of using profiles is the
 rv64i CPU, but users are free to experiment.
 For now we'll handle multi-letter extensions only. MISA extensions need
 additional steps that we'll take care later. At this point we can boot a
 Linux buildroot using rva22u64 using the following options:
 -cpu rv64i,rva22u64=true,sv39=true,g=true,c=true,s=true
 Note that being an usermode/application profile we still need to
 explicitly set 's=true' to enable Supervisor mode to boot Linux.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-11-dbarboza@ventanamicro.com>
+Message-ID: <20241203034932.25185-7-fea.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 80 ++++++++++++++++++++++++++++++++++++++
+ target/riscv/tcg/tcg-cpu.c | 5 +++++
-file changed, 80 insertions(+)
+file changed, 5 insertions(+)
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     return false;
+         return;
  }
 +static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
 +{
 +    switch (feat_offset) {
 +    case CPU_CFG_OFFSET(zic64b):
 +        cpu->cfg.cbom_blocksize = 64;
 +        cpu->cfg.cbop_blocksize = 64;
 +        cpu->cfg.cboz_blocksize = 64;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
  static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
                                          uint32_t ext_offset)
  {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
      }
- }
++    if (mcc->misa_mxl_max == MXL_RV32 && cpu->cfg.ext_svukte) {
-+static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
++        error_setg(errp, "svukte is not supported for RV32");
 +                            void *opaque, Error **errp)
 +{
 +    RISCVCPUProfile *profile = opaque;
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    bool value;
 +    int i, ext_offset;
 +
 +    if (riscv_cpu_is_vendor(obj)) {
 +        error_setg(errp, "Profile %s is not available for vendor CPUs",
 +                   profile->name);
 +        return;
 +    }
 +
-+    if (cpu->env.misa_mxl != MXL_RV64) {
+     /*
-+        error_setg(errp, "Profile %s only available for 64 bit CPUs",
+      * Disable isa extensions based on priv spec after we
-+                   profile->name);
+      * validated and set everything we need.
 +        return;
 +    }
 +
 +    if (!visit_type_bool(v, name, &value, errp)) {
 +        return;
 +    }
 +
 +    profile->user_set = true;
 +    profile->enabled = value;
 +
 +    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
 +        ext_offset = profile->ext_offsets[i];
 +
 +        if (profile->enabled) {
 +            if (cpu_cfg_offset_is_named_feat(ext_offset)) {
 +                riscv_cpu_enable_named_feat(cpu, ext_offset);
 +            }
 +
 +            cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
 +        }
 +
 +        g_hash_table_insert(multi_ext_user_opts,
 +                            GUINT_TO_POINTER(ext_offset),
 +                            (gpointer)profile->enabled);
 +        isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
 +    }
 +}
 +
 +static void cpu_get_profile(Object *obj, Visitor *v, const char *name,
 +                            void *opaque, Error **errp)
 +{
 +    RISCVCPUProfile *profile = opaque;
 +    bool value = profile->enabled;
 +
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
 +static void riscv_cpu_add_profiles(Object *cpu_obj)
 +{
 +    for (int i = 0; riscv_profiles[i] != NULL; i++) {
 +        const RISCVCPUProfile *profile = riscv_profiles[i];
 +
 +        object_property_add(cpu_obj, profile->name, "bool",
 +                            cpu_get_profile, cpu_set_profile,
 +                            NULL, (void *)profile);
 +    }
 +}
 +
  static bool cpu_ext_is_deprecated(const char *ext_name)
  {
      return isupper(ext_name[0]);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
      riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_deprecated_exts);
 +    riscv_cpu_add_profiles(obj);
 +
      for (Property *prop = riscv_cpu_options; prop && prop->name; prop++) {
          qdev_property_add_static(DEVICE(obj), prop);
      }
 --
-.43.0
+.47.1

-[PULL 06/65] target/riscv/cpu.c: fix machine IDs getters
+[PULL 35/39] target/riscv: Include missing headers in 'vector_internals.h'
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-mvendorid is an uint32 property, mimpid/marchid are uint64 properties.
+Rather than relying on implicit includes, explicit them,
-But their getters are returning bools. The reason this went under the
+in order to avoid when refactoring unrelated headers:
 radar for this long is because we have no code using the getters.
-The problem can be seem via the 'qom-get' API though. Launching QEMU
+  target/riscv/vector_internals.h:36:12: error: call to undeclared function 'FIELD_EX32'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
-with the 'veyron-v1' CPU, a model with:
+|     return FIELD_EX32(simd_data(desc), VDATA, NF);
         |            ^
-VEYRON_V1_MVENDORID: 0x61f (1567)
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 VEYRON_V1_MIMPID: 0x111 (273)
 VEYRON_V1_MARCHID: 0x8000000000010000 (9223372036854841344)
 This is what the API returns when retrieving these properties:
 (qemu) qom-get /machine/soc0/harts[0] mvendorid
 true
 (qemu) qom-get /machine/soc0/harts[0] mimpid
 true
 (qemu) qom-get /machine/soc0/harts[0] marchid
 true
 After this patch:
 (qemu) qom-get /machine/soc0/harts[0] mvendorid
 (qemu) qom-get /machine/soc0/harts[0] mimpid
 (qemu) qom-get /machine/soc0/harts[0] marchid
 9223372036854841344
 Fixes: 1e34150045 ("target/riscv/cpu.c: restrict 'mvendorid' value")
 Fixes: a1863ad368 ("target/riscv/cpu.c: restrict 'mimpid' value")
 Fixes: d6a427e2c0 ("target/riscv/cpu.c: restrict 'marchid' value")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231211170732.2541368-1-dbarboza@ventanamicro.com>
+Message-ID: <20241203200828.47311-2-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 12 ++++++------
+ target/riscv/vector_internals.h | 1 +
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/vector_internals.h
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/vector_internals.h
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@
- static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+ #define TARGET_RISCV_VECTOR_INTERNALS_H
-                               void *opaque, Error **errp)
- {
+ #include "qemu/bitops.h"
--    bool value = RISCV_CPU(obj)->cfg.mvendorid;
++#include "hw/registerfields.h"
-+    uint32_t value = RISCV_CPU(obj)->cfg.mvendorid;
+ #include "cpu.h"
+ #include "tcg/tcg-gvec-desc.h"
--    visit_type_bool(v, name, &value, errp);
+ #include "internals.h"
 +    visit_type_uint32(v, name, &value, errp);
  }
  static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
  static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
  {
 -    bool value = RISCV_CPU(obj)->cfg.mimpid;
 +    uint64_t value = RISCV_CPU(obj)->cfg.mimpid;
 -    visit_type_bool(v, name, &value, errp);
 +    visit_type_uint64(v, name, &value, errp);
  }
  static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
  static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
  {
 -    bool value = RISCV_CPU(obj)->cfg.marchid;
 +    uint64_t value = RISCV_CPU(obj)->cfg.marchid;
 -    visit_type_bool(v, name, &value, errp);
 +    visit_type_uint64(v, name, &value, errp);
  }
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
 --
-.43.0
+.47.1

-[PULL 01/65] target/riscv: Add vill check for whole vector register move instructions
+[PULL 36/39] target/riscv: Include missing headers in 'internals.h'
-From: Max Chou <max.chou@sifive.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The ratified version of RISC-V V spec section 16.6 says that
+Rather than relying on implicit includes, explicit them,
-`The instructions operate as if EEW=SEW`.
+in order to avoid when refactoring unrelated headers:
-So the whole vector register move instructions depend on the vtype
+  target/riscv/internals.h:49:15: error: use of undeclared identifier 'PRV_S'
-register that means the whole vector register move instructions should
+|         ret = PRV_S;
-raise an illegal-instruction exception when vtype.vill=1.
+        |               ^
   target/riscv/internals.h:93:9: error: call to undeclared function 'env_archcpu'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
 |     if (env_archcpu(env)->cfg.ext_zfinx) {
         |         ^
   target/riscv/internals.h:101:15: error: unknown type name 'float32'; did you mean 'float'?
 | static inline float32 check_nanbox_s(CPURISCVState *env, uint64_t f)
         |               ^~~~~~~
         |               float
-Signed-off-by: Max Chou <max.chou@sifive.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231129170400.21251-2-max.chou@sifive.com>
+Message-ID: <20241203200828.47311-3-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 5 +++--
+ target/riscv/internals.h | 3 +++
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 3 insertions(+)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+diff --git a/target/riscv/internals.h b/target/riscv/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
+--- a/target/riscv/internals.h
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
+@@ -XXX,XX +XXX,XX @@
- }
+ #ifndef RISCV_CPU_INTERNALS_H
  #define RISCV_CPU_INTERNALS_H
 +#include "exec/cpu-common.h"
  #include "hw/registerfields.h"
 +#include "fpu/softfloat-types.h"
 +#include "target/riscv/cpu_bits.h"
  /*
-- * Whole Vector Register Move Instructions ignore vtype and vl setting.
+  * The current MMU Modes are:
 - * Thus, we don't need to check vill bit. (Section 16.6)
 + * Whole Vector Register Move Instructions depend on vtype register(vsew).
 + * Thus, we need to check vill bit. (Section 16.6)
   */
  #define GEN_VMV_WHOLE_TRANS(NAME, LEN)                             \
  static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
  {                                                                       \
      if (require_rvv(s) &&                                               \
 +        vext_check_isa_ill(s) &&                                        \
          QEMU_IS_ALIGNED(a->rd, LEN) &&                                  \
          QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
          uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
 --
-.43.0
+.47.1

-[PULL 02/65] target/riscv: The whole vector register move instructions depend on vsew
+Deleted patch
-From: Max Chou <max.chou@sifive.com>
-The RISC-V v spec 16.6 section says that the whole vector register move
-instructions operate as if EEW=SEW. So it should depends on the vsew
-field of vtype register.
-Signed-off-by: Max Chou <max.chou@sifive.com>
-Acked-by: Richard Henderson <richard.henderson@linaro.org>
-Message-ID: <20231129170400.21251-3-max.chou@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
-         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
-         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
-         if (s->vstart_eq_zero) {                                        \
--            /* EEW = 8 */                                               \
--            tcg_gen_gvec_mov(MO_8, vreg_ofs(s, a->rd),                  \
-+            tcg_gen_gvec_mov(s->sew, vreg_ofs(s, a->rd),                \
-                              vreg_ofs(s, a->rs2), maxsz, maxsz);        \
-             mark_vs_dirty(s);                                           \
-         } else {                                                        \
---
-.43.0

-[PULL 03/65] target/riscv: Fix th.dcache.cval1 priviledge check
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-According to the specification, the th.dcache.cvall1 can be executed
-under all priviledges.
-The specification about xtheadcmo located in,
-https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadcmo/dcache_cval1.adoc
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Christoph Muellner <christoph.muellner@vrull.eu>
-Message-ID: <20231208094315.177-1-zhiwei_liu@linux.alibaba.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_xthead.c.inc | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_xthead.c.inc
-+++ b/target/riscv/insn_trans/trans_xthead.c.inc
-@@ -XXX,XX +XXX,XX @@ NOP_PRIVCHECK(th_dcache_csw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_dcache_cisw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_dcache_isw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_dcache_cpal1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
--NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
-+NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU)
- NOP_PRIVCHECK(th_icache_iall, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
- NOP_PRIVCHECK(th_icache_ialls, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
---
-.43.0

-[PULL 05/65] target/riscv/pmp: Use hwaddr instead of target_ulong for RV32
+Deleted patch
-From: Ivan Klokov <ivan.klokov@syntacore.com>
-The Sv32 page-based virtual-memory scheme described in RISCV privileged
-spec Section 5.3 supports 34-bit physical addresses for RV32, so the
-PMP scheme must support addresses wider than XLEN for RV32. However,
-PMP address register format is still 32 bit wide.
-Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231123091214.20312-1-ivan.klokov@syntacore.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/pmp.h |  8 ++++----
- target/riscv/pmp.c | 26 ++++++++++++--------------
-files changed, 16 insertions(+), 18 deletions(-)
-diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.h
-+++ b/target/riscv/pmp.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- } pmp_entry_t;
- typedef struct {
--    target_ulong sa;
--    target_ulong ea;
-+    hwaddr sa;
-+    hwaddr ea;
- } pmp_addr_t;
- typedef struct {
-@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env);
- void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-                        target_ulong val);
- target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
--bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
-                         target_ulong size, pmp_priv_t privs,
-                         pmp_priv_t *allowed_privs,
-                         target_ulong mode);
--target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr);
-+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr);
- void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
- void pmp_update_rule_nums(CPURISCVState *env);
- uint32_t pmp_get_num_rules(CPURISCVState *env);
-diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.c
-+++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ void pmp_unlock_entries(CPURISCVState *env)
-     }
- }
--static void pmp_decode_napot(target_ulong a, target_ulong *sa,
--                             target_ulong *ea)
-+static void pmp_decode_napot(hwaddr a, hwaddr *sa, hwaddr *ea)
- {
-     /*
-      * aaaa...aaa0   8-byte NAPOT range
-@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
-     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
-     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
-     target_ulong prev_addr = 0u;
--    target_ulong sa = 0u;
--    target_ulong ea = 0u;
-+    hwaddr sa = 0u;
-+    hwaddr ea = 0u;
-     if (pmp_index >= 1u) {
-         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
-@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_nums(CPURISCVState *env)
-     }
- }
--static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
--                           target_ulong addr)
-+static int pmp_is_in_range(CPURISCVState *env, int pmp_index, hwaddr addr)
- {
-     int result = 0;
-@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, pmp_priv_t privs,
-  * Return true if a pmp rule match or default match
-  * Return false if no match
-  */
--bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
-                         target_ulong size, pmp_priv_t privs,
-                         pmp_priv_t *allowed_privs, target_ulong mode)
- {
-     int i = 0;
-     int pmp_size = 0;
--    target_ulong s = 0;
--    target_ulong e = 0;
-+    hwaddr s = 0;
-+    hwaddr e = 0;
-     /* Short cut if no rules */
-     if (0 == pmp_get_num_rules(env)) {
-@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env)
-  * To avoid this we return a size of 1 (which means no caching) if the PMP
-  * region only covers partial of the TLB page.
-  */
--target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr)
-+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr)
- {
--    target_ulong pmp_sa;
--    target_ulong pmp_ea;
--    target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
--    target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
-+    hwaddr pmp_sa;
-+    hwaddr pmp_ea;
-+    hwaddr tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
-+    hwaddr tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
-     int i;
-     /*
---
-.43.0

-[PULL 07/65] target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM_REG_RISCV_FP_F regs have u32 size according to the API, but by using
-kvm_riscv_reg_id() in RISCV_FP_F_REG() we're returning u64 sizes when
-running with TARGET_RISCV64. The most likely reason why no one noticed
-this is because we're not implementing kvm_cpu_synchronize_state() in
-RISC-V yet.
-Create a new helper that returns a KVM ID with u32 size and use it in
-RISCV_FP_F_REG().
-Reported-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-2-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
-file changed, 8 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-     return id;
- }
-+static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
-+{
-+    return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
-+}
-+
- #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
-                  KVM_REG_RISCV_CORE_REG(name))
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
- #define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
-                  KVM_REG_RISCV_TIMER_REG(name))
--#define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
-+#define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
- #define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
-     if (riscv_has_ext(env, RVF)) {
-         uint32_t reg;
-         for (i = 0; i < 32; i++) {
--            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
-+            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(i), &reg);
-             if (ret) {
-                 return ret;
-             }
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
-         uint32_t reg;
-         for (i = 0; i < 32; i++) {
-             reg = env->fpr[i];
--            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
-+            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(i), &reg);
-             if (ret) {
-                 return ret;
-             }
---
-.43.0

-[PULL 08/65] target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM_REG_RISCV_FP_D regs are always u64 size. Using kvm_riscv_reg_id() in
-RISCV_FP_D_REG() ends up encoding the wrong size if we're running with
-TARGET_RISCV32.
-Create a new helper that returns a KVM ID with u64 size and use it with
-RISCV_FP_D_REG().
-Reported-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-3-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
-file changed, 8 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
-     return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
- }
-+static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-+{
-+    return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
-+}
-+
- #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
-                  KVM_REG_RISCV_CORE_REG(name))
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
- #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
--#define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
-+#define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
- #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
-     do { \
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
-     if (riscv_has_ext(env, RVD)) {
-         uint64_t reg;
-         for (i = 0; i < 32; i++) {
--            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
-+            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(i), &reg);
-             if (ret) {
-                 return ret;
-             }
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
-         uint64_t reg;
-         for (i = 0; i < 32; i++) {
-             reg = env->fpr[i];
--            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
-+            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(i), &reg);
-             if (ret) {
-                 return ret;
-             }
---
-.43.0

-[PULL 09/65] target/riscv/kvm: change timer regs size to u64
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-KVM_REG_RISCV_TIMER regs are always u64 according to the KVM API, but at
-this moment we'll return u32 regs if we're running a RISCV32 target.
-Use the kvm_riscv_reg_id_u64() helper in RISCV_TIMER_REG() to fix it.
-Reported-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-4-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 26 +++++++++++++-------------
-file changed, 13 insertions(+), 13 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
- #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
-                  KVM_REG_RISCV_CSR_REG(name))
--#define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
-+#define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
-                  KVM_REG_RISCV_TIMER_REG(name))
- #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-         } \
-     } while (0)
--#define KVM_RISCV_GET_TIMER(cs, env, name, reg) \
-+#define KVM_RISCV_GET_TIMER(cs, name, reg) \
-     do { \
--        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
-+        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
-         if (ret) { \
-             abort(); \
-         } \
-     } while (0)
--#define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
-+#define KVM_RISCV_SET_TIMER(cs, name, reg) \
-     do { \
--        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
-+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
-         if (ret) { \
-             abort(); \
-         } \
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_get_regs_timer(CPUState *cs)
-         return;
-     }
--    KVM_RISCV_GET_TIMER(cs, env, time, env->kvm_timer_time);
--    KVM_RISCV_GET_TIMER(cs, env, compare, env->kvm_timer_compare);
--    KVM_RISCV_GET_TIMER(cs, env, state, env->kvm_timer_state);
--    KVM_RISCV_GET_TIMER(cs, env, frequency, env->kvm_timer_frequency);
-+    KVM_RISCV_GET_TIMER(cs, time, env->kvm_timer_time);
-+    KVM_RISCV_GET_TIMER(cs, compare, env->kvm_timer_compare);
-+    KVM_RISCV_GET_TIMER(cs, state, env->kvm_timer_state);
-+    KVM_RISCV_GET_TIMER(cs, frequency, env->kvm_timer_frequency);
-     env->kvm_timer_dirty = true;
- }
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-         return;
-     }
--    KVM_RISCV_SET_TIMER(cs, env, time, env->kvm_timer_time);
--    KVM_RISCV_SET_TIMER(cs, env, compare, env->kvm_timer_compare);
-+    KVM_RISCV_SET_TIMER(cs, time, env->kvm_timer_time);
-+    KVM_RISCV_SET_TIMER(cs, compare, env->kvm_timer_compare);
-     /*
-      * To set register of RISCV_TIMER_REG(state) will occur a error from KVM
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-      * TODO If KVM changes, adapt here.
-      */
-     if (env->kvm_timer_state) {
--        KVM_RISCV_SET_TIMER(cs, env, state, env->kvm_timer_state);
-+        KVM_RISCV_SET_TIMER(cs, state, env->kvm_timer_state);
-     }
-     /*
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
-      * during the migration.
-      */
-     if (migration_is_running(migrate_get_current()->state)) {
--        KVM_RISCV_GET_TIMER(cs, env, frequency, reg);
-+        KVM_RISCV_GET_TIMER(cs, frequency, reg);
-         if (reg != env->kvm_timer_frequency) {
-             error_report("Dst Hosts timer frequency != Src Hosts");
-         }
---
-.43.0

-[PULL 10/65] target/riscv/kvm: add RISCV_CONFIG_REG()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Create a RISCV_CONFIG_REG() macro, similar to what other regs use, to
-hide away some of the boilerplate.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-5-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 25 +++++++++++--------------
-file changed, 11 insertions(+), 14 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
- #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
-                  KVM_REG_RISCV_CSR_REG(name))
-+#define RISCV_CONFIG_REG(env, name) \
-+    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
-+                     KVM_REG_RISCV_CONFIG_REG(name))
-+
- #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
-                  KVM_REG_RISCV_TIMER_REG(name))
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
-     struct kvm_one_reg reg;
-     int ret;
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
-+    reg.id = RISCV_CONFIG_REG(env, mvendorid);
-     reg.addr = (uint64_t)&cpu->cfg.mvendorid;
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-     if (ret != 0) {
-         error_report("Unable to retrieve mvendorid from host, error %d", ret);
-     }
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                              KVM_REG_RISCV_CONFIG_REG(marchid));
-+    reg.id = RISCV_CONFIG_REG(env, marchid);
-     reg.addr = (uint64_t)&cpu->cfg.marchid;
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-     if (ret != 0) {
-         error_report("Unable to retrieve marchid from host, error %d", ret);
-     }
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                              KVM_REG_RISCV_CONFIG_REG(mimpid));
-+    reg.id = RISCV_CONFIG_REG(env, mimpid);
-     reg.addr = (uint64_t)&cpu->cfg.mimpid;
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-     if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
-     struct kvm_one_reg reg;
-     int ret;
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                              KVM_REG_RISCV_CONFIG_REG(isa));
-+    reg.id = RISCV_CONFIG_REG(env, isa);
-     reg.addr = (uint64_t)&env->misa_ext_mask;
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
-     uint64_t id;
-     int ret;
--    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
-+    id = RISCV_CONFIG_REG(env, mvendorid);
-     /*
-      * cfg.mvendorid is an uint32 but a target_ulong will
-      * be written. Assign it to a target_ulong var to avoid
-@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
-         return ret;
-     }
--    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                          KVM_REG_RISCV_CONFIG_REG(marchid));
-+    id = RISCV_CONFIG_REG(env, marchid);
-     ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
-     if (ret != 0) {
-         return ret;
-     }
--    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                          KVM_REG_RISCV_CONFIG_REG(mimpid));
-+    id = RISCV_CONFIG_REG(env, mimpid);
-     ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
-     return ret;
---
-.43.0

-[PULL 11/65] target/riscv/kvm: rename riscv_reg_id() to riscv_reg_id_ulong()
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-kvm_riscv_reg_id() returns an id encoded with an ulong size, i.e. an u32
-size when running TARGET_RISCV32 and u64 when running TARGET_RISCV64.
-Rename it to kvm_riscv_reg_id_ulong() to enhance code readability. It'll
-be in line with the existing kvm_riscv_reg_id_<size>() helpers.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-ID: <20231208183835.2411523-6-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/kvm/kvm-cpu.c | 40 ++++++++++++++++++++------------------
-file changed, 21 insertions(+), 19 deletions(-)
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ void riscv_kvm_aplic_request(void *opaque, int irq, int level)
- static bool cap_has_mp_state;
--static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-+static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
-                                  uint64_t idx)
- {
-     uint64_t id = KVM_REG_RISCV | type | idx;
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-     return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
- }
--#define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
--                 KVM_REG_RISCV_CORE_REG(name))
-+#define RISCV_CORE_REG(env, name) \
-+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, \
-+                           KVM_REG_RISCV_CORE_REG(name))
--#define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
--                 KVM_REG_RISCV_CSR_REG(name))
-+#define RISCV_CSR_REG(env, name) \
-+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CSR, \
-+                           KVM_REG_RISCV_CSR_REG(name))
- #define RISCV_CONFIG_REG(env, name) \
--    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
--                     KVM_REG_RISCV_CONFIG_REG(name))
-+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG, \
-+                           KVM_REG_RISCV_CONFIG_REG(name))
- #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
-                  KVM_REG_RISCV_TIMER_REG(name))
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
-         /* If we're here we're going to disable the MISA bit */
-         reg = 0;
--        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
--                              misa_cfg->kvm_reg_id);
-+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
-+                                    misa_cfg->kvm_reg_id);
-         ret = kvm_set_one_reg(cs, id, &reg);
-         if (ret != 0) {
-             /*
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
-             continue;
-         }
--        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
--                              multi_ext_cfg->kvm_reg_id);
-+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
-+                                    multi_ext_cfg->kvm_reg_id);
-         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
-         ret = kvm_set_one_reg(cs, id, &reg);
-         if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_core(CPUState *cs)
-     env->pc = reg;
-     for (i = 1; i < 32; i++) {
--        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
-+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
-         ret = kvm_get_one_reg(cs, id, &reg);
-         if (ret) {
-             return ret;
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_core(CPUState *cs)
-     }
-     for (i = 1; i < 32; i++) {
--        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
-+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
-         reg = env->gpr[i];
-         ret = kvm_set_one_reg(cs, id, &reg);
-         if (ret) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
-     struct kvm_one_reg reg;
-     int ret;
--    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
--                              cbomz_cfg->kvm_reg_id);
-+    reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
-+                                    cbomz_cfg->kvm_reg_id);
-     reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
-     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-     if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
-         KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
-         struct kvm_one_reg reg;
--        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
--                                  multi_ext_cfg->kvm_reg_id);
-+        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
-+                                        multi_ext_cfg->kvm_reg_id);
-         reg.addr = (uint64_t)&val;
-         ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-         if (ret != 0) {
-@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
-     for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
-         multi_ext_cfg = &kvm_multi_ext_cfgs[i];
--        reg_id = kvm_riscv_reg_id(&cpu->env, KVM_REG_RISCV_ISA_EXT,
--                                  multi_ext_cfg->kvm_reg_id);
-+        reg_id = kvm_riscv_reg_id_ulong(&cpu->env, KVM_REG_RISCV_ISA_EXT,
-+                                        multi_ext_cfg->kvm_reg_id);
-         reg_search = bsearch(&reg_id, reglist->reg, reglist->n,
-                              sizeof(uint64_t), uint64_cmp);
-         if (!reg_search) {
---
-.43.0

-[PULL 14/65] hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-With common function to add virtio in DSDT created now, update microvm
-code also to use it instead of duplicate code.
-Suggested-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-4-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/i386/acpi-microvm.c | 15 ++-------------
-file changed, 2 insertions(+), 13 deletions(-)
-diff --git a/hw/i386/acpi-microvm.c b/hw/i386/acpi-microvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/acpi-microvm.c
-+++ b/hw/i386/acpi-microvm.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/pci/pci.h"
- #include "hw/pci/pcie_host.h"
- #include "hw/usb/xhci.h"
-+#include "hw/virtio/virtio-acpi.h"
- #include "hw/virtio/virtio-mmio.h"
- #include "hw/input/i8042.h"
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_virtio(Aml *scope,
-             uint32_t irq = mms->virtio_irq_base + index;
-             hwaddr base = VIRTIO_MMIO_BASE + index * 512;
-             hwaddr size = 512;
--
--            Aml *dev = aml_device("VR%02u", (unsigned)index);
--            aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
--            aml_append(dev, aml_name_decl("_UID", aml_int(index)));
--            aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
--
--            Aml *crs = aml_resource_template();
--            aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
--            aml_append(crs,
--                       aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
--                                     AML_EXCLUSIVE, &irq, 1));
--            aml_append(dev, aml_name_decl("_CRS", crs));
--            aml_append(scope, dev);
-+            virtio_acpi_dsdt_add(scope, base, size, irq, index, 1);
-         }
-     }
- }
---
-.43.0

-[PULL 16/65] hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Update the RINTC structure in MADT with AIA related fields.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-6-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 43 ++++++++++++++++++++++++++++++++++----
-file changed, 39 insertions(+), 4 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/intc/riscv_aclint.h"
- #define ACPI_BUILD_TABLE_SIZE             0x20000
-+#define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
- typedef struct AcpiBuildState {
-     /* Copy of table in RAM (for patching) */
-@@ -XXX,XX +XXX,XX @@ static void acpi_align_size(GArray *blob, unsigned align)
- static void riscv_acpi_madt_add_rintc(uint32_t uid,
-                                       const CPUArchIdList *arch_ids,
--                                      GArray *entry)
-+                                      GArray *entry,
-+                                      RISCVVirtState *s)
- {
-+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
-     uint64_t hart_id = arch_ids->cpus[uid].arch_id;
-+    uint32_t imsic_size, local_cpu_id, socket_id;
-+    uint64_t imsic_socket_addr, imsic_addr;
-+    MachineState *ms = MACHINE(s);
-+    socket_id = arch_ids->cpus[uid].props.node_id;
-+    local_cpu_id = (arch_ids->cpus[uid].arch_id -
-+                    riscv_socket_first_hartid(ms, socket_id)) %
-+                    riscv_socket_hart_count(ms, socket_id);
-+    imsic_socket_addr = s->memmap[VIRT_IMSIC_S].base +
-+                        (socket_id * VIRT_IMSIC_GROUP_MAX_SIZE);
-+    imsic_size = IMSIC_HART_SIZE(guest_index_bits);
-+    imsic_addr = imsic_socket_addr + local_cpu_id * imsic_size;
-     build_append_int_noprefix(entry, 0x18, 1);       /* Type     */
--    build_append_int_noprefix(entry, 20, 1);         /* Length   */
-+    build_append_int_noprefix(entry, 36, 1);         /* Length   */
-     build_append_int_noprefix(entry, 1, 1);          /* Version  */
-     build_append_int_noprefix(entry, 0, 1);          /* Reserved */
-     build_append_int_noprefix(entry, 0x1, 4);        /* Flags    */
-     build_append_int_noprefix(entry, hart_id, 8);    /* Hart ID  */
-     build_append_int_noprefix(entry, uid, 4);        /* ACPI Processor UID */
-+    /* External Interrupt Controller ID */
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-+        build_append_int_noprefix(entry,
-+                                  ACPI_BUILD_INTC_ID(
-+                                      arch_ids->cpus[uid].props.node_id,
-+                                      local_cpu_id),
-+                                  4);
-+    } else {
-+        build_append_int_noprefix(entry, 0, 4);
-+    }
-+
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-+        /* IMSIC Base address */
-+        build_append_int_noprefix(entry, imsic_addr, 8);
-+        /* IMSIC Size */
-+        build_append_int_noprefix(entry, imsic_size, 4);
-+    } else {
-+        build_append_int_noprefix(entry, 0, 8);
-+        build_append_int_noprefix(entry, 0, 4);
-+    }
- }
- static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
-                        aml_int(arch_ids->cpus[i].arch_id)));
-             /* build _MAT object */
--            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf);
-+            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf, s);
-             aml_append(dev, aml_name_decl("_MAT",
-                                           aml_buffer(madt_buf->len,
-                                           (uint8_t *)madt_buf->data)));
-@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
-  * 5.2.12 Multiple APIC Description Table (MADT)
-  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/15
-  *      https://drive.google.com/file/d/1R6k4MshhN3WTT-hwqAquu5nX6xSEqK2l/view
-+ *      https://drive.google.com/file/d/1oMGPyOD58JaPgMl1pKasT-VKsIKia7zR/view
-  */
- static void build_madt(GArray *table_data,
-                        BIOSLinker *linker,
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
-     /* RISC-V Local INTC structures per HART */
-     for (int i = 0; i < arch_ids->len; i++) {
--        riscv_acpi_madt_add_rintc(i, arch_ids, table_data);
-+        riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
-     }
-     acpi_table_end(linker, &table);
---
-.43.0

-[PULL 18/65] hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Add APLIC structures for each socket in the MADT when system is configured
-with APLIC as the external wired interrupt controller.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-8-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 34 ++++++++++++++++++++++++++++++++++
-file changed, 34 insertions(+)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
-     uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
-     uint16_t imsic_max_hart_per_socket = 0;
-     uint8_t  hart_index_bits;
-+    uint64_t aplic_addr;
-+    uint32_t gsi_base;
-     uint8_t  socket;
-     for (socket = 0; socket < riscv_socket_count(ms); socket++) {
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
-         build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
-     }
-+    if (s->aia_type != VIRT_AIA_TYPE_NONE) {
-+        /* APLICs */
-+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
-+            aplic_addr = s->memmap[VIRT_APLIC_S].base +
-+                             s->memmap[VIRT_APLIC_S].size * socket;
-+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
-+            build_append_int_noprefix(table_data, 0x1A, 1);    /* Type */
-+            build_append_int_noprefix(table_data, 36, 1);      /* Length */
-+            build_append_int_noprefix(table_data, 1, 1);       /* Version */
-+            build_append_int_noprefix(table_data, socket, 1);  /* APLIC ID */
-+            build_append_int_noprefix(table_data, 0, 4);       /* Flags */
-+            build_append_int_noprefix(table_data, 0, 8);       /* Hardware ID */
-+            /* Number of IDCs */
-+            if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-+                build_append_int_noprefix(table_data,
-+                                          s->soc[socket].num_harts,
-+                                          2);
-+            } else {
-+                build_append_int_noprefix(table_data, 0, 2);
-+            }
-+            /* Total External Interrupt Sources Supported */
-+            build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_SOURCES, 2);
-+            /* Global System Interrupt Base */
-+            build_append_int_noprefix(table_data, gsi_base, 4);
-+            /* APLIC Address */
-+            build_append_int_noprefix(table_data, aplic_addr, 8);
-+            /* APLIC size */
-+            build_append_int_noprefix(table_data,
-+                                      s->memmap[VIRT_APLIC_S].size, 4);
-+        }
-+    }
-+
-     acpi_table_end(linker, &table);
- }
---
-.43.0

-[PULL 19/65] hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-When CMO related extensions like Zicboz, Zicbom and Zicbop are enabled, the
-block size for those extensions need to be communicated via CMO node in
-RHCT. Add CMO node in RHCT if any of those CMO extensions are detected.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-9-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 64 +++++++++++++++++++++++++++++++++-----
-file changed, 56 insertions(+), 8 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
-  * 5.2.36 RISC-V Hart Capabilities Table (RHCT)
-  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/16
-  *      https://drive.google.com/file/d/1nP3nFiH4jkPMp6COOxP6123DCZKR-tia/view
-+ *      https://drive.google.com/file/d/1sKbOa8m1UZw1JkquZYe3F1zQBN1xXsaf/view
-  */
- static void build_rhct(GArray *table_data,
-                        BIOSLinker *linker,
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-     MachineState *ms = MACHINE(s);
-     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
-     size_t len, aligned_len;
--    uint32_t isa_offset, num_rhct_nodes;
--    RISCVCPU *cpu;
-+    uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
-+    RISCVCPU *cpu = &s->soc[0].harts[0];
-     char *isa;
-     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-     /* ISA + N hart info */
-     num_rhct_nodes = 1 + ms->smp.cpus;
-+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
-+        num_rhct_nodes++;
-+    }
-     /* Number of RHCT nodes*/
-     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-     isa_offset = table_data->len - table.table_offset;
-     build_append_int_noprefix(table_data, 0, 2);   /* Type 0 */
--    cpu = &s->soc[0].harts[0];
-     isa = riscv_isa_string(cpu);
-     len = 8 + strlen(isa) + 1;
-     aligned_len = (len % 2) ? (len + 1) : len;
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-         build_append_int_noprefix(table_data, 0x0, 1);   /* Optional Padding */
-     }
-+    /* CMO node */
-+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
-+        cmo_offset = table_data->len - table.table_offset;
-+        build_append_int_noprefix(table_data, 1, 2);    /* Type */
-+        build_append_int_noprefix(table_data, 10, 2);   /* Length */
-+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
-+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
-+
-+        /* CBOM block size */
-+        if (cpu->cfg.cbom_blocksize) {
-+            build_append_int_noprefix(table_data,
-+                                      __builtin_ctz(cpu->cfg.cbom_blocksize),
-+                                      1);
-+        } else {
-+            build_append_int_noprefix(table_data, 0, 1);
-+        }
-+
-+        /* CBOP block size */
-+        build_append_int_noprefix(table_data, 0, 1);
-+
-+        /* CBOZ block size */
-+        if (cpu->cfg.cboz_blocksize) {
-+            build_append_int_noprefix(table_data,
-+                                      __builtin_ctz(cpu->cfg.cboz_blocksize),
-+                                      1);
-+        } else {
-+            build_append_int_noprefix(table_data, 0, 1);
-+        }
-+    }
-+
-     /* Hart Info Node */
-     for (int i = 0; i < arch_ids->len; i++) {
-+        len = 16;
-+        int num_offsets = 1;
-         build_append_int_noprefix(table_data, 0xFFFF, 2);  /* Type */
--        build_append_int_noprefix(table_data, 16, 2);      /* Length */
--        build_append_int_noprefix(table_data, 0x1, 2);     /* Revision */
--        build_append_int_noprefix(table_data, 1, 2);    /* Number of offsets */
--        build_append_int_noprefix(table_data, i, 4);    /* ACPI Processor UID */
--        build_append_int_noprefix(table_data, isa_offset, 4); /* Offsets[0] */
-+
-+        /* Length */
-+        if (cmo_offset) {
-+            len += 4;
-+            num_offsets++;
-+        }
-+
-+        build_append_int_noprefix(table_data, len, 2);
-+        build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
-+        /* Number of offsets */
-+        build_append_int_noprefix(table_data, num_offsets, 2);
-+        build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
-+
-+        /* Offsets */
-+        build_append_int_noprefix(table_data, isa_offset, 4);
-+        if (cmo_offset) {
-+            build_append_int_noprefix(table_data, cmo_offset, 4);
-+        }
-     }
-     acpi_table_end(linker, &table);
---
-.43.0

-[PULL 20/65] hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-MMU type information is available via MMU node in RHCT. Add this node in
-RHCT.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-10-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 36 +++++++++++++++++++++++++++++++++++-
-file changed, 35 insertions(+), 1 deletion(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-     size_t len, aligned_len;
-     uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
-     RISCVCPU *cpu = &s->soc[0].harts[0];
-+    uint32_t mmu_offset = 0;
-+    uint8_t satp_mode_max;
-     char *isa;
-     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-         num_rhct_nodes++;
-     }
-+    if (cpu->cfg.satp_mode.supported != 0) {
-+        num_rhct_nodes++;
-+    }
-+
-     /* Number of RHCT nodes*/
-     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-         }
-     }
-+    /* MMU node structure */
-+    if (cpu->cfg.satp_mode.supported != 0) {
-+        satp_mode_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
-+        mmu_offset = table_data->len - table.table_offset;
-+        build_append_int_noprefix(table_data, 2, 2);    /* Type */
-+        build_append_int_noprefix(table_data, 8, 2);    /* Length */
-+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
-+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
-+        /* MMU Type */
-+        if (satp_mode_max == VM_1_10_SV57) {
-+            build_append_int_noprefix(table_data, 2, 1);    /* Sv57 */
-+        } else if (satp_mode_max == VM_1_10_SV48) {
-+            build_append_int_noprefix(table_data, 1, 1);    /* Sv48 */
-+        } else if (satp_mode_max == VM_1_10_SV39) {
-+            build_append_int_noprefix(table_data, 0, 1);    /* Sv39 */
-+        } else {
-+            assert(1);
-+        }
-+    }
-+
-     /* Hart Info Node */
-     for (int i = 0; i < arch_ids->len; i++) {
-         len = 16;
-@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
-             num_offsets++;
-         }
-+        if (mmu_offset) {
-+            len += 4;
-+            num_offsets++;
-+        }
-+
-         build_append_int_noprefix(table_data, len, 2);
-         build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
-         /* Number of offsets */
-         build_append_int_noprefix(table_data, num_offsets, 2);
-         build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
--
-         /* Offsets */
-         build_append_int_noprefix(table_data, isa_offset, 4);
-         if (cmo_offset) {
-             build_append_int_noprefix(table_data, cmo_offset, 4);
-         }
-+
-+        if (mmu_offset) {
-+            build_append_int_noprefix(table_data, mmu_offset, 4);
-+        }
-     }
-     acpi_table_end(linker, &table);
---
-.43.0

-[PULL 21/65] hw/pci-host/gpex: Define properties for MMIO ranges
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-ACPI DSDT generator needs information like ECAM range, PIO range, 32-bit
-and 64-bit PCI MMIO range etc related to the PCI host bridge. Instead of
-making these values machine specific, create properties for the GPEX
-host bridge with default value 0. During initialization, the firmware
-can initialize these properties with correct values for the platform.
-This basically allows DSDT generator code independent of the machine
-specific memory map accesses.
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231218150247.466427-11-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/pci-host/gpex.h | 28 ++++++++++++++++++++--------
- hw/pci-host/gpex-acpi.c    | 13 +++++++++++++
- hw/pci-host/gpex.c         | 12 ++++++++++++
-files changed, 45 insertions(+), 8 deletions(-)
-diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci-host/gpex.h
-+++ b/include/hw/pci-host/gpex.h
-@@ -XXX,XX +XXX,XX @@ struct GPEXRootState {
-     /*< public >*/
- };
-+struct GPEXConfig {
-+    MemMapEntry ecam;
-+    MemMapEntry mmio32;
-+    MemMapEntry mmio64;
-+    MemMapEntry pio;
-+    int         irq;
-+    PCIBus      *bus;
-+};
-+
- struct GPEXHost {
-     /*< private >*/
-     PCIExpressHost parent_obj;
-@@ -XXX,XX +XXX,XX @@ struct GPEXHost {
-     int irq_num[GPEX_NUM_IRQS];
-     bool allow_unmapped_accesses;
--};
--struct GPEXConfig {
--    MemMapEntry ecam;
--    MemMapEntry mmio32;
--    MemMapEntry mmio64;
--    MemMapEntry pio;
--    int         irq;
--    PCIBus      *bus;
-+    struct GPEXConfig gpex_cfg;
- };
- int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
- void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg);
-+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq);
-+
-+#define PCI_HOST_PIO_BASE               "x-pio-base"
-+#define PCI_HOST_PIO_SIZE               "x-pio-size"
-+#define PCI_HOST_ECAM_BASE              "x-ecam-base"
-+#define PCI_HOST_ECAM_SIZE              "x-ecam-size"
-+#define PCI_HOST_BELOW_4G_MMIO_BASE     "x-below-4g-mmio-base"
-+#define PCI_HOST_BELOW_4G_MMIO_SIZE     "x-below-4g-mmio-size"
-+#define PCI_HOST_ABOVE_4G_MMIO_BASE     "x-above-4g-mmio-base"
-+#define PCI_HOST_ABOVE_4G_MMIO_SIZE     "x-above-4g-mmio-size"
- #endif /* HW_GPEX_H */
-diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex-acpi.c
-+++ b/hw/pci-host/gpex-acpi.c
-@@ -XXX,XX +XXX,XX @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
-     crs_range_set_free(&crs_range_set);
- }
-+
-+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq)
-+{
-+    bool ambig;
-+    Object *obj = object_resolve_path_type("", TYPE_GPEX_HOST, &ambig);
-+
-+    if (!obj || ambig) {
-+        return;
-+    }
-+
-+    GPEX_HOST(obj)->gpex_cfg.irq = irq;
-+    acpi_dsdt_add_gpex(scope, &GPEX_HOST(obj)->gpex_cfg);
-+}
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
-+++ b/hw/pci-host/gpex.c
-@@ -XXX,XX +XXX,XX @@ static Property gpex_host_properties[] = {
-      */
-     DEFINE_PROP_BOOL("allow-unmapped-accesses", GPEXHost,
-                      allow_unmapped_accesses, true),
-+    DEFINE_PROP_UINT64(PCI_HOST_ECAM_BASE, GPEXHost, gpex_cfg.ecam.base, 0),
-+    DEFINE_PROP_SIZE(PCI_HOST_ECAM_SIZE, GPEXHost, gpex_cfg.ecam.size, 0),
-+    DEFINE_PROP_UINT64(PCI_HOST_PIO_BASE, GPEXHost, gpex_cfg.pio.base, 0),
-+    DEFINE_PROP_SIZE(PCI_HOST_PIO_SIZE, GPEXHost, gpex_cfg.pio.size, 0),
-+    DEFINE_PROP_UINT64(PCI_HOST_BELOW_4G_MMIO_BASE, GPEXHost,
-+                       gpex_cfg.mmio32.base, 0),
-+    DEFINE_PROP_SIZE(PCI_HOST_BELOW_4G_MMIO_SIZE, GPEXHost,
-+                     gpex_cfg.mmio32.size, 0),
-+    DEFINE_PROP_UINT64(PCI_HOST_ABOVE_4G_MMIO_BASE, GPEXHost,
-+                       gpex_cfg.mmio64.base, 0),
-+    DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MMIO_SIZE, GPEXHost,
-+                     gpex_cfg.mmio64.size, 0),
-     DEFINE_PROP_END_OF_LIST(),
- };
---
-.43.0

-[PULL 23/65] hw/riscv/virt-acpi-build.c: Add IO controllers and devices
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Add basic IO controllers and devices like PCI, VirtIO and UART in the
-ACPI namespace.
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-13-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 79 ++++++++++++++++++++++++++++++++++++--
- hw/riscv/Kconfig           |  1 +
-files changed, 76 insertions(+), 4 deletions(-)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/acpi/acpi-defs.h"
- #include "hw/acpi/acpi.h"
- #include "hw/acpi/aml-build.h"
-+#include "hw/acpi/pci.h"
- #include "hw/acpi/utils.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "hw/nvram/fw_cfg_acpi.h"
-+#include "hw/pci-host/gpex.h"
-+#include "hw/riscv/virt.h"
-+#include "hw/riscv/numa.h"
-+#include "hw/virtio/virtio-acpi.h"
-+#include "migration/vmstate.h"
- #include "qapi/error.h"
- #include "qemu/error-report.h"
- #include "sysemu/reset.h"
--#include "migration/vmstate.h"
--#include "hw/riscv/virt.h"
--#include "hw/riscv/numa.h"
--#include "hw/intc/riscv_aclint.h"
- #define ACPI_BUILD_TABLE_SIZE             0x20000
- #define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
-     }
- }
-+static void
-+acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
-+                    uint32_t uart_irq)
-+{
-+    Aml *dev = aml_device("COM0");
-+    aml_append(dev, aml_name_decl("_HID", aml_string("PNP0501")));
-+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
-+
-+    Aml *crs = aml_resource_template();
-+    aml_append(crs, aml_memory32_fixed(uart_memmap->base,
-+                                         uart_memmap->size, AML_READ_WRITE));
-+    aml_append(crs,
-+                aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
-+                               AML_EXCLUSIVE, &uart_irq, 1));
-+    aml_append(dev, aml_name_decl("_CRS", crs));
-+
-+    Aml *pkg = aml_package(2);
-+    aml_append(pkg, aml_string("clock-frequency"));
-+    aml_append(pkg, aml_int(3686400));
-+
-+    Aml *UUID = aml_touuid("DAFFD814-6EBA-4D8C-8A91-BC9BBF4AA301");
-+
-+    Aml *pkg1 = aml_package(1);
-+    aml_append(pkg1, pkg);
-+
-+    Aml *package = aml_package(2);
-+    aml_append(package, UUID);
-+    aml_append(package, pkg1);
-+
-+    aml_append(dev, aml_name_decl("_DSD", package));
-+    aml_append(scope, dev);
-+}
-+
- /* RHCT Node[N] starts at offset 56 */
- #define RHCT_NODE_ARRAY_OFFSET 56
-@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
-                        RISCVVirtState *s)
- {
-     Aml *scope, *dsdt;
-+    MachineState *ms = MACHINE(s);
-+    uint8_t socket_count;
-     const MemMapEntry *memmap = s->memmap;
-     AcpiTable table = { .sig = "DSDT", .rev = 2, .oem_id = s->oem_id,
-                         .oem_table_id = s->oem_table_id };
-@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
-     fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
-+    socket_count = riscv_socket_count(ms);
-+
-+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART0], UART0_IRQ);
-+
-+    if (socket_count == 1) {
-+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
-+                             memmap[VIRT_VIRTIO].size,
-+                             VIRTIO_IRQ, 0, VIRTIO_COUNT);
-+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ);
-+    } else if (socket_count == 2) {
-+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
-+                             memmap[VIRT_VIRTIO].size,
-+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
-+                             VIRTIO_COUNT);
-+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES);
-+    } else {
-+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
-+                             memmap[VIRT_VIRTIO].size,
-+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
-+                             VIRTIO_COUNT);
-+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES * 2);
-+    }
-+
-     aml_append(dsdt, scope);
-     /* copy AML table into ACPI tables blob and patch header there */
-@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
-     acpi_add_table(table_offsets, tables_blob);
-     build_rhct(tables_blob, tables->linker, s);
-+    acpi_add_table(table_offsets, tables_blob);
-+    {
-+        AcpiMcfgInfo mcfg = {
-+           .base = s->memmap[VIRT_PCIE_MMIO].base,
-+           .size = s->memmap[VIRT_PCIE_MMIO].size,
-+        };
-+        build_mcfg(tables_blob, tables->linker, &mcfg, s->oem_id,
-+                   s->oem_table_id);
-+    }
-+
-     /* XSDT is pointed to by RSDP */
-     xsdt = tables_blob->len;
-     build_xsdt(tables_blob, tables->linker, table_offsets, s->oem_id,
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
-+++ b/hw/riscv/Kconfig
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
-     select FW_CFG_DMA
-     select PLATFORM_BUS
-     select ACPI
-+    select ACPI_PCI
- config SHAKTI_C
-     bool
---
-.43.0

-[PULL 24/65] hw/riscv/virt-acpi-build.c: Add PLIC in MADT
+Deleted patch
-From: Sunil V L <sunilvl@ventanamicro.com>
-Add PLIC structures for each socket in the MADT when system is
-configured with PLIC as the external interrupt controller.
-Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
-Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20231218150247.466427-14-sunilvl@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt-acpi-build.c | 29 +++++++++++++++++++++++++++++
-file changed, 29 insertions(+)
-diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt-acpi-build.c
-+++ b/hw/riscv/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_acpi_madt_add_rintc(uint32_t uid,
-                                       arch_ids->cpus[uid].props.node_id,
-                                       local_cpu_id),
-);
-+    } else if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-+        build_append_int_noprefix(entry,
-+                                  ACPI_BUILD_INTC_ID(
-+                                      arch_ids->cpus[uid].props.node_id,
-+                                      2 * local_cpu_id + 1),
-+                                  4);
-     } else {
-         build_append_int_noprefix(entry, 0, 4);
-     }
-@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
-             build_append_int_noprefix(table_data,
-                                       s->memmap[VIRT_APLIC_S].size, 4);
-         }
-+    } else {
-+        /* PLICs */
-+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
-+            aplic_addr = s->memmap[VIRT_PLIC].base +
-+                         s->memmap[VIRT_PLIC].size * socket;
-+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
-+            build_append_int_noprefix(table_data, 0x1B, 1);   /* Type */
-+            build_append_int_noprefix(table_data, 36, 1);     /* Length */
-+            build_append_int_noprefix(table_data, 1, 1);      /* Version */
-+            build_append_int_noprefix(table_data, socket, 1); /* PLIC ID */
-+            build_append_int_noprefix(table_data, 0, 8);      /* Hardware ID */
-+            /* Total External Interrupt Sources Supported */
-+            build_append_int_noprefix(table_data,
-+                                      VIRT_IRQCHIP_NUM_SOURCES - 1, 2);
-+            build_append_int_noprefix(table_data, 0, 2);     /* Max Priority */
-+            build_append_int_noprefix(table_data, 0, 4);     /* Flags */
-+            /* PLIC Size */
-+            build_append_int_noprefix(table_data, s->memmap[VIRT_PLIC].size, 4);
-+            /* PLIC Address */
-+            build_append_int_noprefix(table_data, aplic_addr, 8);
-+            /* Global System Interrupt Vector Base */
-+            build_append_int_noprefix(table_data, gsi_base, 4);
-+        }
-     }
-     acpi_table_end(linker, &table);
---
-.43.0

-[PULL 25/65] hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
+Deleted patch
-From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The interrupts-extended property of PLIC only has 2 * hart number
-fields when KVM enabled, copy 4 * hart number fields to fdt will
-expose some uninitialized value.
-In this patch, I also refactor the code about the setting of
-interrupts-extended property of PLIC for improved readability.
-Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20231218090543.22353-1-yongxuan.wang@sifive.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt.c | 47 +++++++++++++++++++++++++++--------------------
-file changed, 27 insertions(+), 20 deletions(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
-         "sifive,plic-1.0.0", "riscv,plic0"
-     };
--    if (kvm_enabled()) {
--        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
--    } else {
--        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
--    }
--
--    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
--        if (kvm_enabled()) {
--            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
--            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
--        } else {
--            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
--            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
--            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
--            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
--        }
--    }
--
-     plic_phandles[socket] = (*phandle)++;
-     plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
-     plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
-                                   (char **)&plic_compat,
-                                   ARRAY_SIZE(plic_compat));
-     qemu_fdt_setprop(ms->fdt, plic_name, "interrupt-controller", NULL, 0);
--    qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
--        plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
-+
-+    if (kvm_enabled()) {
-+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
-+
-+        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-+            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-+            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-+        }
-+
-+        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
-+                         plic_cells,
-+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-+   } else {
-+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
-+
-+        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-+            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
-+            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
-+            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
-+            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
-+        }
-+
-+        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
-+                         plic_cells,
-+                         s->soc[socket].num_harts * sizeof(uint32_t) * 4);
-+    }
-+
-     qemu_fdt_setprop_cells(ms->fdt, plic_name, "reg",
-x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
-     qemu_fdt_setprop_cell(ms->fdt, plic_name, "riscv,ndev",
---
-.43.0

-[PULL 28/65] docs/system/riscv: document acpi parameter of virt machine
+Deleted patch
-From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-Since QEMU v8.0.0 the RISC-V virt machine has a switch to disable ACPI
-table generation. Add it to the documentation.
-Fixes: 168b8c29cedb ("hw/riscv/virt: Add a switch to disable ACPI")
-Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231220193436.25909-1-heinrich.schuchardt@canonical.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- docs/system/riscv/virt.rst | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
-+++ b/docs/system/riscv/virt.rst
-@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
-   SiFive CLINT. When not specified, this option is assumed to be "off".
-   This option is restricted to the TCG accelerator.
-+- acpi=[on|off|auto]
-+
-+  When this option is "on" (which is the default), ACPI tables are generated and
-+  exposed as firmware tables etc/acpi/rsdp and etc/acpi/tables.
-+
- - aia=[none|aplic|aplic-imsic]
-   This option allows selecting interrupt controller defined by the AIA
---
-.43.0

-[PULL 40/65] target/riscv/tcg: add riscv_cpu_write_misa_bit()
+[PULL 37/39] target/riscv/tcg: hide warn for named feats when disabling via priv_ver
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We have two instances of the setting/clearing a MISA bit from
+Commit 68c9e54bea handled a situation where a warning was being shown
-env->misa_ext and env->misa_ext_mask pattern. And the next patch will
+when using the 'sifive_e' cpu when disabling the named extension zic64b.
-end up adding one more.
+It makes little sense to show user warnings for named extensions that
 users can't control, and the solution taken was to disable zic64b
 manually in riscv_cpu_update_named_features().
-Create a helper to avoid code repetition.
+This solution won't scale well when adding more named features, and can
 eventually end up repeating riscv_cpu_disable_priv_spec_isa_exts().
 Change riscv_cpu_disable_priv_spec_isa_exts() to not show warnings when
 disabling a named feature. This will accomplish the same thing we're
 doing today while avoiding having two points where we're disabling
 exts via priv_ver mismatch.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-ID: <20241113171755.978109-2-dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20231218125334.37184-13-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++--------------
+ target/riscv/tcg/tcg-cpu.c | 13 ++++++++++---
-file changed, 18 insertions(+), 14 deletions(-)
+file changed, 10 insertions(+), 3 deletions(-)
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
-                                  GUINT_TO_POINTER(ext_offset));
+             }
              isa_ext_update_enabled(cpu, edata->ext_enable_offset, false);
 +
 +            /*
 +             * Do not show user warnings for named features that users
 +             * can't enable/disable in the command line. See commit
 +             * 68c9e54bea for more info.
 +             */
 +            if (cpu_cfg_offset_is_named_feat(edata->ext_enable_offset)) {
 +                continue;
 +            }
  #ifndef CONFIG_USER_ONLY
              warn_report("disabling %s extension for hart 0x" TARGET_FMT_lx
                          " because privilege spec version does not match",
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
          cpu->cfg.has_priv_1_13 = true;
      }
 -    /* zic64b is 1.12 or later */
      cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
                            cpu->cfg.cbop_blocksize == 64 &&
 -                          cpu->cfg.cboz_blocksize == 64 &&
 -                          cpu->cfg.has_priv_1_12;
 +                          cpu->cfg.cboz_blocksize == 64;
  }
-+static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
+ static void riscv_cpu_validate_g(RISCVCPU *cpu)
 +                                     bool enabled)
 +{
 +    CPURISCVState *env = &cpu->env;
 +
 +    if (enabled) {
 +        env->misa_ext |= bit;
 +        env->misa_ext_mask |= bit;
 +    } else {
 +        env->misa_ext &= ~bit;
 +        env->misa_ext_mask &= ~bit;
 +    }
 +}
 +
  static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                            const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
               */
              env->priv_ver = PRIV_VERSION_1_12_0;
          }
 -
 -        env->misa_ext |= misa_bit;
 -        env->misa_ext_mask |= misa_bit;
 -    } else {
 -        env->misa_ext &= ~misa_bit;
 -        env->misa_ext_mask &= ~misa_bit;
      }
 +
 +    riscv_cpu_write_misa_bit(cpu, misa_bit, value);
  }
  static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
   */
  static void riscv_cpu_add_misa_properties(Object *cpu_obj)
  {
 -    CPURISCVState *env = &RISCV_CPU(cpu_obj)->env;
      bool use_def_vals = riscv_cpu_is_generic(cpu_obj);
      int i;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
                              NULL, (void *)misa_cfg);
          object_property_set_description(cpu_obj, name, desc);
          if (use_def_vals) {
 -            if (misa_cfg->enabled) {
 -                env->misa_ext |= bit;
 -                env->misa_ext_mask |= bit;
 -            } else {
 -                env->misa_ext &= ~bit;
 -                env->misa_ext_mask &= ~bit;
 -            }
 +            riscv_cpu_write_misa_bit(RISCV_CPU(cpu_obj), bit,
 +                                     misa_cfg->enabled);
          }
      }
  }
 --
-.43.0
+.47.1

-[PULL 47/65] target/riscv: implement svade
+[PULL 38/39] target/riscv: add ssstateen
 From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-'svade' is a RVA22S64 profile requirement, a profile we're going to add
+ssstateen is defined in RVA22 as:
 shortly. It is a named feature (i.e. not a formal extension, not defined
 in riscv,isa DT at this moment) defined in [1] as:
-"Page-fault exceptions are raised when a page is accessed when A bit is
+"Supervisor-mode view of the state-enable extension. The supervisor-mode
-clear, or written when D bit is clear.".
+(sstateen0-3) and hypervisor-mode (hstateen0-3) state-enable registers
 must be provided."
-As far as the spec goes, 'svade' is one of the two distinct modes of
+Add ssstateen as a named feature that is available if we also have
-handling PTE_A and PTE_D. The other way, i.e. update PTE_A/PTE_D when
+smstateen.
 they're cleared, is defined by the 'svadu' extension. Checking
 cpu_helper.c, get_physical_address(), we can verify that QEMU is
 compliant with that: we will update PTE_A/PTE_D if 'svadu' is enabled,
 or throw a page-fault exception if 'svadu' isn't enabled.
 So, as far as we're concerned, 'svade' translates to 'svadu must be
 disabled'.
 We'll implement it like 'zic64b': an internal flag that profiles can
 enable. The flag will not be exposed to users.
 [1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20241113171755.978109-3-dbarboza@ventanamicro.com>
 Message-ID: <20231218125334.37184-20-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h     | 1 +
- target/riscv/cpu.c         | 1 +
+ target/riscv/cpu.c         | 2 ++
- target/riscv/tcg/tcg-cpu.c | 5 +++++
+ target/riscv/tcg/tcg-cpu.c | 9 ++++++++-
-files changed, 7 insertions(+)
+files changed, 11 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_smepmp;
+     /* Named features  */
-     bool rvv_ta_all_1s;
+     bool ext_svade;
-     bool rvv_ma_all_1s;
+     bool ext_zic64b;
-+    bool svade;
++    bool ext_ssstateen;
-     bool zic64b;
+     /*
-     uint32_t mvendorid;
+      * Always 'true' booleans for named features
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(ssccptr, PRIV_VERSION_1_11_0, has_priv_1_11),
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
+     ISA_EXT_DATA_ENTRY(sscounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
++    ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
+     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
+     ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(sstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
 @@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+  */
+ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
++    MULTI_EXT_CFG_BOOL("ssstateen", ext_ssstateen, true),
+     DEFINE_PROP_END_OF_LIST(),
  };
- const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
-+    MULTI_EXT_CFG_BOOL("svade", svade, true),
-     MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
-     DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
+       * All other named features are already enabled
+       * in riscv_tcg_cpu_instance_init().
+       */
+-    if (feat_offset == CPU_CFG_OFFSET(ext_zic64b)) {
++    switch (feat_offset) {
++    case CPU_CFG_OFFSET(ext_zic64b):
+         cpu->cfg.cbom_blocksize = 64;
          cpu->cfg.cbop_blocksize = 64;
          cpu->cfg.cboz_blocksize = 64;
-         break;
-+    case CPU_CFG_OFFSET(svade):
-+        cpu->cfg.ext_svadu = false;
 +        break;
-     default:
++    case CPU_CFG_OFFSET(ext_ssstateen):
-         g_assert_not_reached();
++        cpu->cfg.ext_smstateen = true;
 +        break;
      }
+ }
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
-     cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
+     cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
-                       cpu->cfg.cbop_blocksize == 64 &&
+                           cpu->cfg.cbop_blocksize == 64 &&
-                       cpu->cfg.cboz_blocksize == 64;
+                           cpu->cfg.cboz_blocksize == 64;
 +
-+    cpu->cfg.svade = !cpu->cfg.ext_svadu;
++    cpu->cfg.ext_ssstateen = cpu->cfg.ext_smstateen;
  }
  static void riscv_cpu_validate_g(RISCVCPU *cpu)
 --
-.43.0
+.47.1

-[PULL 32/65] target/riscv: add rv64i CPU
+[PULL 39/39] target/riscv: add support for RV64 Xiangshan Nanhu CPU
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From: MollyChen <xiaoou@iscas.ac.cn>
-We don't have any form of a 'bare bones' CPU. rv64, our default CPUs,
+Add a CPU entry for the RV64 XiangShan NANHU CPU which
-comes with a lot of defaults. This is fine for most regular uses but
+supports single-core and dual-core configurations. More
-it's not suitable when more control of what is actually loaded in the
+details can be found at
-CPU is required.
+https://docs.xiangshan.cc/zh-cn/latest/integration/overview
-A bare-bones CPU would be annoying to deal with if not by profile
+Signed-off-by: MollyChen <xiaoou@iscas.ac.cn>
-support, a way to load a multitude of extensions with a single flag.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Profile support is going to be implemented shortly, so let's add a CPU
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-for it.
+Message-ID: <20241205073622.46052-1-xiaoou@iscas.ac.cn>
+[ Changes by AF
-The new 'rv64i' CPU will have only RVI loaded. It is inspired in the
+ - Fixup code formatting
-profile specification that dictates, for RVA22U64 [1]:
+]
 "RVA22U64 Mandatory Base
  RV64I is the mandatory base ISA for RVA22U64"
 And so it seems that RV64I is the mandatory base ISA for all profiles
 listed in [1], making it an ideal CPU to use with profile support.
 rv64i is a CPU of type TYPE_RISCV_BARE_CPU. It has a mix of features
 from pre-existent CPUs:
 - it allows extensions to be enabled, like generic CPUs;
 - it will not inherit extension defaults, like vendor CPUs.
 This is the minimum extension set to boot OpenSBI and buildroot using
 rv64i:
 ./build/qemu-system-riscv64 -nographic -M virt \
     -cpu rv64i,sv39=true,g=true,c=true,s=true,u=true
 Our minimal riscv,isa in this case will be:
  # cat /proc/device-tree/cpus/cpu@0/riscv,isa
 rv64imafdc_zicntr_zicsr_zifencei_zihpm_zca_zcd#
 [1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20231218125334.37184-5-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu-qom.h |  2 ++
+ target/riscv/cpu-qom.h |  1 +
- target/riscv/cpu.c     | 46 ++++++++++++++++++++++++++++++++++++++++++
+ target/riscv/cpu.c     | 30 ++++++++++++++++++++++++++++++
-files changed, 48 insertions(+)
+files changed, 31 insertions(+)
 diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu-qom.h
 +++ b/target/riscv/cpu-qom.h
 @@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU "riscv-cpu"
+ #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
- #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
+ #define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
- #define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
+ #define TYPE_RISCV_CPU_TT_ASCALON       RISCV_CPU_TYPE_NAME("tt-ascalon")
-+#define TYPE_RISCV_BARE_CPU "riscv-bare-cpu"
++#define TYPE_RISCV_CPU_XIANGSHAN_NANHU  RISCV_CPU_TYPE_NAME("xiangshan-nanhu")
+ #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
- #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
- #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
+ OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
@@ -XXX,XX +XXX,XX @@
  #define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
  #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
  #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
 +#define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
  #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
  #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
  #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static void rv64_tt_ascalon_cpu_init(Object *obj)
  /* Set the satp mode to the max supported */
  static void set_satp_mode_default_map(RISCVCPU *cpu)
  {
 +    /*
 +     * Bare CPUs do not default to the max available.
 +     * Users must set a valid satp_mode in the command
 +     * line.
 +     */
 +    if (object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_BARE_CPU) != NULL) {
 +        warn_report("No satp mode set. Defaulting to 'bare'");
 +        cpu->cfg.satp_mode.map = (1 << VM_1_10_MBARE);
 +        return;
 +    }
 +
      cpu->cfg.satp_mode.map = cpu->cfg.satp_mode.supported;
  }
  #endif
@@ -XXX,XX +XXX,XX @@ static void rv128_base_cpu_init(Object *obj)
      set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
  #endif
  }
-+
-+static void rv64i_bare_cpu_init(Object *obj)
++static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
 +{
 +    CPURISCVState *env = &RISCV_CPU(obj)->env;
-+    riscv_cpu_set_misa(env, MXL_RV64, RVI);
++    RISCVCPU *cpu = RISCV_CPU(obj);
 +
-+    /* Remove the defaults from the parent class */
++    riscv_cpu_set_misa_ext(env, RVG | RVC | RVB | RVS | RVU);
-+    RISCV_CPU(obj)->cfg.ext_zicntr = false;
++    env->priv_ver = PRIV_VERSION_1_12_0;
 +    RISCV_CPU(obj)->cfg.ext_zihpm = false;
 +
-+    /* Set to QEMU's first supported priv version */
++    /* Enable ISA extensions */
-+    env->priv_ver = PRIV_VERSION_1_10_0;
++    cpu->cfg.ext_zbc = true;
 +    cpu->cfg.ext_zbkb = true;
 +    cpu->cfg.ext_zbkc = true;
 +    cpu->cfg.ext_zbkx = true;
 +    cpu->cfg.ext_zknd = true;
 +    cpu->cfg.ext_zkne = true;
 +    cpu->cfg.ext_zknh = true;
 +    cpu->cfg.ext_zksed = true;
 +    cpu->cfg.ext_zksh = true;
 +    cpu->cfg.ext_svinval = true;
 +
-+    /*
++    cpu->cfg.mmu = true;
-+     * Support all available satp_mode settings. The default
++    cpu->cfg.pmp = true;
-+     * value will be set to MBARE if the user doesn't set
++
 +     * satp_mode manually (see set_satp_mode_default()).
 +     */
 +#ifndef CONFIG_USER_ONLY
-+    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV64);
++    set_satp_mode_max_supported(cpu, VM_1_10_SV39);
 +#endif
 +}
- #else
++
- static void rv32_base_cpu_init(Object *obj)
+ #ifdef CONFIG_TCG
  static void rv128_base_cpu_init(Object *obj)
  {
-@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
-         .instance_init = initfn              \
-     }
-+#define DEFINE_BARE_CPU(type_name, initfn) \
-+    {                                      \
-+        .name = type_name,                 \
-+        .parent = TYPE_RISCV_BARE_CPU,     \
-+        .instance_init = initfn            \
-+    }
-+
- static const TypeInfo riscv_cpu_type_infos[] = {
-     {
-         .name = TYPE_RISCV_CPU,
 @@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
-         .parent = TYPE_RISCV_CPU,
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
-         .abstract = true,
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
-     },
+     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
-+    {
++    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
-+        .name = TYPE_RISCV_BARE_CPU,
++                                                 MXL_RV64, rv64_xiangshan_nanhu_cpu_init),
-+        .parent = TYPE_RISCV_CPU,
+ #ifdef CONFIG_TCG
-+        .abstract = true,
+     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
-+    },
+ #endif /* CONFIG_TCG */
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
  #if defined(TARGET_RISCV32)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
      DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
      DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
      DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
 +    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
  #endif
  };
 --
-.43.0
+.47.1

-[PULL 41/65] target/riscv/tcg: handle profile MISA bits
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The profile support is handling multi-letter extensions only. Let's add
-support for MISA bits as well.
-We'll go through every known MISA bit. If the profile doesn't declare
-the bit as mandatory, ignore it. Otherwise, set the bit in env->misa_ext
-and env->misa_ext_mask.
-Now that we're setting profile MISA bits, one can use the rv64i CPU to boot
-Linux using the following options:
--cpu rv64i,rva22u64=true,rv39=true,s=true,zifencei=true
-In the near future, when rva22s64 (where, 's', 'zifencei' and sv39 are
-mandatory), is implemented, rv64i will be able to boot Linux loading
-rva22s64 and no additional flags.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-14-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/tcg/tcg-cpu.c | 21 +++++++++++++++++++++
-file changed, 21 insertions(+)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
-     profile->user_set = true;
-     profile->enabled = value;
-+    for (i = 0; misa_bits[i] != 0; i++) {
-+        uint32_t bit = misa_bits[i];
-+
-+        if  (!(profile->misa_ext & bit)) {
-+            continue;
-+        }
-+
-+        if (bit == RVI && !profile->enabled) {
-+            /*
-+             * Disabling profiles will not disable the base
-+             * ISA RV64I.
-+             */
-+            continue;
-+        }
-+
-+        g_hash_table_insert(misa_ext_user_opts,
-+                            GUINT_TO_POINTER(bit),
-+                            (gpointer)value);
-+        riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
-+    }
-+
-     for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
-         ext_offset = profile->ext_offsets[i];
---
-.43.0

-[PULL 43/65] target/riscv/tcg: honor user choice for G MISA bits
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-RVG behaves like a profile: a single flag enables a set of bits. Right
-now we're considering user choice when handling RVG and zicsr/zifencei
-and ignoring user choice on MISA bits.
-We'll add user warnings for profiles when the user disables its
-mandatory extensions in the next patch. We'll do the same thing with RVG
-now to keep consistency between RVG and profile handling.
-First and foremost, create a new RVG only helper to avoid clogging
-riscv_cpu_validate_set_extensions(). We do not want to annoy users with
-RVG warnings like we did in the past (see 9b9741c38f), thus we'll only
-warn if RVG was user set and the user disabled a RVG extension in the
-command line.
-For every RVG MISA bit (IMAFD), zicsr and zifencei, the logic then
-becomes:
-- if enabled, do nothing;
-- if disabled and not user set, enable it;
-- if disabled and user set, throw a warning that it's a RVG mandatory
-  extension.
-This same logic will be used for profiles in the next patch.
-Note that this is a behavior change, where we would error out if the
-user disabled either zicsr or zifencei. As long as users are explicitly
-disabling things in the command line we'll let them have a go at it, at
-least in this step. We'll error out later in the validation if needed.
-Other notable changes from the previous RVG code:
-- use riscv_cpu_write_misa_bit() instead of manually updating both
-  env->misa_ext and env->misa_ext_mask;
-- set zicsr and zifencei directly. We're already checking if they
-  were user set and priv version will never fail for these
-  extensions, making cpu_cfg_ext_auto_update() redundant.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-16-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/tcg/tcg-cpu.c | 73 +++++++++++++++++++++++++-------------
-file changed, 48 insertions(+), 25 deletions(-)
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
-                                  GUINT_TO_POINTER(ext_offset));
- }
-+static bool cpu_misa_ext_is_user_set(uint32_t misa_bit)
-+{
-+    return g_hash_table_contains(misa_ext_user_opts,
-+                                 GUINT_TO_POINTER(misa_bit));
-+}
-+
- static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
- {
-     g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
-                       cpu->cfg.cboz_blocksize == 64;
- }
-+static void riscv_cpu_validate_g(RISCVCPU *cpu)
-+{
-+    const char *warn_msg = "RVG mandates disabled extension %s";
-+    uint32_t g_misa_bits[] = {RVI, RVM, RVA, RVF, RVD};
-+    bool send_warn = cpu_misa_ext_is_user_set(RVG);
-+
-+    for (int i = 0; i < ARRAY_SIZE(g_misa_bits); i++) {
-+        uint32_t bit = g_misa_bits[i];
-+
-+        if (riscv_has_ext(&cpu->env, bit)) {
-+            continue;
-+        }
-+
-+        if (!cpu_misa_ext_is_user_set(bit)) {
-+            riscv_cpu_write_misa_bit(cpu, bit, true);
-+            continue;
-+        }
-+
-+        if (send_warn) {
-+            warn_report(warn_msg, riscv_get_misa_ext_name(bit));
-+        }
-+    }
-+
-+    if (!cpu->cfg.ext_zicsr) {
-+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr))) {
-+            cpu->cfg.ext_zicsr = true;
-+        } else if (send_warn) {
-+            warn_report(warn_msg, "zicsr");
-+        }
-+    }
-+
-+    if (!cpu->cfg.ext_zifencei) {
-+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei))) {
-+            cpu->cfg.ext_zifencei = true;
-+        } else if (send_warn) {
-+            warn_report(warn_msg, "zifencei");
-+        }
-+    }
-+}
-+
- /*
-  * Check consistency between chosen extensions while setting
-  * cpu->cfg accordingly.
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-     CPURISCVState *env = &cpu->env;
-     Error *local_err = NULL;
--    /* Do some ISA extension error checking */
--    if (riscv_has_ext(env, RVG) &&
--        !(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
--          riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
--          riscv_has_ext(env, RVD) &&
--          cpu->cfg.ext_zicsr && cpu->cfg.ext_zifencei)) {
--
--        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr)) &&
--            !cpu->cfg.ext_zicsr) {
--            error_setg(errp, "RVG requires Zicsr but user set Zicsr to false");
--            return;
--        }
--
--        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei)) &&
--            !cpu->cfg.ext_zifencei) {
--            error_setg(errp, "RVG requires Zifencei but user set "
--                       "Zifencei to false");
--            return;
--        }
--
--        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zicsr), true);
--        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zifencei), true);
--
--        env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
--        env->misa_ext_mask |= RVI | RVM | RVA | RVF | RVD;
-+    if (riscv_has_ext(env, RVG)) {
-+        riscv_cpu_validate_g(cpu);
-     }
-     if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
---
-.43.0

-[PULL 45/65] riscv-qmp-cmds.c: add profile flags in cpu-model-expansion
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Expose all profile flags for all CPUs when executing
-query-cpu-model-expansion. This will allow callers to quickly determine
-if a certain profile is implemented by a given CPU. This includes vendor
-CPUs - the fact that they don't have profile user flags doesn't mean
-that they don't implement the profile.
-After this change it's possible to quickly determine if our stock CPUs
-implement the existing rva22u64 profile. Here's a few examples:
- $ ./build/qemu-system-riscv64 -S -M virt -display none
--qmp tcp:localhost:1234,server,wait=off
- $ ./scripts/qmp/qmp-shell localhost:1234
-Welcome to the QMP low-level shell!
-Connected to QEMU 8.1.50
-- As expected, the 'max' CPU implements the rva22u64 profile.
-(QEMU) query-cpu-model-expansion type=full model={"name":"max"}
-    {"return": {"model":
-        {"name": "rv64", "props": {... "rva22u64": true, ...}}}}
-- rv64 is missing "zba", "zbb", "zbs", "zkt" and "zfhmin":
-query-cpu-model-expansion type=full model={"name":"rv64"}
-    {"return": {"model":
-        {"name": "rv64", "props": {... "rva22u64": false, ...}}}}
-query-cpu-model-expansion type=full model={"name":"rv64",
-    "props":{"zba":true,"zbb":true,"zbs":true,"zkt":true,"zfhmin":true}}
-    {"return": {"model":
-        {"name": "rv64", "props": {... "rva22u64": true, ...}}}}
-We have no vendor CPUs that supports rva22u64 (veyron-v1 is the closest
-- it is missing just 'zkt').
-In short, aside from the 'max' CPU, we have no CPUs that supports
-rva22u64 by default.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-18-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/riscv-qmp-cmds.c | 14 ++++++++++++++
-file changed, 14 insertions(+)
-diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/riscv-qmp-cmds.c
-+++ b/target/riscv/riscv-qmp-cmds.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
-     }
- }
-+static void riscv_obj_add_profiles_qdict(Object *obj, QDict *qdict_out)
-+{
-+    RISCVCPUProfile *profile;
-+    QObject *value;
-+
-+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
-+        profile = riscv_profiles[i];
-+        value = QOBJECT(qbool_from_bool(profile->enabled));
-+
-+        qdict_put_obj(qdict_out, profile->name, value);
-+    }
-+}
-+
- static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
-                                            const QDict *qdict_in,
-                                            Error **errp)
-@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
-     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
-     riscv_obj_add_named_feats_qdict(obj, qdict_out);
-+    riscv_obj_add_profiles_qdict(obj, qdict_out);
-     /* Add our CPU boolean options too */
-     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
---
-.43.0

-[PULL 48/65] target/riscv: add priv ver restriction to profiles
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Some profiles, like RVA22S64, has a priv_spec requirement.
-Make this requirement explicit for all profiles. We'll validate this
-requirement finalize() time and, in case the user chooses an
-incompatible priv_spec while activating a profile, a warning will be
-shown.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-21-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h         |  2 ++
- target/riscv/cpu.c         |  1 +
- target/riscv/tcg/tcg-cpu.c | 31 +++++++++++++++++++++++++++++++
-files changed, 34 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
-     uint32_t misa_ext;
-     bool enabled;
-     bool user_set;
-+    int priv_spec;
-     const int32_t ext_offsets[];
- } RISCVCPUProfile;
- #define RISCV_PROFILE_EXT_LIST_END -1
-+#define RISCV_PROFILE_ATTR_UNUSED -1
- extern RISCVCPUProfile *riscv_profiles[];
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
- static RISCVCPUProfile RVA22U64 = {
-     .name = "rva22u64",
-     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
-+    .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
-     .ext_offsets = {
-         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
-         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
-     }
- }
-+static const char *cpu_priv_ver_to_str(int priv_ver)
-+{
-+    switch (priv_ver) {
-+    case PRIV_VERSION_1_10_0:
-+        return "v1.10.0";
-+    case PRIV_VERSION_1_11_0:
-+        return "v1.11.0";
-+    case PRIV_VERSION_1_12_0:
-+        return "v1.12.0";
-+    }
-+
-+    g_assert_not_reached();
-+}
-+
- static void riscv_cpu_synchronize_from_tb(CPUState *cs,
-                                           const TranslationBlock *tb)
- {
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
- static void riscv_cpu_validate_profile(RISCVCPU *cpu,
-                                        RISCVCPUProfile *profile)
- {
-+    CPURISCVState *env = &cpu->env;
-     const char *warn_msg = "Profile %s mandates disabled extension %s";
-     bool send_warn = profile->user_set && profile->enabled;
-     bool profile_impl = true;
-     int i;
-+    if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
-+        profile->priv_spec != env->priv_ver) {
-+        profile_impl = false;
-+
-+        if (send_warn) {
-+            warn_report("Profile %s requires priv spec %s, "
-+                        "but priv ver %s was set", profile->name,
-+                        cpu_priv_ver_to_str(profile->priv_spec),
-+                        cpu_priv_ver_to_str(env->priv_ver));
-+        }
-+    }
-+
-     for (i = 0; misa_bits[i] != 0; i++) {
-         uint32_t bit = misa_bits[i];
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
-     profile->user_set = true;
-     profile->enabled = value;
-+    if (profile->enabled) {
-+        cpu->env.priv_ver = profile->priv_spec;
-+    }
-+
-     for (i = 0; misa_bits[i] != 0; i++) {
-         uint32_t bit = misa_bits[i];
---
-.43.0

-[PULL 49/65] target/riscv/cpu.c: finalize satp_mode earlier
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Profiles will need to validate satp_mode during their own finalize
-methods. This will occur inside riscv_tcg_cpu_finalize_features() for
-TCG. Given that satp_mode does not have any pre-req from the accelerator
-finalize() method, it's safe to finalize it earlier.
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-22-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 16 ++++++++--------
-file changed, 8 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
- {
-     Error *local_err = NULL;
-+#ifndef CONFIG_USER_ONLY
-+    riscv_cpu_satp_mode_finalize(cpu, &local_err);
-+    if (local_err != NULL) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+#endif
-+
-     /*
-      * KVM accel does not have a specialized finalize()
-      * callback because its extensions are validated
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
-             return;
-         }
-     }
--
--#ifndef CONFIG_USER_ONLY
--    riscv_cpu_satp_mode_finalize(cpu, &local_err);
--    if (local_err != NULL) {
--        error_propagate(errp, local_err);
--        return;
--    }
--#endif
- }
- static void riscv_cpu_realize(DeviceState *dev, Error **errp)
---
-.43.0

-[PULL 52/65] target/riscv: add 'parent' in profile description
+Deleted patch
-From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Certain S-mode profiles, like RVA22S64 and RVA23S64, mandate all the
-mandatory extensions of their respective U-mode profiles. RVA22S64
-includes all mandatory extensions of RVA22U64, and the same happens with
-RVA23 profiles.
-Add a 'parent' field to allow profiles to enable other profiles. This
-will allow us to describe S-mode profiles by specifying their parent
-U-mode profile, then adding just the S-mode specific extensions.
-We're naming the field 'parent' to consider the possibility of other
-uses (e.g. a s-mode profile including a previous s-mode profile) in the
-future.
-Suggested-by: Andrew Jones <ajones@ventanamicro.com>
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231218125334.37184-25-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h         |  1 +
- target/riscv/cpu.c         |  1 +
- target/riscv/tcg/tcg-cpu.c | 14 +++++++++++++-
-files changed, 15 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
- #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
- typedef struct riscv_cpu_profile {
-+    struct riscv_cpu_profile *parent;
-     const char *name;
-     uint32_t misa_ext;
-     bool enabled;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
-  * having a cfg offset) at this moment.
-  */
- static RISCVCPUProfile RVA22U64 = {
-+    .parent = NULL,
-     .name = "rva22u64",
-     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
-     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
-diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/tcg/tcg-cpu.c
-+++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
-     CPURISCVState *env = &cpu->env;
-     const char *warn_msg = "Profile %s mandates disabled extension %s";
-     bool send_warn = profile->user_set && profile->enabled;
--    bool profile_impl = true;
-+    bool parent_enabled, profile_impl = true;
-     int i;
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
-     }
-     profile->enabled = profile_impl;
-+
-+    if (profile->parent != NULL) {
-+        parent_enabled = object_property_get_bool(OBJECT(cpu),
-+                                                  profile->parent->name,
-+                                                  NULL);
-+        profile->enabled = profile->enabled && parent_enabled;
-+    }
- }
- static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
-@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
-     profile->user_set = true;
-     profile->enabled = value;
-+    if (profile->parent != NULL) {
-+        object_property_set_bool(obj, profile->parent->name,
-+                                 profile->enabled, NULL);
-+    }
-+
-     if (profile->enabled) {
-         cpu->env.priv_ver = profile->priv_spec;
-     }
---
-.43.0

-[PULL 61/65] roms/opensbi: Upgrade from v1.3.1 to v1.4
+Deleted patch
-From: Bin Meng <bmeng@tinylab.org>
-Upgrade OpenSBI from v1.3.1 to v1.4 and the pre-built bios images.
-The v1.4 release includes the following commits:
-a398d9 lib: sbi: Add Zicntr as a HART ISA extension
-c lib: sbi: Add Zihpm as a HART ISA extension
-b9c8f lib: sbi: Alphabetically sort HART ISA extensions
-fc6 lib: sbi: Rename hart_pmu_get_allowed_bits() function
-c lib: sbi: Fix Priv spec version for [m|s]counteren and mcountinhibit CSRs
-6053917 lib: sbi: Fix how print gets flags
-ef182 lib: sbi: print not fill '0' when left-aligned
-dac06 lib: sbi: Add '+' flags for print
-fa74 lib: sbi: Add ' ' '\'' flags for print
-cbb6e lib: sbi: implifying the parameters of printi
-fe08281 lib: sbi: print add 'o' type
-c6ee5ae lib: sbi: Fix printi
-b6fcdd lib: sbi: Simplify prints
-cc89fa7 lib: sbi: Fix printc
-ff43168 lib: sbi: Fix timing of clearing tbuf
-a73982d lib: sbi: Fix missing '\0' when buffer szie equal 1
-ea6533a lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
-c3b98c6 include: sbi: Add macro definitions for mseccfg CSR
-c099c4 lib: sbi: Add functions to manipulate PMP entries
-c202c5 include: sbi: Add Smepmp specific access flags for PMP entries
-cbcfc7b lib: sbi: Add smepmp in hart extensions
-d72f5f1 lib: utils: Add detection of Smepmp from ISA string in FDT
-a42a23 lib: sbi: Grant SU R/W/X permissions to whole memory
-f3fdd04 lib: sbi: Change the order of PMP initialization
-dd8db5 lib: sbi: Add support for Smepmp
-e44ef6 lib: sbi: Add functions to map/unmap shared memory
-ad8660 lib: sbi: Map/Unmap debug console shared memory buffers
-eb10 lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
-e2111e libfdt: fix SPDX license identifiers
-e05a9cf lib: sbi: Update system suspend to spec
-e20d25 include: sbi: fix CSR define of mseccfg
-c5151 include: sbi_utils: Remove driver pointer from struct i2c_adapter
-a35b0 lib: utils/regmap: Add generic regmap access library
-e97275 lib: utils/regmap: Add simple FDT based regmap framework
-f21d8f7 lib: utils/regmap: Add simple FDT based syscon regmap driver
-a344a9 lib: utils/reset: Add syscon based reboot and poweroff
-c2e6027 lib: utils/reset: Remove SiFive Test reset driver
-f536e0b gitignore: allow gitignore to ignore most dot file
-c744ed7 lib: sbi_pmu: Enable noncontigous hpm event and counters
-b2e lib: utils/fdt: Fix fdt_parse_isa_extensions() implementation
-f46a564 lib: sbi: Fix typo for finding fixed event counter
-a8 fw_base.S: Fix assembler error with clang 16+
-c104c60 lib: sbi: Add support for smcntrpmf
-aabeee Makefile: Fix grep warning
-e7e73aa platform: generic: allwinner: correct mhpmevent count
-ee1f83c lib: sbi_pmu: remove mhpm_count field in hart feature
-a9cffd6 firmware: payload: test: Change to SBI v2.0 DBCN ecalls
-b20bd47 lib: sbi: improve the definition of SBI_IPI_EVENT_MAX
-f lib: sbi_pmu: ensure update hpm counter before starting counting
-c9a296d platform: generic: allwinner: fix OF process for T-HEAD c9xx pmu
-d3d7 lib: sbi_pmu: keep overflow interrupt of stopped hpm counter disabled
-cacfba3 platform: Allow platforms to specify the size of tlb fifo
-bd9694 lib: sbi: alloc tlb fifo by sbi_malloc
-e65d lib: sbi: Implement SET_FS_DIRTY() to make sure the mstatus FS dirty is set
-d1e4dff lib: sbi: Introduce HART index in sbi_scratch
-e6125c3 lib: sbi: Remove sbi_platform_hart_index/invalid() functions
-e70d lib: sbi: Extend sbi_hartmask to support both hartid and hartindex
-e632cd7 lib: sbi: Use sbi_scratch_last_hartindex() in remote TLB managment
-c667b lib: sbi: Prefer hartindex over hartid in IPI framework
-d6ff8 lib: sbi: Remove sbi_scratch_last_hartid() macro
-daa2 lib: sbi: Maximize the use of HART index in sbi_domain
-fb3 include: sbi: Remove sbi_hartmask_for_each_hart() macro
-b8fb96e include: sbi_domain: Fix permission test macros
-bff27c1 lib: sbi: Factor-out Smepmp configuration as separate function
-d31 lib: sbi: Don't clear mseccfg.MML bit in sbi_hart_smepmp_configure()
-b51a9d lib: sbi: Fix pmp_flags for Smepmp read-only shared region
-aea28 lib: sbi: Populate M-only Smepmp entries before setting mseccfg.MML
-e8bc162 lib: utils/serial: Add shared regions for serial drivers
-b7e9d34 lib: utils/regmap: Mark syscon region as shared read-write
-3669153 platform: generic: thead: fix stale TLB entries for th1520/sg2042
-de525ac firmware: Remove ALIGN in .rela.dyn in linker script
-a6d725 firmware: Remove handling of R_RISCV_{32,64}
-ed125a Makefile: Add --exclude-libs ALL to avoid .dynsym
-e21901d doc: Fix fw_payload.md
-a125423 lib: utils/serial: Ensure proper allocation of PMP entries for uart8250
-d36709f lib: utils: timer/ipi: Update memregion flags for PLMT and PLICSW
-c2f lib: sbi: fix sbi_domain_get_assigned_hartmask()
-da30f6 lib: utils/fdt: simplify dt_parse_isa_extensions
-aca2 lib: utils: Simplify SET_ISA_EXT_MAP()
-f831b93 lib: sbi_pmu: check for index overflows
-d891cae gpio/starfive: redundant readl() call
-e8114c6 docs: platform: update platform_requirements.md
-f2b lib: sbi: Add support for mconfigptr
-ec0559e lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP
-cbdd869 include: sbi: Change spec version to 2.0
-d0ed1b lib: sbi: simplify sanitize_domain()
-c1a6987 platform: generic: thead: move to thead c9xx header to vendor specific postion
-e941e7 platform: generic: thead: separate implement of T-HEAD c9xx pmu
-d9b1 platform: generic: thead: separate implement of T-HEAD c9xx errata
-e21b96 platform: generic: thead: initialize PMU by default in thead generic platform
-a140a4e lib: sbi: Correctly limit flushes to a single ASID/VMID
-ae718 platform: generic: thead: improve tlb flush errata
-fd64b platform: Uses hart count as the default size of tlb info
-f2ccd lib: utils/serial: Optimize semihosting_putc implementation
-fccdf41 firmware: fw_base.S: Fix boot hart status synchronization
-d1e0f7f utils/reset: Remove fdt_reset_thead
-d2c9 lib: utils/timer: Allow ACLINT MTIMER driver to setup quirks
-accafb1 lib: utils/timer: mtimer: add separate T-Head C9xx CLINT mtimer compatible
-bc25f lib: utils/ipi: mswi: add separate T-Head C9xx CLINT mswi compatible
-b2f55d lib: sbi: separate the swap operation of domain region
-b03cdd lib: sbi: Add regions merging when sanitizing domain region
-bfdb9e platform: generic: Add Sophgo sg2042 platform support
-f7ae include: sbi: macros for mseccfg.sseed and .useed
-efcac33 lib: sbi: Add Zkr in hart extensions
-e5b0cf lib: sbi: enable seed access in S-mode
-e11 lib: sbi: change sbi_hart_features.extensions as an array
-aaed4f lib: sbi: Make console_puts/console_putc interchangeable
-dc0bb19 lib: utils/serial: remove semihosting_putc
-bb930 lib: sbi: Fix PMP granularity handling in sbi_hart_map_saddr()
-b9c8 lib: sbi_pmu: avoid buffer overflow
-c lib: utils/irqchip: Avoid redundant writes to APLIC CLRIE register
-f520256 lib: sbi: Allow relaxed MMIO writes in device ipi_send() callback
-b70d628 lib: sbi: Allow relaxed MMIO writes in device ipi_clear() callback
-bd74931 lib: ipi: Adjust Andes PLICSW to single-bit-per-hart scheme
-f sbi: sbi_pmu: Improve sbi_pmu_init() error handling
-fa99 lib: sbi: Add XAndesPMU in hart extensions
-a48f2cf sbi: sbi_pmu: Add hw_counter_filter_mode() to pmu device
-ec60c platform: include: andes45: Add PMU related CSR defines
-effd89a platform: generic: Introduce pmu_init() platform override
-b9e743 platform: andes: Add Andes custom PMU support
-e50c24 platform: andes: Enable Andes PMU for AE350
-c661 platform: rzfive: Enable Andes PMU for RZ/Five
-b3262e lib: utils: fdt_fixup: Allow preserving PMU properties
-ae4e platform: andes: Factor out is_andes() helper
-f93 lib: utils: fdt_pmu: Make the fdt_pmu_evt_select table global variable
-e19d419 lib: utils: fdt_pmu: Do not iterate over the fdt_pmu_evt_select table
-d162009 docs: pmu: Add Andes PMU node example
-b9a849 lib: sbi: Remove xchg/cmpxchg implemented via lr/sc
-bf49b lib: sbi: Fix __atomic_op_bit_ord and comments
-8839869 lib: sbi: Replace __atomic_op_bit_ord with __atomic intrinsics
-ec lib: sbi: Prevent redundant sbi_ipi_process
-da66b lib: sbi_hart: Store PMP granularity as log base 2
-ee72517 lib: sbi_pmu: Add PMU snapshot definitions
-a0ba5 lib: sbi_pmu: Fix the counter info function
-0696810 firmware: fix section types
-a25fc74 lib: sbi_hsm: Put the resume_pending hart in the interruptible hart mask
-aa306 platform: recalculate heap size to support new tlb entry number
-a2e254e lib: sbi: skip wait_for_coldboot when coolboot done
-d58 lib: utils/fdt: Allow to use reg-names when parsing ACLINT
-cba92 lib: sbi_tlb: Check tlb_range_flush_limit only once per request
-a894187 lib: sbi_ipi: Do not ignore errors from sbi_ipi_send()
-fa65 lib: sbi_ipi: Process self-IPIs in sbi_ipi_send()
-2707250 lib: sbi_ipi: Drop unnecessary ipi_process check
-ce14 lib: sbi: Simplify the initialization of root_hmask in sbi_domain_init
-c8be56 lib: sbi: Improve the code of privilege mode and extensions detection
-fe6f lib: sbi: Refactor the code for enable extensions in menvfg CSR
-d lib: sbi: Using one array to define the name of extensions
-daac8f lib: sbi: Detect extensions from the ISA string in DT
-ceb3 lib: sbi_tlb: Reduce size of struct sbi_tlb_info
-b2 platform: generic: Fine tune fw_platform_calculate_heap_size()
-cdebae2 lib: utils/irqchip: Add shared MMIO region for PLIC in root domain
-bea lib: sbi: Allow ecall handlers to directly update register state
-a57e8c lib: sbi: Remove the SBI_ETRAP error code
-b80b92 lib: sbi: Do not enter OpenSBI with mseccfg.MML == 1
-e09ad lib: sbi: Fix shift bug in sbi_system_reset
-ba29293 lib: utils/timer: mtimer: only use regname for aclint
-bbd065d lib: sbi: Detect Zicntr extension only based on traps
-a2b255b include: Bump-up version to 1.4
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20240102151153.133896-1-bmeng@tinylab.org>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 135376 -> 267416 bytes
- .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 138368 -> 270808 bytes
- roms/opensbi                                  |   2 +-
-files changed, 1 insertion(+), 1 deletion(-)
-diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
-diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
-diff --git a/roms/opensbi b/roms/opensbi
-index XXXXXXX..XXXXXXX 160000
---- a/roms/opensbi
-+++ b/roms/opensbi
-@@ -1 +1 @@
--Subproject commit 057eb10b6d523540012e6947d5c9f63e95244e94
-+Subproject commit a2b255b88918715173942f2c5e1f97ac9e90c877
---
-.43.0

-[PULL 62/65] target/riscv: pmp: Ignore writes when RW=01 and MML=0
+Deleted patch
-From: Ivan Klokov <ivan.klokov@syntacore.com>
-This patch changes behavior on writing RW=01 to pmpcfg with MML=0.
-RWX filed is form of collective WARL with the combination of
-pmpcfg.RW=01 remains reserved for future standard use.
-According to definition of WARL writing the CSR has no other side
-effect. But current implementation change architectural state and
-change system behavior. After writing we will get unreadable-unwriteble
-region regardless on the previous state.
-On the other side WARL said that we should read legal value and nothing
-says about what we should write. Current behavior change system state
-regardless of whether we read this register or not.
-Fixes: ac66f2f0 ("target/riscv: pmp: Ignore writes when RW=01")
-Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
-Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-ID: <20231220153205.11072-1-ivan.klokov@syntacore.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/pmp.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.c
-+++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
-             /* If !mseccfg.MML then ignore writes with encoding RW=01 */
-             if ((val & PMP_WRITE) && !(val & PMP_READ) &&
-                 !MSECCFG_MML_ISSET(env)) {
--                val &= ~(PMP_WRITE | PMP_READ);
-+                return false;
-             }
-             env->pmp_state.pmp[pmp_index].cfg_reg = val;
-             pmp_update_rule_addr(env, pmp_index);
---
-.43.0

The following changes since commit 9468484fe904ab4691de6d9c34616667f377ceac:

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2024-01-09 10:32:23 +0000)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240110

for you to fetch changes up to 71b76da33a1558bcd59100188f5753737ef6fa21:

target/riscv: Ensure mideleg is set correctly on reset (2024-01-10 18:47:47 +1000)

----------------------------------------------------------------
RISC-V PR for 9.0

* Make vector whole-register move (vmv) depend on vtype register
* Fix th.dcache.cval1 priviledge check
* Don't allow write mstatus_vs without RVV
* Use hwaddr instead of target_ulong for RV32
* Fix machine IDs QOM getters\
* Fix KVM reg id sizes
* ACPI: Enable AIA, PLIC and update RHCT
* Fix the interrupts-extended property format of PLIC
* Add support for Zacas extension
* Add amocas.[w,d,q] instructions
* Document acpi parameter of virt machine
* RVA22 profiles support
* Remove group setting of KVM AIA if the machine only has 1 socket
* Add RVV CSRs to KVM
* sifive_u: Update S-mode U-Boot image build instructions
* Upgrade OpenSBI from v1.3.1 to v1.4
* pmp: Ignore writes when RW=01 and MML=0
* Assert that the CSR numbers will be correct
* Don't adjust vscause for exceptions
* Ensure mideleg is set correctly on reset

----------------------------------------------------------------
Alistair Francis (3):
      target/riscv: Assert that the CSR numbers will be correct
      target/riscv: Don't adjust vscause for exceptions
      target/riscv: Ensure mideleg is set correctly on reset

Bin Meng (2):
      docs/system/riscv: sifive_u: Update S-mode U-Boot image build instructions
      roms/opensbi: Upgrade from v1.3.1 to v1.4

Daniel Henrique Barboza (36):
      target/riscv/cpu.c: fix machine IDs getters
      target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
      target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
      target/riscv/kvm: change timer regs size to u64
      target/riscv/kvm: add RISCV_CONFIG_REG()
      target/riscv/kvm: rename riscv_reg_id() to riscv_reg_id_ulong()
      target/riscv: create TYPE_RISCV_VENDOR_CPU
      target/riscv/tcg: do not use "!generic" CPU checks
      target/riscv/tcg: update priv_ver on user_set extensions
      target/riscv: add rv64i CPU
      target/riscv: add zicbop extension flag
      target/riscv/tcg: add 'zic64b' support
      riscv-qmp-cmds.c: expose named features in cpu_model_expansion
      target/riscv: add rva22u64 profile definition
      target/riscv/kvm: add 'rva22u64' flag as unavailable
      target/riscv/tcg: add user flag for profile support
      target/riscv/tcg: add MISA user options hash
      target/riscv/tcg: add riscv_cpu_write_misa_bit()
      target/riscv/tcg: handle profile MISA bits
      target/riscv/tcg: add hash table insert helpers
      target/riscv/tcg: honor user choice for G MISA bits
      target/riscv/tcg: validate profiles during finalize
      riscv-qmp-cmds.c: add profile flags in cpu-model-expansion
      target/riscv: add 'rva22u64' CPU
      target/riscv: implement svade
      target/riscv: add priv ver restriction to profiles
      target/riscv/cpu.c: finalize satp_mode earlier
      target/riscv/cpu.c: add riscv_cpu_is_32bit()
      target/riscv: add satp_mode profile support
      target/riscv: add 'parent' in profile description
      target/riscv: add RVA22S64 profile
      target/riscv: add rva22s64 cpu
      linux-headers: Update to Linux v6.7-rc5
      linux-headers: riscv: add ptrace.h
      target/riscv/kvm: do PR_RISCV_V_SET_CONTROL during realize()
      target/riscv/kvm: add RVV and Vector CSR regs

Heinrich Schuchardt (1):
      docs/system/riscv: document acpi parameter of virt machine

Ivan Klokov (2):
      target/riscv/pmp: Use hwaddr instead of target_ulong for RV32
      target/riscv: pmp: Ignore writes when RW=01 and MML=0

LIU Zhiwei (2):
      target/riscv: Fix th.dcache.cval1 priviledge check
      target/riscv: Not allow write mstatus_vs without RVV

Max Chou (2):
      target/riscv: Add vill check for whole vector register move instructions
      target/riscv: The whole vector register move instructions depend on vsew

Rob Bradford (1):
      disas/riscv: Add amocas.[w,d,q] instructions

Sunil V L (13):
      hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
      hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
      hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
      hw/riscv: virt: Make few IMSIC macros and functions public
      hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
      hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
      hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
      hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
      hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
      hw/pci-host/gpex: Define properties for MMIO ranges
      hw/riscv/virt: Update GPEX MMIO related properties
      hw/riscv/virt-acpi-build.c: Add IO controllers and devices
      hw/riscv/virt-acpi-build.c: Add PLIC in MADT

Weiwei Li (1):
      target/riscv: Add support for Zacas extension

Yong-Xuan Wang (2):
      hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
      target/riscv/kvm.c: remove group setting of KVM AIA if the machine only has 1 socket

docs/system/riscv/sifive_u.rst                 |  33 +-
 docs/system/riscv/virt.rst                     |   5 +
 include/hw/nvram/fw_cfg_acpi.h                 |  15 +
 include/hw/pci-host/gpex.h                     |  28 +-
 include/hw/riscv/virt.h                        |  26 ++
 include/hw/virtio/virtio-acpi.h                |  16 +
 include/standard-headers/drm/drm_fourcc.h      |   2 +
 include/standard-headers/linux/pci_regs.h      |  24 +-
 include/standard-headers/linux/vhost_types.h   |   7 +
 include/standard-headers/linux/virtio_config.h |   5 +
 include/standard-headers/linux/virtio_pci.h    |  11 +
 linux-headers/asm-arm64/kvm.h                  |  32 ++
 linux-headers/asm-generic/unistd.h             |  14 +-
 linux-headers/asm-loongarch/bitsperlong.h      |   1 +
 linux-headers/asm-loongarch/kvm.h              | 108 ++++++
 linux-headers/asm-loongarch/mman.h             |   1 +
 linux-headers/asm-loongarch/unistd.h           |   5 +
 linux-headers/asm-mips/unistd_n32.h            |   4 +
 linux-headers/asm-mips/unistd_n64.h            |   4 +
 linux-headers/asm-mips/unistd_o32.h            |   4 +
 linux-headers/asm-powerpc/unistd_32.h          |   4 +
 linux-headers/asm-powerpc/unistd_64.h          |   4 +
 linux-headers/asm-riscv/kvm.h                  |  12 +
 linux-headers/asm-riscv/ptrace.h               | 132 +++++++
 linux-headers/asm-s390/unistd_32.h             |   4 +
 linux-headers/asm-s390/unistd_64.h             |   4 +
 linux-headers/asm-x86/unistd_32.h              |   4 +
 linux-headers/asm-x86/unistd_64.h              |   3 +
 linux-headers/asm-x86/unistd_x32.h             |   3 +
 linux-headers/linux/iommufd.h                  | 180 +++++++++-
 linux-headers/linux/kvm.h                      |  11 +
 linux-headers/linux/psp-sev.h                  |   1 +
 linux-headers/linux/stddef.h                   |   9 +-
 linux-headers/linux/userfaultfd.h              |   9 +-
 linux-headers/linux/vfio.h                     |  47 ++-
 linux-headers/linux/vhost.h                    |   8 +
 target/riscv/cpu-qom.h                         |   5 +
 target/riscv/cpu.h                             |  18 +
 target/riscv/cpu_cfg.h                         |   5 +
 target/riscv/pmp.h                             |   8 +-
 target/riscv/insn32.decode                     |   6 +
 disas/riscv.c                                  |   9 +
 hw/arm/virt-acpi-build.c                       |  51 +--
 hw/i386/acpi-microvm.c                         |  15 +-
 hw/nvram/fw_cfg-acpi.c                         |  23 ++
 hw/pci-host/gpex-acpi.c                        |  13 +
 hw/pci-host/gpex.c                             |  12 +
 hw/riscv/virt-acpi-build.c                     | 323 ++++++++++++++++--
 hw/riscv/virt.c                                | 124 +++----
 hw/virtio/virtio-acpi.c                        |  33 ++
 target/riscv/cpu.c                             | 223 ++++++++++--
 target/riscv/cpu_helper.c                      |   4 +-
 target/riscv/csr.c                             |  10 +-
 target/riscv/kvm/kvm-cpu.c                     | 250 ++++++++++----
 target/riscv/pmp.c                             |  28 +-
 target/riscv/riscv-qmp-cmds.c                  |  44 ++-
 target/riscv/tcg/tcg-cpu.c                     | 455 ++++++++++++++++++++++---
 target/riscv/translate.c                       |   1 +
 target/riscv/insn_trans/trans_rvv.c.inc        |   8 +-
 target/riscv/insn_trans/trans_rvzacas.c.inc    | 150 ++++++++
 target/riscv/insn_trans/trans_xthead.c.inc     |   2 +-
 hw/nvram/meson.build                           |   1 +
 hw/riscv/Kconfig                               |   1 +
 hw/virtio/meson.build                          |   1 +
 pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 135376 -> 267416 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 138368 -> 270808 bytes
 roms/opensbi                                   |   2 +-
 scripts/update-linux-headers.sh                |   3 +
 68 files changed, 2248 insertions(+), 360 deletions(-)
 create mode 100644 include/hw/nvram/fw_cfg_acpi.h
 create mode 100644 include/hw/virtio/virtio-acpi.h
 create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
 create mode 100644 linux-headers/asm-loongarch/kvm.h
 create mode 100644 linux-headers/asm-loongarch/mman.h
 create mode 100644 linux-headers/asm-loongarch/unistd.h
 create mode 100644 linux-headers/asm-riscv/ptrace.h
 create mode 100644 hw/nvram/fw_cfg-acpi.c
 create mode 100644 hw/virtio/virtio-acpi.c
 create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc

From: Max Chou <max.chou@sifive.com>

The ratified version of RISC-V V spec section 16.6 says that
`The instructions operate as if EEW=SEW`.

So the whole vector register move instructions depend on the vtype
register that means the whole vector register move instructions should
raise an illegal-instruction exception when vtype.vill=1.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231129170400.21251-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
 }
 
 /*
- * Whole Vector Register Move Instructions ignore vtype and vl setting.
- * Thus, we don't need to check vill bit. (Section 16.6)
+ * Whole Vector Register Move Instructions depend on vtype register(vsew).
+ * Thus, we need to check vill bit. (Section 16.6)
  */
 #define GEN_VMV_WHOLE_TRANS(NAME, LEN)                             \
 static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
 {                                                                       \
     if (require_rvv(s) &&                                               \
+        vext_check_isa_ill(s) &&                                        \
         QEMU_IS_ALIGNED(a->rd, LEN) &&                                  \
         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
-- 
2.43.0

From: Max Chou <max.chou@sifive.com>

The RISC-V v spec 16.6 section says that the whole vector register move
instructions operate as if EEW=SEW. So it should depends on the vsew
field of vtype register.

Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231129170400.21251-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_##NAME * a)               \
         QEMU_IS_ALIGNED(a->rs2, LEN)) {                                 \
         uint32_t maxsz = (s->cfg_ptr->vlen >> 3) * LEN;                 \
         if (s->vstart_eq_zero) {                                        \
-            /* EEW = 8 */                                               \
-            tcg_gen_gvec_mov(MO_8, vreg_ofs(s, a->rd),                  \
+            tcg_gen_gvec_mov(s->sew, vreg_ofs(s, a->rd),                \
                              vreg_ofs(s, a->rs2), maxsz, maxsz);        \
             mark_vs_dirty(s);                                           \
         } else {                                                        \
-- 
2.43.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

According to the specification, the th.dcache.cvall1 can be executed
under all priviledges.
The specification about xtheadcmo located in,
https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadcmo/dcache_cval1.adoc

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Christoph Muellner <christoph.muellner@vrull.eu>
Message-ID: <20231208094315.177-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_xthead.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -XXX,XX +XXX,XX @@ NOP_PRIVCHECK(th_dcache_csw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_dcache_cisw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_dcache_isw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_dcache_cpal1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
-NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
+NOP_PRIVCHECK(th_dcache_cval1, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU)
 
 NOP_PRIVCHECK(th_icache_iall, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
 NOP_PRIVCHECK(th_icache_ialls, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS)
-- 
2.43.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

If CPU does not implement the Vector extension, it usually means
mstatus vs hardwire to zero. So we should not allow write a
non-zero value to this field.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231215023313.1708-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
-        MSTATUS_TW | MSTATUS_VS;
+        MSTATUS_TW;
 
     if (riscv_has_ext(env, RVF)) {
         mask |= MSTATUS_FS;
     }
+    if (riscv_has_ext(env, RVV)) {
+        mask |= MSTATUS_VS;
+    }
 
     if (xl != MXL_RV32 || env->debugger) {
         if (riscv_has_ext(env, RVH)) {
-- 
2.43.0

From: Ivan Klokov <ivan.klokov@syntacore.com>

The Sv32 page-based virtual-memory scheme described in RISCV privileged
spec Section 5.3 supports 34-bit physical addresses for RV32, so the
PMP scheme must support addresses wider than XLEN for RV32. However,
PMP address register format is still 32 bit wide.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231123091214.20312-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h |  8 ++++----
 target/riscv/pmp.c | 26 ++++++++++++--------------
 2 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 } pmp_entry_t;
 
 typedef struct {
-    target_ulong sa;
-    target_ulong ea;
+    hwaddr sa;
+    hwaddr ea;
 } pmp_addr_t;
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env);
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
                        target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
-bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
                         target_ulong size, pmp_priv_t privs,
                         pmp_priv_t *allowed_privs,
                         target_ulong mode);
-target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr);
+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
 void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ void pmp_unlock_entries(CPURISCVState *env)
     }
 }
 
-static void pmp_decode_napot(target_ulong a, target_ulong *sa,
-                             target_ulong *ea)
+static void pmp_decode_napot(hwaddr a, hwaddr *sa, hwaddr *ea)
 {
     /*
      * aaaa...aaa0   8-byte NAPOT range
@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
     target_ulong prev_addr = 0u;
-    target_ulong sa = 0u;
-    target_ulong ea = 0u;
+    hwaddr sa = 0u;
+    hwaddr ea = 0u;
 
     if (pmp_index >= 1u) {
         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
@@ -XXX,XX +XXX,XX @@ void pmp_update_rule_nums(CPURISCVState *env)
     }
 }
 
-static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
-                           target_ulong addr)
+static int pmp_is_in_range(CPURISCVState *env, int pmp_index, hwaddr addr)
 {
     int result = 0;
 
@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, pmp_priv_t privs,
  * Return true if a pmp rule match or default match
  * Return false if no match
  */
-bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
                         target_ulong size, pmp_priv_t privs,
                         pmp_priv_t *allowed_privs, target_ulong mode)
 {
     int i = 0;
     int pmp_size = 0;
-    target_ulong s = 0;
-    target_ulong e = 0;
+    hwaddr s = 0;
+    hwaddr e = 0;
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env)
  * To avoid this we return a size of 1 (which means no caching) if the PMP
  * region only covers partial of the TLB page.
  */
-target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr)
+target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr)
 {
-    target_ulong pmp_sa;
-    target_ulong pmp_ea;
-    target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
-    target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
+    hwaddr pmp_sa;
+    hwaddr pmp_ea;
+    hwaddr tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
+    hwaddr tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
     int i;
 
     /*
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

mvendorid is an uint32 property, mimpid/marchid are uint64 properties.
But their getters are returning bools. The reason this went under the
radar for this long is because we have no code using the getters.

The problem can be seem via the 'qom-get' API though. Launching QEMU
with the 'veyron-v1' CPU, a model with:

VEYRON_V1_MVENDORID: 0x61f (1567)
VEYRON_V1_MIMPID: 0x111 (273)
VEYRON_V1_MARCHID: 0x8000000000010000 (9223372036854841344)

This is what the API returns when retrieving these properties:

(qemu) qom-get /machine/soc0/harts[0] mvendorid
true
(qemu) qom-get /machine/soc0/harts[0] mimpid
true
(qemu) qom-get /machine/soc0/harts[0] marchid
true

After this patch:

(qemu) qom-get /machine/soc0/harts[0] mvendorid
1567
(qemu) qom-get /machine/soc0/harts[0] mimpid
273
(qemu) qom-get /machine/soc0/harts[0] marchid
9223372036854841344

Fixes: 1e34150045 ("target/riscv/cpu.c: restrict 'mvendorid' value")
Fixes: a1863ad368 ("target/riscv/cpu.c: restrict 'mimpid' value")
Fixes: d6a427e2c0 ("target/riscv/cpu.c: restrict 'marchid' value")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231211170732.2541368-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
 static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
                               void *opaque, Error **errp)
 {
-    bool value = RISCV_CPU(obj)->cfg.mvendorid;
+    uint32_t value = RISCV_CPU(obj)->cfg.mvendorid;
 
-    visit_type_bool(v, name, &value, errp);
+    visit_type_uint32(v, name, &value, errp);
 }
 
 static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
 static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
                            void *opaque, Error **errp)
 {
-    bool value = RISCV_CPU(obj)->cfg.mimpid;
+    uint64_t value = RISCV_CPU(obj)->cfg.mimpid;
 
-    visit_type_bool(v, name, &value, errp);
+    visit_type_uint64(v, name, &value, errp);
 }
 
 static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
 static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
                            void *opaque, Error **errp)
 {
-    bool value = RISCV_CPU(obj)->cfg.marchid;
+    uint64_t value = RISCV_CPU(obj)->cfg.marchid;
 
-    visit_type_bool(v, name, &value, errp);
+    visit_type_uint64(v, name, &value, errp);
 }
 
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM_REG_RISCV_FP_F regs have u32 size according to the API, but by using
kvm_riscv_reg_id() in RISCV_FP_F_REG() we're returning u64 sizes when
running with TARGET_RISCV64. The most likely reason why no one noticed
this is because we're not implementing kvm_cpu_synchronize_state() in
RISC-V yet.

Create a new helper that returns a KVM ID with u32 size and use it in
RISCV_FP_F_REG().

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
     return id;
 }
 
+static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
+{
+    return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
+}
+
 #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
                  KVM_REG_RISCV_CORE_REG(name))
 
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 #define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
-#define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
+#define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
 
 #define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
 
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
     if (riscv_has_ext(env, RVF)) {
         uint32_t reg;
         for (i = 0; i < 32; i++) {
-            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
+            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(i), &reg);
             if (ret) {
                 return ret;
             }
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
         uint32_t reg;
         for (i = 0; i < 32; i++) {
             reg = env->fpr[i];
-            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
+            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(i), &reg);
             if (ret) {
                 return ret;
             }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM_REG_RISCV_FP_D regs are always u64 size. Using kvm_riscv_reg_id() in
RISCV_FP_D_REG() ends up encoding the wrong size if we're running with
TARGET_RISCV32.

Create a new helper that returns a KVM ID with u64 size and use it with
RISCV_FP_D_REG().

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
     return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
 }
 
+static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
+{
+    return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
+}
+
 #define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
                  KVM_REG_RISCV_CORE_REG(name))
 
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
 
 #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
 
-#define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
+#define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
 
 #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
     do { \
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
     if (riscv_has_ext(env, RVD)) {
         uint64_t reg;
         for (i = 0; i < 32; i++) {
-            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
+            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(i), &reg);
             if (ret) {
                 return ret;
             }
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
         uint64_t reg;
         for (i = 0; i < 32; i++) {
             reg = env->fpr[i];
-            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
+            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(i), &reg);
             if (ret) {
                 return ret;
             }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM_REG_RISCV_TIMER regs are always u64 according to the KVM API, but at
this moment we'll return u32 regs if we're running a RISCV32 target.

Use the kvm_riscv_reg_id_u64() helper in RISCV_TIMER_REG() to fix it.

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
 #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
                  KVM_REG_RISCV_CSR_REG(name))
 
-#define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
+#define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
 #define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
         } \
     } while (0)
 
-#define KVM_RISCV_GET_TIMER(cs, env, name, reg) \
+#define KVM_RISCV_GET_TIMER(cs, name, reg) \
     do { \
-        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
+        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
         if (ret) { \
             abort(); \
         } \
     } while (0)
 
-#define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
+#define KVM_RISCV_SET_TIMER(cs, name, reg) \
     do { \
-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
         if (ret) { \
             abort(); \
         } \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_get_regs_timer(CPUState *cs)
         return;
     }
 
-    KVM_RISCV_GET_TIMER(cs, env, time, env->kvm_timer_time);
-    KVM_RISCV_GET_TIMER(cs, env, compare, env->kvm_timer_compare);
-    KVM_RISCV_GET_TIMER(cs, env, state, env->kvm_timer_state);
-    KVM_RISCV_GET_TIMER(cs, env, frequency, env->kvm_timer_frequency);
+    KVM_RISCV_GET_TIMER(cs, time, env->kvm_timer_time);
+    KVM_RISCV_GET_TIMER(cs, compare, env->kvm_timer_compare);
+    KVM_RISCV_GET_TIMER(cs, state, env->kvm_timer_state);
+    KVM_RISCV_GET_TIMER(cs, frequency, env->kvm_timer_frequency);
 
     env->kvm_timer_dirty = true;
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
         return;
     }
 
-    KVM_RISCV_SET_TIMER(cs, env, time, env->kvm_timer_time);
-    KVM_RISCV_SET_TIMER(cs, env, compare, env->kvm_timer_compare);
+    KVM_RISCV_SET_TIMER(cs, time, env->kvm_timer_time);
+    KVM_RISCV_SET_TIMER(cs, compare, env->kvm_timer_compare);
 
     /*
      * To set register of RISCV_TIMER_REG(state) will occur a error from KVM
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
      * TODO If KVM changes, adapt here.
      */
     if (env->kvm_timer_state) {
-        KVM_RISCV_SET_TIMER(cs, env, state, env->kvm_timer_state);
+        KVM_RISCV_SET_TIMER(cs, state, env->kvm_timer_state);
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
      * during the migration.
      */
     if (migration_is_running(migrate_get_current()->state)) {
-        KVM_RISCV_GET_TIMER(cs, env, frequency, reg);
+        KVM_RISCV_GET_TIMER(cs, frequency, reg);
         if (reg != env->kvm_timer_frequency) {
             error_report("Dst Hosts timer frequency != Src Hosts");
         }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Create a RISCV_CONFIG_REG() macro, similar to what other regs use, to
hide away some of the boilerplate.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
 #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
                  KVM_REG_RISCV_CSR_REG(name))
 
+#define RISCV_CONFIG_REG(env, name) \
+    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
+                     KVM_REG_RISCV_CONFIG_REG(name))
+
 #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    reg.id = RISCV_CONFIG_REG(env, mvendorid);
     reg.addr = (uint64_t)&cpu->cfg.mvendorid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(marchid));
+    reg.id = RISCV_CONFIG_REG(env, marchid);
     reg.addr = (uint64_t)&cpu->cfg.marchid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
         error_report("Unable to retrieve marchid from host, error %d", ret);
     }
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(mimpid));
+    reg.id = RISCV_CONFIG_REG(env, mimpid);
     reg.addr = (uint64_t)&cpu->cfg.mimpid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              KVM_REG_RISCV_CONFIG_REG(isa));
+    reg.id = RISCV_CONFIG_REG(env, isa);
     reg.addr = (uint64_t)&env->misa_ext_mask;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
     uint64_t id;
     int ret;
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    id = RISCV_CONFIG_REG(env, mvendorid);
     /*
      * cfg.mvendorid is an uint32 but a target_ulong will
      * be written. Assign it to a target_ulong var to avoid
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
         return ret;
     }
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(marchid));
+    id = RISCV_CONFIG_REG(env, marchid);
     ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
     if (ret != 0) {
         return ret;
     }
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(mimpid));
+    id = RISCV_CONFIG_REG(env, mimpid);
     ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
 
     return ret;
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

kvm_riscv_reg_id() returns an id encoded with an ulong size, i.e. an u32
size when running TARGET_RISCV32 and u64 when running TARGET_RISCV64.

Rename it to kvm_riscv_reg_id_ulong() to enhance code readability. It'll
be in line with the existing kvm_riscv_reg_id_<size>() helpers.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231208183835.2411523-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 40 ++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 
 static bool cap_has_mp_state;
 
-static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
     uint64_t id = KVM_REG_RISCV | type | idx;
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
     return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
 }
 
-#define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
-                 KVM_REG_RISCV_CORE_REG(name))
+#define RISCV_CORE_REG(env, name) \
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, \
+                           KVM_REG_RISCV_CORE_REG(name))
 
-#define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
-                 KVM_REG_RISCV_CSR_REG(name))
+#define RISCV_CSR_REG(env, name) \
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CSR, \
+                           KVM_REG_RISCV_CSR_REG(name))
 
 #define RISCV_CONFIG_REG(env, name) \
-    kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG, \
-                     KVM_REG_RISCV_CONFIG_REG(name))
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG, \
+                           KVM_REG_RISCV_CONFIG_REG(name))
 
 #define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
 
         /* If we're here we're going to disable the MISA bit */
         reg = 0;
-        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-                              misa_cfg->kvm_reg_id);
+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+                                    misa_cfg->kvm_reg_id);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
             /*
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
             continue;
         }
 
-        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-                              multi_ext_cfg->kvm_reg_id);
+        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+                                    multi_ext_cfg->kvm_reg_id);
         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_core(CPUState *cs)
     env->pc = reg;
 
     for (i = 1; i < 32; i++) {
-        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
         ret = kvm_get_one_reg(cs, id, &reg);
         if (ret) {
             return ret;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_core(CPUState *cs)
     }
 
     for (i = 1; i < 32; i++) {
-        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
+        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
         reg = env->gpr[i];
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                              cbomz_cfg->kvm_reg_id);
+    reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
+                                    cbomz_cfg->kvm_reg_id);
     reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
         KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
         struct kvm_one_reg reg;
 
-        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-                                  multi_ext_cfg->kvm_reg_id);
+        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+                                        multi_ext_cfg->kvm_reg_id);
         reg.addr = (uint64_t)&val;
         ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
         if (ret != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
     for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
         multi_ext_cfg = &kvm_multi_ext_cfgs[i];
-        reg_id = kvm_riscv_reg_id(&cpu->env, KVM_REG_RISCV_ISA_EXT,
-                                  multi_ext_cfg->kvm_reg_id);
+        reg_id = kvm_riscv_reg_id_ulong(&cpu->env, KVM_REG_RISCV_ISA_EXT,
+                                        multi_ext_cfg->kvm_reg_id);
         reg_search = bsearch(&reg_id, reglist->reg, reglist->n,
                              sizeof(uint64_t), uint64_cmp);
         if (!reg_search) {
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

RISC-V also needs to use the same code to create fw_cfg in DSDT. So,
avoid code duplication by moving the code in arm and riscv to a device
specific file.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-2-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/nvram/fw_cfg_acpi.h | 15 +++++++++++++++
 hw/arm/virt-acpi-build.c       | 19 ++-----------------
 hw/nvram/fw_cfg-acpi.c         | 23 +++++++++++++++++++++++
 hw/riscv/virt-acpi-build.c     | 19 ++-----------------
 hw/nvram/meson.build           |  1 +
 5 files changed, 43 insertions(+), 34 deletions(-)
 create mode 100644 include/hw/nvram/fw_cfg_acpi.h
 create mode 100644 hw/nvram/fw_cfg-acpi.c

diff --git a/include/hw/nvram/fw_cfg_acpi.h b/include/hw/nvram/fw_cfg_acpi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/nvram/fw_cfg_acpi.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * ACPI support for fw_cfg
+ *
+ */
+
+#ifndef FW_CFG_ACPI_H
+#define FW_CFG_ACPI_H
+
+#include "qemu/osdep.h"
+#include "exec/hwaddr.h"
+
+void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap);
+
+#endif
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/cpu.h"
 #include "hw/acpi/acpi-defs.h"
 #include "hw/acpi/acpi.h"
-#include "hw/nvram/fw_cfg.h"
+#include "hw/nvram/fw_cfg_acpi.h"
 #include "hw/acpi/bios-linker-loader.h"
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/utils.h"
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
     aml_append(scope, dev);
 }
 
-static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
-{
-    Aml *dev = aml_device("FWCF");
-    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
-    /* device present, functioning, decoding, not shown in UI */
-    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
-    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-    Aml *crs = aml_resource_template();
-    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
-                                       fw_cfg_memmap->size, AML_READ_WRITE));
-    aml_append(dev, aml_name_decl("_CRS", crs));
-    aml_append(scope, dev);
-}
-
 static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
 {
     Aml *dev, *crs;
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     if (vmc->acpi_expose_flash) {
         acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
     }
-    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
+    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
     acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
                     (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
     acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
diff --git a/hw/nvram/fw_cfg-acpi.c b/hw/nvram/fw_cfg-acpi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/nvram/fw_cfg-acpi.c
@@ -XXX,XX +XXX,XX @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Add fw_cfg device in DSDT
+ *
+ */
+
+#include "hw/nvram/fw_cfg_acpi.h"
+#include "hw/acpi/aml-build.h"
+
+void fw_cfg_acpi_dsdt_add(Aml *scope, const MemMapEntry *fw_cfg_memmap)
+{
+    Aml *dev = aml_device("FWCF");
+    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
+    /* device present, functioning, decoding, not shown in UI */
+    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+
+    Aml *crs = aml_resource_template();
+    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
+                                       fw_cfg_memmap->size, AML_READ_WRITE));
+    aml_append(dev, aml_name_decl("_CRS", crs));
+    aml_append(scope, dev);
+}
diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/utils.h"
+#include "hw/nvram/fw_cfg_acpi.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/reset.h"
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
     }
 }
 
-static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
-{
-    Aml *dev = aml_device("FWCF");
-    aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
-
-    /* device present, functioning, decoding, not shown in UI */
-    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
-    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-    Aml *crs = aml_resource_template();
-    aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
-                                       fw_cfg_memmap->size, AML_READ_WRITE));
-    aml_append(dev, aml_name_decl("_CRS", crs));
-    aml_append(scope, dev);
-}
-
 /* RHCT Node[N] starts at offset 56 */
 #define RHCT_NODE_ARRAY_OFFSET 56
 
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
     scope = aml_scope("\\_SB");
     acpi_dsdt_add_cpus(scope, s);
 
-    acpi_dsdt_add_fw_cfg(scope, &memmap[VIRT_FW_CFG]);
+    fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
 
     aml_append(dsdt, scope);
 
diff --git a/hw/nvram/meson.build b/hw/nvram/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/meson.build
+++ b/hw/nvram/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_XLNX_EFUSE_ZYNQMP', if_true: files(
 system_ss.add(when: 'CONFIG_XLNX_BBRAM', if_true: files('xlnx-bbram.c'))
 
 specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_nvram.c'))
+specific_ss.add(when: 'CONFIG_ACPI', if_true: files('fw_cfg-acpi.c'))
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

RISC-V also needs to create the virtio in DSDT in the same way as ARM.
So, instead of duplicating the code, move this function to the device
specific file which is common across architectures.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-3-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/virtio/virtio-acpi.h | 16 ++++++++++++++++
 hw/arm/virt-acpi-build.c        | 32 ++++----------------------------
 hw/virtio/virtio-acpi.c         | 33 +++++++++++++++++++++++++++++++++
 hw/virtio/meson.build           |  1 +
 4 files changed, 54 insertions(+), 28 deletions(-)
 create mode 100644 include/hw/virtio/virtio-acpi.h
 create mode 100644 hw/virtio/virtio-acpi.c

diff --git a/include/hw/virtio/virtio-acpi.h b/include/hw/virtio/virtio-acpi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/virtio/virtio-acpi.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * ACPI support for virtio
+ */
+
+#ifndef VIRTIO_ACPI_H
+#define VIRTIO_ACPI_H
+
+#include "qemu/osdep.h"
+#include "exec/hwaddr.h"
+
+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr virtio_mmio_base,
+                          const hwaddr virtio_mmio_size, uint32_t mmio_irq,
+                          long int start_index, int num);
+
+#endif
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "hw/acpi/ghes.h"
 #include "hw/acpi/viot.h"
+#include "hw/virtio/virtio-acpi.h"
 
 #define ARM_SPI_BASE 32
 
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
     aml_append(scope, dev);
 }
 
-static void acpi_dsdt_add_virtio(Aml *scope,
-                                 const MemMapEntry *virtio_mmio_memmap,
-                                 uint32_t mmio_irq, int num)
-{
-    hwaddr base = virtio_mmio_memmap->base;
-    hwaddr size = virtio_mmio_memmap->size;
-    int i;
-
-    for (i = 0; i < num; i++) {
-        uint32_t irq = mmio_irq + i;
-        Aml *dev = aml_device("VR%02u", i);
-        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
-        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
-        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-        Aml *crs = aml_resource_template();
-        aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
-        aml_append(crs,
-                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
-                                 AML_EXCLUSIVE, &irq, 1));
-        aml_append(dev, aml_name_decl("_CRS", crs));
-        aml_append(scope, dev);
-        base += size;
-    }
-}
-
 static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
                               uint32_t irq, VirtMachineState *vms)
 {
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         acpi_dsdt_add_flash(scope, &memmap[VIRT_FLASH]);
     }
     fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
-    acpi_dsdt_add_virtio(scope, &memmap[VIRT_MMIO],
-                    (irqmap[VIRT_MMIO] + ARM_SPI_BASE), NUM_VIRTIO_TRANSPORTS);
+    virtio_acpi_dsdt_add(scope, memmap[VIRT_MMIO].base, memmap[VIRT_MMIO].size,
+                         (irqmap[VIRT_MMIO] + ARM_SPI_BASE),
+                         0, NUM_VIRTIO_TRANSPORTS);
     acpi_dsdt_add_pci(scope, memmap, irqmap[VIRT_PCIE] + ARM_SPI_BASE, vms);
     if (vms->acpi_dev) {
         build_ged_aml(scope, "\\_SB."GED_DEVICE,
diff --git a/hw/virtio/virtio-acpi.c b/hw/virtio/virtio-acpi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/virtio-acpi.c
@@ -XXX,XX +XXX,XX @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * virtio ACPI Support
+ *
+ */
+
+#include "hw/virtio/virtio-acpi.h"
+#include "hw/acpi/aml-build.h"
+
+void virtio_acpi_dsdt_add(Aml *scope, const hwaddr base, const hwaddr size,
+                          uint32_t mmio_irq, long int start_index, int num)
+{
+    hwaddr virtio_base = base;
+    uint32_t irq = mmio_irq;
+    long int i;
+
+    for (i = start_index; i < start_index + num; i++) {
+        Aml *dev = aml_device("VR%02u", (unsigned)i);
+        aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
+        aml_append(dev, aml_name_decl("_UID", aml_int(i)));
+        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
+
+        Aml *crs = aml_resource_template();
+        aml_append(crs, aml_memory32_fixed(virtio_base, size, AML_READ_WRITE));
+        aml_append(crs,
+                   aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
+                                 AML_EXCLUSIVE, &irq, 1));
+        aml_append(dev, aml_name_decl("_CRS", crs));
+        aml_append(scope, dev);
+        virtio_base += size;
+        irq++;
+    }
+}
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('virtio-stub.c'))
 system_ss.add(files('virtio-hmp-cmds.c'))
 
 specific_ss.add_all(when: 'CONFIG_VIRTIO', if_true: specific_virtio_ss)
+system_ss.add(when: 'CONFIG_ACPI', if_true: files('virtio-acpi.c'))
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

With common function to add virtio in DSDT created now, update microvm
code also to use it instead of duplicate code.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-4-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/i386/acpi-microvm.c | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/hw/i386/acpi-microvm.c b/hw/i386/acpi-microvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/acpi-microvm.c
+++ b/hw/i386/acpi-microvm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/pci.h"
 #include "hw/pci/pcie_host.h"
 #include "hw/usb/xhci.h"
+#include "hw/virtio/virtio-acpi.h"
 #include "hw/virtio/virtio-mmio.h"
 #include "hw/input/i8042.h"
 
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_virtio(Aml *scope,
             uint32_t irq = mms->virtio_irq_base + index;
             hwaddr base = VIRTIO_MMIO_BASE + index * 512;
             hwaddr size = 512;
-
-            Aml *dev = aml_device("VR%02u", (unsigned)index);
-            aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
-            aml_append(dev, aml_name_decl("_UID", aml_int(index)));
-            aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
-
-            Aml *crs = aml_resource_template();
-            aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
-            aml_append(crs,
-                       aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
-                                     AML_EXCLUSIVE, &irq, 1));
-            aml_append(dev, aml_name_decl("_CRS", crs));
-            aml_append(scope, dev);
+            virtio_acpi_dsdt_add(scope, base, size, irq, index, 1);
         }
     }
 }
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Some macros and static function related to IMSIC are defined in virt.c.
They are required in virt-acpi-build.c. So, make them public.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-5-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h | 25 +++++++++++++++++++++++++
 hw/riscv/virt.c         | 25 +------------------------
 2 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/sysbus.h"
 #include "hw/block/flash.h"
+#include "hw/intc/riscv_imsic.h"
 
 #define VIRT_CPUS_MAX_BITS             9
 #define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
@@ -XXX,XX +XXX,XX @@ enum {
 
 bool virt_is_acpi_enabled(RISCVVirtState *s);
 void virt_acpi_setup(RISCVVirtState *vms);
+uint32_t imsic_num_bits(uint32_t count);
+
+/*
+ * The virt machine physical address space used by some of the devices
+ * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
+ * number of CPUs, and number of IMSIC guest files.
+ *
+ * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
+ * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
+ * of virt machine physical address space.
+ */
+
+#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
+#if VIRT_IMSIC_GROUP_MAX_SIZE < \
+    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
+#error "Can't accomodate single IMSIC group in address space"
+#endif
+
+#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
+                                        VIRT_IMSIC_GROUP_MAX_SIZE)
+#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
+#error "Can't accomodate all IMSIC groups in address space"
+#endif
+
 #endif
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm/kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
-#include "hw/intc/riscv_imsic.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "hw/platform-bus.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/acpi/aml-build.h"
 #include "qapi/qapi-visit-common.h"
 
-/*
- * The virt machine physical address space used by some of the devices
- * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
- * number of CPUs, and number of IMSIC guest files.
- *
- * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
- * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
- * of virt machine physical address space.
- */
-
-#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
-#if VIRT_IMSIC_GROUP_MAX_SIZE < \
-    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
-#error "Can't accommodate single IMSIC group in address space"
-#endif
-
-#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
-                                        VIRT_IMSIC_GROUP_MAX_SIZE)
-#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
-#error "Can't accommodate all IMSIC groups in address space"
-#endif
-
 /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 static bool virt_use_kvm_aia(RISCVVirtState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     g_free(plic_cells);
 }
 
-static uint32_t imsic_num_bits(uint32_t count)
+uint32_t imsic_num_bits(uint32_t count)
 {
     uint32_t ret = 0;
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Update the RINTC structure in MADT with AIA related fields.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-6-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 43 ++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/riscv_aclint.h"
 
 #define ACPI_BUILD_TABLE_SIZE             0x20000
+#define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
 
 typedef struct AcpiBuildState {
     /* Copy of table in RAM (for patching) */
@@ -XXX,XX +XXX,XX @@ static void acpi_align_size(GArray *blob, unsigned align)
 
 static void riscv_acpi_madt_add_rintc(uint32_t uid,
                                       const CPUArchIdList *arch_ids,
-                                      GArray *entry)
+                                      GArray *entry,
+                                      RISCVVirtState *s)
 {
+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
     uint64_t hart_id = arch_ids->cpus[uid].arch_id;
+    uint32_t imsic_size, local_cpu_id, socket_id;
+    uint64_t imsic_socket_addr, imsic_addr;
+    MachineState *ms = MACHINE(s);
 
+    socket_id = arch_ids->cpus[uid].props.node_id;
+    local_cpu_id = (arch_ids->cpus[uid].arch_id -
+                    riscv_socket_first_hartid(ms, socket_id)) %
+                    riscv_socket_hart_count(ms, socket_id);
+    imsic_socket_addr = s->memmap[VIRT_IMSIC_S].base +
+                        (socket_id * VIRT_IMSIC_GROUP_MAX_SIZE);
+    imsic_size = IMSIC_HART_SIZE(guest_index_bits);
+    imsic_addr = imsic_socket_addr + local_cpu_id * imsic_size;
     build_append_int_noprefix(entry, 0x18, 1);       /* Type     */
-    build_append_int_noprefix(entry, 20, 1);         /* Length   */
+    build_append_int_noprefix(entry, 36, 1);         /* Length   */
     build_append_int_noprefix(entry, 1, 1);          /* Version  */
     build_append_int_noprefix(entry, 0, 1);          /* Reserved */
     build_append_int_noprefix(entry, 0x1, 4);        /* Flags    */
     build_append_int_noprefix(entry, hart_id, 8);    /* Hart ID  */
     build_append_int_noprefix(entry, uid, 4);        /* ACPI Processor UID */
+    /* External Interrupt Controller ID */
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+        build_append_int_noprefix(entry,
+                                  ACPI_BUILD_INTC_ID(
+                                      arch_ids->cpus[uid].props.node_id,
+                                      local_cpu_id),
+                                  4);
+    } else {
+        build_append_int_noprefix(entry, 0, 4);
+    }
+
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        /* IMSIC Base address */
+        build_append_int_noprefix(entry, imsic_addr, 8);
+        /* IMSIC Size */
+        build_append_int_noprefix(entry, imsic_size, 4);
+    } else {
+        build_append_int_noprefix(entry, 0, 8);
+        build_append_int_noprefix(entry, 0, 4);
+    }
 }
 
 static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
                        aml_int(arch_ids->cpus[i].arch_id)));
 
             /* build _MAT object */
-            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf);
+            riscv_acpi_madt_add_rintc(i, arch_ids, madt_buf, s);
             aml_append(dev, aml_name_decl("_MAT",
                                           aml_buffer(madt_buf->len,
                                           (uint8_t *)madt_buf->data)));
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
  * 5.2.12 Multiple APIC Description Table (MADT)
  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/15
  *      https://drive.google.com/file/d/1R6k4MshhN3WTT-hwqAquu5nX6xSEqK2l/view
+ *      https://drive.google.com/file/d/1oMGPyOD58JaPgMl1pKasT-VKsIKia7zR/view
  */
 static void build_madt(GArray *table_data,
                        BIOSLinker *linker,
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
 
     /* RISC-V Local INTC structures per HART */
     for (int i = 0; i < arch_ids->len; i++) {
-        riscv_acpi_madt_add_rintc(i, arch_ids, table_data);
+        riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add IMSIC structure in MADT when IMSIC is configured.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-7-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
     MachineClass *mc = MACHINE_GET_CLASS(s);
     MachineState *ms = MACHINE(s);
     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
+    uint8_t  group_index_bits = imsic_num_bits(riscv_socket_count(ms));
+    uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
+    uint16_t imsic_max_hart_per_socket = 0;
+    uint8_t  hart_index_bits;
+    uint8_t  socket;
+
+    for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
+            imsic_max_hart_per_socket = s->soc[socket].num_harts;
+        }
+    }
+
+    hart_index_bits = imsic_num_bits(imsic_max_hart_per_socket);
 
     AcpiTable table = { .sig = "APIC", .rev = 6, .oem_id = s->oem_id,
                         .oem_table_id = s->oem_table_id };
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
         riscv_acpi_madt_add_rintc(i, arch_ids, table_data, s);
     }
 
+    /* IMSIC */
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        /* IMSIC */
+        build_append_int_noprefix(table_data, 0x19, 1);     /* Type */
+        build_append_int_noprefix(table_data, 16, 1);       /* Length */
+        build_append_int_noprefix(table_data, 1, 1);        /* Version */
+        build_append_int_noprefix(table_data, 0, 1);        /* Reserved */
+        build_append_int_noprefix(table_data, 0, 4);        /* Flags */
+        /* Number of supervisor mode Interrupt Identities */
+        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
+        /* Number of guest mode Interrupt Identities */
+        build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_MSIS, 2);
+        /* Guest Index Bits */
+        build_append_int_noprefix(table_data, guest_index_bits, 1);
+        /* Hart Index Bits */
+        build_append_int_noprefix(table_data, hart_index_bits, 1);
+        /* Group Index Bits */
+        build_append_int_noprefix(table_data, group_index_bits, 1);
+        /* Group Index Shift */
+        build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
+    }
+
     acpi_table_end(linker, &table);
 }
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add APLIC structures for each socket in the MADT when system is configured
with APLIC as the external wired interrupt controller.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-8-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
     uint8_t  guest_index_bits = imsic_num_bits(s->aia_guests + 1);
     uint16_t imsic_max_hart_per_socket = 0;
     uint8_t  hart_index_bits;
+    uint64_t aplic_addr;
+    uint32_t gsi_base;
     uint8_t  socket;
 
     for (socket = 0; socket < riscv_socket_count(ms); socket++) {
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
         build_append_int_noprefix(table_data, IMSIC_MMIO_GROUP_MIN_SHIFT, 1);
     }
 
+    if (s->aia_type != VIRT_AIA_TYPE_NONE) {
+        /* APLICs */
+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+            aplic_addr = s->memmap[VIRT_APLIC_S].base +
+                             s->memmap[VIRT_APLIC_S].size * socket;
+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
+            build_append_int_noprefix(table_data, 0x1A, 1);    /* Type */
+            build_append_int_noprefix(table_data, 36, 1);      /* Length */
+            build_append_int_noprefix(table_data, 1, 1);       /* Version */
+            build_append_int_noprefix(table_data, socket, 1);  /* APLIC ID */
+            build_append_int_noprefix(table_data, 0, 4);       /* Flags */
+            build_append_int_noprefix(table_data, 0, 8);       /* Hardware ID */
+            /* Number of IDCs */
+            if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+                build_append_int_noprefix(table_data,
+                                          s->soc[socket].num_harts,
+                                          2);
+            } else {
+                build_append_int_noprefix(table_data, 0, 2);
+            }
+            /* Total External Interrupt Sources Supported */
+            build_append_int_noprefix(table_data, VIRT_IRQCHIP_NUM_SOURCES, 2);
+            /* Global System Interrupt Base */
+            build_append_int_noprefix(table_data, gsi_base, 4);
+            /* APLIC Address */
+            build_append_int_noprefix(table_data, aplic_addr, 8);
+            /* APLIC size */
+            build_append_int_noprefix(table_data,
+                                      s->memmap[VIRT_APLIC_S].size, 4);
+        }
+    }
+
     acpi_table_end(linker, &table);
 }
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

When CMO related extensions like Zicboz, Zicbom and Zicbop are enabled, the
block size for those extensions need to be communicated via CMO node in
RHCT. Add CMO node in RHCT if any of those CMO extensions are detected.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-9-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 64 +++++++++++++++++++++++++++++++++-----
 1 file changed, 56 insertions(+), 8 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
  * 5.2.36 RISC-V Hart Capabilities Table (RHCT)
  * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/16
  *      https://drive.google.com/file/d/1nP3nFiH4jkPMp6COOxP6123DCZKR-tia/view
+ *      https://drive.google.com/file/d/1sKbOa8m1UZw1JkquZYe3F1zQBN1xXsaf/view
  */
 static void build_rhct(GArray *table_data,
                        BIOSLinker *linker,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
     MachineState *ms = MACHINE(s);
     const CPUArchIdList *arch_ids = mc->possible_cpu_arch_ids(ms);
     size_t len, aligned_len;
-    uint32_t isa_offset, num_rhct_nodes;
-    RISCVCPU *cpu;
+    uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
+    RISCVCPU *cpu = &s->soc[0].harts[0];
     char *isa;
 
     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
 
     /* ISA + N hart info */
     num_rhct_nodes = 1 + ms->smp.cpus;
+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
+        num_rhct_nodes++;
+    }
 
     /* Number of RHCT nodes*/
     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
     isa_offset = table_data->len - table.table_offset;
     build_append_int_noprefix(table_data, 0, 2);   /* Type 0 */
 
-    cpu = &s->soc[0].harts[0];
     isa = riscv_isa_string(cpu);
     len = 8 + strlen(isa) + 1;
     aligned_len = (len % 2) ? (len + 1) : len;
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
         build_append_int_noprefix(table_data, 0x0, 1);   /* Optional Padding */
     }
 
+    /* CMO node */
+    if (cpu->cfg.ext_zicbom || cpu->cfg.ext_zicboz) {
+        cmo_offset = table_data->len - table.table_offset;
+        build_append_int_noprefix(table_data, 1, 2);    /* Type */
+        build_append_int_noprefix(table_data, 10, 2);   /* Length */
+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
+
+        /* CBOM block size */
+        if (cpu->cfg.cbom_blocksize) {
+            build_append_int_noprefix(table_data,
+                                      __builtin_ctz(cpu->cfg.cbom_blocksize),
+                                      1);
+        } else {
+            build_append_int_noprefix(table_data, 0, 1);
+        }
+
+        /* CBOP block size */
+        build_append_int_noprefix(table_data, 0, 1);
+
+        /* CBOZ block size */
+        if (cpu->cfg.cboz_blocksize) {
+            build_append_int_noprefix(table_data,
+                                      __builtin_ctz(cpu->cfg.cboz_blocksize),
+                                      1);
+        } else {
+            build_append_int_noprefix(table_data, 0, 1);
+        }
+    }
+
     /* Hart Info Node */
     for (int i = 0; i < arch_ids->len; i++) {
+        len = 16;
+        int num_offsets = 1;
         build_append_int_noprefix(table_data, 0xFFFF, 2);  /* Type */
-        build_append_int_noprefix(table_data, 16, 2);      /* Length */
-        build_append_int_noprefix(table_data, 0x1, 2);     /* Revision */
-        build_append_int_noprefix(table_data, 1, 2);    /* Number of offsets */
-        build_append_int_noprefix(table_data, i, 4);    /* ACPI Processor UID */
-        build_append_int_noprefix(table_data, isa_offset, 4); /* Offsets[0] */
+
+        /* Length */
+        if (cmo_offset) {
+            len += 4;
+            num_offsets++;
+        }
+
+        build_append_int_noprefix(table_data, len, 2);
+        build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
+        /* Number of offsets */
+        build_append_int_noprefix(table_data, num_offsets, 2);
+        build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
+
+        /* Offsets */
+        build_append_int_noprefix(table_data, isa_offset, 4);
+        if (cmo_offset) {
+            build_append_int_noprefix(table_data, cmo_offset, 4);
+        }
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

MMU type information is available via MMU node in RHCT. Add this node in
RHCT.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-10-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
     size_t len, aligned_len;
     uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
     RISCVCPU *cpu = &s->soc[0].harts[0];
+    uint32_t mmu_offset = 0;
+    uint8_t satp_mode_max;
     char *isa;
 
     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
         num_rhct_nodes++;
     }
 
+    if (cpu->cfg.satp_mode.supported != 0) {
+        num_rhct_nodes++;
+    }
+
     /* Number of RHCT nodes*/
     build_append_int_noprefix(table_data, num_rhct_nodes, 4);
 
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
         }
     }
 
+    /* MMU node structure */
+    if (cpu->cfg.satp_mode.supported != 0) {
+        satp_mode_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
+        mmu_offset = table_data->len - table.table_offset;
+        build_append_int_noprefix(table_data, 2, 2);    /* Type */
+        build_append_int_noprefix(table_data, 8, 2);    /* Length */
+        build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
+        build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
+        /* MMU Type */
+        if (satp_mode_max == VM_1_10_SV57) {
+            build_append_int_noprefix(table_data, 2, 1);    /* Sv57 */
+        } else if (satp_mode_max == VM_1_10_SV48) {
+            build_append_int_noprefix(table_data, 1, 1);    /* Sv48 */
+        } else if (satp_mode_max == VM_1_10_SV39) {
+            build_append_int_noprefix(table_data, 0, 1);    /* Sv39 */
+        } else {
+            assert(1);
+        }
+    }
+
     /* Hart Info Node */
     for (int i = 0; i < arch_ids->len; i++) {
         len = 16;
@@ -XXX,XX +XXX,XX @@ static void build_rhct(GArray *table_data,
             num_offsets++;
         }
 
+        if (mmu_offset) {
+            len += 4;
+            num_offsets++;
+        }
+
         build_append_int_noprefix(table_data, len, 2);
         build_append_int_noprefix(table_data, 0x1, 2); /* Revision */
         /* Number of offsets */
         build_append_int_noprefix(table_data, num_offsets, 2);
         build_append_int_noprefix(table_data, i, 4);   /* ACPI Processor UID */
-
         /* Offsets */
         build_append_int_noprefix(table_data, isa_offset, 4);
         if (cmo_offset) {
             build_append_int_noprefix(table_data, cmo_offset, 4);
         }
+
+        if (mmu_offset) {
+            build_append_int_noprefix(table_data, mmu_offset, 4);
+        }
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

ACPI DSDT generator needs information like ECAM range, PIO range, 32-bit
and 64-bit PCI MMIO range etc related to the PCI host bridge. Instead of
making these values machine specific, create properties for the GPEX
host bridge with default value 0. During initialization, the firmware
can initialize these properties with correct values for the platform.
This basically allows DSDT generator code independent of the machine
specific memory map accesses.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231218150247.466427-11-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/pci-host/gpex.h | 28 ++++++++++++++++++++--------
 hw/pci-host/gpex-acpi.c    | 13 +++++++++++++
 hw/pci-host/gpex.c         | 12 ++++++++++++
 3 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -XXX,XX +XXX,XX @@ struct GPEXRootState {
     /*< public >*/
 };
 
+struct GPEXConfig {
+    MemMapEntry ecam;
+    MemMapEntry mmio32;
+    MemMapEntry mmio64;
+    MemMapEntry pio;
+    int         irq;
+    PCIBus      *bus;
+};
+
 struct GPEXHost {
     /*< private >*/
     PCIExpressHost parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GPEXHost {
     int irq_num[GPEX_NUM_IRQS];
 
     bool allow_unmapped_accesses;
-};
 
-struct GPEXConfig {
-    MemMapEntry ecam;
-    MemMapEntry mmio32;
-    MemMapEntry mmio64;
-    MemMapEntry pio;
-    int         irq;
-    PCIBus      *bus;
+    struct GPEXConfig gpex_cfg;
 };
 
 int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
 
 void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg);
+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq);
+
+#define PCI_HOST_PIO_BASE               "x-pio-base"
+#define PCI_HOST_PIO_SIZE               "x-pio-size"
+#define PCI_HOST_ECAM_BASE              "x-ecam-base"
+#define PCI_HOST_ECAM_SIZE              "x-ecam-size"
+#define PCI_HOST_BELOW_4G_MMIO_BASE     "x-below-4g-mmio-base"
+#define PCI_HOST_BELOW_4G_MMIO_SIZE     "x-below-4g-mmio-size"
+#define PCI_HOST_ABOVE_4G_MMIO_BASE     "x-above-4g-mmio-base"
+#define PCI_HOST_ABOVE_4G_MMIO_SIZE     "x-above-4g-mmio-size"
 
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -XXX,XX +XXX,XX @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
 
     crs_range_set_free(&crs_range_set);
 }
+
+void acpi_dsdt_add_gpex_host(Aml *scope, uint32_t irq)
+{
+    bool ambig;
+    Object *obj = object_resolve_path_type("", TYPE_GPEX_HOST, &ambig);
+
+    if (!obj || ambig) {
+        return;
+    }
+
+    GPEX_HOST(obj)->gpex_cfg.irq = irq;
+    acpi_dsdt_add_gpex(scope, &GPEX_HOST(obj)->gpex_cfg);
+}
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ static Property gpex_host_properties[] = {
      */
     DEFINE_PROP_BOOL("allow-unmapped-accesses", GPEXHost,
                      allow_unmapped_accesses, true),
+    DEFINE_PROP_UINT64(PCI_HOST_ECAM_BASE, GPEXHost, gpex_cfg.ecam.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_ECAM_SIZE, GPEXHost, gpex_cfg.ecam.size, 0),
+    DEFINE_PROP_UINT64(PCI_HOST_PIO_BASE, GPEXHost, gpex_cfg.pio.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_PIO_SIZE, GPEXHost, gpex_cfg.pio.size, 0),
+    DEFINE_PROP_UINT64(PCI_HOST_BELOW_4G_MMIO_BASE, GPEXHost,
+                       gpex_cfg.mmio32.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_BELOW_4G_MMIO_SIZE, GPEXHost,
+                     gpex_cfg.mmio32.size, 0),
+    DEFINE_PROP_UINT64(PCI_HOST_ABOVE_4G_MMIO_BASE, GPEXHost,
+                       gpex_cfg.mmio64.base, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MMIO_SIZE, GPEXHost,
+                     gpex_cfg.mmio64.size, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Update the GPEX host bridge properties related to MMIO ranges with
values set for the virt machine.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-12-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  1 +
 hw/riscv/virt.c         | 47 ++++++++++++++++++++++++++++-------------
 2 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     char *oem_table_id;
     OnOffAuto acpi;
     const MemMapEntry *memmap;
+    struct GPEXHost *gpex_host;
 };
 
 enum {
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
 }
 
 static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
-                                          hwaddr ecam_base, hwaddr ecam_size,
-                                          hwaddr mmio_base, hwaddr mmio_size,
-                                          hwaddr high_mmio_base,
-                                          hwaddr high_mmio_size,
-                                          hwaddr pio_base,
-                                          DeviceState *irqchip)
+                                          DeviceState *irqchip,
+                                          RISCVVirtState *s)
 {
     DeviceState *dev;
     MemoryRegion *ecam_alias, *ecam_reg;
     MemoryRegion *mmio_alias, *high_mmio_alias, *mmio_reg;
+    hwaddr ecam_base = s->memmap[VIRT_PCIE_ECAM].base;
+    hwaddr ecam_size = s->memmap[VIRT_PCIE_ECAM].size;
+    hwaddr mmio_base = s->memmap[VIRT_PCIE_MMIO].base;
+    hwaddr mmio_size = s->memmap[VIRT_PCIE_MMIO].size;
+    hwaddr high_mmio_base = virt_high_pcie_memmap.base;
+    hwaddr high_mmio_size = virt_high_pcie_memmap.size;
+    hwaddr pio_base = s->memmap[VIRT_PCIE_PIO].base;
+    hwaddr pio_size = s->memmap[VIRT_PCIE_PIO].size;
     qemu_irq irq;
     int i;
 
     dev = qdev_new(TYPE_GPEX_HOST);
 
+    /* Set GPEX object properties for the virt machine */
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_BASE,
+                            ecam_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ECAM_SIZE,
+                            ecam_size, NULL);
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
+                             PCI_HOST_BELOW_4G_MMIO_BASE,
+                             mmio_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_BELOW_4G_MMIO_SIZE,
+                            mmio_size, NULL);
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)),
+                             PCI_HOST_ABOVE_4G_MMIO_BASE,
+                             high_mmio_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_ABOVE_4G_MMIO_SIZE,
+                            high_mmio_size, NULL);
+    object_property_set_uint(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_BASE,
+                            pio_base, NULL);
+    object_property_set_int(OBJECT(GPEX_HOST(dev)), PCI_HOST_PIO_SIZE,
+                            pio_size, NULL);
+
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     ecam_alias = g_new0(MemoryRegion, 1);
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
         gpex_set_irq_num(GPEX_HOST(dev), i, PCIE_IRQ + i);
     }
 
+    GPEX_HOST(dev)->gpex_cfg.bus = PCI_HOST_BRIDGE(GPEX_HOST(dev))->bus;
     return dev;
 }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
             qdev_get_gpio_in(virtio_irqchip, VIRTIO_IRQ + i));
     }
 
-    gpex_pcie_init(system_memory,
-                   memmap[VIRT_PCIE_ECAM].base,
-                   memmap[VIRT_PCIE_ECAM].size,
-                   memmap[VIRT_PCIE_MMIO].base,
-                   memmap[VIRT_PCIE_MMIO].size,
-                   virt_high_pcie_memmap.base,
-                   virt_high_pcie_memmap.size,
-                   memmap[VIRT_PCIE_PIO].base,
-                   pcie_irqchip);
+    gpex_pcie_init(system_memory, pcie_irqchip, s);
 
     create_platform_bus(s, mmio_irqchip);
 
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add basic IO controllers and devices like PCI, VirtIO and UART in the
ACPI namespace.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-13-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 79 ++++++++++++++++++++++++++++++++++++--
 hw/riscv/Kconfig           |  1 +
 2 files changed, 76 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/acpi/acpi-defs.h"
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/aml-build.h"
+#include "hw/acpi/pci.h"
 #include "hw/acpi/utils.h"
+#include "hw/intc/riscv_aclint.h"
 #include "hw/nvram/fw_cfg_acpi.h"
+#include "hw/pci-host/gpex.h"
+#include "hw/riscv/virt.h"
+#include "hw/riscv/numa.h"
+#include "hw/virtio/virtio-acpi.h"
+#include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/reset.h"
-#include "migration/vmstate.h"
-#include "hw/riscv/virt.h"
-#include "hw/riscv/numa.h"
-#include "hw/intc/riscv_aclint.h"
 
 #define ACPI_BUILD_TABLE_SIZE             0x20000
 #define ACPI_BUILD_INTC_ID(socket, index) ((socket << 24) | (index))
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_cpus(Aml *scope, RISCVVirtState *s)
     }
 }
 
+static void
+acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
+                    uint32_t uart_irq)
+{
+    Aml *dev = aml_device("COM0");
+    aml_append(dev, aml_name_decl("_HID", aml_string("PNP0501")));
+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+
+    Aml *crs = aml_resource_template();
+    aml_append(crs, aml_memory32_fixed(uart_memmap->base,
+                                         uart_memmap->size, AML_READ_WRITE));
+    aml_append(crs,
+                aml_interrupt(AML_CONSUMER, AML_LEVEL, AML_ACTIVE_HIGH,
+                               AML_EXCLUSIVE, &uart_irq, 1));
+    aml_append(dev, aml_name_decl("_CRS", crs));
+
+    Aml *pkg = aml_package(2);
+    aml_append(pkg, aml_string("clock-frequency"));
+    aml_append(pkg, aml_int(3686400));
+
+    Aml *UUID = aml_touuid("DAFFD814-6EBA-4D8C-8A91-BC9BBF4AA301");
+
+    Aml *pkg1 = aml_package(1);
+    aml_append(pkg1, pkg);
+
+    Aml *package = aml_package(2);
+    aml_append(package, UUID);
+    aml_append(package, pkg1);
+
+    aml_append(dev, aml_name_decl("_DSD", package));
+    aml_append(scope, dev);
+}
+
 /* RHCT Node[N] starts at offset 56 */
 #define RHCT_NODE_ARRAY_OFFSET 56
 
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
                        RISCVVirtState *s)
 {
     Aml *scope, *dsdt;
+    MachineState *ms = MACHINE(s);
+    uint8_t socket_count;
     const MemMapEntry *memmap = s->memmap;
     AcpiTable table = { .sig = "DSDT", .rev = 2, .oem_id = s->oem_id,
                         .oem_table_id = s->oem_table_id };
@@ -XXX,XX +XXX,XX @@ static void build_dsdt(GArray *table_data,
 
     fw_cfg_acpi_dsdt_add(scope, &memmap[VIRT_FW_CFG]);
 
+    socket_count = riscv_socket_count(ms);
+
+    acpi_dsdt_add_uart(scope, &memmap[VIRT_UART0], UART0_IRQ);
+
+    if (socket_count == 1) {
+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
+                             memmap[VIRT_VIRTIO].size,
+                             VIRTIO_IRQ, 0, VIRTIO_COUNT);
+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ);
+    } else if (socket_count == 2) {
+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
+                             memmap[VIRT_VIRTIO].size,
+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
+                             VIRTIO_COUNT);
+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES);
+    } else {
+        virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
+                             memmap[VIRT_VIRTIO].size,
+                             VIRTIO_IRQ + VIRT_IRQCHIP_NUM_SOURCES, 0,
+                             VIRTIO_COUNT);
+        acpi_dsdt_add_gpex_host(scope, PCIE_IRQ + VIRT_IRQCHIP_NUM_SOURCES * 2);
+    }
+
     aml_append(dsdt, scope);
 
     /* copy AML table into ACPI tables blob and patch header there */
@@ -XXX,XX +XXX,XX @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
     acpi_add_table(table_offsets, tables_blob);
     build_rhct(tables_blob, tables->linker, s);
 
+    acpi_add_table(table_offsets, tables_blob);
+    {
+        AcpiMcfgInfo mcfg = {
+           .base = s->memmap[VIRT_PCIE_MMIO].base,
+           .size = s->memmap[VIRT_PCIE_MMIO].size,
+        };
+        build_mcfg(tables_blob, tables->linker, &mcfg, s->oem_id,
+                   s->oem_table_id);
+    }
+
     /* XSDT is pointed to by RSDP */
     xsdt = tables_blob->len;
     build_xsdt(tables_blob, tables->linker, table_offsets, s->oem_id,
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select FW_CFG_DMA
     select PLATFORM_BUS
     select ACPI
+    select ACPI_PCI
 
 config SHAKTI_C
     bool
-- 
2.43.0

From: Sunil V L <sunilvl@ventanamicro.com>

Add PLIC structures for each socket in the MADT when system is
configured with PLIC as the external interrupt controller.

Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20231218150247.466427-14-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void riscv_acpi_madt_add_rintc(uint32_t uid,
                                       arch_ids->cpus[uid].props.node_id,
                                       local_cpu_id),
                                   4);
+    } else if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+        build_append_int_noprefix(entry,
+                                  ACPI_BUILD_INTC_ID(
+                                      arch_ids->cpus[uid].props.node_id,
+                                      2 * local_cpu_id + 1),
+                                  4);
     } else {
         build_append_int_noprefix(entry, 0, 4);
     }
@@ -XXX,XX +XXX,XX @@ static void build_madt(GArray *table_data,
             build_append_int_noprefix(table_data,
                                       s->memmap[VIRT_APLIC_S].size, 4);
         }
+    } else {
+        /* PLICs */
+        for (socket = 0; socket < riscv_socket_count(ms); socket++) {
+            aplic_addr = s->memmap[VIRT_PLIC].base +
+                         s->memmap[VIRT_PLIC].size * socket;
+            gsi_base = VIRT_IRQCHIP_NUM_SOURCES * socket;
+            build_append_int_noprefix(table_data, 0x1B, 1);   /* Type */
+            build_append_int_noprefix(table_data, 36, 1);     /* Length */
+            build_append_int_noprefix(table_data, 1, 1);      /* Version */
+            build_append_int_noprefix(table_data, socket, 1); /* PLIC ID */
+            build_append_int_noprefix(table_data, 0, 8);      /* Hardware ID */
+            /* Total External Interrupt Sources Supported */
+            build_append_int_noprefix(table_data,
+                                      VIRT_IRQCHIP_NUM_SOURCES - 1, 2);
+            build_append_int_noprefix(table_data, 0, 2);     /* Max Priority */
+            build_append_int_noprefix(table_data, 0, 4);     /* Flags */
+            /* PLIC Size */
+            build_append_int_noprefix(table_data, s->memmap[VIRT_PLIC].size, 4);
+            /* PLIC Address */
+            build_append_int_noprefix(table_data, aplic_addr, 8);
+            /* Global System Interrupt Vector Base */
+            build_append_int_noprefix(table_data, gsi_base, 4);
+        }
     }
 
     acpi_table_end(linker, &table);
-- 
2.43.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

The interrupts-extended property of PLIC only has 2 * hart number
fields when KVM enabled, copy 4 * hart number fields to fdt will
expose some uninitialized value.

In this patch, I also refactor the code about the setting of
interrupts-extended property of PLIC for improved readability.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231218090543.22353-1-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 47 +++++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
         "sifive,plic-1.0.0", "riscv,plic0"
     };
 
-    if (kvm_enabled()) {
-        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
-    } else {
-        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
-    }
-
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        if (kvm_enabled()) {
-            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-        } else {
-            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
-            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
-            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
-            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
-        }
-    }
-
     plic_phandles[socket] = (*phandle)++;
     plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
     plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
                                   (char **)&plic_compat,
                                   ARRAY_SIZE(plic_compat));
     qemu_fdt_setprop(ms->fdt, plic_name, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
-        plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+
+    if (kvm_enabled()) {
+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+
+        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+        }
+
+        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
+                         plic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+   } else {
+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+        for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
+            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
+        }
+
+        qemu_fdt_setprop(ms->fdt, plic_name, "interrupts-extended",
+                         plic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+    }
+
     qemu_fdt_setprop_cells(ms->fdt, plic_name, "reg",
         0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
     qemu_fdt_setprop_cell(ms->fdt, plic_name, "riscv,ndev",
-- 
2.43.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add support for amocas.w/d/q instructions which are part of the ratified
Zacas extension: https://github.com/riscv/riscv-zacas

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231207153842.32401-2-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                      |   1 +
 target/riscv/insn32.decode                  |   6 +
 target/riscv/cpu.c                          |   2 +
 target/riscv/tcg/tcg-cpu.c                  |   5 +
 target/riscv/translate.c                    |   1 +
 target/riscv/insn_trans/trans_rvzacas.c.inc | 150 ++++++++++++++++++++
 6 files changed, 165 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_rvzacas.c.inc

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svnapot;
     bool ext_svpbmt;
     bool ext_zdinx;
+    bool ext_zacas;
     bool ext_zawrs;
     bool ext_zfa;
     bool ext_zfbfmin;
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
+
+# *** RV32 Zacas Standard Extension ***
+amocas_w    00101 . . ..... ..... 010 ..... 0101111 @atom_st
+amocas_d    00101 . . ..... ..... 011 ..... 0101111 @atom_st
+# *** RV64 Zacas Standard Extension ***
+amocas_q    00101 . . ..... ..... 100 ..... 0101111 @atom_st
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+    ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true),
     MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
     MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
+    MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
     MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
     MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if ((cpu->cfg.ext_zacas) && !riscv_has_ext(env, RVA)) {
+        error_setg(errp, "Zacas extension requires A extension");
+        return;
+    }
+
     if ((cpu->cfg.ext_zawrs) && !riscv_has_ext(env, RVA)) {
         error_setg(errp, "Zawrs extension requires A extension");
         return;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvv.c.inc"
 #include "insn_trans/trans_rvb.c.inc"
 #include "insn_trans/trans_rvzicond.c.inc"
+#include "insn_trans/trans_rvzacas.c.inc"
 #include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzicbo.c.inc"
 #include "insn_trans/trans_rvzfa.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the RV64 Zacas Standard Extension.
+ *
+ * Copyright (c) 2020-2023 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZACAS(ctx) do {          \
+    if (!ctx->cfg_ptr->ext_zacas) {      \
+        return false;                     \
+    }                                     \
+} while (0)
+
+static bool gen_cmpxchg(DisasContext *ctx, arg_atomic *a, MemOp mop)
+{
+    TCGv dest = get_gpr(ctx, a->rd, EXT_NONE);
+    TCGv src1 = get_address(ctx, a->rs1, 0);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+
+    decode_save_opc(ctx);
+    tcg_gen_atomic_cmpxchg_tl(dest, src1, dest, src2, ctx->mem_idx, mop);
+
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+static bool trans_amocas_w(DisasContext *ctx, arg_amocas_w *a)
+{
+    REQUIRE_ZACAS(ctx);
+    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TESL);
+}
+
+static TCGv_i64 get_gpr_pair(DisasContext *ctx, int reg_num)
+{
+    TCGv_i64 t;
+
+    assert(get_ol(ctx) == MXL_RV32);
+
+    if (reg_num == 0) {
+        return tcg_constant_i64(0);
+    }
+
+    t = tcg_temp_new_i64();
+    tcg_gen_concat_tl_i64(t, cpu_gpr[reg_num], cpu_gpr[reg_num + 1]);
+    return t;
+}
+
+static void gen_set_gpr_pair(DisasContext *ctx, int reg_num, TCGv_i64 t)
+{
+    assert(get_ol(ctx) == MXL_RV32);
+
+    if (reg_num != 0) {
+#ifdef TARGET_RISCV32
+        tcg_gen_extr_i64_i32(cpu_gpr[reg_num], cpu_gpr[reg_num + 1], t);
+#else
+        tcg_gen_ext32s_i64(cpu_gpr[reg_num], t);
+        tcg_gen_sari_i64(cpu_gpr[reg_num + 1], t, 32);
+#endif
+
+        if (get_xl_max(ctx) == MXL_RV128) {
+            tcg_gen_sari_tl(cpu_gprh[reg_num], cpu_gpr[reg_num], 63);
+            tcg_gen_sari_tl(cpu_gprh[reg_num + 1], cpu_gpr[reg_num + 1], 63);
+        }
+    }
+}
+
+static bool gen_cmpxchg64(DisasContext *ctx, arg_atomic *a, MemOp mop)
+{
+    /*
+     * Encodings with odd numbered registers specified in rs2 and rd are
+     * reserved.
+     */
+    if ((a->rs2 | a->rd) & 1) {
+        return false;
+    }
+
+    TCGv_i64 dest = get_gpr_pair(ctx, a->rd);
+    TCGv src1 = get_address(ctx, a->rs1, 0);
+    TCGv_i64 src2 = get_gpr_pair(ctx, a->rs2);
+
+    decode_save_opc(ctx);
+    tcg_gen_atomic_cmpxchg_i64(dest, src1, dest, src2, ctx->mem_idx, mop);
+
+    gen_set_gpr_pair(ctx, a->rd, dest);
+    return true;
+}
+
+static bool trans_amocas_d(DisasContext *ctx, arg_amocas_d *a)
+{
+    REQUIRE_ZACAS(ctx);
+    switch (get_ol(ctx)) {
+    case MXL_RV32:
+        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TEUQ);
+    case MXL_RV64:
+    case MXL_RV128:
+        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TEUQ);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
+{
+    REQUIRE_ZACAS(ctx);
+    REQUIRE_64BIT(ctx);
+
+    /*
+     * Encodings with odd numbered registers specified in rs2 and rd are
+     * reserved.
+     */
+    if ((a->rs2 | a->rd) & 1) {
+        return false;
+    }
+
+#ifdef TARGET_RISCV64
+    TCGv_i128 dest = tcg_temp_new_i128();
+    TCGv src1 = get_address(ctx, a->rs1, 0);
+    TCGv_i128 src2 = tcg_temp_new_i128();
+    TCGv_i64 src2l = get_gpr(ctx, a->rs2, EXT_NONE);
+    TCGv_i64 src2h = get_gpr(ctx, a->rs2 == 0 ? 0 : a->rs2 + 1, EXT_NONE);
+    TCGv_i64 destl = get_gpr(ctx, a->rd, EXT_NONE);
+    TCGv_i64 desth = get_gpr(ctx, a->rd == 0 ? 0 : a->rd + 1, EXT_NONE);
+
+    tcg_gen_concat_i64_i128(src2, src2l, src2h);
+    tcg_gen_concat_i64_i128(dest, destl, desth);
+    decode_save_opc(ctx);
+    tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx,
+                                (MO_ALIGN | MO_TEUO));
+
+    tcg_gen_extr_i128_i64(destl, desth, dest);
+
+    if (a->rd != 0) {
+        gen_set_gpr(ctx, a->rd, destl);
+        gen_set_gpr(ctx, a->rd + 1, desth);
+    }
+#endif
+
+    return true;
+}
-- 
2.43.0

From: Rob Bradford <rbradford@rivosinc.com>

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231207153842.32401-3-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_vwsll_vv = 872,
     rv_op_vwsll_vx = 873,
     rv_op_vwsll_vi = 874,
+    rv_op_amocas_w = 875,
+    rv_op_amocas_d = 876,
+    rv_op_amocas_q = 877,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "vwsll.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
     { "vwsll.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
     { "vwsll.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+    { "amocas.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
+    { "amocas.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
+    { "amocas.q", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 34: op = rv_op_amoxor_w; break;
             case 35: op = rv_op_amoxor_d; break;
             case 36: op = rv_op_amoxor_q; break;
+            case 42: op = rv_op_amocas_w; break;
+            case 43: op = rv_op_amocas_d; break;
+            case 44: op = rv_op_amocas_q; break;
             case 66: op = rv_op_amoor_w; break;
             case 67: op = rv_op_amoor_d; break;
             case 68: op = rv_op_amoor_q; break;
-- 
2.43.0

From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

Since QEMU v8.0.0 the RISC-V virt machine has a switch to disable ACPI
table generation. Add it to the documentation.

Fixes: 168b8c29cedb ("hw/riscv/virt: Add a switch to disable ACPI")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231220193436.25909-1-heinrich.schuchardt@canonical.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
   SiFive CLINT. When not specified, this option is assumed to be "off".
   This option is restricted to the TCG accelerator.
 
+- acpi=[on|off|auto]
+
+  When this option is "on" (which is the default), ACPI tables are generated and
+  exposed as firmware tables etc/acpi/rsdp and etc/acpi/tables.
+
 - aia=[none|aplic|aplic-imsic]
 
   This option allows selecting interrupt controller defined by the AIA
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We want to add a new CPU type for bare CPUs that will inherit specific
traits of the 2 existing types:

- it will allow for extensions to be enabled/disabled, like generic
  CPUs;

- it will NOT inherit defaults, like vendor CPUs.

We can make this conditions met by adding an explicit type for the
existing vendor CPUs and change the existing logic to not imply that
"not generic" means vendor CPUs.

Let's add the "vendor" CPU type first.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 30 +++++++++++++++++++++---------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 
 #define TYPE_RISCV_CPU "riscv-cpu"
 #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
+#define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
 
 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
         .instance_init = initfn               \
     }
 
+#define DEFINE_VENDOR_CPU(type_name, initfn) \
+    {                                        \
+        .name = type_name,                   \
+        .parent = TYPE_RISCV_VENDOR_CPU,     \
+        .instance_init = initfn              \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .parent = TYPE_RISCV_CPU,
         .abstract = true,
     },
+    {
+        .name = TYPE_RISCV_VENDOR_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+    },
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
 #if defined(TARGET_RISCV32)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,   rv32_base_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,       rv32_sifive_e_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,       rv32_imafcu_nommu_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,       rv32_sifive_u_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,        rv32_ibex_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31,  rv32_sifive_e_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34,  rv32_imafcu_nommu_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34,  rv32_sifive_u_cpu_init),
 #elif defined(TARGET_RISCV64)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,       rv64_sifive_e_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,       rv64_sifive_u_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C,         rv64_sifive_u_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_THEAD_C906,       rv64_thead_c906_cpu_init),
-    DEFINE_CPU(TYPE_RISCV_CPU_VEYRON_V1,        rv64_veyron_v1_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51,  rv64_sifive_e_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54,  rv64_sifive_u_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,    rv64_sifive_u_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
 #endif
 };
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Our current logic in get/setters of MISA and multi-letter extensions
works because we have only 2 CPU types, generic and vendor, and by using
"!generic" we're implying that we're talking about vendor CPUs. When adding
a third CPU type this logic will break so let's handle it beforehand.

In set_misa_ext_cfg() and set_multi_ext_cfg(), check for "vendor" cpu instead
of "not generic". The "generic CPU" checks remaining are from
riscv_cpu_add_misa_properties() and cpu_add_multi_ext_prop() before
applying default values for the extensions.

This leaves us with:

- vendor CPUs will not allow extension enablement, all other CPUs will;

- generic CPUs will inherit default values for extensions, all others
  won't.

And now we can add a new, third CPU type, that will allow extensions to
be enabled and will not inherit defaults, without changing the existing
logic.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_is_generic(Object *cpu_obj)
     return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
 }
 
+static bool riscv_cpu_is_vendor(Object *cpu_obj)
+{
+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_VENDOR_CPU) != NULL;
+}
+
 /*
  * We'll get here via the following path:
  *
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     target_ulong misa_bit = misa_ext_cfg->misa_bit;
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
-    bool generic_cpu = riscv_cpu_is_generic(obj);
+    bool vendor_cpu = riscv_cpu_is_vendor(obj);
     bool prev_val, value;
 
     if (!visit_type_bool(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     }
 
     if (value) {
-        if (!generic_cpu) {
+        if (vendor_cpu) {
             g_autofree char *cpuname = riscv_cpu_get_name(cpu);
             error_setg(errp, "'%s' CPU does not allow enabling extensions",
                        cpuname);
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
 {
     const RISCVCPUMultiExtConfig *multi_ext_cfg = opaque;
     RISCVCPU *cpu = RISCV_CPU(obj);
-    bool generic_cpu = riscv_cpu_is_generic(obj);
+    bool vendor_cpu = riscv_cpu_is_vendor(obj);
     bool prev_val, value;
 
     if (!visit_type_bool(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    if (value && !generic_cpu) {
+    if (value && vendor_cpu) {
         g_autofree char *cpuname = riscv_cpu_get_name(cpu);
         error_setg(errp, "'%s' CPU does not allow enabling extensions",
                    cpuname);
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We'll add a new bare CPU type that won't have any default priv_ver. This
means that the CPU will default to priv_ver = 0, i.e. 1.10.0.

At the same we'll allow these CPUs to enable extensions at will, but
then, if the extension has a priv_ver newer than 1.10, we'll end up
disabling it. Users will then need to manually set priv_ver to something
other than 1.10 to enable the extensions they want, which is not ideal.

Change the setter() of extensions to allow user enabled extensions to
bump the priv_ver of the CPU. This will make it convenient for users to
enable extensions for CPUs that doesn't set a default priv_ver.

This change does not affect any existing CPU: vendor CPUs does not allow
extensions to be enabled, and generic CPUs are already set to priv_ver
LATEST.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We don't have any form of a 'bare bones' CPU. rv64, our default CPUs,
comes with a lot of defaults. This is fine for most regular uses but
it's not suitable when more control of what is actually loaded in the
CPU is required.

A bare-bones CPU would be annoying to deal with if not by profile
support, a way to load a multitude of extensions with a single flag.
Profile support is going to be implemented shortly, so let's add a CPU
for it.

The new 'rv64i' CPU will have only RVI loaded. It is inspired in the
profile specification that dictates, for RVA22U64 [1]:

"RVA22U64 Mandatory Base
 RV64I is the mandatory base ISA for RVA22U64"

And so it seems that RV64I is the mandatory base ISA for all profiles
listed in [1], making it an ideal CPU to use with profile support.

rv64i is a CPU of type TYPE_RISCV_BARE_CPU. It has a mix of features
from pre-existent CPUs:

- it allows extensions to be enabled, like generic CPUs;
- it will not inherit extension defaults, like vendor CPUs.

This is the minimum extension set to boot OpenSBI and buildroot using
rv64i:

./build/qemu-system-riscv64 -nographic -M virt \
    -cpu rv64i,sv39=true,g=true,c=true,s=true,u=true

Our minimal riscv,isa in this case will be:

# cat /proc/device-tree/cpus/cpu@0/riscv,isa
rv64imafdc_zicntr_zicsr_zifencei_zihpm_zca_zcd#

[1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  2 ++
 target/riscv/cpu.c     | 46 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU "riscv-cpu"
 #define TYPE_RISCV_DYNAMIC_CPU "riscv-dynamic-cpu"
 #define TYPE_RISCV_VENDOR_CPU "riscv-vendor-cpu"
+#define TYPE_RISCV_BARE_CPU "riscv-bare-cpu"
 
 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_BASE32           RISCV_CPU_TYPE_NAME("rv32")
 #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
 #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
+#define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
 /* Set the satp mode to the max supported */
 static void set_satp_mode_default_map(RISCVCPU *cpu)
 {
+    /*
+     * Bare CPUs do not default to the max available.
+     * Users must set a valid satp_mode in the command
+     * line.
+     */
+    if (object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_BARE_CPU) != NULL) {
+        warn_report("No satp mode set. Defaulting to 'bare'");
+        cpu->cfg.satp_mode.map = (1 << VM_1_10_MBARE);
+        return;
+    }
+
     cpu->cfg.satp_mode.map = cpu->cfg.satp_mode.supported;
 }
 #endif
@@ -XXX,XX +XXX,XX @@ static void rv128_base_cpu_init(Object *obj)
     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
 #endif
 }
+
+static void rv64i_bare_cpu_init(Object *obj)
+{
+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+    riscv_cpu_set_misa(env, MXL_RV64, RVI);
+
+    /* Remove the defaults from the parent class */
+    RISCV_CPU(obj)->cfg.ext_zicntr = false;
+    RISCV_CPU(obj)->cfg.ext_zihpm = false;
+
+    /* Set to QEMU's first supported priv version */
+    env->priv_ver = PRIV_VERSION_1_10_0;
+
+    /*
+     * Support all available satp_mode settings. The default
+     * value will be set to MBARE if the user doesn't set
+     * satp_mode manually (see set_satp_mode_default()).
+     */
+#ifndef CONFIG_USER_ONLY
+    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV64);
+#endif
+}
 #else
 static void rv32_base_cpu_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
         .instance_init = initfn              \
     }
 
+#define DEFINE_BARE_CPU(type_name, initfn) \
+    {                                      \
+        .name = type_name,                 \
+        .parent = TYPE_RISCV_BARE_CPU,     \
+        .instance_init = initfn            \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .parent = TYPE_RISCV_CPU,
         .abstract = true,
     },
+    {
+        .name = TYPE_RISCV_BARE_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+    },
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,      riscv_any_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,      riscv_max_cpu_init),
 #if defined(TARGET_RISCV32)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906,  rv64_thead_c906_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
+    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
 #endif
 };
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

QEMU already implements zicbom (Cache Block Management Operations) and
zicboz (Cache Block Zero Operations). Commit 59cb29d6a5 ("target/riscv:
add Zicbop cbo.prefetch{i, r, m} placeholder") added placeholders for
what would be the instructions for zicbop (Cache Block Prefetch
Operations), which are now no-ops.

The RVA22U64 profile mandates zicbop, which means that applications that
run with this profile might expect zicbop to be present in the riscv,isa
DT and might behave badly if it's absent.

Adding zicbop as an extension will make our future RVA22U64
implementation more in line with what userspace expects and, if/when
cache block prefetch operations became relevant to QEMU, we already have
the extension flag to turn then on/off as needed.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 2 ++
 hw/riscv/virt.c        | 5 +++++
 target/riscv/cpu.c     | 3 +++
 3 files changed, 10 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zic64b is defined in the RVA22U64 profile [1] as a named feature for
"Cache blocks must be 64 bytes in size, naturally aligned in the address
space". It's a fantasy name for 64 bytes cache blocks. The RVA22U64
profile mandates this feature, meaning that applications using this
profile expects 64 bytes cache blocks.

To make the upcoming RVA22U64 implementation complete, we'll zic64b as
a 'named feature', not a regular extension. This means that:

- it won't be exposed to users;
- it won't be written in riscv,isa.

This will be extended to other named extensions in the future, so we're
creating some common boilerplate for them as well.

zic64b is default to 'true' since we're already using 64 bytes blocks.
If any cache block size (cbo{m,p,z}_blocksize) is changed to something
different than 64, zic64b is set to 'false'.

Our profile implementation will then be able to check the current state
of zic64b and take the appropriate action (e.g. throw a warning).

[1] https://github.com/riscv/riscv-profiles/releases/download/v1.0/profiles.pdf

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/cpu_cfg.h     |  1 +
 target/riscv/cpu.c         |  6 ++++++
 target/riscv/tcg/tcg-cpu.c | 26 ++++++++++++++++++++++++++
 4 files changed, 34 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVCPUMultiExtConfig {
 extern const RISCVCPUMultiExtConfig riscv_cpu_extensions[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[];
+extern const RISCVCPUMultiExtConfig riscv_cpu_named_features[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[];
 extern Property riscv_cpu_options[];
 
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smepmp;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
+    bool zic64b;
 
     uint32_t mvendorid;
     uint64_t marchid;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+    MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
+
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 /* Deprecated entries marked for future removal */
 const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[] = {
     MULTI_EXT_CFG_BOOL("Zifencei", ext_zifencei, true),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
     g_assert_not_reached();
 }
 
+static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
+{
+    const RISCVCPUMultiExtConfig *feat;
+
+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
+        if (feat->offset == ext_offset) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
                                         uint32_t ext_offset)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
         return;
     }
 
+    if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+        return;
+    }
+
     ext_priv_ver = cpu_cfg_ext_get_min_version(ext_offset);
 
     if (env->priv_ver < ext_priv_ver) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
     }
 }
 
+static void riscv_cpu_update_named_features(RISCVCPU *cpu)
+{
+    cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
+                      cpu->cfg.cbop_blocksize == 64 &&
+                      cpu->cfg.cboz_blocksize == 64;
+}
+
 /*
  * Check consistency between chosen extensions while setting
  * cpu->cfg accordingly.
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    riscv_cpu_update_named_features(cpu);
+
     if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
         /*
          * Enhanced PMP should only be available
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Named features (zic64b the sole example at this moment) aren't expose to
users, thus we need another way to expose them.

Go through each named feature, get its boolean value, do the needed
conversions (bool to qbool, qbool to QObject) and add it to output dict.

Another adjustment is needed: named features are evaluated during
finalize(), so riscv_cpu_finalize_features() needs to be mandatory
regardless of whether we have an input dict or not. Otherwise zic64b
will always return 'false', which is incorrect: the default values of
cache blocksizes ([cbom/cbop/cboz]_blocksize) are set to 64, satisfying
the conditions for zic64b.

Here's an API usage example after this patch:

$ ./build/qemu-system-riscv64 -S -M virt -display none
    -qmp tcp:localhost:1234,server,wait=off

$ ./scripts/qmp/qmp-shell localhost:1234
Welcome to the QMP low-level shell!
Connected to QEMU 8.1.50

(QEMU) query-cpu-model-expansion type=full model={"name":"rv64"}
{"return": {"model":
    {"name": "rv64", "props": {... "zic64b": true, ...}}}}

zic64b is set to 'true', as expected, since all cache sizes are 64
bytes by default.

If we change one of the cache blocksizes, zic64b is returned as 'false':

(QEMU) query-cpu-model-expansion type=full model={"name":"rv64","props":{"cbom_blocksize":128}}
{"return": {"model":
    {"name": "rv64", "props": {... "zic64b": false, ...}}}}

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/riscv-qmp-cmds.c | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
 #include "qapi/qobject-input-visitor.h"
@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_multiext_props(Object *obj, QDict *qdict_out,
     }
 }
 
+static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
+{
+    const RISCVCPUMultiExtConfig *named_cfg;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    QObject *value;
+    bool flag_val;
+
+    for (int i = 0; riscv_cpu_named_features[i].name != NULL; i++) {
+        named_cfg = &riscv_cpu_named_features[i];
+        flag_val = isa_ext_is_enabled(cpu, named_cfg->offset);
+        value = QOBJECT(qbool_from_bool(flag_val));
+
+        qdict_put_obj(qdict_out, named_cfg->name, value);
+    }
+}
+
 static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
                                            const QDict *qdict_in,
                                            Error **errp)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
         goto err;
     }
 
-    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
-    if (local_err) {
-        goto err;
-    }
-
     visit_end_struct(visitor, NULL);
 
 err:
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
         }
     }
 
+    riscv_cpu_finalize_features(RISCV_CPU(obj), &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        object_unref(obj);
+        return NULL;
+    }
+
     expansion_info = g_new0(CpuModelExpansionInfo, 1);
     expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
     expansion_info->model->name = g_strdup(model->name);
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_extensions);
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
+    riscv_obj_add_named_feats_qdict(obj, qdict_out);
 
     /* Add our CPU boolean options too */
     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The rva22U64 profile, described in:

https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc#rva22-profiles

Contains a set of CPU extensions aimed for 64-bit userspace
applications. Enabling this set to be enabled via a single user flag
makes it convenient to enable a predictable set of features for the CPU,
giving users more predicability when running/testing their workloads.

QEMU implements all possible extensions of this profile. All the so
called 'synthetic extensions' described in the profile that are cache
related are ignored/assumed enabled (Za64rs, Zic64b, Ziccif, Ziccrse,
Ziccamoa, Zicclsm) since we do not implement a cache model.

An abstraction called RISCVCPUProfile is created to store the profile.
'ext_offsets' contains mandatory extensions that QEMU supports. Same
thing with the 'misa_ext' mask. Optional extensions must be enabled
manually in the command line if desired.

The design here is to use the common target/riscv/cpu.c file to store
the profile declaration and export it to the accelerator files. Each
accelerator is then responsible to expose it (or not) to users and how
to enable the extensions.

Next patches will implement the profile for TCG and KVM.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 12 ++++++++++++
 target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
 
 #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
 
+typedef struct riscv_cpu_profile {
+    const char *name;
+    uint32_t misa_ext;
+    bool enabled;
+    bool user_set;
+    const int32_t ext_offsets[];
+} RISCVCPUProfile;
+
+#define RISCV_PROFILE_EXT_LIST_END -1
+
+extern RISCVCPUProfile *riscv_profiles[];
+
 /* Privileged specification version */
 enum {
     PRIV_VERSION_1_10_0 = 0,
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+/*
+ * RVA22U64 defines some 'named features' or 'synthetic extensions'
+ * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
+ * and Zicclsm. We do not implement caching in QEMU so we'll consider
+ * all these named features as always enabled.
+ *
+ * There's no riscv,isa update for them (nor for zic64b, despite it
+ * having a cfg offset) at this moment.
+ */
+static RISCVCPUProfile RVA22U64 = {
+    .name = "rva22u64",
+    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+    .ext_offsets = {
+        CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
+        CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
+        CPU_CFG_OFFSET(ext_zbs), CPU_CFG_OFFSET(ext_zfhmin),
+        CPU_CFG_OFFSET(ext_zkt), CPU_CFG_OFFSET(ext_zicntr),
+        CPU_CFG_OFFSET(ext_zihpm), CPU_CFG_OFFSET(ext_zicbom),
+        CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
+
+        /* mandatory named features for this profile */
+        CPU_CFG_OFFSET(zic64b),
+
+        RISCV_PROFILE_EXT_LIST_END
+    }
+};
+
+RISCVCPUProfile *riscv_profiles[] = {
+    &RVA22U64,
+    NULL,
+};
+
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM does not have the means to support enabling the rva22u64 profile.
The main reasons are:

- we're missing support for some mandatory rva22u64 extensions in the
  KVM module;

- we can't make promises about enabling a profile since it all depends
  on host support in the end.

We'll revisit this decision in the future if needed. For now mark the
'rva22u64' profile as unavailable when running a KVM CPU:

$ qemu-system-riscv64 -machine virt,accel=kvm -cpu rv64,rva22u64=true
qemu-system-riscv64: can't apply global rv64-riscv-cpu.rva22u64=true:
    'rva22u64' is not available with KVM

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-10-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
     }
 
     if (value) {
-        error_setg(errp, "extension %s is not available with KVM",
+        error_setg(errp, "'%s' is not available with KVM",
                    propname);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_extensions);
     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_vendor_exts);
     riscv_cpu_add_kvm_unavail_prop_array(cpu_obj, riscv_cpu_experimental_exts);
+
+   /* We don't have the needed KVM support for profiles */
+    for (i = 0; riscv_profiles[i] != NULL; i++) {
+        riscv_cpu_add_kvm_unavail_prop(cpu_obj, riscv_profiles[i]->name);
+    }
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The TCG emulation implements all the extensions described in the
RVA22U64 profile, both mandatory and optional. The mandatory extensions
will be enabled via the profile flag. We'll leave the optional
extensions to be enabled by hand.

Given that this is the first profile we're implementing in TCG we'll
need some ground work first:

- all profiles declared in riscv_profiles[] will be exposed to users.
TCG is the main accelerator we're considering when adding profile
support in QEMU, so for now it's safe to assume that all profiles in
riscv_profiles[] will be relevant to TCG;

- we'll not support user profile settings for vendor CPUs. The flags
will still be exposed but users won't be able to change them;

- profile support, albeit available for all non-vendor CPUs, will be
based on top of the new 'rv64i' CPU. Setting a profile to 'true' means
enable all mandatory extensions of this profile, setting it to 'false'
will disable all mandatory profile extensions of the CPU, which will
obliterate preset defaults. This is not a problem for a bare CPU like
rv64i but it can allow for silly scenarios when using other CPUs. E.g.
an user can do "-cpu rv64,rva22u64=false" and have a bunch of default
rv64 extensions disabled. The recommended way of using profiles is the
rv64i CPU, but users are free to experiment.

For now we'll handle multi-letter extensions only. MISA extensions need
additional steps that we'll take care later. At this point we can boot a
Linux buildroot using rva22u64 using the following options:

-cpu rv64i,rva22u64=true,sv39=true,g=true,c=true,s=true

Note that being an usermode/application profile we still need to
explicitly set 's=true' to enable Supervisor mode to boot Linux.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 80 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
     return false;
 }
 
+static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
+{
+    switch (feat_offset) {
+    case CPU_CFG_OFFSET(zic64b):
+        cpu->cfg.cbom_blocksize = 64;
+        cpu->cfg.cbop_blocksize = 64;
+        cpu->cfg.cboz_blocksize = 64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void cpu_bump_multi_ext_priv_ver(CPURISCVState *env,
                                         uint32_t ext_offset)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
     }
 }
 
+static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    RISCVCPUProfile *profile = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    bool value;
+    int i, ext_offset;
+
+    if (riscv_cpu_is_vendor(obj)) {
+        error_setg(errp, "Profile %s is not available for vendor CPUs",
+                   profile->name);
+        return;
+    }
+
+    if (cpu->env.misa_mxl != MXL_RV64) {
+        error_setg(errp, "Profile %s only available for 64 bit CPUs",
+                   profile->name);
+        return;
+    }
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    profile->user_set = true;
+    profile->enabled = value;
+
+    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
+        ext_offset = profile->ext_offsets[i];
+
+        if (profile->enabled) {
+            if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+                riscv_cpu_enable_named_feat(cpu, ext_offset);
+            }
+
+            cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
+        }
+
+        g_hash_table_insert(multi_ext_user_opts,
+                            GUINT_TO_POINTER(ext_offset),
+                            (gpointer)profile->enabled);
+        isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
+    }
+}
+
+static void cpu_get_profile(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    RISCVCPUProfile *profile = opaque;
+    bool value = profile->enabled;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
+static void riscv_cpu_add_profiles(Object *cpu_obj)
+{
+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+        const RISCVCPUProfile *profile = riscv_profiles[i];
+
+        object_property_add(cpu_obj, profile->name, "bool",
+                            cpu_get_profile, cpu_set_profile,
+                            NULL, (void *)profile);
+    }
+}
+
 static bool cpu_ext_is_deprecated(const char *ext_name)
 {
     return isupper(ext_name[0]);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 
     riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_deprecated_exts);
 
+    riscv_cpu_add_profiles(obj);
+
     for (Property *prop = riscv_cpu_options; prop && prop->name; prop++) {
         qdev_property_add_static(DEVICE(obj), prop);
     }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We already track user choice for multi-letter extensions because we
needed to honor user choice when enabling/disabling extensions during
realize(). We refrained from adding the same mechanism for MISA
extensions since we didn't need it.

Profile support requires tne need to check for user choice for MISA
extensions, so let's add the corresponding hash now. It works like the
existing multi-letter hash (multi_ext_user_opts) but tracking MISA bits
options in the cpu_set_misa_ext_cfg() callback.

Note that we can't re-use the same hash from multi-letter extensions
because that hash uses cpu->cfg offsets as keys, while for MISA
extensions we're using MISA bits as keys.

After adding the user hash in cpu_set_misa_ext_cfg(), setting default
values with object_property_set_bool() in add_misa_properties() will end
up marking the user choice hash with them. Set the default value
manually to avoid it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@
 
 /* Hash that stores user set extensions */
 static GHashTable *multi_ext_user_opts;
+static GHashTable *misa_ext_user_opts;
 
 static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
+    g_hash_table_insert(misa_ext_user_opts,
+                        GUINT_TO_POINTER(misa_bit),
+                        (gpointer)value);
+
     prev_val = env->misa_ext & misa_bit;
 
     if (value == prev_val) {
@@ -XXX,XX +XXX,XX @@ static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  */
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 {
+    CPURISCVState *env = &RISCV_CPU(cpu_obj)->env;
     bool use_def_vals = riscv_cpu_is_generic(cpu_obj);
     int i;
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
                             NULL, (void *)misa_cfg);
         object_property_set_description(cpu_obj, name, desc);
         if (use_def_vals) {
-            object_property_set_bool(cpu_obj, name, misa_cfg->enabled, NULL);
+            if (misa_cfg->enabled) {
+                env->misa_ext |= bit;
+                env->misa_ext_mask |= bit;
+            } else {
+                env->misa_ext &= ~bit;
+                env->misa_ext_mask &= ~bit;
+            }
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_cpu_instance_init(CPUState *cs)
     RISCVCPU *cpu = RISCV_CPU(cs);
     Object *obj = OBJECT(cpu);
 
+    misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
     multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
     riscv_cpu_add_user_properties(obj);
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We have two instances of the setting/clearing a MISA bit from
env->misa_ext and env->misa_ext_mask pattern. And the next patch will
end up adding one more.

Create a helper to avoid code repetition.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231218125334.37184-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The profile support is handling multi-letter extensions only. Let's add
support for MISA bits as well.

We'll go through every known MISA bit. If the profile doesn't declare
the bit as mandatory, ignore it. Otherwise, set the bit in env->misa_ext
and env->misa_ext_mask.

Now that we're setting profile MISA bits, one can use the rv64i CPU to boot
Linux using the following options:

-cpu rv64i,rva22u64=true,rv39=true,s=true,zifencei=true

In the near future, when rva22s64 (where, 's', 'zifencei' and sv39 are
mandatory), is implemented, rv64i will be able to boot Linux loading
rva22s64 and no additional flags.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
+    for (i = 0; misa_bits[i] != 0; i++) {
+        uint32_t bit = misa_bits[i];
+
+        if  (!(profile->misa_ext & bit)) {
+            continue;
+        }
+
+        if (bit == RVI && !profile->enabled) {
+            /*
+             * Disabling profiles will not disable the base
+             * ISA RV64I.
+             */
+            continue;
+        }
+
+        g_hash_table_insert(misa_ext_user_opts,
+                            GUINT_TO_POINTER(bit),
+                            (gpointer)value);
+        riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
+    }
+
     for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
         ext_offset = profile->ext_offsets[i];
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Previous patches added several g_hash_table_insert() patterns. Add two
helpers, one for each user hash, to make the code cleaner.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
                                  GUINT_TO_POINTER(ext_offset));
 }
 
+static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
+{
+    g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
+                        (gpointer)value);
+}
+
+static void cpu_misa_ext_add_user_opt(uint32_t bit, bool value)
+{
+    g_hash_table_insert(misa_ext_user_opts, GUINT_TO_POINTER(bit),
+                        (gpointer)value);
+}
+
 static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
                                      bool enabled)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    g_hash_table_insert(misa_ext_user_opts,
-                        GUINT_TO_POINTER(misa_bit),
-                        (gpointer)value);
+    cpu_misa_ext_add_user_opt(misa_bit, value);
 
     prev_val = env->misa_ext & misa_bit;
 
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
             continue;
         }
 
-        g_hash_table_insert(misa_ext_user_opts,
-                            GUINT_TO_POINTER(bit),
-                            (gpointer)value);
+        cpu_misa_ext_add_user_opt(bit, profile->enabled);
         riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
     }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
             cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
         }
 
-        g_hash_table_insert(multi_ext_user_opts,
-                            GUINT_TO_POINTER(ext_offset),
-                            (gpointer)profile->enabled);
+        cpu_cfg_ext_add_user_opt(ext_offset, profile->enabled);
         isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
                     multi_ext_cfg->name, lower);
     }
 
-    g_hash_table_insert(multi_ext_user_opts,
-                        GUINT_TO_POINTER(multi_ext_cfg->offset),
-                        (gpointer)value);
+    cpu_cfg_ext_add_user_opt(multi_ext_cfg->offset, value);
 
     prev_val = isa_ext_is_enabled(cpu, multi_ext_cfg->offset);
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

RVG behaves like a profile: a single flag enables a set of bits. Right
now we're considering user choice when handling RVG and zicsr/zifencei
and ignoring user choice on MISA bits.

We'll add user warnings for profiles when the user disables its
mandatory extensions in the next patch. We'll do the same thing with RVG
now to keep consistency between RVG and profile handling.

First and foremost, create a new RVG only helper to avoid clogging
riscv_cpu_validate_set_extensions(). We do not want to annoy users with
RVG warnings like we did in the past (see 9b9741c38f), thus we'll only
warn if RVG was user set and the user disabled a RVG extension in the
command line.

For every RVG MISA bit (IMAFD), zicsr and zifencei, the logic then
becomes:

- if enabled, do nothing;
- if disabled and not user set, enable it;
- if disabled and user set, throw a warning that it's a RVG mandatory
  extension.

This same logic will be used for profiles in the next patch.

Note that this is a behavior change, where we would error out if the
user disabled either zicsr or zifencei. As long as users are explicitly
disabling things in the command line we'll let them have a go at it, at
least in this step. We'll error out later in the validation if needed.

Other notable changes from the previous RVG code:

- use riscv_cpu_write_misa_bit() instead of manually updating both
  env->misa_ext and env->misa_ext_mask;

- set zicsr and zifencei directly. We're already checking if they
  were user set and priv version will never fail for these
  extensions, making cpu_cfg_ext_auto_update() redundant.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 73 +++++++++++++++++++++++++-------------
 1 file changed, 48 insertions(+), 25 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_cfg_ext_is_user_set(uint32_t ext_offset)
                                  GUINT_TO_POINTER(ext_offset));
 }
 
+static bool cpu_misa_ext_is_user_set(uint32_t misa_bit)
+{
+    return g_hash_table_contains(misa_ext_user_opts,
+                                 GUINT_TO_POINTER(misa_bit));
+}
+
 static void cpu_cfg_ext_add_user_opt(uint32_t ext_offset, bool value)
 {
     g_hash_table_insert(multi_ext_user_opts, GUINT_TO_POINTER(ext_offset),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
                       cpu->cfg.cboz_blocksize == 64;
 }
 
+static void riscv_cpu_validate_g(RISCVCPU *cpu)
+{
+    const char *warn_msg = "RVG mandates disabled extension %s";
+    uint32_t g_misa_bits[] = {RVI, RVM, RVA, RVF, RVD};
+    bool send_warn = cpu_misa_ext_is_user_set(RVG);
+
+    for (int i = 0; i < ARRAY_SIZE(g_misa_bits); i++) {
+        uint32_t bit = g_misa_bits[i];
+
+        if (riscv_has_ext(&cpu->env, bit)) {
+            continue;
+        }
+
+        if (!cpu_misa_ext_is_user_set(bit)) {
+            riscv_cpu_write_misa_bit(cpu, bit, true);
+            continue;
+        }
+
+        if (send_warn) {
+            warn_report(warn_msg, riscv_get_misa_ext_name(bit));
+        }
+    }
+
+    if (!cpu->cfg.ext_zicsr) {
+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr))) {
+            cpu->cfg.ext_zicsr = true;
+        } else if (send_warn) {
+            warn_report(warn_msg, "zicsr");
+        }
+    }
+
+    if (!cpu->cfg.ext_zifencei) {
+        if (!cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei))) {
+            cpu->cfg.ext_zifencei = true;
+        } else if (send_warn) {
+            warn_report(warn_msg, "zifencei");
+        }
+    }
+}
+
 /*
  * Check consistency between chosen extensions while setting
  * cpu->cfg accordingly.
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
-    /* Do some ISA extension error checking */
-    if (riscv_has_ext(env, RVG) &&
-        !(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
-          riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
-          riscv_has_ext(env, RVD) &&
-          cpu->cfg.ext_zicsr && cpu->cfg.ext_zifencei)) {
-
-        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zicsr)) &&
-            !cpu->cfg.ext_zicsr) {
-            error_setg(errp, "RVG requires Zicsr but user set Zicsr to false");
-            return;
-        }
-
-        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_zifencei)) &&
-            !cpu->cfg.ext_zifencei) {
-            error_setg(errp, "RVG requires Zifencei but user set "
-                       "Zifencei to false");
-            return;
-        }
-
-        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zicsr), true);
-        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zifencei), true);
-
-        env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
-        env->misa_ext_mask |= RVI | RVM | RVA | RVF | RVD;
+    if (riscv_has_ext(env, RVG)) {
+        riscv_cpu_validate_g(cpu);
     }
 
     if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Enabling a profile and then disabling some of its mandatory extensions
is a valid use. It can be useful for debugging and testing. But the
common expected use of enabling a profile is to enable all its mandatory
extensions.

Add an user warning when mandatory extensions from an enabled profile
are disabled in the command line. We're also going to disable the
profile flag in this case since the profile must include all the
mandatory extensions. This flag can be exposed by QMP to indicate the
actual profile state after the CPU is realized.

After this patch, this will throw warnings:

-cpu rv64,rva22u64=true,zihintpause=false,zicbom=false,zicboz=false

qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zihintpause
qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicbom
qemu-system-riscv64: warning: Profile rva22u64 mandates disabled extension zicboz

Note that the following will NOT throw warnings because the profile is
being enabled last, hence all its mandatory extensions will be enabled:

-cpu rv64,zihintpause=false,zicbom=false,zicboz=false,rva22u64=true

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 69 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_cfg_ext_get_min_version(uint32_t ext_offset)
     g_assert_not_reached();
 }
 
+static const char *cpu_cfg_ext_get_name(uint32_t ext_offset)
+{
+    const RISCVCPUMultiExtConfig *feat;
+    const RISCVIsaExtData *edata;
+
+    for (edata = isa_edata_arr; edata->name != NULL; edata++) {
+        if (edata->ext_enable_offset == ext_offset) {
+            return edata->name;
+        }
+    }
+
+    for (feat = riscv_cpu_named_features; feat->name != NULL; feat++) {
+        if (feat->offset == ext_offset) {
+            return feat->name;
+        }
+    }
+
+    g_assert_not_reached();
+}
+
 static bool cpu_cfg_offset_is_named_feat(uint32_t ext_offset)
 {
     const RISCVCPUMultiExtConfig *feat;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     riscv_cpu_disable_priv_spec_isa_exts(cpu);
 }
 
+static void riscv_cpu_validate_profile(RISCVCPU *cpu,
+                                       RISCVCPUProfile *profile)
+{
+    const char *warn_msg = "Profile %s mandates disabled extension %s";
+    bool send_warn = profile->user_set && profile->enabled;
+    bool profile_impl = true;
+    int i;
+
+    for (i = 0; misa_bits[i] != 0; i++) {
+        uint32_t bit = misa_bits[i];
+
+        if (!(profile->misa_ext & bit)) {
+            continue;
+        }
+
+        if (!riscv_has_ext(&cpu->env, bit)) {
+            profile_impl = false;
+
+            if (send_warn) {
+                warn_report(warn_msg, profile->name,
+                            riscv_get_misa_ext_name(bit));
+            }
+        }
+    }
+
+    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
+        int ext_offset = profile->ext_offsets[i];
+
+        if (!isa_ext_is_enabled(cpu, ext_offset)) {
+            profile_impl = false;
+
+            if (send_warn) {
+                warn_report(warn_msg, profile->name,
+                            cpu_cfg_ext_get_name(ext_offset));
+            }
+        }
+    }
+
+    profile->enabled = profile_impl;
+}
+
+static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
+{
+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+        riscv_cpu_validate_profile(cpu, riscv_profiles[i]);
+    }
+}
+
 void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     }
 
     riscv_cpu_update_named_features(cpu);
+    riscv_cpu_validate_profiles(cpu);
 
     if (cpu->cfg.ext_smepmp && !cpu->cfg.pmp) {
         /*
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Expose all profile flags for all CPUs when executing
query-cpu-model-expansion. This will allow callers to quickly determine
if a certain profile is implemented by a given CPU. This includes vendor
CPUs - the fact that they don't have profile user flags doesn't mean
that they don't implement the profile.

After this change it's possible to quickly determine if our stock CPUs
implement the existing rva22u64 profile. Here's a few examples:

$ ./build/qemu-system-riscv64 -S -M virt -display none
-qmp tcp:localhost:1234,server,wait=off

$ ./scripts/qmp/qmp-shell localhost:1234
Welcome to the QMP low-level shell!
Connected to QEMU 8.1.50

- As expected, the 'max' CPU implements the rva22u64 profile.

(QEMU) query-cpu-model-expansion type=full model={"name":"max"}
    {"return": {"model":
        {"name": "rv64", "props": {... "rva22u64": true, ...}}}}

- rv64 is missing "zba", "zbb", "zbs", "zkt" and "zfhmin":

query-cpu-model-expansion type=full model={"name":"rv64"}
    {"return": {"model":
        {"name": "rv64", "props": {... "rva22u64": false, ...}}}}

query-cpu-model-expansion type=full model={"name":"rv64",
    "props":{"zba":true,"zbb":true,"zbs":true,"zkt":true,"zfhmin":true}}
    {"return": {"model":
        {"name": "rv64", "props": {... "rva22u64": true, ...}}}}

We have no vendor CPUs that supports rva22u64 (veyron-v1 is the closest
- it is missing just 'zkt').

In short, aside from the 'max' CPU, we have no CPUs that supports
rva22u64 by default.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/riscv-qmp-cmds.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ static void riscv_obj_add_named_feats_qdict(Object *obj, QDict *qdict_out)
     }
 }
 
+static void riscv_obj_add_profiles_qdict(Object *obj, QDict *qdict_out)
+{
+    RISCVCPUProfile *profile;
+    QObject *value;
+
+    for (int i = 0; riscv_profiles[i] != NULL; i++) {
+        profile = riscv_profiles[i];
+        value = QOBJECT(qbool_from_bool(profile->enabled));
+
+        qdict_put_obj(qdict_out, profile->name, value);
+    }
+}
+
 static void riscv_cpuobj_validate_qdict_in(Object *obj, QObject *props,
                                            const QDict *qdict_in,
                                            Error **errp)
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_experimental_exts);
     riscv_obj_add_multiext_props(obj, qdict_out, riscv_cpu_vendor_exts);
     riscv_obj_add_named_feats_qdict(obj, qdict_out);
+    riscv_obj_add_profiles_qdict(obj, qdict_out);
 
     /* Add our CPU boolean options too */
     riscv_obj_add_qdict_prop(obj, qdict_out, "mmu");
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This CPU was suggested by Alistair [1] and others during the profile
design discussions. It consists of the bare 'rv64i' CPU with rva22u64
enabled by default, like an alias of '-cpu rv64i,rva22u64=true'.

Users now have an even easier way of consuming this user-mode profile by
doing '-cpu rva22u64'. Extensions can be enabled/disabled at will on top
of it.

We can boot Linux with this "user-mode" CPU by doing:

-cpu rva22u64,sv39=true,s=true,zifencei=true

[1] https://lore.kernel.org/qemu-riscv/CAKmqyKP7xzZ9Sx=-Lbx2Ob0qCfB7Z+JO944FQ2TQ+49mqo0q_Q@mail.gmail.com/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h     |  1 +
 target/riscv/cpu.c         | 17 +++++++++++++++++
 target/riscv/tcg/tcg-cpu.c |  9 +++++++++
 3 files changed, 27 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_BASE64           RISCV_CPU_TYPE_NAME("rv64")
 #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
 #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
+#define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#if defined(TARGET_RISCV64)
+static void rva22u64_profile_cpu_init(Object *obj)
+{
+    rv64i_bare_cpu_init(obj);
+
+    RVA22U64.enabled = true;
+}
+#endif
+
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
@@ -XXX,XX +XXX,XX @@ char *riscv_isa_string(RISCVCPU *cpu)
         .instance_init = initfn            \
     }
 
+#define DEFINE_PROFILE_CPU(type_name, initfn) \
+    {                                         \
+        .name = type_name,                    \
+        .parent = TYPE_RISCV_BARE_CPU,        \
+        .instance_init = initfn               \
+    }
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,   rv64_veyron_v1_cpu_init),
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
 #endif
 };
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_profiles(Object *cpu_obj)
         object_property_add(cpu_obj, profile->name, "bool",
                             cpu_get_profile, cpu_set_profile,
                             NULL, (void *)profile);
+
+        /*
+         * CPUs might enable a profile right from the start.
+         * Enable its mandatory extensions right away in this
+         * case.
+         */
+        if (profile->enabled) {
+            object_property_set_bool(cpu_obj, profile->name, true, NULL);
+        }
     }
 }
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'svade' is a RVA22S64 profile requirement, a profile we're going to add
shortly. It is a named feature (i.e. not a formal extension, not defined
in riscv,isa DT at this moment) defined in [1] as:

"Page-fault exceptions are raised when a page is accessed when A bit is
clear, or written when D bit is clear.".

As far as the spec goes, 'svade' is one of the two distinct modes of
handling PTE_A and PTE_D. The other way, i.e. update PTE_A/PTE_D when
they're cleared, is defined by the 'svadu' extension. Checking
cpu_helper.c, get_physical_address(), we can verify that QEMU is
compliant with that: we will update PTE_A/PTE_D if 'svadu' is enabled,
or throw a page-fault exception if 'svadu' isn't enabled.

So, as far as we're concerned, 'svade' translates to 'svadu must be
disabled'.

We'll implement it like 'zic64b': an internal flag that profiles can
enable. The flag will not be exposed to users.

[1] https://github.com/riscv/riscv-profiles/blob/main/profiles.adoc

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     | 1 +
 target/riscv/cpu.c         | 1 +
 target/riscv/tcg/tcg-cpu.c | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_smepmp;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
+    bool svade;
     bool zic64b;
 
     uint32_t mvendorid;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
 };
 
 const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+    MULTI_EXT_CFG_BOOL("svade", svade, true),
     MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_enable_named_feat(RISCVCPU *cpu, uint32_t feat_offset)
         cpu->cfg.cbop_blocksize = 64;
         cpu->cfg.cboz_blocksize = 64;
         break;
+    case CPU_CFG_OFFSET(svade):
+        cpu->cfg.ext_svadu = false;
+        break;
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
     cpu->cfg.zic64b = cpu->cfg.cbom_blocksize == 64 &&
                       cpu->cfg.cbop_blocksize == 64 &&
                       cpu->cfg.cboz_blocksize == 64;
+
+    cpu->cfg.svade = !cpu->cfg.ext_svadu;
 }
 
 static void riscv_cpu_validate_g(RISCVCPU *cpu)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Some profiles, like RVA22S64, has a priv_spec requirement.

Make this requirement explicit for all profiles. We'll validate this
requirement finalize() time and, in case the user chooses an
incompatible priv_spec while activating a profile, a warning will be
shown.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  2 ++
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 31 +++++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
     uint32_t misa_ext;
     bool enabled;
     bool user_set;
+    int priv_spec;
     const int32_t ext_offsets[];
 } RISCVCPUProfile;
 
 #define RISCV_PROFILE_EXT_LIST_END -1
+#define RISCV_PROFILE_ATTR_UNUSED -1
 
 extern RISCVCPUProfile *riscv_profiles[];
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
 static RISCVCPUProfile RVA22U64 = {
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+    .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
     .ext_offsets = {
         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_write_misa_bit(RISCVCPU *cpu, uint32_t bit,
     }
 }
 
+static const char *cpu_priv_ver_to_str(int priv_ver)
+{
+    switch (priv_ver) {
+    case PRIV_VERSION_1_10_0:
+        return "v1.10.0";
+    case PRIV_VERSION_1_11_0:
+        return "v1.11.0";
+    case PRIV_VERSION_1_12_0:
+        return "v1.12.0";
+    }
+
+    g_assert_not_reached();
+}
+
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_validate_profile(RISCVCPU *cpu,
                                        RISCVCPUProfile *profile)
 {
+    CPURISCVState *env = &cpu->env;
     const char *warn_msg = "Profile %s mandates disabled extension %s";
     bool send_warn = profile->user_set && profile->enabled;
     bool profile_impl = true;
     int i;
 
+    if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
+        profile->priv_spec != env->priv_ver) {
+        profile_impl = false;
+
+        if (send_warn) {
+            warn_report("Profile %s requires priv spec %s, "
+                        "but priv ver %s was set", profile->name,
+                        cpu_priv_ver_to_str(profile->priv_spec),
+                        cpu_priv_ver_to_str(env->priv_ver));
+        }
+    }
+
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];
 
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
+    if (profile->enabled) {
+        cpu->env.priv_ver = profile->priv_spec;
+    }
+
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Profiles will need to validate satp_mode during their own finalize
methods. This will occur inside riscv_tcg_cpu_finalize_features() for
TCG. Given that satp_mode does not have any pre-req from the accelerator
finalize() method, it's safe to finalize it earlier.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-22-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
 {
     Error *local_err = NULL;
 
+#ifndef CONFIG_USER_ONLY
+    riscv_cpu_satp_mode_finalize(cpu, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+#endif
+
     /*
      * KVM accel does not have a specialized finalize()
      * callback because its extensions are validated
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
             return;
         }
     }
-
-#ifndef CONFIG_USER_ONLY
-    riscv_cpu_satp_mode_finalize(cpu, &local_err);
-    if (local_err != NULL) {
-        error_propagate(errp, local_err);
-        return;
-    }
-#endif
 }
 
 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Next patch will need to retrieve if a given RISCVCPU is 32 or 64 bit.
The existing helper riscv_is_32bit() (hw/riscv/boot.c) will always check
the first CPU of a given hart array, not any given CPU.

Create a helper to retrieve the info for any given CPU, not the first
CPU of the hart array. The helper is using the same 32 bit check that
riscv_cpu_satp_mode_finalize() was doing.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-23-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 +
 target/riscv/cpu.c | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *pflags);
 
 void riscv_cpu_update_mask(CPURISCVState *env);
+bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
 #define BYTE(x)   (x)
 #endif
 
+bool riscv_cpu_is_32bit(RISCVCPU *cpu)
+{
+    return riscv_cpu_mxl(&cpu->env) == MXL_RV32;
+}
+
 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
     {#_name, _min_ver, CPU_CFG_OFFSET(_prop)}
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 #ifndef CONFIG_USER_ONLY
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
-    bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
+    bool rv32 = riscv_cpu_is_32bit(cpu);
     uint8_t satp_mode_map_max, satp_mode_supported_max;
 
     /* The CPU wants the OS to decide which satp mode to use */
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'satp_mode' is a requirement for supervisor profiles like RVA22S64.
User-mode/application profiles like RVA22U64 doesn't care.

Add 'satp_mode' to the profile description. If a profile requires it,
set it during cpu_set_profile(). We'll also check it during finalize()
to validate if the running config implements the profile.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-24-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 40 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct riscv_cpu_profile {
     bool enabled;
     bool user_set;
     int priv_spec;
+    int satp_mode;
     const int32_t ext_offsets[];
 } RISCVCPUProfile;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+    .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
     .ext_offsets = {
         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
     riscv_cpu_disable_priv_spec_isa_exts(cpu);
 }
 
+#ifndef CONFIG_USER_ONLY
+static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
+                                            RISCVCPUProfile *profile,
+                                            bool send_warn)
+{
+    int satp_max = satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+
+    if (profile->satp_mode > satp_max) {
+        if (send_warn) {
+            bool is_32bit = riscv_cpu_is_32bit(cpu);
+            const char *req_satp = satp_mode_str(profile->satp_mode, is_32bit);
+            const char *cur_satp = satp_mode_str(satp_max, is_32bit);
+
+            warn_report("Profile %s requires satp mode %s, "
+                        "but satp mode %s was set", profile->name,
+                        req_satp, cur_satp);
+        }
+
+        return false;
+    }
+
+    return true;
+}
+#endif
+
 static void riscv_cpu_validate_profile(RISCVCPU *cpu,
                                        RISCVCPUProfile *profile)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
     bool profile_impl = true;
     int i;
 
+#ifndef CONFIG_USER_ONLY
+    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+        profile_impl = riscv_cpu_validate_profile_satp(cpu, profile,
+                                                       send_warn);
+    }
+#endif
+
     if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
         profile->priv_spec != env->priv_ver) {
         profile_impl = false;
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
         cpu->env.priv_ver = profile->priv_spec;
     }
 
+#ifndef CONFIG_USER_ONLY
+    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+        const char *satp_prop = satp_mode_str(profile->satp_mode,
+                                              riscv_cpu_is_32bit(cpu));
+        object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
+    }
+#endif
+
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Certain S-mode profiles, like RVA22S64 and RVA23S64, mandate all the
mandatory extensions of their respective U-mode profiles. RVA22S64
includes all mandatory extensions of RVA22U64, and the same happens with
RVA23 profiles.

Add a 'parent' field to allow profiles to enable other profiles. This
will allow us to describe S-mode profiles by specifying their parent
U-mode profile, then adding just the S-mode specific extensions.

We're naming the field 'parent' to consider the possibility of other
uses (e.g. a s-mode profile including a previous s-mode profile) in the
future.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-25-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 14 +++++++++++++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
 #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
 
 typedef struct riscv_cpu_profile {
+    struct riscv_cpu_profile *parent;
     const char *name;
     uint32_t misa_ext;
     bool enabled;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ Property riscv_cpu_options[] = {
  * having a cfg offset) at this moment.
  */
 static RISCVCPUProfile RVA22U64 = {
+    .parent = NULL,
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
     CPURISCVState *env = &cpu->env;
     const char *warn_msg = "Profile %s mandates disabled extension %s";
     bool send_warn = profile->user_set && profile->enabled;
-    bool profile_impl = true;
+    bool parent_enabled, profile_impl = true;
     int i;
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
     }
 
     profile->enabled = profile_impl;
+
+    if (profile->parent != NULL) {
+        parent_enabled = object_property_get_bool(OBJECT(cpu),
+                                                  profile->parent->name,
+                                                  NULL);
+        profile->enabled = profile->enabled && parent_enabled;
+    }
 }
 
 static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
+    if (profile->parent != NULL) {
+        object_property_set_bool(obj, profile->parent->name,
+                                 profile->enabled, NULL);
+    }
+
     if (profile->enabled) {
         cpu->env.priv_ver = profile->priv_spec;
     }
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The RVA22S64 profile consists of the following:

- all mandatory extensions of RVA22U64;
- priv spec v1.12.0;
- satp mode sv39;
- Ssccptr, a cache related named feature that we're assuming always
  enable since we don't implement a cache;
- Other named features already implemented: Sstvecd, Sstvala,
  Sscounterenw;
- the new Svade named feature that was recently added.

Most of the work is already done, so this patch is enough to implement
the profile.

After this patch, the 'rva22s64' user flag alone can be used with the
rva64i CPU to boot Linux:

-cpu rv64i,rva22s64=true

This is the /proc/cpuinfo with this profile enabled:

# cat /proc/cpuinfo
processor	: 0
hart		: 0
isa		: rv64imafdc_zicbom_zicbop_zicboz_zicntr_zicsr_zifencei_zihintpause_zihpm_zfhmin_zca_zcd_zba_zbb_zbs_zkt_svinval_svpbmt
mmu		: sv39

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-26-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
     }
 };
 
+/*
+ * As with RVA22U64, RVA22S64 also defines 'named features'.
+ *
+ * Cache related features that we consider enabled since we don't
+ * implement cache: Ssccptr
+ *
+ * Other named features that we already implement: Sstvecd, Sstvala,
+ * Sscounterenw
+ *
+ * Named features that we need to enable: svade
+ *
+ * The remaining features/extensions comes from RVA22U64.
+ */
+static RISCVCPUProfile RVA22S64 = {
+    .parent = &RVA22U64,
+    .name = "rva22s64",
+    .misa_ext = RVS,
+    .priv_spec = PRIV_VERSION_1_12_0,
+    .satp_mode = VM_1_10_SV39,
+    .ext_offsets = {
+        /* rva22s64 exts */
+        CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
+        CPU_CFG_OFFSET(ext_svinval),
+
+        /* rva22s64 named features */
+        CPU_CFG_OFFSET(svade),
+
+        RISCV_PROFILE_EXT_LIST_END
+    }
+};
+
 RISCVCPUProfile *riscv_profiles[] = {
     &RVA22U64,
+    &RVA22S64,
     NULL,
 };
 
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add a new profile CPU 'rva22s64' to work as an alias of

-cpu rv64i,rva22s64

Like the existing rva22u64 CPU already does with the RVA22U64 profile.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218125334.37184-27-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h | 1 +
 target/riscv/cpu.c     | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_BASE128          RISCV_CPU_TYPE_NAME("x-rv128")
 #define TYPE_RISCV_CPU_RV64I            RISCV_CPU_TYPE_NAME("rv64i")
 #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
+#define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rva22u64_profile_cpu_init(Object *obj)
 
     RVA22U64.enabled = true;
 }
+
+static void rva22s64_profile_cpu_init(Object *obj)
+{
+    rv64i_bare_cpu_init(obj);
+
+    RVA22S64.enabled = true;
+}
 #endif
 
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,  rv128_base_cpu_init),
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I, rv64i_bare_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64, rva22u64_profile_cpu_init),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64, rva22s64_profile_cpu_init),
 #endif
 };
 
-- 
2.43.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

The emulated AIA within the Linux kernel restores the HART index
of the IMSICs according to the configured AIA settings. During
this process, the group setting is used only when the machine
partitions harts into groups. It's unnecessary to set the group
configuration if the machine has only one socket, as its address
space might not contain the group shift.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20231218090543.22353-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         exit(1);
     }
 
-    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
-                            &socket_bits, true, NULL);
-    if (ret < 0) {
-        error_report("KVM AIA: failed to set group_bits");
-        exit(1);
-    }
 
-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
-                            &group_shift, true, NULL);
-    if (ret < 0) {
-        error_report("KVM AIA: failed to set group_shift");
-        exit(1);
+    if (socket_count > 1) {
+        socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                                &socket_bits, true, NULL);
+        if (ret < 0) {
+            error_report("KVM AIA: failed to set group_bits");
+            exit(1);
+        }
+
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                                &group_shift, true, NULL);
+        if (ret < 0) {
+            error_report("KVM AIA: failed to set group_shift");
+            exit(1);
+        }
     }
 
     guest_bits = guest_num == 0 ? 0 :
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We'll add a new RISC-V linux-header file, but first let's update all
headers.

Headers for 'asm-loongarch' were added in this update.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/standard-headers/drm/drm_fourcc.h     |   2 +
 include/standard-headers/linux/pci_regs.h     |  24 ++-
 include/standard-headers/linux/vhost_types.h  |   7 +
 .../standard-headers/linux/virtio_config.h    |   5 +
 include/standard-headers/linux/virtio_pci.h   |  11 ++
 linux-headers/asm-arm64/kvm.h                 |  32 ++++
 linux-headers/asm-generic/unistd.h            |  14 +-
 linux-headers/asm-loongarch/bitsperlong.h     |   1 +
 linux-headers/asm-loongarch/kvm.h             | 108 +++++++++++
 linux-headers/asm-loongarch/mman.h            |   1 +
 linux-headers/asm-loongarch/unistd.h          |   5 +
 linux-headers/asm-mips/unistd_n32.h           |   4 +
 linux-headers/asm-mips/unistd_n64.h           |   4 +
 linux-headers/asm-mips/unistd_o32.h           |   4 +
 linux-headers/asm-powerpc/unistd_32.h         |   4 +
 linux-headers/asm-powerpc/unistd_64.h         |   4 +
 linux-headers/asm-riscv/kvm.h                 |  12 ++
 linux-headers/asm-s390/unistd_32.h            |   4 +
 linux-headers/asm-s390/unistd_64.h            |   4 +
 linux-headers/asm-x86/unistd_32.h             |   4 +
 linux-headers/asm-x86/unistd_64.h             |   3 +
 linux-headers/asm-x86/unistd_x32.h            |   3 +
 linux-headers/linux/iommufd.h                 | 180 +++++++++++++++++-
 linux-headers/linux/kvm.h                     |  11 ++
 linux-headers/linux/psp-sev.h                 |   1 +
 linux-headers/linux/stddef.h                  |   9 +-
 linux-headers/linux/userfaultfd.h             |   9 +-
 linux-headers/linux/vfio.h                    |  47 +++--
 linux-headers/linux/vhost.h                   |   8 +
 29 files changed, 498 insertions(+), 27 deletions(-)
 create mode 100644 linux-headers/asm-loongarch/bitsperlong.h
 create mode 100644 linux-headers/asm-loongarch/kvm.h
 create mode 100644 linux-headers/asm-loongarch/mman.h
 create mode 100644 linux-headers/asm-loongarch/unistd.h

diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -XXX,XX +XXX,XX @@ extern "C" {
  * index 1 = Cr:Cb plane, [39:0] Cr1:Cb1:Cr0:Cb0 little endian
  */
 #define DRM_FORMAT_NV15		fourcc_code('N', 'V', '1', '5') /* 2x2 subsampled Cr:Cb plane */
+#define DRM_FORMAT_NV20		fourcc_code('N', 'V', '2', '0') /* 2x1 subsampled Cr:Cb plane */
+#define DRM_FORMAT_NV30		fourcc_code('N', 'V', '3', '0') /* non-subsampled Cr:Cb plane */
 
 /*
  * 2 plane YCbCr MSB aligned
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
 #define  PCI_HEADER_TYPE_NORMAL		0
 #define  PCI_HEADER_TYPE_BRIDGE		1
 #define  PCI_HEADER_TYPE_CARDBUS	2
+#define  PCI_HEADER_TYPE_MFD		0x80	/* Multi-Function Device (possible) */
 
 #define PCI_BIST		0x0f	/* 8 bits */
 #define  PCI_BIST_CODE_MASK	0x0f	/* Return result */
@@ -XXX,XX +XXX,XX @@
 #define PCI_EXP_RTCAP		0x1e	/* Root Capabilities */
 #define  PCI_EXP_RTCAP_CRSVIS	0x0001	/* CRS Software Visibility capability */
 #define PCI_EXP_RTSTA		0x20	/* Root Status */
+#define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
 #define  PCI_EXP_RTSTA_PME	0x00010000 /* PME status */
 #define  PCI_EXP_RTSTA_PENDING	0x00020000 /* PME pending */
 /*
@@ -XXX,XX +XXX,XX @@
 
 /* Process Address Space ID */
 #define PCI_PASID_CAP		0x04    /* PASID feature register */
-#define  PCI_PASID_CAP_EXEC	0x02	/* Exec permissions Supported */
-#define  PCI_PASID_CAP_PRIV	0x04	/* Privilege Mode Supported */
+#define  PCI_PASID_CAP_EXEC	0x0002	/* Exec permissions Supported */
+#define  PCI_PASID_CAP_PRIV	0x0004	/* Privilege Mode Supported */
+#define  PCI_PASID_CAP_WIDTH	0x1f00
 #define PCI_PASID_CTRL		0x06    /* PASID control register */
-#define  PCI_PASID_CTRL_ENABLE	0x01	/* Enable bit */
-#define  PCI_PASID_CTRL_EXEC	0x02	/* Exec permissions Enable */
-#define  PCI_PASID_CTRL_PRIV	0x04	/* Privilege Mode Enable */
+#define  PCI_PASID_CTRL_ENABLE	0x0001	/* Enable bit */
+#define  PCI_PASID_CTRL_EXEC	0x0002	/* Exec permissions Enable */
+#define  PCI_PASID_CTRL_PRIV	0x0004	/* Privilege Mode Enable */
 #define PCI_EXT_CAP_PASID_SIZEOF	8
 
 /* Single Root I/O Virtualization */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_LTR_VALUE_MASK	0x000003ff
 #define  PCI_LTR_SCALE_MASK	0x00001c00
 #define  PCI_LTR_SCALE_SHIFT	10
+#define  PCI_LTR_NOSNOOP_VALUE	0x03ff0000 /* Max No-Snoop Latency Value */
+#define  PCI_LTR_NOSNOOP_SCALE	0x1c000000 /* Scale for Max Value */
 #define PCI_EXT_CAP_LTR_SIZEOF	8
 
 /* Access Control Service */
@@ -XXX,XX +XXX,XX @@
 #define PCI_EXP_DPC_STATUS		0x08	/* DPC Status */
 #define  PCI_EXP_DPC_STATUS_TRIGGER	    0x0001 /* Trigger Status */
 #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN	    0x0006 /* Trigger Reason */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_UNCOR  0x0000 /* Uncorrectable error */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_NFE    0x0002 /* Rcvd ERR_NONFATAL */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_FE     0x0004 /* Rcvd ERR_FATAL */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_IN_EXT 0x0006 /* Reason in Trig Reason Extension field */
 #define  PCI_EXP_DPC_STATUS_INTERRUPT	    0x0008 /* Interrupt Status */
 #define  PCI_EXP_DPC_RP_BUSY		    0x0010 /* Root Port Busy */
 #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_EXT 0x0060 /* Trig Reason Extension */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_RP_PIO		0x0000	/* RP PIO error */
+#define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_SW_TRIGGER	0x0020	/* DPC SW Trigger bit */
+#define  PCI_EXP_DPC_RP_PIO_FEP		    0x1f00 /* RP PIO First Err Ptr */
 
 #define PCI_EXP_DPC_SOURCE_ID		 0x0A	/* DPC Source Identifier */
 
@@ -XXX,XX +XXX,XX @@
 #define  PCI_L1SS_CTL1_LTR_L12_TH_VALUE	0x03ff0000  /* LTR_L1.2_THRESHOLD_Value */
 #define  PCI_L1SS_CTL1_LTR_L12_TH_SCALE	0xe0000000  /* LTR_L1.2_THRESHOLD_Scale */
 #define PCI_L1SS_CTL2		0x0c	/* Control 2 Register */
+#define  PCI_L1SS_CTL2_T_PWR_ON_SCALE	0x00000003  /* T_POWER_ON Scale */
+#define  PCI_L1SS_CTL2_T_PWR_ON_VALUE	0x000000f8  /* T_POWER_ON Value */
 
 /* Designated Vendor-Specific (DVSEC, PCI_EXT_CAP_ID_DVSEC) */
 #define PCI_DVSEC_HEADER1		0x4 /* Designated Vendor-Specific Header1 */
diff --git a/include/standard-headers/linux/vhost_types.h b/include/standard-headers/linux/vhost_types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/vhost_types.h
+++ b/include/standard-headers/linux/vhost_types.h
@@ -XXX,XX +XXX,XX @@ struct vhost_vdpa_iova_range {
  * DRIVER_OK
  */
 #define VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK  0x6
+/* Device may expose the virtqueue's descriptor area, driver area and
+ * device area to a different group for ASID binding than where its
+ * buffers may reside. Requires VHOST_BACKEND_F_IOTLB_ASID.
+ */
+#define VHOST_BACKEND_F_DESC_ASID    0x7
+/* IOTLB don't flush memory mapping across device reset */
+#define VHOST_BACKEND_F_IOTLB_PERSIST  0x8
 
 #endif
diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_config.h
+++ b/include/standard-headers/linux/virtio_config.h
@@ -XXX,XX +XXX,XX @@
  */
 #define VIRTIO_F_NOTIFICATION_DATA	38
 
+/* This feature indicates that the driver uses the data provided by the device
+ * as a virtqueue identifier in available buffer notifications.
+ */
+#define VIRTIO_F_NOTIF_CONFIG_DATA	39
+
 /*
  * This feature indicates that the driver can reset a queue individually.
  */
diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_pci.h
+++ b/include/standard-headers/linux/virtio_pci.h
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_common_cfg {
 	uint32_t queue_used_hi;		/* read-write */
 };
 
+/*
+ * Warning: do not use sizeof on this: use offsetofend for
+ * specific fields you need.
+ */
+struct virtio_pci_modern_common_cfg {
+	struct virtio_pci_common_cfg cfg;
+
+	uint16_t queue_notify_data;	/* read-write */
+	uint16_t queue_reset;		/* read-write */
+};
+
 /* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
 struct virtio_pci_cfg_cap {
 	struct virtio_pci_cap cap;
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_smccc_filter {
 #define KVM_HYPERCALL_EXIT_SMC		(1U << 0)
 #define KVM_HYPERCALL_EXIT_16BIT	(1U << 1)
 
+/*
+ * Get feature ID registers userspace writable mask.
+ *
+ * From DDI0487J.a, D19.2.66 ("ID_AA64MMFR2_EL1, AArch64 Memory Model
+ * Feature Register 2"):
+ *
+ * "The Feature ID space is defined as the System register space in
+ * AArch64 with op0==3, op1=={0, 1, 3}, CRn==0, CRm=={0-7},
+ * op2=={0-7}."
+ *
+ * This covers all currently known R/O registers that indicate
+ * anything useful feature wise, including the ID registers.
+ *
+ * If we ever need to introduce a new range, it will be described as
+ * such in the range field.
+ */
+#define KVM_ARM_FEATURE_ID_RANGE_IDX(op0, op1, crn, crm, op2)		\
+	({								\
+		__u64 __op1 = (op1) & 3;				\
+		__op1 -= (__op1 == 3);					\
+		(__op1 << 6 | ((crm) & 7) << 3 | (op2));		\
+	})
+
+#define KVM_ARM_FEATURE_ID_RANGE	0
+#define KVM_ARM_FEATURE_ID_RANGE_SIZE	(3 * 8 * 8)
+
+struct reg_mask_range {
+	__u64 addr;		/* Pointer to mask array */
+	__u32 range;		/* Requested range */
+	__u32 reserved[13];
+};
+
 #endif
 
 #endif /* __ARM_KVM_H__ */
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fremovexattr, sys_fremovexattr)
 #define __NR_getcwd 17
 __SYSCALL(__NR_getcwd, sys_getcwd)
 #define __NR_lookup_dcookie 18
-__SC_COMP(__NR_lookup_dcookie, sys_lookup_dcookie, compat_sys_lookup_dcookie)
+__SYSCALL(__NR_lookup_dcookie, sys_ni_syscall)
 #define __NR_eventfd2 19
 __SYSCALL(__NR_eventfd2, sys_eventfd2)
 #define __NR_epoll_create1 20
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_process_mrelease, sys_process_mrelease)
 __SYSCALL(__NR_futex_waitv, sys_futex_waitv)
 #define __NR_set_mempolicy_home_node 450
 __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node)
-
 #define __NR_cachestat 451
 __SYSCALL(__NR_cachestat, sys_cachestat)
-
 #define __NR_fchmodat2 452
 __SYSCALL(__NR_fchmodat2, sys_fchmodat2)
+#define __NR_map_shadow_stack 453
+__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack)
+#define __NR_futex_wake 454
+__SYSCALL(__NR_futex_wake, sys_futex_wake)
+#define __NR_futex_wait 455
+__SYSCALL(__NR_futex_wait, sys_futex_wait)
+#define __NR_futex_requeue 456
+__SYSCALL(__NR_futex_requeue, sys_futex_requeue)
 
 #undef __NR_syscalls
-#define __NR_syscalls 453
+#define __NR_syscalls 457
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-loongarch/bitsperlong.h b/linux-headers/asm-loongarch/bitsperlong.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/bitsperlong.h
@@ -0,0 +1 @@
+#include <asm-generic/bitsperlong.h>
diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/kvm.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2020-2023 Loongson Technology Corporation Limited
+ */
+
+#ifndef __UAPI_ASM_LOONGARCH_KVM_H
+#define __UAPI_ASM_LOONGARCH_KVM_H
+
+#include <linux/types.h>
+
+/*
+ * KVM LoongArch specific structures and definitions.
+ *
+ * Some parts derived from the x86 version of this file.
+ */
+
+#define __KVM_HAVE_READONLY_MEM
+
+#define KVM_COALESCED_MMIO_PAGE_OFFSET	1
+#define KVM_DIRTY_LOG_PAGE_OFFSET	64
+
+/*
+ * for KVM_GET_REGS and KVM_SET_REGS
+ */
+struct kvm_regs {
+	/* out (KVM_GET_REGS) / in (KVM_SET_REGS) */
+	__u64 gpr[32];
+	__u64 pc;
+};
+
+/*
+ * for KVM_GET_FPU and KVM_SET_FPU
+ */
+struct kvm_fpu {
+	__u32 fcsr;
+	__u64 fcc;    /* 8x8 */
+	struct kvm_fpureg {
+		__u64 val64[4];
+	} fpr[32];
+};
+
+/*
+ * For LoongArch, we use KVM_SET_ONE_REG and KVM_GET_ONE_REG to access various
+ * registers.  The id field is broken down as follows:
+ *
+ *  bits[63..52] - As per linux/kvm.h
+ *  bits[51..32] - Must be zero.
+ *  bits[31..16] - Register set.
+ *
+ * Register set = 0: GP registers from kvm_regs (see definitions below).
+ *
+ * Register set = 1: CSR registers.
+ *
+ * Register set = 2: KVM specific registers (see definitions below).
+ *
+ * Register set = 3: FPU / SIMD registers (see definitions below).
+ *
+ * Other sets registers may be added in the future.  Each set would
+ * have its own identifier in bits[31..16].
+ */
+
+#define KVM_REG_LOONGARCH_GPR		(KVM_REG_LOONGARCH | 0x00000ULL)
+#define KVM_REG_LOONGARCH_CSR		(KVM_REG_LOONGARCH | 0x10000ULL)
+#define KVM_REG_LOONGARCH_KVM		(KVM_REG_LOONGARCH | 0x20000ULL)
+#define KVM_REG_LOONGARCH_FPSIMD	(KVM_REG_LOONGARCH | 0x30000ULL)
+#define KVM_REG_LOONGARCH_CPUCFG	(KVM_REG_LOONGARCH | 0x40000ULL)
+#define KVM_REG_LOONGARCH_MASK		(KVM_REG_LOONGARCH | 0x70000ULL)
+#define KVM_CSR_IDX_MASK		0x7fff
+#define KVM_CPUCFG_IDX_MASK		0x7fff
+
+/*
+ * KVM_REG_LOONGARCH_KVM - KVM specific control registers.
+ */
+
+#define KVM_REG_LOONGARCH_COUNTER	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 1)
+#define KVM_REG_LOONGARCH_VCPU_RESET	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 2)
+
+#define LOONGARCH_REG_SHIFT		3
+#define LOONGARCH_REG_64(TYPE, REG)	(TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
+#define KVM_IOC_CSRID(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
+#define KVM_IOC_CPUCFG(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
+
+struct kvm_debug_exit_arch {
+};
+
+/* for KVM_SET_GUEST_DEBUG */
+struct kvm_guest_debug_arch {
+};
+
+/* definition of registers in kvm_run */
+struct kvm_sync_regs {
+};
+
+/* dummy definition */
+struct kvm_sregs {
+};
+
+struct kvm_iocsr_entry {
+	__u32 addr;
+	__u32 pad;
+	__u64 data;
+};
+
+#define KVM_NR_IRQCHIPS		1
+#define KVM_IRQCHIP_NUM_PINS	64
+#define KVM_MAX_CORES		256
+
+#endif /* __UAPI_ASM_LOONGARCH_KVM_H */
diff --git a/linux-headers/asm-loongarch/mman.h b/linux-headers/asm-loongarch/mman.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/mman.h
@@ -0,0 +1 @@
+#include <asm-generic/mman.h>
diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/unistd.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#define __ARCH_WANT_SYS_CLONE
+#define __ARCH_WANT_SYS_CLONE3
+
+#include <asm-generic/unistd.h>
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
 #define __NR_cachestat (__NR_Linux + 451)
 #define __NR_fchmodat2 (__NR_Linux + 452)
+#define __NR_map_shadow_stack (__NR_Linux + 453)
+#define __NR_futex_wake (__NR_Linux + 454)
+#define __NR_futex_wait (__NR_Linux + 455)
+#define __NR_futex_requeue (__NR_Linux + 456)
 
 #endif /* _ASM_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
 #define __NR_cachestat (__NR_Linux + 451)
 #define __NR_fchmodat2 (__NR_Linux + 452)
+#define __NR_map_shadow_stack (__NR_Linux + 453)
+#define __NR_futex_wake (__NR_Linux + 454)
+#define __NR_futex_wait (__NR_Linux + 455)
+#define __NR_futex_requeue (__NR_Linux + 456)
 
 #endif /* _ASM_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
 #define __NR_cachestat (__NR_Linux + 451)
 #define __NR_fchmodat2 (__NR_Linux + 452)
+#define __NR_map_shadow_stack (__NR_Linux + 453)
+#define __NR_futex_wake (__NR_Linux + 454)
+#define __NR_futex_wait (__NR_Linux + 455)
+#define __NR_futex_requeue (__NR_Linux + 456)
 
 #endif /* _ASM_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_csr {
 	unsigned long sip;
 	unsigned long satp;
 	unsigned long scounteren;
+	unsigned long senvcfg;
 };
 
 /* AIA CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_aia_csr {
 	unsigned long iprio2h;
 };
 
+/* Smstateen CSR for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_smstateen_csr {
+	unsigned long sstateen0;
+};
+
 /* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
 struct kvm_riscv_timer {
 	__u64 frequency;
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_ZICSR,
 	KVM_RISCV_ISA_EXT_ZIFENCEI,
 	KVM_RISCV_ISA_EXT_ZIHPM,
+	KVM_RISCV_ISA_EXT_SMSTATEEN,
+	KVM_RISCV_ISA_EXT_ZICOND,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 	KVM_RISCV_SBI_EXT_PMU,
 	KVM_RISCV_SBI_EXT_EXPERIMENTAL,
 	KVM_RISCV_SBI_EXT_VENDOR,
+	KVM_RISCV_SBI_EXT_DBCN,
 	KVM_RISCV_SBI_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 #define KVM_REG_RISCV_CSR		(0x03 << KVM_REG_RISCV_TYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_GENERAL	(0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_AIA		(0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_CSR_SMSTATEEN	(0x2 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_REG(name)	\
 		(offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
 #define KVM_REG_RISCV_CSR_AIA_REG(name)	\
 	(offsetof(struct kvm_riscv_aia_csr, name) / sizeof(unsigned long))
+#define KVM_REG_RISCV_CSR_SMSTATEEN_REG(name)  \
+	(offsetof(struct kvm_riscv_smstateen_csr, name) / sizeof(unsigned long))
 
 /* Timer registers are mapped as type 4 */
 #define KVM_REG_RISCV_TIMER		(0x04 << KVM_REG_RISCV_TYPE_SHIFT)
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node 450
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_cachestat 451
 #define __NR_fchmodat2 452
 #define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
 #define __NR_cachestat (__X32_SYSCALL_BIT + 451)
 #define __NR_fchmodat2 (__X32_SYSCALL_BIT + 452)
+#define __NR_futex_wake (__X32_SYSCALL_BIT + 454)
+#define __NR_futex_wait (__X32_SYSCALL_BIT + 455)
+#define __NR_futex_requeue (__X32_SYSCALL_BIT + 456)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@ enum {
 	IOMMUFD_CMD_VFIO_IOAS,
 	IOMMUFD_CMD_HWPT_ALLOC,
 	IOMMUFD_CMD_GET_HW_INFO,
+	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
+	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
 };
 #define IOMMU_VFIO_IOAS _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VFIO_IOAS)
 
+/**
+ * enum iommufd_hwpt_alloc_flags - Flags for HWPT allocation
+ * @IOMMU_HWPT_ALLOC_NEST_PARENT: If set, allocate a HWPT that can serve as
+ *                                the parent HWPT in a nesting configuration.
+ * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
+ *                                   enforced on device attachment
+ */
+enum iommufd_hwpt_alloc_flags {
+	IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
+	IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
+};
+
+/**
+ * enum iommu_hwpt_vtd_s1_flags - Intel VT-d stage-1 page table
+ *                                entry attributes
+ * @IOMMU_VTD_S1_SRE: Supervisor request
+ * @IOMMU_VTD_S1_EAFE: Extended access enable
+ * @IOMMU_VTD_S1_WPE: Write protect enable
+ */
+enum iommu_hwpt_vtd_s1_flags {
+	IOMMU_VTD_S1_SRE = 1 << 0,
+	IOMMU_VTD_S1_EAFE = 1 << 1,
+	IOMMU_VTD_S1_WPE = 1 << 2,
+};
+
+/**
+ * struct iommu_hwpt_vtd_s1 - Intel VT-d stage-1 page table
+ *                            info (IOMMU_HWPT_DATA_VTD_S1)
+ * @flags: Combination of enum iommu_hwpt_vtd_s1_flags
+ * @pgtbl_addr: The base address of the stage-1 page table.
+ * @addr_width: The address width of the stage-1 page table
+ * @__reserved: Must be 0
+ */
+struct iommu_hwpt_vtd_s1 {
+	__aligned_u64 flags;
+	__aligned_u64 pgtbl_addr;
+	__u32 addr_width;
+	__u32 __reserved;
+};
+
+/**
+ * enum iommu_hwpt_data_type - IOMMU HWPT Data Type
+ * @IOMMU_HWPT_DATA_NONE: no data
+ * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
+ */
+enum iommu_hwpt_data_type {
+	IOMMU_HWPT_DATA_NONE,
+	IOMMU_HWPT_DATA_VTD_S1,
+};
+
 /**
  * struct iommu_hwpt_alloc - ioctl(IOMMU_HWPT_ALLOC)
  * @size: sizeof(struct iommu_hwpt_alloc)
- * @flags: Must be 0
+ * @flags: Combination of enum iommufd_hwpt_alloc_flags
  * @dev_id: The device to allocate this HWPT for
- * @pt_id: The IOAS to connect this HWPT to
+ * @pt_id: The IOAS or HWPT to connect this HWPT to
  * @out_hwpt_id: The ID of the new HWPT
  * @__reserved: Must be 0
+ * @data_type: One of enum iommu_hwpt_data_type
+ * @data_len: Length of the type specific data
+ * @data_uptr: User pointer to the type specific data
  *
  * Explicitly allocate a hardware page table object. This is the same object
  * type that is returned by iommufd_device_attach() and represents the
  * underlying iommu driver's iommu_domain kernel object.
  *
- * A HWPT will be created with the IOVA mappings from the given IOAS.
+ * A kernel-managed HWPT will be created with the mappings from the given
+ * IOAS via the @pt_id. The @data_type for this allocation must be set to
+ * IOMMU_HWPT_DATA_NONE. The HWPT can be allocated as a parent HWPT for a
+ * nesting configuration by passing IOMMU_HWPT_ALLOC_NEST_PARENT via @flags.
+ *
+ * A user-managed nested HWPT will be created from a given parent HWPT via
+ * @pt_id, in which the parent HWPT must be allocated previously via the
+ * same ioctl from a given IOAS (@pt_id). In this case, the @data_type
+ * must be set to a pre-defined type corresponding to an I/O page table
+ * type supported by the underlying IOMMU hardware.
+ *
+ * If the @data_type is set to IOMMU_HWPT_DATA_NONE, @data_len and
+ * @data_uptr should be zero. Otherwise, both @data_len and @data_uptr
+ * must be given.
  */
 struct iommu_hwpt_alloc {
 	__u32 size;
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_alloc {
 	__u32 pt_id;
 	__u32 out_hwpt_id;
 	__u32 __reserved;
+	__u32 data_type;
+	__u32 data_len;
+	__aligned_u64 data_uptr;
 };
 #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
 
+/**
+ * enum iommu_hw_info_vtd_flags - Flags for VT-d hw_info
+ * @IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17: If set, disallow read-only mappings
+ *                                         on a nested_parent domain.
+ *                                         https://www.intel.com/content/www/us/en/content-details/772415/content-details.html
+ */
+enum iommu_hw_info_vtd_flags {
+	IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 = 1 << 0,
+};
+
 /**
  * struct iommu_hw_info_vtd - Intel VT-d hardware information
  *
- * @flags: Must be 0
+ * @flags: Combination of enum iommu_hw_info_vtd_flags
  * @__reserved: Must be 0
  *
  * @cap_reg: Value of Intel VT-d capability register defined in VT-d spec
@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
 	IOMMU_HW_INFO_TYPE_INTEL_VTD,
 };
 
+/**
+ * enum iommufd_hw_capabilities
+ * @IOMMU_HW_CAP_DIRTY_TRACKING: IOMMU hardware support for dirty tracking
+ *                               If available, it means the following APIs
+ *                               are supported:
+ *
+ *                                   IOMMU_HWPT_GET_DIRTY_BITMAP
+ *                                   IOMMU_HWPT_SET_DIRTY_TRACKING
+ *
+ */
+enum iommufd_hw_capabilities {
+	IOMMU_HW_CAP_DIRTY_TRACKING = 1 << 0,
+};
+
 /**
  * struct iommu_hw_info - ioctl(IOMMU_GET_HW_INFO)
  * @size: sizeof(struct iommu_hw_info)
@@ -XXX,XX +XXX,XX @@ enum iommu_hw_info_type {
  *             the iommu type specific hardware information data
  * @out_data_type: Output the iommu hardware info type as defined in the enum
  *                 iommu_hw_info_type.
+ * @out_capabilities: Output the generic iommu capability info type as defined
+ *                    in the enum iommu_hw_capabilities.
  * @__reserved: Must be 0
  *
  * Query an iommu type specific hardware information data from an iommu behind
@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info {
 	__aligned_u64 data_uptr;
 	__u32 out_data_type;
 	__u32 __reserved;
+	__aligned_u64 out_capabilities;
 };
 #define IOMMU_GET_HW_INFO _IO(IOMMUFD_TYPE, IOMMUFD_CMD_GET_HW_INFO)
+
+/*
+ * enum iommufd_hwpt_set_dirty_tracking_flags - Flags for steering dirty
+ *                                              tracking
+ * @IOMMU_HWPT_DIRTY_TRACKING_ENABLE: Enable dirty tracking
+ */
+enum iommufd_hwpt_set_dirty_tracking_flags {
+	IOMMU_HWPT_DIRTY_TRACKING_ENABLE = 1,
+};
+
+/**
+ * struct iommu_hwpt_set_dirty_tracking - ioctl(IOMMU_HWPT_SET_DIRTY_TRACKING)
+ * @size: sizeof(struct iommu_hwpt_set_dirty_tracking)
+ * @flags: Combination of enum iommufd_hwpt_set_dirty_tracking_flags
+ * @hwpt_id: HW pagetable ID that represents the IOMMU domain
+ * @__reserved: Must be 0
+ *
+ * Toggle dirty tracking on an HW pagetable.
+ */
+struct iommu_hwpt_set_dirty_tracking {
+	__u32 size;
+	__u32 flags;
+	__u32 hwpt_id;
+	__u32 __reserved;
+};
+#define IOMMU_HWPT_SET_DIRTY_TRACKING _IO(IOMMUFD_TYPE, \
+					  IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING)
+
+/**
+ * enum iommufd_hwpt_get_dirty_bitmap_flags - Flags for getting dirty bits
+ * @IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR: Just read the PTEs without clearing
+ *                                        any dirty bits metadata. This flag
+ *                                        can be passed in the expectation
+ *                                        where the next operation is an unmap
+ *                                        of the same IOVA range.
+ *
+ */
+enum iommufd_hwpt_get_dirty_bitmap_flags {
+	IOMMU_HWPT_GET_DIRTY_BITMAP_NO_CLEAR = 1,
+};
+
+/**
+ * struct iommu_hwpt_get_dirty_bitmap - ioctl(IOMMU_HWPT_GET_DIRTY_BITMAP)
+ * @size: sizeof(struct iommu_hwpt_get_dirty_bitmap)
+ * @hwpt_id: HW pagetable ID that represents the IOMMU domain
+ * @flags: Combination of enum iommufd_hwpt_get_dirty_bitmap_flags
+ * @__reserved: Must be 0
+ * @iova: base IOVA of the bitmap first bit
+ * @length: IOVA range size
+ * @page_size: page size granularity of each bit in the bitmap
+ * @data: bitmap where to set the dirty bits. The bitmap bits each
+ *        represent a page_size which you deviate from an arbitrary iova.
+ *
+ * Checking a given IOVA is dirty:
+ *
+ *  data[(iova / page_size) / 64] & (1ULL << ((iova / page_size) % 64))
+ *
+ * Walk the IOMMU pagetables for a given IOVA range to return a bitmap
+ * with the dirty IOVAs. In doing so it will also by default clear any
+ * dirty bit metadata set in the IOPTE.
+ */
+struct iommu_hwpt_get_dirty_bitmap {
+	__u32 size;
+	__u32 hwpt_id;
+	__u32 flags;
+	__u32 __reserved;
+	__aligned_u64 iova;
+	__aligned_u64 length;
+	__aligned_u64 page_size;
+	__aligned_u64 data;
+};
+#define IOMMU_HWPT_GET_DIRTY_BITMAP _IO(IOMMUFD_TYPE, \
+					IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP)
+
 #endif
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
 #define KVM_EXIT_RISCV_SBI        35
 #define KVM_EXIT_RISCV_CSR        36
 #define KVM_EXIT_NOTIFY           37
+#define KVM_EXIT_LOONGARCH_IOCSR  38
 
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
@@ -XXX,XX +XXX,XX @@ struct kvm_run {
 			__u32 len;
 			__u8  is_write;
 		} mmio;
+		/* KVM_EXIT_LOONGARCH_IOCSR */
+		struct {
+			__u64 phys_addr;
+			__u8  data[8];
+			__u32 len;
+			__u8  is_write;
+		} iocsr_io;
 		/* KVM_EXIT_HYPERCALL */
 		struct {
 			__u64 nr;
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_COUNTER_OFFSET 227
 #define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
 #define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
+#define KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES 230
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
 #define KVM_REG_ARM64		0x6000000000000000ULL
 #define KVM_REG_MIPS		0x7000000000000000ULL
 #define KVM_REG_RISCV		0x8000000000000000ULL
+#define KVM_REG_LOONGARCH	0x9000000000000000ULL
 
 #define KVM_REG_SIZE_SHIFT	52
 #define KVM_REG_SIZE_MASK	0x00f0000000000000ULL
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
 #define KVM_ARM_MTE_COPY_TAGS	  _IOR(KVMIO,  0xb4, struct kvm_arm_copy_mte_tags)
 /* Available with KVM_CAP_COUNTER_OFFSET */
 #define KVM_ARM_SET_COUNTER_OFFSET _IOW(KVMIO,  0xb5, struct kvm_arm_counter_offset)
+#define KVM_ARM_GET_REG_WRITABLE_MASKS _IOR(KVMIO,  0xb6, struct reg_mask_range)
 
 /* ioctl for vm fd */
 #define KVM_CREATE_DEVICE	  _IOWR(KVMIO,  0xe0, struct kvm_create_device)
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 	SEV_RET_INVALID_PARAM,
 	SEV_RET_RESOURCE_LIMIT,
 	SEV_RET_SECURE_DATA_INVALID,
+	SEV_RET_INVALID_KEY = 0x27,
 	SEV_RET_MAX,
 } sev_ret_code;
 
diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/stddef.h
+++ b/linux-headers/linux/stddef.h
@@ -XXX,XX +XXX,XX @@
 	union { \
 		struct { MEMBERS } ATTRS; \
 		struct TAG { MEMBERS } ATTRS NAME; \
-	}
+	} ATTRS
 
+#ifdef __cplusplus
+/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */
+#define __DECLARE_FLEX_ARRAY(T, member)	\
+	T member[0]
+#else
 /**
  * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
  *
@@ -XXX,XX +XXX,XX @@
 #ifndef __counted_by
 #define __counted_by(m)
 #endif
+
+#endif /* _LINUX_STDDEF_H */
diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/userfaultfd.h
+++ b/linux-headers/linux/userfaultfd.h
@@ -XXX,XX +XXX,XX @@
 			   UFFD_FEATURE_EXACT_ADDRESS |		\
 			   UFFD_FEATURE_WP_HUGETLBFS_SHMEM |	\
 			   UFFD_FEATURE_WP_UNPOPULATED |	\
-			   UFFD_FEATURE_POISON)
+			   UFFD_FEATURE_POISON |		\
+			   UFFD_FEATURE_WP_ASYNC)
 #define UFFD_API_IOCTLS				\
 	((__u64)1 << _UFFDIO_REGISTER |		\
 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
 	 * (i.e. empty ptes).  This will be the default behavior for shmem
 	 * & hugetlbfs, so this flag only affects anonymous memory behavior
 	 * when userfault write-protection mode is registered.
+	 *
+	 * UFFD_FEATURE_WP_ASYNC indicates that userfaultfd write-protection
+	 * asynchronous mode is supported in which the write fault is
+	 * automatically resolved and write-protection is un-set.
+	 * It implies UFFD_FEATURE_WP_UNPOPULATED.
 	 */
 #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
 #define UFFD_FEATURE_EVENT_FORK			(1<<1)
@@ -XXX,XX +XXX,XX @@ struct uffdio_api {
 #define UFFD_FEATURE_WP_HUGETLBFS_SHMEM		(1<<12)
 #define UFFD_FEATURE_WP_UNPOPULATED		(1<<13)
 #define UFFD_FEATURE_POISON			(1<<14)
+#define UFFD_FEATURE_WP_ASYNC			(1<<15)
 	__u64 features;
 
 	__u64 ioctls;
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
 #define VFIO_REGION_INFO_FLAG_CAPS	(1 << 3) /* Info supports caps */
 	__u32	index;		/* Region index */
 	__u32	cap_offset;	/* Offset within info struct of first cap */
-	__u64	size;		/* Region size (bytes) */
-	__u64	offset;		/* Region offset from start of device fd */
+	__aligned_u64	size;	/* Region size (bytes) */
+	__aligned_u64	offset;	/* Region offset from start of device fd */
 };
 #define VFIO_DEVICE_GET_REGION_INFO	_IO(VFIO_TYPE, VFIO_BASE + 8)
 
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info {
 #define VFIO_REGION_INFO_CAP_SPARSE_MMAP	1
 
 struct vfio_region_sparse_mmap_area {
-	__u64	offset;	/* Offset of mmap'able area within region */
-	__u64	size;	/* Size of mmap'able area */
+	__aligned_u64	offset;	/* Offset of mmap'able area within region */
+	__aligned_u64	size;	/* Size of mmap'able area */
 };
 
 struct vfio_region_info_cap_sparse_mmap {
@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
 					     VFIO_DEVICE_STATE_V1_RESUMING)
 
 	__u32 reserved;
-	__u64 pending_bytes;
-	__u64 data_offset;
-	__u64 data_size;
+	__aligned_u64 pending_bytes;
+	__aligned_u64 data_offset;
+	__aligned_u64 data_size;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ struct vfio_device_migration_info {
 
 struct vfio_region_info_cap_nvlink2_ssatgt {
 	struct vfio_info_cap_header header;
-	__u64 tgt;
+	__aligned_u64 tgt;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
 	__u32 drm_plane_type;	/* type of plane: DRM_PLANE_TYPE_* */
 	/* out */
 	__u32 drm_format;	/* drm format of plane */
-	__u64 drm_format_mod;   /* tiled mode */
+	__aligned_u64 drm_format_mod;   /* tiled mode */
 	__u32 width;	/* width of plane */
 	__u32 height;	/* height of plane */
 	__u32 stride;	/* stride of plane */
@@ -XXX,XX +XXX,XX @@ struct vfio_device_gfx_plane_info {
 		__u32 region_index;	/* region index */
 		__u32 dmabuf_id;	/* dma-buf id */
 	};
+	__u32 reserved;
 };
 
 #define VFIO_DEVICE_QUERY_GFX_PLANE _IO(VFIO_TYPE, VFIO_BASE + 14)
@@ -XXX,XX +XXX,XX @@ struct vfio_device_ioeventfd {
 #define VFIO_DEVICE_IOEVENTFD_32	(1 << 2) /* 4-byte write */
 #define VFIO_DEVICE_IOEVENTFD_64	(1 << 3) /* 8-byte write */
 #define VFIO_DEVICE_IOEVENTFD_SIZE_MASK	(0xf)
-	__u64	offset;			/* device fd offset of write */
-	__u64	data;			/* data to be written */
+	__aligned_u64	offset;		/* device fd offset of write */
+	__aligned_u64	data;		/* data to be written */
 	__s32	fd;			/* -1 for de-assignment */
+	__u32	reserved;
 };
 
 #define VFIO_DEVICE_IOEVENTFD		_IO(VFIO_TYPE, VFIO_BASE + 16)
@@ -XXX,XX +XXX,XX @@ struct vfio_device_feature_mig_data_size {
 
 #define VFIO_DEVICE_FEATURE_MIG_DATA_SIZE 9
 
+/**
+ * Upon VFIO_DEVICE_FEATURE_SET, set or clear the BUS mastering for the device
+ * based on the operation specified in op flag.
+ *
+ * The functionality is incorporated for devices that needs bus master control,
+ * but the in-band device interface lacks the support. Consequently, it is not
+ * applicable to PCI devices, as bus master control for PCI devices is managed
+ * in-band through the configuration space. At present, this feature is supported
+ * only for CDX devices.
+ * When the device's BUS MASTER setting is configured as CLEAR, it will result in
+ * blocking all incoming DMA requests from the device. On the other hand, configuring
+ * the device's BUS MASTER setting as SET (enable) will grant the device the
+ * capability to perform DMA to the host memory.
+ */
+struct vfio_device_feature_bus_master {
+	__u32 op;
+#define		VFIO_DEVICE_FEATURE_CLEAR_MASTER	0	/* Clear Bus Master */
+#define		VFIO_DEVICE_FEATURE_SET_MASTER		1	/* Set Bus Master */
+};
+#define VFIO_DEVICE_FEATURE_BUS_MASTER 10
+
 /* -------- API for Type1 VFIO IOMMU -------- */
 
 /**
@@ -XXX,XX +XXX,XX @@ struct vfio_iommu_type1_info {
 	__u32	flags;
 #define VFIO_IOMMU_INFO_PGSIZES (1 << 0)	/* supported page sizes info */
 #define VFIO_IOMMU_INFO_CAPS	(1 << 1)	/* Info supports caps */
-	__u64	iova_pgsizes;	/* Bitmap of supported page sizes */
+	__aligned_u64	iova_pgsizes;		/* Bitmap of supported page sizes */
 	__u32   cap_offset;	/* Offset within info struct of first cap */
 	__u32   pad;
 };
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vhost.h
+++ b/linux-headers/linux/vhost.h
@@ -XXX,XX +XXX,XX @@
  */
 #define VHOST_VDPA_RESUME		_IO(VHOST_VIRTIO, 0x7E)
 
+/* Get the group for the descriptor table including driver & device areas
+ * of a virtqueue: read index, write group in num.
+ * The virtqueue index is stored in the index field of vhost_vring_state.
+ * The group ID of the descriptor table for this specific virtqueue
+ * is returned via num field of vhost_vring_state.
+ */
+#define VHOST_VDPA_GET_VRING_DESC_GROUP	_IOWR(VHOST_VIRTIO, 0x7F,	\
+					      struct vhost_vring_state)
 #endif
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM vector support for RISC-V requires the linux-header ptrace.h.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-headers/asm-riscv/ptrace.h | 132 +++++++++++++++++++++++++++++++
 scripts/update-linux-headers.sh  |   3 +
 2 files changed, 135 insertions(+)
 create mode 100644 linux-headers/asm-riscv/ptrace.h

diff --git a/linux-headers/asm-riscv/ptrace.h b/linux-headers/asm-riscv/ptrace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-riscv/ptrace.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2012 Regents of the University of California
+ */
+
+#ifndef _ASM_RISCV_PTRACE_H
+#define _ASM_RISCV_PTRACE_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/types.h>
+
+#define PTRACE_GETFDPIC		33
+
+#define PTRACE_GETFDPIC_EXEC	0
+#define PTRACE_GETFDPIC_INTERP	1
+
+/*
+ * User-mode register state for core dumps, ptrace, sigcontext
+ *
+ * This decouples struct pt_regs from the userspace ABI.
+ * struct user_regs_struct must form a prefix of struct pt_regs.
+ */
+struct user_regs_struct {
+	unsigned long pc;
+	unsigned long ra;
+	unsigned long sp;
+	unsigned long gp;
+	unsigned long tp;
+	unsigned long t0;
+	unsigned long t1;
+	unsigned long t2;
+	unsigned long s0;
+	unsigned long s1;
+	unsigned long a0;
+	unsigned long a1;
+	unsigned long a2;
+	unsigned long a3;
+	unsigned long a4;
+	unsigned long a5;
+	unsigned long a6;
+	unsigned long a7;
+	unsigned long s2;
+	unsigned long s3;
+	unsigned long s4;
+	unsigned long s5;
+	unsigned long s6;
+	unsigned long s7;
+	unsigned long s8;
+	unsigned long s9;
+	unsigned long s10;
+	unsigned long s11;
+	unsigned long t3;
+	unsigned long t4;
+	unsigned long t5;
+	unsigned long t6;
+};
+
+struct __riscv_f_ext_state {
+	__u32 f[32];
+	__u32 fcsr;
+};
+
+struct __riscv_d_ext_state {
+	__u64 f[32];
+	__u32 fcsr;
+};
+
+struct __riscv_q_ext_state {
+	__u64 f[64] __attribute__((aligned(16)));
+	__u32 fcsr;
+	/*
+	 * Reserved for expansion of sigcontext structure.  Currently zeroed
+	 * upon signal, and must be zero upon sigreturn.
+	 */
+	__u32 reserved[3];
+};
+
+struct __riscv_ctx_hdr {
+	__u32 magic;
+	__u32 size;
+};
+
+struct __riscv_extra_ext_header {
+	__u32 __padding[129] __attribute__((aligned(16)));
+	/*
+	 * Reserved for expansion of sigcontext structure.  Currently zeroed
+	 * upon signal, and must be zero upon sigreturn.
+	 */
+	__u32 reserved;
+	struct __riscv_ctx_hdr hdr;
+};
+
+union __riscv_fp_state {
+	struct __riscv_f_ext_state f;
+	struct __riscv_d_ext_state d;
+	struct __riscv_q_ext_state q;
+};
+
+struct __riscv_v_ext_state {
+	unsigned long vstart;
+	unsigned long vl;
+	unsigned long vtype;
+	unsigned long vcsr;
+	unsigned long vlenb;
+	void *datap;
+	/*
+	 * In signal handler, datap will be set a correct user stack offset
+	 * and vector registers will be copied to the address of datap
+	 * pointer.
+	 */
+};
+
+struct __riscv_v_regset_state {
+	unsigned long vstart;
+	unsigned long vl;
+	unsigned long vtype;
+	unsigned long vcsr;
+	unsigned long vlenb;
+	char vreg[];
+};
+
+/*
+ * According to spec: The number of bits in a single vector register,
+ * VLEN >= ELEN, which must be a power of 2, and must be no greater than
+ * 2^16 = 65536bits = 8192bytes
+ */
+#define RISCV_MAX_VLENB (8192)
+
+#endif /* __ASSEMBLY__ */
+
+#endif /* _ASM_RISCV_PTRACE_H */
diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -XXX,XX +XXX,XX @@ for arch in $ARCHLIST; do
         cp_portable "$tmpdir/bootparam.h" \
                     "$output/include/standard-headers/asm-$arch"
     fi
+    if [ $arch = riscv ]; then
+        cp "$tmpdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
+    fi
 done
 
 rm -rf "$output/linux-headers/linux"
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Linux RISC-V vector documentation (Document/arch/riscv/vector.rst)
mandates a prctl() in order to allow an userspace thread to use the
Vector extension from the host.

This is something to be done in realize() time, after init(), when we
already decided whether we're using RVV or not. We don't have a
realize() callback for KVM yet, so add kvm_cpu_realize() and enable RVV
for the thread via PR_RISCV_V_SET_CONTROL.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include <sys/ioctl.h>
+#include <sys/prctl.h>
 
 #include <linux/kvm.h>
 
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+#define PR_RISCV_V_SET_CONTROL            69
+#define PR_RISCV_V_VSTATE_CTRL_ON          2
+
 void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 {
     kvm_set_irq(kvm_state, irq, !!level);
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_instance_init(CPUState *cs)
     }
 }
 
+/*
+ * We'll get here via the following path:
+ *
+ * riscv_cpu_realize()
+ *   -> cpu_exec_realizefn()
+ *      -> kvm_cpu_realize() (via accel_cpu_common_realize())
+ */
+static bool kvm_cpu_realize(CPUState *cs, Error **errp)
+{
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    int ret;
+
+    if (riscv_has_ext(&cpu->env, RVV)) {
+        ret = prctl(PR_RISCV_V_SET_CONTROL, PR_RISCV_V_VSTATE_CTRL_ON);
+        if (ret) {
+            error_setg(errp, "Error in prctl PR_RISCV_V_SET_CONTROL, code: %s",
+                       strerrorname_np(errno));
+            return false;
+        }
+    }
+
+   return true;
+}
+
 static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
     acc->cpu_instance_init = kvm_cpu_instance_init;
+    acc->cpu_target_realize = kvm_cpu_realize;
 }
 
 static const TypeInfo kvm_cpu_accel_type_info = {
-- 
2.43.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add support for RVV and Vector CSR KVM regs vstart, vl and vtype.

Support for vregs[] requires KVM side changes and an extra reg (vlenb)
and will be added later.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231218204321.75757-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 74 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
 
 #define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
 
+#define RISCV_VECTOR_CSR_REG(env, name) \
+    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_VECTOR, \
+                           KVM_REG_RISCV_VECTOR_CSR_REG(name))
+
 #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
     do { \
         int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_misa_ext_cfgs[] = {
     KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
     KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
     KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
+    KVM_MISA_CFG(RVV, KVM_RISCV_ISA_EXT_V),
 };
 
 static void kvm_cpu_get_misa_ext_cfg(Object *obj, Visitor *v,
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
+static int kvm_riscv_get_regs_vector(CPUState *cs)
+{
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    target_ulong reg;
+    int ret = 0;
+
+    if (!riscv_has_ext(env, RVV)) {
+        return 0;
+    }
+
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->vstart = reg;
+
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->vl = reg;
+
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->vtype = reg;
+
+    return 0;
+}
+
+static int kvm_riscv_put_regs_vector(CPUState *cs)
+{
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    target_ulong reg;
+    int ret = 0;
+
+    if (!riscv_has_ext(env, RVV)) {
+        return 0;
+    }
+
+    reg = env->vstart;
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg = env->vl;
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg = env->vtype;
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
+
+    return ret;
+}
+
 typedef struct KVMScratchCPU {
     int kvmfd;
     int vmfd;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         return ret;
     }
 
+    ret = kvm_riscv_get_regs_vector(cs);
+    if (ret) {
+        return ret;
+    }
+
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
+    ret = kvm_riscv_put_regs_vector(cs);
+    if (ret) {
+        return ret;
+    }
+
     if (KVM_PUT_RESET_STATE == level) {
         RISCVCPU *cpu = RISCV_CPU(cs);
         if (cs->cpu_index == 0) {
-- 
2.43.0

From: Bin Meng <bmeng@tinylab.org>

Currently, the documentation outlines the process for building the
S-mode U-Boot image using `make menuconfig` and manual actions within
the menuconfig UI. However, this approach is fragile due to Kconfig
options potentially changing across different releases. For example,
CONFIG_OF_PRIOR_STAGE has been replaced by CONFIG_BOARD since v2022.01
release, and CONFIG_TEXT_BASE has been moved to the 'General setup'
menu from the 'Boot options' menu in v2024.01 release.

This update aims to make the S-mode U-Boot image build instructions
future-proof. It leverages the 'config' script provided in the U-Boot
source tree to edit the .config file, followed by a `make olddefconfig`.

Validated with U-Boot v2024.01 release.

Signed-off-by: Bin Meng <bmeng@tinylab.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240104071523.273702-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/sifive_u.rst | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/sifive_u.rst
+++ b/docs/system/riscv/sifive_u.rst
@@ -XXX,XX +XXX,XX @@ command line options with ``qemu-system-riscv32``.
 Running U-Boot
 --------------
 
-U-Boot mainline v2021.07 release is tested at the time of writing. To build a
+U-Boot mainline v2024.01 release is tested at the time of writing. To build a
 U-Boot mainline bootloader that can be booted by the ``sifive_u`` machine, use
 the sifive_unleashed_defconfig with similar commands as described above for
 Linux:
@@ -XXX,XX +XXX,XX @@ configuration of U-Boot:
 
   $ export CROSS_COMPILE=riscv64-linux-
   $ make sifive_unleashed_defconfig
-  $ make menuconfig
-
-then manually select the following configuration:
-
-  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
-
-and unselect the following configuration:
-
-  * Library routines ---> Allow access to binman information in the device tree
+  $ ./scripts/config --enable OF_BOARD
+  $ ./scripts/config --disable BINMAN_FDT
+  $ ./scripts/config --disable SPL
+  $ make olddefconfig
 
 This changes U-Boot to use the QEMU generated device tree blob, and bypass
 running the U-Boot SPL stage.
@@ -XXX,XX +XXX,XX @@ It's possible to create a 32-bit U-Boot S-mode image as well.
 
   $ export CROSS_COMPILE=riscv64-linux-
   $ make sifive_unleashed_defconfig
-  $ make menuconfig
-
-then manually update the following configuration in U-Boot:
-
-  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
-  * RISC-V architecture ---> Base ISA ---> RV32I
-  * Boot options ---> Boot images ---> Text Base ---> 0x80400000
-
-and unselect the following configuration:
-
-  * Library routines ---> Allow access to binman information in the device tree
+  $ ./scripts/config --disable ARCH_RV64I
+  $ ./scripts/config --enable ARCH_RV32I
+  $ ./scripts/config --set-val TEXT_BASE 0x80400000
+  $ ./scripts/config --enable OF_BOARD
+  $ ./scripts/config --disable BINMAN_FDT
+  $ ./scripts/config --disable SPL
+  $ make olddefconfig
 
 Use the same command line options to boot the 32-bit U-Boot S-mode image:
 
-- 
2.43.0

From: Bin Meng <bmeng@tinylab.org>

Upgrade OpenSBI from v1.3.1 to v1.4 and the pre-built bios images.

The v1.4 release includes the following commits:

1a398d9 lib: sbi: Add Zicntr as a HART ISA extension
669089c lib: sbi: Add Zihpm as a HART ISA extension
72b9c8f lib: sbi: Alphabetically sort HART ISA extensions
5359fc6 lib: sbi: Rename hart_pmu_get_allowed_bits() function
976895c lib: sbi: Fix Priv spec version for [m|s]counteren and mcountinhibit CSRs
6053917 lib: sbi: Fix how print gets flags
35ef182 lib: sbi: print not fill '0' when left-aligned
40dac06 lib: sbi: Add '+' flags for print
458fa74 lib: sbi: Add ' ' '\'' flags for print
05cbb6e lib: sbi: implifying the parameters of printi
fe08281 lib: sbi: print add 'o' type
c6ee5ae lib: sbi: Fix printi
3b6fcdd lib: sbi: Simplify prints
cc89fa7 lib: sbi: Fix printc
ff43168 lib: sbi: Fix timing of clearing tbuf
a73982d lib: sbi: Fix missing '\0' when buffer szie equal 1
ea6533a lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
c3b98c6 include: sbi: Add macro definitions for mseccfg CSR
1c099c4 lib: sbi: Add functions to manipulate PMP entries
6c202c5 include: sbi: Add Smepmp specific access flags for PMP entries
cbcfc7b lib: sbi: Add smepmp in hart extensions
d72f5f1 lib: utils: Add detection of Smepmp from ISA string in FDT
4a42a23 lib: sbi: Grant SU R/W/X permissions to whole memory
f3fdd04 lib: sbi: Change the order of PMP initialization
5dd8db5 lib: sbi: Add support for Smepmp
6e44ef6 lib: sbi: Add functions to map/unmap shared memory
0ad8660 lib: sbi: Map/Unmap debug console shared memory buffers
057eb10 lib: utils/gpio: Fix RV32 compile error for designware GPIO driver
0e2111e libfdt: fix SPDX license identifiers
e05a9cf lib: sbi: Update system suspend to spec
5e20d25 include: sbi: fix CSR define of mseccfg
44c5151 include: sbi_utils: Remove driver pointer from struct i2c_adapter
14a35b0 lib: utils/regmap: Add generic regmap access library
8e97275 lib: utils/regmap: Add simple FDT based regmap framework
f21d8f7 lib: utils/regmap: Add simple FDT based syscon regmap driver
4a344a9 lib: utils/reset: Add syscon based reboot and poweroff
c2e6027 lib: utils/reset: Remove SiFive Test reset driver
f536e0b gitignore: allow gitignore to ignore most dot file
c744ed7 lib: sbi_pmu: Enable noncontigous hpm event and counters
6259b2e lib: utils/fdt: Fix fdt_parse_isa_extensions() implementation
f46a564 lib: sbi: Fix typo for finding fixed event counter
94197a8 fw_base.S: Fix assembler error with clang 16+
c104c60 lib: sbi: Add support for smcntrpmf
7aabeee Makefile: Fix grep warning
e7e73aa platform: generic: allwinner: correct mhpmevent count
ee1f83c lib: sbi_pmu: remove mhpm_count field in hart feature
a9cffd6 firmware: payload: test: Change to SBI v2.0 DBCN ecalls
b20bd47 lib: sbi: improve the definition of SBI_IPI_EVENT_MAX
664692f lib: sbi_pmu: ensure update hpm counter before starting counting
c9a296d platform: generic: allwinner: fix OF process for T-HEAD c9xx pmu
901d3d7 lib: sbi_pmu: keep overflow interrupt of stopped hpm counter disabled
cacfba3 platform: Allow platforms to specify the size of tlb fifo
5bd9694 lib: sbi: alloc tlb fifo by sbi_malloc
130e65d lib: sbi: Implement SET_FS_DIRTY() to make sure the mstatus FS dirty is set
d1e4dff lib: sbi: Introduce HART index in sbi_scratch
e6125c3 lib: sbi: Remove sbi_platform_hart_index/invalid() functions
296e70d lib: sbi: Extend sbi_hartmask to support both hartid and hartindex
e632cd7 lib: sbi: Use sbi_scratch_last_hartindex() in remote TLB managment
78c667b lib: sbi: Prefer hartindex over hartid in IPI framework
22d6ff8 lib: sbi: Remove sbi_scratch_last_hartid() macro
112daa2 lib: sbi: Maximize the use of HART index in sbi_domain
9560fb3 include: sbi: Remove sbi_hartmask_for_each_hart() macro
b8fb96e include: sbi_domain: Fix permission test macros
bff27c1 lib: sbi: Factor-out Smepmp configuration as separate function
5240d31 lib: sbi: Don't clear mseccfg.MML bit in sbi_hart_smepmp_configure()
2b51a9d lib: sbi: Fix pmp_flags for Smepmp read-only shared region
73aea28 lib: sbi: Populate M-only Smepmp entries before setting mseccfg.MML
e8bc162 lib: utils/serial: Add shared regions for serial drivers
b7e9d34 lib: utils/regmap: Mark syscon region as shared read-write
3669153 platform: generic: thead: fix stale TLB entries for th1520/sg2042
de525ac firmware: Remove ALIGN in .rela.dyn in linker script
2a6d725 firmware: Remove handling of R_RISCV_{32,64}
6ed125a Makefile: Add --exclude-libs ALL to avoid .dynsym
e21901d doc: Fix fw_payload.md
a125423 lib: utils/serial: Ensure proper allocation of PMP entries for uart8250
d36709f lib: utils: timer/ipi: Update memregion flags for PLMT and PLICSW
8197c2f lib: sbi: fix sbi_domain_get_assigned_hartmask()
9da30f6 lib: utils/fdt: simplify dt_parse_isa_extensions
942aca2 lib: utils: Simplify SET_ISA_EXT_MAP()
f831b93 lib: sbi_pmu: check for index overflows
d891cae gpio/starfive: redundant readl() call
e8114c6 docs: platform: update platform_requirements.md
3632f2b lib: sbi: Add support for mconfigptr
ec0559e lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP
cbdd869 include: sbi: Change spec version to 2.0
5d0ed1b lib: sbi: simplify sanitize_domain()
c1a6987 platform: generic: thead: move to thead c9xx header to vendor specific postion
8e941e7 platform: generic: thead: separate implement of T-HEAD c9xx pmu
492d9b1 platform: generic: thead: separate implement of T-HEAD c9xx errata
3e21b96 platform: generic: thead: initialize PMU by default in thead generic platform
a140a4e lib: sbi: Correctly limit flushes to a single ASID/VMID
88ae718 platform: generic: thead: improve tlb flush errata
52fd64b platform: Uses hart count as the default size of tlb info
07f2ccd lib: utils/serial: Optimize semihosting_putc implementation
fccdf41 firmware: fw_base.S: Fix boot hart status synchronization
d1e0f7f utils/reset: Remove fdt_reset_thead
896d2c9 lib: utils/timer: Allow ACLINT MTIMER driver to setup quirks
accafb1 lib: utils/timer: mtimer: add separate T-Head C9xx CLINT mtimer compatible
98bc25f lib: utils/ipi: mswi: add separate T-Head C9xx CLINT mswi compatible
5b2f55d lib: sbi: separate the swap operation of domain region
3b03cdd lib: sbi: Add regions merging when sanitizing domain region
2bfdb9e platform: generic: Add Sophgo sg2042 platform support
280f7ae include: sbi: macros for mseccfg.sseed and .useed
efcac33 lib: sbi: Add Zkr in hart extensions
6e5b0cf lib: sbi: enable seed access in S-mode
6602e11 lib: sbi: change sbi_hart_features.extensions as an array
3aaed4f lib: sbi: Make console_puts/console_putc interchangeable
dc0bb19 lib: utils/serial: remove semihosting_putc
16bb930 lib: sbi: Fix PMP granularity handling in sbi_hart_map_saddr()
574b9c8 lib: sbi_pmu: avoid buffer overflow
791704c lib: utils/irqchip: Avoid redundant writes to APLIC CLRIE register
f520256 lib: sbi: Allow relaxed MMIO writes in device ipi_send() callback
b70d628 lib: sbi: Allow relaxed MMIO writes in device ipi_clear() callback
bd74931 lib: ipi: Adjust Andes PLICSW to single-bit-per-hart scheme
291403f sbi: sbi_pmu: Improve sbi_pmu_init() error handling
090fa99 lib: sbi: Add XAndesPMU in hart extensions
a48f2cf sbi: sbi_pmu: Add hw_counter_filter_mode() to pmu device
51ec60c platform: include: andes45: Add PMU related CSR defines
effd89a platform: generic: Introduce pmu_init() platform override
1b9e743 platform: andes: Add Andes custom PMU support
2e50c24 platform: andes: Enable Andes PMU for AE350
535c661 platform: rzfive: Enable Andes PMU for RZ/Five
0b3262e lib: utils: fdt_fixup: Allow preserving PMU properties
009ae4e platform: andes: Factor out is_andes() helper
0308f93 lib: utils: fdt_pmu: Make the fdt_pmu_evt_select table global variable
e19d419 lib: utils: fdt_pmu: Do not iterate over the fdt_pmu_evt_select table
d162009 docs: pmu: Add Andes PMU node example
6b9a849 lib: sbi: Remove xchg/cmpxchg implemented via lr/sc
11bf49b lib: sbi: Fix __atomic_op_bit_ord and comments
8839869 lib: sbi: Replace __atomic_op_bit_ord with __atomic intrinsics
07419ec lib: sbi: Prevent redundant sbi_ipi_process
93da66b lib: sbi_hart: Store PMP granularity as log base 2
ee72517 lib: sbi_pmu: Add PMU snapshot definitions
11a0ba5 lib: sbi_pmu: Fix the counter info function
0696810 firmware: fix section types
a25fc74 lib: sbi_hsm: Put the resume_pending hart in the interruptible hart mask
87aa306 platform: recalculate heap size to support new tlb entry number
a2e254e lib: sbi: skip wait_for_coldboot when coolboot done
6112d58 lib: utils/fdt: Allow to use reg-names when parsing ACLINT
35cba92 lib: sbi_tlb: Check tlb_range_flush_limit only once per request
a894187 lib: sbi_ipi: Do not ignore errors from sbi_ipi_send()
446fa65 lib: sbi_ipi: Process self-IPIs in sbi_ipi_send()
2707250 lib: sbi_ipi: Drop unnecessary ipi_process check
925ce14 lib: sbi: Simplify the initialization of root_hmask in sbi_domain_init
2c8be56 lib: sbi: Improve the code of privilege mode and extensions detection
056fe6f lib: sbi: Refactor the code for enable extensions in menvfg CSR
776770d lib: sbi: Using one array to define the name of extensions
3daac8f lib: sbi: Detect extensions from the ISA string in DT
416ceb3 lib: sbi_tlb: Reduce size of struct sbi_tlb_info
80169b2 platform: generic: Fine tune fw_platform_calculate_heap_size()
cdebae2 lib: utils/irqchip: Add shared MMIO region for PLIC in root domain
3284bea lib: sbi: Allow ecall handlers to directly update register state
5a57e8c lib: sbi: Remove the SBI_ETRAP error code
2b80b92 lib: sbi: Do not enter OpenSBI with mseccfg.MML == 1
63e09ad lib: sbi: Fix shift bug in sbi_system_reset
ba29293 lib: utils/timer: mtimer: only use regname for aclint
bbd065d lib: sbi: Detect Zicntr extension only based on traps
a2b255b include: Bump-up version to 1.4

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20240102151153.133896-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 135376 -> 267416 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 138368 -> 270808 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index XXXXXXX..XXXXXXX 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 057eb10b6d523540012e6947d5c9f63e95244e94
+Subproject commit a2b255b88918715173942f2c5e1f97ac9e90c877
-- 
2.43.0

From: Ivan Klokov <ivan.klokov@syntacore.com>

This patch changes behavior on writing RW=01 to pmpcfg with MML=0.
RWX filed is form of collective WARL with the combination of
pmpcfg.RW=01 remains reserved for future standard use.

According to definition of WARL writing the CSR has no other side
effect. But current implementation change architectural state and
change system behavior. After writing we will get unreadable-unwriteble
region regardless on the previous state.

On the other side WARL said that we should read legal value and nothing
says about what we should write. Current behavior change system state
regardless of whether we read this register or not.

Fixes: ac66f2f0 ("target/riscv: pmp: Ignore writes when RW=01")

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20231220153205.11072-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
             /* If !mseccfg.MML then ignore writes with encoding RW=01 */
             if ((val & PMP_WRITE) && !(val & PMP_READ) &&
                 !MSECCFG_MML_ISSET(env)) {
-                val &= ~(PMP_WRITE | PMP_READ);
+                return false;
             }
             env->pmp_state.pmp[pmp_index].cfg_reg = val;
             pmp_update_rule_addr(env, pmp_index);
-- 
2.43.0

From: Alistair Francis <alistair23@gmail.com>

The CSRs will always be between either CSR_MHPMCOUNTER3 and
CSR_MHPMCOUNTER31 or CSR_MHPMCOUNTER3H and CSR_MHPMCOUNTER31H.

So although ctr_index can't be negative, Coverity doesn't know this and
it isn't obvious to human readers either. Let's add an assert to ensure
that Coverity knows the values will be within range.

To simplify the code let's also change the RV32 adjustment.

Fixes: Coverity CID 1523910
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240108001328.280222-2-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr(CPURISCVState *env, int csrno)
 
     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
         /* Offset for RV32 mhpmcounternh counters */
-        base_csrno += 0x80;
+        csrno -= 0x80;
     }
+
+    g_assert(csrno >= CSR_MHPMCOUNTER3 && csrno <= CSR_MHPMCOUNTER31);
+
     ctr_index = csrno - base_csrno;
     if ((BIT(ctr_index) & pmu_avail_ctrs >> 3) == 0) {
         /* The PMU is not enabled or counter is out of range */
-- 
2.43.0

From: Alistair Francis <alistair23@gmail.com>

We have been incorrectly adjusting both the interrupt and exception
cause when using the hypervisor extension and trapping to VS-mode. This
patch changes the conditional to ensure we only adjust the cause for
interrupts and not exceptions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1708
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240108001328.280222-3-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                  * See if we need to adjust cause. Yes if its VS mode interrupt
                  * no if hypervisor has delegated one of hs mode's interrupt
                  */
-                if (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
-                    cause == IRQ_VS_EXT) {
+                if (async && (cause == IRQ_VS_TIMER || cause == IRQ_VS_SOFT ||
+                              cause == IRQ_VS_EXT)) {
                     cause = cause - 1;
                 }
                 write_gva = false;
-- 
2.43.0

From: Alistair Francis <alistair23@gmail.com>

Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor is
enabled. We currently only set them on accesses to mideleg, but they
aren't correctly set on reset. Let's ensure they are always the correct
value.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1617
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240108001328.280222-4-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     /* mmte is supposed to have pm.current hardwired to 1 */
     env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
 
+    /*
+     * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
+     * extension is enabled.
+     */
+    if (riscv_has_ext(env, RVH)) {
+        env->mideleg |= HS_MODE_INTERRUPTS;
+    }
+
     /*
      * Clear mseccfg and unlock all the PMP entries upon reset.
      * This is allowed as per the priv and smepmp specifications
-- 
2.43.0

The following changes since commit 8032c78e556cd0baec111740a6c636863f9bd7c8:

Merge tag 'firmware-20241216-pull-request' of https://gitlab.com/kraxel/qemu into staging (2024-12-16 14:20:33 -0500)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20241219-1

for you to fetch changes up to 5632d271be16b5e769342d54198c4359658abcb7:

target/riscv: add support for RV64 Xiangshan Nanhu CPU (2024-12-18 11:07:59 +1000)

----------------------------------------------------------------
RISC-V PR for 10.0

* Correct the validness check of iova
* Fix APLIC in_clrip and clripnum write emulation
* Support riscv-iommu-sys device
* Add Tenstorrent Ascalon CPU
* Add AIA userspace irqchip_split support
* Add Microblaze V generic board
* Upgrade ACPI SPCR table to support SPCR table revision 4 format
* Remove tswap64() calls from HTIF
* Support 64-bit address of initrd
* Introduce svukte ISA extension
* Support ssstateen extension
* Support for RV64 Xiangshan Nanhu CPU

----------------------------------------------------------------
Anton Blanchard (1):
      target/riscv: Add Tenstorrent Ascalon CPU

Daniel Henrique Barboza (15):
      hw/riscv/riscv-iommu.c: add riscv_iommu_instance_init()
      hw/riscv/riscv-iommu: parametrize CAP.IGS
      hw/riscv/virt.c, riscv-iommu-sys.c: add MSIx support
      hw/riscv/riscv-iommu: implement reset protocol
      docs/specs: add riscv-iommu-sys information
      hw/intc/riscv_aplic: rename is_kvm_aia()
      hw/riscv/virt.c: reduce virt_use_kvm_aia() usage
      hw/riscv/virt.c: rename helper to virt_use_kvm_aia_aplic_imsic()
      target/riscv/kvm: consider irqchip_split() in aia_create()
      hw/riscv/virt.c, riscv_aplic.c: add 'emulated_aplic' helpers
      hw/intc/riscv_aplic: add kvm_msicfgaddr for split mode aplic-imsic
      target/riscv/kvm: remove irqchip_split() restriction
      docs: update riscv/virt.rst with kernel-irqchip=split support
      target/riscv/tcg: hide warn for named feats when disabling via priv_ver
      target/riscv: add ssstateen

Fea.Wang (6):
      target/riscv: Add svukte extension capability variable
      target/riscv: Support senvcfg[UKTE] bit when svukte extension is enabled
      target/riscv: Support hstatus[HUKTE] bit when svukte extension is enabled
      target/riscv: Check memory access to meet svukte rule
      target/riscv: Expose svukte ISA extension
      target/riscv: Check svukte is not enabled in RV32

Jason Chien (1):
      hw/riscv/riscv-iommu.c: Correct the validness check of iova

Jim Shu (3):
      hw/riscv: Support to load DTB after 3GB memory on 64-bit system.
      hw/riscv: Add a new struct RISCVBootInfo
      hw/riscv: Add the checking if DTB overlaps to kernel or initrd

MollyChen (1):
      target/riscv: add support for RV64 Xiangshan Nanhu CPU

Philippe Mathieu-Daudé (5):
      MAINTAINERS: Cover RISC-V HTIF interface
      hw/char/riscv_htif: Explicit little-endian implementation
      hw/char/riscv_htif: Clarify MemoryRegionOps expect 32-bit accesses
      target/riscv: Include missing headers in 'vector_internals.h'
      target/riscv: Include missing headers in 'internals.h'

Sai Pavan Boddu (1):
      hw/riscv: Add Microblaze V generic board

Sia Jee Heng (3):
      qtest: allow SPCR acpi table changes
      hw/acpi: Upgrade ACPI SPCR table to support SPCR table revision 4 format
      tests/qtest/bios-tables-test: Update virt SPCR golden reference for RISC-V

Sunil V L (1):
      hw/riscv/virt: Add IOMMU as platform device if the option is set

Tomasz Jeznach (1):
      hw/riscv: add riscv-iommu-sys platform device

Yong-Xuan Wang (1):
      hw/intc/riscv_aplic: Fix APLIC in_clrip and clripnum write emulation

From: Jason Chien <jason.chien@sifive.com>

From RISCV IOMMU spec section 2.1.3:
When SXL is 1, the following rules apply:
- If the first-stage is not Bare, then a page fault corresponding to the
original access type occurs if the IOVA has bits beyond bit 31 set to 1.
- If the second-stage is not Bare, then a guest page fault corresponding
to the original access type occurs if the incoming GPA has bits beyond bit
33 set to 1.

From RISCV IOMMU spec section 2.3 step 17:
Use the process specified in Section "Two-Stage Address Translation" of
the RISC-V Privileged specification to determine the GPA accessed by the
transaction.

From RISCV IOMMU spec section 2.3 step 19:
Use the second-stage address translation process specified in Section
"Two-Stage Address Translation" of the RISC-V Privileged specification
to translate the GPA A to determine the SPA accessed by the transaction.

This commit adds the iova check with the following rules:
- For Sv32, Sv32x4, Sv39x4, Sv48x4 and Sv57x4, the iova must be zero
extended.
- For Sv39, Sv48 and Sv57, the iova must be signed extended with most
significant bit.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241114065617.25133-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
 
         /* Address range check before first level lookup */
         if (!sc[pass].step) {
-            const uint64_t va_mask = (1ULL << (va_skip + va_bits)) - 1;
-            if ((addr & va_mask) != addr) {
-                return RISCV_IOMMU_FQ_CAUSE_DMA_DISABLED;
+            const uint64_t va_len = va_skip + va_bits;
+            const uint64_t va_mask = (1ULL << va_len) - 1;
+
+            if (pass == S_STAGE && va_len > 32) {
+                target_ulong mask, masked_msbs;
+
+                mask = (1L << (TARGET_LONG_BITS - (va_len - 1))) - 1;
+                masked_msbs = (addr >> (va_len - 1)) & mask;
+
+                if (masked_msbs != 0 && masked_msbs != mask) {
+                    return (iotlb->perm & IOMMU_WO) ?
+                                RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S :
+                                RISCV_IOMMU_FQ_CAUSE_RD_FAULT_S;
+                }
+            } else {
+                if ((addr & va_mask) != addr) {
+                    return (iotlb->perm & IOMMU_WO) ?
+                                RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS :
+                                RISCV_IOMMU_FQ_CAUSE_RD_FAULT_VS;
+                }
             }
         }
 
-- 
2.47.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In the section "4.7 Precise effects on interrupt-pending bits"
of the RISC-V AIA specification defines that:

"If the source mode is Level1 or Level0 and the interrupt domain
is configured in MSI delivery mode (domaincfg.DM = 1):
The pending bit is cleared whenever the rectified input value is
low, when the interrupt is forwarded by MSI, or by a relevant
write to an in_clrip register or to clripnum."

Update the riscv_aplic_set_pending() to match the spec.

Fixes: bf31cf06eb ("hw/intc/riscv_aplic: Fix setipnum_le write emulation for APLIC MSI-mode")
Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241029085349.30412-1-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
 
     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
         (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
-        if (!aplic->msimode || (aplic->msimode && !pending)) {
+        if (!aplic->msimode) {
             return;
         }
+        if (aplic->msimode && !pending) {
+            goto noskip_write_pending;
+        }
         if ((aplic->state[irq] & APLIC_ISTATE_INPUT) &&
             (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
             return;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
         }
     }
 
+noskip_write_pending:
     riscv_aplic_set_pending_raw(aplic, irq, pending);
 }
 
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Move all the static initializion of the device to an init() function,
leaving only the dynamic initialization to be done during realize.

With this change s->cap is initialized with RISCV_IOMMU_CAP_DBG during
init(), and realize() will increment s->cap with the extra caps.

This will allow callers to add IOMMU capabilities before the
realization.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.c | 71 +++++++++++++++++++++++-------------------
 1 file changed, 39 insertions(+), 32 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps riscv_iommu_trap_ops = {
     }
 };
 
+static void riscv_iommu_instance_init(Object *obj)
+{
+    RISCVIOMMUState *s = RISCV_IOMMU(obj);
+
+    /* Enable translation debug interface */
+    s->cap = RISCV_IOMMU_CAP_DBG;
+
+    /* Report QEMU target physical address space limits */
+    s->cap = set_field(s->cap, RISCV_IOMMU_CAP_PAS,
+                       TARGET_PHYS_ADDR_SPACE_BITS);
+
+    /* TODO: method to report supported PID bits */
+    s->pid_bits = 8; /* restricted to size of MemTxAttrs.pid */
+    s->cap |= RISCV_IOMMU_CAP_PD8;
+
+    /* register storage */
+    s->regs_rw = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
+    s->regs_ro = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
+    s->regs_wc = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
+
+     /* Mark all registers read-only */
+    memset(s->regs_ro, 0xff, RISCV_IOMMU_REG_SIZE);
+
+    /* Device translation context cache */
+    s->ctx_cache = g_hash_table_new_full(riscv_iommu_ctx_hash,
+                                         riscv_iommu_ctx_equal,
+                                         g_free, NULL);
+
+    s->iot_cache = g_hash_table_new_full(riscv_iommu_iot_hash,
+                                         riscv_iommu_iot_equal,
+                                         g_free, NULL);
+
+    s->iommus.le_next = NULL;
+    s->iommus.le_prev = NULL;
+    QLIST_INIT(&s->spaces);
+}
+
 static void riscv_iommu_realize(DeviceState *dev, Error **errp)
 {
     RISCVIOMMUState *s = RISCV_IOMMU(dev);
 
-    s->cap = s->version & RISCV_IOMMU_CAP_VERSION;
+    s->cap |= s->version & RISCV_IOMMU_CAP_VERSION;
     if (s->enable_msi) {
         s->cap |= RISCV_IOMMU_CAP_MSI_FLAT | RISCV_IOMMU_CAP_MSI_MRIF;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
         s->cap |= RISCV_IOMMU_CAP_SV32X4 | RISCV_IOMMU_CAP_SV39X4 |
                   RISCV_IOMMU_CAP_SV48X4 | RISCV_IOMMU_CAP_SV57X4;
     }
-    /* Enable translation debug interface */
-    s->cap |= RISCV_IOMMU_CAP_DBG;
-
-    /* Report QEMU target physical address space limits */
-    s->cap = set_field(s->cap, RISCV_IOMMU_CAP_PAS,
-                       TARGET_PHYS_ADDR_SPACE_BITS);
-
-    /* TODO: method to report supported PID bits */
-    s->pid_bits = 8; /* restricted to size of MemTxAttrs.pid */
-    s->cap |= RISCV_IOMMU_CAP_PD8;
 
     /* Out-of-reset translation mode: OFF (DMA disabled) BARE (passthrough) */
     s->ddtp = set_field(0, RISCV_IOMMU_DDTP_MODE, s->enable_off ?
                         RISCV_IOMMU_DDTP_MODE_OFF : RISCV_IOMMU_DDTP_MODE_BARE);
 
-    /* register storage */
-    s->regs_rw = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
-    s->regs_ro = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
-    s->regs_wc = g_new0(uint8_t, RISCV_IOMMU_REG_SIZE);
-
-     /* Mark all registers read-only */
-    memset(s->regs_ro, 0xff, RISCV_IOMMU_REG_SIZE);
-
     /*
      * Register complete MMIO space, including MSI/PBA registers.
      * Note, PCIDevice implementation will add overlapping MR for MSI/PBA,
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->trap_mr, OBJECT(dev), &riscv_iommu_trap_ops, s,
             "riscv-iommu-trap", ~0ULL);
     address_space_init(&s->trap_as, &s->trap_mr, "riscv-iommu-trap-as");
-
-    /* Device translation context cache */
-    s->ctx_cache = g_hash_table_new_full(riscv_iommu_ctx_hash,
-                                         riscv_iommu_ctx_equal,
-                                         g_free, NULL);
-
-    s->iot_cache = g_hash_table_new_full(riscv_iommu_iot_hash,
-                                         riscv_iommu_iot_equal,
-                                         g_free, NULL);
-
-    s->iommus.le_next = NULL;
-    s->iommus.le_prev = NULL;
-    QLIST_INIT(&s->spaces);
 }
 
 static void riscv_iommu_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_iommu_info = {
     .name = TYPE_RISCV_IOMMU,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(RISCVIOMMUState),
+    .instance_init = riscv_iommu_instance_init,
     .class_init = riscv_iommu_class_init,
 };
 
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Interrupt Generation Support (IGS) is a capability that is tied to the
interrupt deliver mechanism, not with the core IOMMU emulation. We
should allow device implementations to set IGS as they wish.

A new helper is added to make it easier for device impls to set IGS. Use
it in our existing IOMMU device (riscv-iommu-pci) to set
RISCV_IOMMU_CAPS_IGS_MSI.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-bits.h | 6 ++++++
 hw/riscv/riscv-iommu.h      | 4 ++++
 hw/riscv/riscv-iommu-pci.c  | 1 +
 hw/riscv/riscv-iommu.c      | 5 +++++
 4 files changed, 16 insertions(+)

diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -XXX,XX +XXX,XX @@ struct riscv_iommu_pq_record {
 #define RISCV_IOMMU_CAP_PD17            BIT_ULL(39)
 #define RISCV_IOMMU_CAP_PD20            BIT_ULL(40)
 
+enum riscv_iommu_igs_modes {
+    RISCV_IOMMU_CAP_IGS_MSI = 0,
+    RISCV_IOMMU_CAP_IGS_WSI,
+    RISCV_IOMMU_CAP_IGS_BOTH
+};
+
 /* 5.4 Features control register (32bits) */
 #define RISCV_IOMMU_REG_FCTL            0x0008
 #define RISCV_IOMMU_FCTL_BE             BIT(0)
diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qom/object.h"
 #include "hw/riscv/iommu.h"
+#include "hw/riscv/riscv-iommu-bits.h"
+
+typedef enum riscv_iommu_igs_modes riscv_iommu_igs_mode;
 
 struct RISCVIOMMUState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
 
 void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
          Error **errp);
+void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
 
 /* private helpers */
 
diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-pci.c
+++ b/hw/riscv/riscv-iommu-pci.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_pci_init(Object *obj)
     qdev_alias_all_properties(DEVICE(iommu), obj);
 
     iommu->icvec_avail_vectors = RISCV_IOMMU_PCI_ICVEC_VECTORS;
+    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_MSI);
 }
 
 static const Property riscv_iommu_pci_properties[] = {
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps riscv_iommu_trap_ops = {
     }
 };
 
+void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode)
+{
+    s->cap = set_field(s->cap, RISCV_IOMMU_CAP_IGS, mode);
+}
+
 static void riscv_iommu_instance_init(Object *obj)
 {
     RISCVIOMMUState *s = RISCV_IOMMU(obj);
-- 
2.47.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

This device models the RISC-V IOMMU as a sysbus device. The same design
decisions taken in the riscv-iommu-pci device were kept, namely the
existence of 4 vectors are available for each interrupt cause.

The WSIs are emitted using the input of the s->notify() callback as a
index to an IRQ list. The IRQ list starts at 'base_irq' and goes until
base_irq + 3. This means that boards must have 4 contiguous IRQ lines
available, starting from 'base_irq'.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/iommu.h   |   4 ++
 hw/riscv/riscv-iommu-sys.c | 128 +++++++++++++++++++++++++++++++++++++
 hw/riscv/riscv-iommu.c     |   3 +-
 hw/riscv/meson.build       |   2 +-
 4 files changed, 134 insertions(+), 3 deletions(-)
 create mode 100644 hw/riscv/riscv-iommu-sys.c

From: Sunil V L <sunilvl@ventanamicro.com>

Add a new machine option called 'iommu-sys' that enables a
riscv-iommu-sys platform device for the 'virt' machine. The option is
default 'off'.

The device will use IRQs 36 to 39.

We will not support both riscv-iommu-sys and riscv-iommu-pci devices in
the same board in this first implementation. If a riscv-iommu-pci device
is added in the command line we will disable the riscv-iommu-sys device.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/iommu.h |   2 +
 include/hw/riscv/virt.h  |   6 ++-
 hw/riscv/virt.c          | 104 ++++++++++++++++++++++++++++++++++++++-
 3 files changed, 109 insertions(+), 3 deletions(-)

diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/iommu.h
+++ b/include/hw/riscv/iommu.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
 OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
 typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
 
+#define FDT_IRQ_TYPE_EDGE_LOW 1
+
 #endif
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     OnOffAuto acpi;
     const MemMapEntry *memmap;
     struct GPEXHost *gpex_host;
+    OnOffAuto iommu_sys;
 };
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_PCIE_MMIO,
     VIRT_PCIE_PIO,
     VIRT_PLATFORM_BUS,
-    VIRT_PCIE_ECAM
+    VIRT_PCIE_ECAM,
+    VIRT_IOMMU_SYS,
 };
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
     VIRTIO_IRQ = 1, /* 1 to 8 */
     VIRTIO_COUNT = 8,
     PCIE_IRQ = 0x20, /* 32 to 35 */
+    IOMMU_SYS_IRQ = 0x24, /* 36-39 */
     VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 95 */
 };
 
@@ -XXX,XX +XXX,XX @@ enum {
                                  1 + FDT_APLIC_INT_CELLS)
 
 bool virt_is_acpi_enabled(RISCVVirtState *s);
+bool virt_is_iommu_sys_enabled(RISCVVirtState *s);
 void virt_acpi_setup(RISCVVirtState *vms);
 uint32_t imsic_num_bits(uint32_t count);
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/pmu.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/iommu.h"
+#include "hw/riscv/riscv-iommu-bits.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_CLINT] =        {  0x2000000,       0x10000 },
     [VIRT_ACLINT_SSWI] =  {  0x2F00000,        0x4000 },
     [VIRT_PCIE_PIO] =     {  0x3000000,       0x10000 },
+    [VIRT_IOMMU_SYS] =    {  0x3010000,        0x1000 },
     [VIRT_PLATFORM_BUS] = {  0x4000000,     0x2000000 },
     [VIRT_PLIC] =         {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
     [VIRT_APLIC_M] =      {  0xc000000, APLIC_SIZE(VIRT_CPUS_MAX) },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
 
 static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
                             uint32_t irq_pcie_phandle,
-                            uint32_t msi_pcie_phandle)
+                            uint32_t msi_pcie_phandle,
+                            uint32_t iommu_sys_phandle)
 {
     g_autofree char *name = NULL;
     MachineState *ms = MACHINE(s);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
         2, virt_high_pcie_memmap.base,
         2, virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
 
+    if (virt_is_iommu_sys_enabled(s)) {
+        qemu_fdt_setprop_cells(ms->fdt, name, "iommu-map",
+                               0, iommu_sys_phandle, 0, 0, 0,
+                               iommu_sys_phandle, 0, 0xffff);
+    }
+
     create_pcie_irq_map(s, ms->fdt, name, irq_pcie_phandle);
 }
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
                            bdf + 1, iommu_phandle, bdf + 1, 0xffff - bdf);
 }
 
+static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
+                                 uint32_t *iommu_sys_phandle)
+{
+    const char comp[] = "riscv,iommu";
+    void *fdt = MACHINE(s)->fdt;
+    uint32_t iommu_phandle;
+    g_autofree char *iommu_node = NULL;
+    hwaddr addr = s->memmap[VIRT_IOMMU_SYS].base;
+    hwaddr size = s->memmap[VIRT_IOMMU_SYS].size;
+    uint32_t iommu_irq_map[RISCV_IOMMU_INTR_COUNT] = {
+        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_CQ,
+        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_FQ,
+        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_PM,
+        IOMMU_SYS_IRQ + RISCV_IOMMU_INTR_PQ,
+    };
+
+    iommu_node = g_strdup_printf("/soc/iommu@%x",
+                               (unsigned int) s->memmap[VIRT_IOMMU_SYS].base);
+    iommu_phandle = qemu_fdt_alloc_phandle(fdt);
+    qemu_fdt_add_subnode(fdt, iommu_node);
+
+    qemu_fdt_setprop(fdt, iommu_node, "compatible", comp, sizeof(comp));
+    qemu_fdt_setprop_cell(fdt, iommu_node, "#iommu-cells", 1);
+    qemu_fdt_setprop_cell(fdt, iommu_node, "phandle", iommu_phandle);
+
+    qemu_fdt_setprop_cells(fdt, iommu_node, "reg",
+                           addr >> 32, addr, size >> 32, size);
+    qemu_fdt_setprop_cell(fdt, iommu_node, "interrupt-parent", irq_chip);
+
+    qemu_fdt_setprop_cells(fdt, iommu_node, "interrupts",
+        iommu_irq_map[0], FDT_IRQ_TYPE_EDGE_LOW,
+        iommu_irq_map[1], FDT_IRQ_TYPE_EDGE_LOW,
+        iommu_irq_map[2], FDT_IRQ_TYPE_EDGE_LOW,
+        iommu_irq_map[3], FDT_IRQ_TYPE_EDGE_LOW);
+
+    *iommu_sys_phandle = iommu_phandle;
+}
+
 static void create_fdt_iommu(RISCVVirtState *s, uint16_t bdf)
 {
     const char comp[] = "riscv,pci-iommu";
@@ -XXX,XX +XXX,XX @@ static void finalize_fdt(RISCVVirtState *s)
 {
     uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
     uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
+    uint32_t iommu_sys_phandle = 1;
 
     create_fdt_sockets(s, virt_memmap, &phandle, &irq_mmio_phandle,
                        &irq_pcie_phandle, &irq_virtio_phandle,
@@ -XXX,XX +XXX,XX @@ static void finalize_fdt(RISCVVirtState *s)
 
     create_fdt_virtio(s, virt_memmap, irq_virtio_phandle);
 
-    create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle);
+    if (virt_is_iommu_sys_enabled(s)) {
+        create_fdt_iommu_sys(s, irq_mmio_phandle, &iommu_sys_phandle);
+    }
+    create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle,
+                    iommu_sys_phandle);
 
     create_fdt_reset(s, virt_memmap, &phandle);
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         create_fdt(s, memmap);
     }
 
+    if (virt_is_iommu_sys_enabled(s)) {
+        DeviceState *iommu_sys = qdev_new(TYPE_RISCV_IOMMU_SYS);
+
+        object_property_set_uint(OBJECT(iommu_sys), "addr",
+                                 s->memmap[VIRT_IOMMU_SYS].base,
+                                 &error_fatal);
+        object_property_set_uint(OBJECT(iommu_sys), "base-irq",
+                                 IOMMU_SYS_IRQ,
+                                 &error_fatal);
+        object_property_set_link(OBJECT(iommu_sys), "irqchip",
+                                 OBJECT(mmio_irqchip),
+                                 &error_fatal);
+
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(iommu_sys), &error_fatal);
+    }
+
     s->machine_done.notify = virt_machine_done;
     qemu_add_machine_init_done_notifier(&s->machine_done);
 }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
     s->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
     s->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
     s->acpi = ON_OFF_AUTO_AUTO;
+    s->iommu_sys = ON_OFF_AUTO_AUTO;
 }
 
 static char *virt_get_aia_guests(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void virt_set_aclint(Object *obj, bool value, Error **errp)
     s->have_aclint = value;
 }
 
+bool virt_is_iommu_sys_enabled(RISCVVirtState *s)
+{
+    return s->iommu_sys == ON_OFF_AUTO_ON;
+}
+
+static void virt_get_iommu_sys(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+    OnOffAuto iommu_sys = s->iommu_sys;
+
+    visit_type_OnOffAuto(v, name, &iommu_sys, errp);
+}
+
+static void virt_set_iommu_sys(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+
+    visit_type_OnOffAuto(v, name, &s->iommu_sys, errp);
+}
+
 bool virt_is_acpi_enabled(RISCVVirtState *s)
 {
     return s->acpi != ON_OFF_AUTO_OFF;
@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
                                                         DeviceState *dev)
 {
     MachineClass *mc = MACHINE_GET_CLASS(machine);
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(machine);
 
     if (device_is_dynamic_sysbus(mc, dev) ||
         object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI) ||
         object_dynamic_cast(OBJECT(dev), TYPE_RISCV_IOMMU_PCI)) {
+        s->iommu_sys = ON_OFF_AUTO_OFF;
         return HOTPLUG_HANDLER(machine);
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
 
     if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_IOMMU_PCI)) {
         create_fdt_iommu(s, pci_get_bdf(PCI_DEVICE(dev)));
+        s->iommu_sys = ON_OFF_AUTO_OFF;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                               NULL, NULL);
     object_class_property_set_description(oc, "acpi",
                                           "Enable ACPI");
+
+    object_class_property_add(oc, "iommu-sys", "OnOffAuto",
+                              virt_get_iommu_sys, virt_set_iommu_sys,
+                              NULL, NULL);
+    object_class_property_set_description(oc, "iommu-sys",
+                                          "Enable IOMMU platform device");
 }
 
 static const TypeInfo virt_machine_typeinfo = {
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

MSIx support is added in the RISC-V IOMMU platform device by including
the required MSIx facilities to alow software to properly setup the MSIx
subsystem.

We took inspiration of what is being done in the riscv-iommu-pci device,
mainly msix_init() and msix_notify(), while keeping in mind that
riscv-iommu-sys isn't a true PCI device and we don't need to copy/paste
all the contents of these MSIx functions.

Two extra MSI MemoryRegions were added: 'msix-table' and 'msix-pba'.
They are used to manage r/w of the MSI table and Pending Bit Array (PBA)
respectively. Both are subregions of the main IOMMU memory region,
iommu->regs_mr, initialized during riscv_iommu_realize(), and each one
has their own handlers for MSIx reads and writes.

This is the expected memory map when using this device in the 'virt'
machine:

0000000003010000-0000000003010fff (prio 0, i/o): riscv-iommu-regs
      0000000003010300-000000000301034f (prio 0, i/o): msix-table
      0000000003010400-0000000003010407 (prio 0, i/o): msix-pba

We're now able to set IGS to RISCV_IOMMU_CAP_IGS_BOTH, and userspace is
free to decide which interrupt model to use.

Enabling MSIx support for this device in the 'virt' machine requires
adding 'msi-parent' in the iommu-sys DT.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-sys.c | 116 +++++++++++++++++++++++++++++++++++--
 hw/riscv/virt.c            |   6 +-
 hw/riscv/trace-events      |   2 +
 3 files changed, 119 insertions(+), 5 deletions(-)

diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-sys.c
+++ b/hw/riscv/riscv-iommu-sys.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/host-utils.h"
 #include "qemu/module.h"
 #include "qom/object.h"
+#include "exec/exec-all.h"
+#include "trace.h"
 
 #include "riscv-iommu.h"
 
 #define RISCV_IOMMU_SYSDEV_ICVEC_VECTORS 0x3333
 
+#define RISCV_IOMMU_PCI_MSIX_VECTORS 5
+
 /* RISC-V IOMMU System Platform Device Emulation */
 
 struct RISCVIOMMUStateSys {
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUStateSys {
     uint32_t         base_irq;
     DeviceState      *irqchip;
     RISCVIOMMUState  iommu;
+
+    /* Wired int support */
     qemu_irq         irqs[RISCV_IOMMU_INTR_COUNT];
+
+    /* Memory Regions for MSIX table and pending bit entries. */
+    MemoryRegion msix_table_mmio;
+    MemoryRegion msix_pba_mmio;
+    uint8_t *msix_table;
+    uint8_t *msix_pba;
+};
+
+static uint64_t msix_table_mmio_read(void *opaque, hwaddr addr,
+                                     unsigned size)
+{
+    RISCVIOMMUStateSys *s = opaque;
+
+    g_assert(addr + size <= RISCV_IOMMU_PCI_MSIX_VECTORS * PCI_MSIX_ENTRY_SIZE);
+    return pci_get_long(s->msix_table + addr);
+}
+
+static void msix_table_mmio_write(void *opaque, hwaddr addr,
+                                  uint64_t val, unsigned size)
+{
+    RISCVIOMMUStateSys *s = opaque;
+
+    g_assert(addr + size <= RISCV_IOMMU_PCI_MSIX_VECTORS * PCI_MSIX_ENTRY_SIZE);
+    pci_set_long(s->msix_table + addr, val);
+}
+
+static const MemoryRegionOps msix_table_mmio_ops = {
+    .read = msix_table_mmio_read,
+    .write = msix_table_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .max_access_size = 4,
+    },
+};
+
+static uint64_t msix_pba_mmio_read(void *opaque, hwaddr addr,
+                                   unsigned size)
+{
+    RISCVIOMMUStateSys *s = opaque;
+
+    return pci_get_long(s->msix_pba + addr);
+}
+
+static void msix_pba_mmio_write(void *opaque, hwaddr addr,
+                                uint64_t val, unsigned size)
+{
+}
+
+static const MemoryRegionOps msix_pba_mmio_ops = {
+    .read = msix_pba_mmio_read,
+    .write = msix_pba_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .max_access_size = 4,
+    },
 };
 
+static void riscv_iommu_sysdev_init_msi(RISCVIOMMUStateSys *s,
+                                        uint32_t n_vectors)
+{
+    RISCVIOMMUState *iommu = &s->iommu;
+    uint32_t table_size = table_size = n_vectors * PCI_MSIX_ENTRY_SIZE;
+    uint32_t table_offset = RISCV_IOMMU_REG_MSI_CONFIG;
+    uint32_t pba_size = QEMU_ALIGN_UP(n_vectors, 64) / 8;
+    uint32_t pba_offset = RISCV_IOMMU_REG_MSI_CONFIG + 256;
+
+    s->msix_table = g_malloc0(table_size);
+    s->msix_pba = g_malloc0(pba_size);
+
+    memory_region_init_io(&s->msix_table_mmio, OBJECT(s), &msix_table_mmio_ops,
+                          s, "msix-table", table_size);
+    memory_region_add_subregion(&iommu->regs_mr, table_offset,
+                                &s->msix_table_mmio);
+
+    memory_region_init_io(&s->msix_pba_mmio, OBJECT(s), &msix_pba_mmio_ops, s,
+                          "msix-pba", pba_size);
+    memory_region_add_subregion(&iommu->regs_mr, pba_offset,
+                                &s->msix_pba_mmio);
+}
+
+static void riscv_iommu_sysdev_send_MSI(RISCVIOMMUStateSys *s,
+                                        uint32_t vector)
+{
+    uint8_t *table_entry = s->msix_table + vector * PCI_MSIX_ENTRY_SIZE;
+    uint64_t msi_addr = pci_get_quad(table_entry + PCI_MSIX_ENTRY_LOWER_ADDR);
+    uint32_t msi_data = pci_get_long(table_entry + PCI_MSIX_ENTRY_DATA);
+    MemTxResult result;
+
+    address_space_stl_le(&address_space_memory, msi_addr,
+                         msi_data, MEMTXATTRS_UNSPECIFIED, &result);
+    trace_riscv_iommu_sys_msi_sent(vector, msi_addr, msi_data, result);
+}
+
 static void riscv_iommu_sysdev_notify(RISCVIOMMUState *iommu,
                                       unsigned vector)
 {
     RISCVIOMMUStateSys *s = container_of(iommu, RISCVIOMMUStateSys, iommu);
     uint32_t fctl =  riscv_iommu_reg_get32(iommu, RISCV_IOMMU_REG_FCTL);
 
-    /* We do not support MSIs yet */
-    if (!(fctl & RISCV_IOMMU_FCTL_WSI)) {
+    if (fctl & RISCV_IOMMU_FCTL_WSI) {
+        qemu_irq_pulse(s->irqs[vector]);
+        trace_riscv_iommu_sys_irq_sent(vector);
         return;
     }
 
-    qemu_irq_pulse(s->irqs[vector]);
+    riscv_iommu_sysdev_send_MSI(s, vector);
 }
 
 static void riscv_iommu_sys_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_sys_realize(DeviceState *dev, Error **errp)
         irq = qdev_get_gpio_in(s->irqchip, s->base_irq + i);
         sysbus_connect_irq(sysdev, i, irq);
     }
+
+    riscv_iommu_sysdev_init_msi(s, RISCV_IOMMU_PCI_MSIX_VECTORS);
 }
 
 static void riscv_iommu_sys_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_sys_init(Object *obj)
     qdev_alias_all_properties(DEVICE(iommu), obj);
 
     iommu->icvec_avail_vectors = RISCV_IOMMU_SYSDEV_ICVEC_VECTORS;
-    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_WSI);
+    riscv_iommu_set_cap_igs(iommu, RISCV_IOMMU_CAP_IGS_BOTH);
 }
 
 static Property riscv_iommu_sys_properties[] = {
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
 }
 
 static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
+                                 uint32_t msi_phandle,
                                  uint32_t *iommu_sys_phandle)
 {
     const char comp[] = "riscv,iommu";
@@ -XXX,XX +XXX,XX @@ static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
         iommu_irq_map[2], FDT_IRQ_TYPE_EDGE_LOW,
         iommu_irq_map[3], FDT_IRQ_TYPE_EDGE_LOW);
 
+    qemu_fdt_setprop_cell(fdt, iommu_node, "msi-parent", msi_phandle);
+
     *iommu_sys_phandle = iommu_phandle;
 }
 
@@ -XXX,XX +XXX,XX @@ static void finalize_fdt(RISCVVirtState *s)
     create_fdt_virtio(s, virt_memmap, irq_virtio_phandle);
 
     if (virt_is_iommu_sys_enabled(s)) {
-        create_fdt_iommu_sys(s, irq_mmio_phandle, &iommu_sys_phandle);
+        create_fdt_iommu_sys(s, irq_mmio_phandle, msi_pcie_phandle,
+                             &iommu_sys_phandle);
     }
     create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle,
                     iommu_sys_phandle);
diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/trace-events
+++ b/hw/riscv/trace-events
@@ -XXX,XX +XXX,XX @@ riscv_iommu_icvec_write(uint32_t orig, uint32_t actual) "ICVEC write: incoming 0
 riscv_iommu_ats(const char *id, unsigned b, unsigned d, unsigned f, uint64_t iova) "%s: translate request %04x:%02x.%u iova: 0x%"PRIx64
 riscv_iommu_ats_inval(const char *id) "%s: dev-iotlb invalidate"
 riscv_iommu_ats_prgr(const char *id) "%s: dev-iotlb page request group response"
+riscv_iommu_sys_irq_sent(uint32_t vector) "IRQ sent to vector %u"
+riscv_iommu_sys_msi_sent(uint32_t vector, uint64_t msi_addr, uint32_t msi_data, uint32_t result) "MSI sent to vector %u msi_addr 0x%lx msi_data 0x%x result %u"
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add a riscv_iommu_reset() helper in the base emulation code that
implements the expected reset behavior as defined by the riscv-iommu
spec.

Devices can then use this helper in their own reset callbacks.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.h     |  1 +
 include/hw/riscv/iommu.h   |  6 ++++--
 hw/riscv/riscv-iommu-pci.c | 20 ++++++++++++++++++++
 hw/riscv/riscv-iommu-sys.c | 20 ++++++++++++++++++++
 hw/riscv/riscv-iommu.c     | 35 +++++++++++++++++++++++++++++++++++
 hw/riscv/trace-events      |  2 ++
 6 files changed, 82 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
 void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
          Error **errp);
 void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
+void riscv_iommu_reset(RISCVIOMMUState *s);
 
 /* private helpers */
 
diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/iommu.h
+++ b/include/hw/riscv/iommu.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUState RISCVIOMMUState;
 typedef struct RISCVIOMMUSpace RISCVIOMMUSpace;
 
 #define TYPE_RISCV_IOMMU_PCI "riscv-iommu-pci"
-OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStatePci, RISCV_IOMMU_PCI)
+OBJECT_DECLARE_TYPE(RISCVIOMMUStatePci, RISCVIOMMUPciClass, RISCV_IOMMU_PCI)
 typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
+typedef struct RISCVIOMMUPciClass RISCVIOMMUPciClass;
 
 #define TYPE_RISCV_IOMMU_SYS "riscv-iommu-device"
-OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
+OBJECT_DECLARE_TYPE(RISCVIOMMUStateSys, RISCVIOMMUSysClass, RISCV_IOMMU_SYS)
 typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
+typedef struct RISCVIOMMUSysClass RISCVIOMMUSysClass;
 
 #define FDT_IRQ_TYPE_EDGE_LOW 1
 
diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-pci.c
+++ b/hw/riscv/riscv-iommu-pci.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu_bits.h"
 #include "riscv-iommu.h"
 #include "riscv-iommu-bits.h"
+#include "trace.h"
 
 /* RISC-V IOMMU PCI Device Emulation */
 #define RISCV_PCI_CLASS_SYSTEM_IOMMU     0x0806
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVIOMMUStatePci {
     RISCVIOMMUState  iommu;   /* common IOMMU state */
 } RISCVIOMMUStatePci;
 
+struct RISCVIOMMUPciClass {
+    /*< public >*/
+    DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
+};
+
 /* interrupt delivery callback */
 static void riscv_iommu_pci_notify(RISCVIOMMUState *iommu, unsigned vector)
 {
@@ -XXX,XX +XXX,XX @@ static const Property riscv_iommu_pci_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static void riscv_iommu_pci_reset_hold(Object *obj, ResetType type)
+{
+    RISCVIOMMUStatePci *pci = RISCV_IOMMU_PCI(obj);
+    RISCVIOMMUState *iommu = &pci->iommu;
+
+    riscv_iommu_reset(iommu);
+
+    trace_riscv_iommu_pci_reset_hold(type);
+}
+
 static void riscv_iommu_pci_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    rc->phases.hold = riscv_iommu_pci_reset_hold;
 
     k->realize = riscv_iommu_pci_realize;
     k->exit = riscv_iommu_pci_exit;
diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-sys.c
+++ b/hw/riscv/riscv-iommu-sys.c
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUStateSys {
     uint8_t *msix_pba;
 };
 
+struct RISCVIOMMUSysClass {
+    /*< public >*/
+    DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
+};
+
 static uint64_t msix_table_mmio_read(void *opaque, hwaddr addr,
                                      unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static Property riscv_iommu_sys_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static void riscv_iommu_sys_reset_hold(Object *obj, ResetType type)
+{
+    RISCVIOMMUStateSys *sys = RISCV_IOMMU_SYS(obj);
+    RISCVIOMMUState *iommu = &sys->iommu;
+
+    riscv_iommu_reset(iommu);
+
+    trace_riscv_iommu_sys_reset_hold(type);
+}
+
 static void riscv_iommu_sys_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    rc->phases.hold = riscv_iommu_sys_reset_hold;
+
     dc->realize = riscv_iommu_sys_realize;
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     device_class_set_props(dc, riscv_iommu_sys_properties);
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_unrealize(DeviceState *dev)
     g_hash_table_unref(s->ctx_cache);
 }
 
+void riscv_iommu_reset(RISCVIOMMUState *s)
+{
+    uint32_t reg_clr;
+    int ddtp_mode;
+
+    /*
+     * Clear DDTP while setting DDTP_mode back to user
+     * initial setting.
+     */
+    ddtp_mode = s->enable_off ?
+                RISCV_IOMMU_DDTP_MODE_OFF : RISCV_IOMMU_DDTP_MODE_BARE;
+    s->ddtp = set_field(0, RISCV_IOMMU_DDTP_MODE, ddtp_mode);
+    riscv_iommu_reg_set64(s, RISCV_IOMMU_REG_DDTP, s->ddtp);
+
+    reg_clr = RISCV_IOMMU_CQCSR_CQEN | RISCV_IOMMU_CQCSR_CIE |
+              RISCV_IOMMU_CQCSR_CQON | RISCV_IOMMU_CQCSR_BUSY;
+    riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_CQCSR, 0, reg_clr);
+
+    reg_clr = RISCV_IOMMU_FQCSR_FQEN | RISCV_IOMMU_FQCSR_FIE |
+              RISCV_IOMMU_FQCSR_FQON | RISCV_IOMMU_FQCSR_BUSY;
+    riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_FQCSR, 0, reg_clr);
+
+    reg_clr = RISCV_IOMMU_PQCSR_PQEN | RISCV_IOMMU_PQCSR_PIE |
+              RISCV_IOMMU_PQCSR_PQON | RISCV_IOMMU_PQCSR_BUSY;
+    riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_PQCSR, 0, reg_clr);
+
+    riscv_iommu_reg_mod64(s, RISCV_IOMMU_REG_TR_REQ_CTL, 0,
+                          RISCV_IOMMU_TR_REQ_CTL_GO_BUSY);
+
+    riscv_iommu_reg_set32(s, RISCV_IOMMU_REG_IPSR, 0);
+
+    g_hash_table_remove_all(s->ctx_cache);
+    g_hash_table_remove_all(s->iot_cache);
+}
+
 static const Property riscv_iommu_properties[] = {
     DEFINE_PROP_UINT32("version", RISCVIOMMUState, version,
         RISCV_IOMMU_SPEC_DOT_VER),
diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/trace-events
+++ b/hw/riscv/trace-events
@@ -XXX,XX +XXX,XX @@ riscv_iommu_ats_inval(const char *id) "%s: dev-iotlb invalidate"
 riscv_iommu_ats_prgr(const char *id) "%s: dev-iotlb page request group response"
 riscv_iommu_sys_irq_sent(uint32_t vector) "IRQ sent to vector %u"
 riscv_iommu_sys_msi_sent(uint32_t vector, uint64_t msi_addr, uint32_t msi_data, uint32_t result) "MSI sent to vector %u msi_addr 0x%lx msi_data 0x%x result %u"
+riscv_iommu_sys_reset_hold(int reset_type) "reset type %d"
+riscv_iommu_pci_reset_hold(int reset_type) "reset type %d"
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241106133407.604587-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/specs/riscv-iommu.rst | 30 +++++++++++++++++++++++++++---
 docs/system/riscv/virt.rst | 10 ++++++++++
 2 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/docs/specs/riscv-iommu.rst b/docs/specs/riscv-iommu.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/riscv-iommu.rst
+++ b/docs/specs/riscv-iommu.rst
@@ -XXX,XX +XXX,XX @@ RISC-V IOMMU support for RISC-V machines
 QEMU implements a RISC-V IOMMU emulation based on the RISC-V IOMMU spec
 version 1.0 `iommu1.0`_.
 
-The emulation includes a PCI reference device, riscv-iommu-pci, that QEMU
-RISC-V boards can use.  The 'virt' RISC-V machine is compatible with this
-device.
+The emulation includes a PCI reference device (riscv-iommu-pci) and a platform
+bus device (riscv-iommu-sys) that QEMU RISC-V boards can use.  The 'virt'
+RISC-V machine is compatible with both devices.
 
 riscv-iommu-pci reference device
 --------------------------------
@@ -XXX,XX +XXX,XX @@ Several options are available to control the capabilities of the device, namely:
 - "s-stage": enable s-stage support
 - "g-stage": enable g-stage support
 
+riscv-iommu-sys device
+----------------------
+
+This device implements the RISC-V IOMMU emulation as a platform bus device that
+RISC-V boards can use.
+
+For the 'virt' board the device is disabled by default.  To enable it use the
+'iommu-sys' machine option:
+
+.. code-block:: bash
+
+  $ qemu-system-riscv64 -M virt,iommu-sys=on (...)
+
+There is no options to configure the capabilities of this device in the 'virt'
+board using the QEMU command line.  The device is configured with the following
+riscv-iommu options:
+
+- "ioatc-limit": default value (2Mb)
+- "intremap": enabled
+- "ats": enabled
+- "off": on (DMA disabled)
+- "s-stage": enabled
+- "g-stage": enabled
+
 .. _iommu1.0: https://github.com/riscv-non-isa/riscv-iommu/releases/download/v1.0/riscv-iommu.pdf
 
 .. _linux-v8: https://lore.kernel.org/linux-riscv/cover.1718388908.git.tjeznach@rivosinc.com/
diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ command line:
 
   $ qemu-system-riscv64 -M virt -device riscv-iommu-pci (...)
 
+It also has support for the riscv-iommu-sys platform device:
+
+.. code-block:: bash
+
+  $ qemu-system-riscv64 -M virt,iommu-sys=on (...)
+
 Refer to :ref:`riscv-iommu` for more information on how the RISC-V IOMMU support
 works.
 
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
   having AIA IMSIC (i.e. "aia=aplic-imsic" selected). When not specified,
   the default number of per-HART VS-level AIA IMSIC pages is 0.
 
+- iommu-sys=[on|off]
+
+  Enables the riscv-iommu-sys platform device. Defaults to 'off'.
+
 Running Linux kernel
 --------------------
 
-- 
2.47.1

From: Anton Blanchard <antonb@tenstorrent.com>

Add a CPU entry for the Tenstorrent Ascalon CPU, a series of 2 wide to
8 wide RV64 cores. More details can be found at
https://tenstorrent.com/ip/tt-ascalon

Signed-off-by: Anton Blanchard <antonb@tenstorrent.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241113110459.1607299-1-antonb@tenstorrent.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 67 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
 #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
 #define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
+#define TYPE_RISCV_CPU_TT_ASCALON       RISCV_CPU_TYPE_NAME("tt-ascalon")
 #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
 
 OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
 #endif
 }
 
+/* Tenstorrent Ascalon */
+static void rv64_tt_ascalon_cpu_init(Object *obj)
+{
+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+
+    riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU | RVH | RVV);
+    env->priv_ver = PRIV_VERSION_1_13_0;
+
+    /* Enable ISA extensions */
+    cpu->cfg.mmu = true;
+    cpu->cfg.vlenb = 256 >> 3;
+    cpu->cfg.elen = 64;
+    cpu->env.vext_ver = VEXT_VERSION_1_00_0;
+    cpu->cfg.rvv_ma_all_1s = true;
+    cpu->cfg.rvv_ta_all_1s = true;
+    cpu->cfg.misa_w = true;
+    cpu->cfg.pmp = true;
+    cpu->cfg.cbom_blocksize = 64;
+    cpu->cfg.cbop_blocksize = 64;
+    cpu->cfg.cboz_blocksize = 64;
+    cpu->cfg.ext_zic64b = true;
+    cpu->cfg.ext_zicbom = true;
+    cpu->cfg.ext_zicbop = true;
+    cpu->cfg.ext_zicboz = true;
+    cpu->cfg.ext_zicntr = true;
+    cpu->cfg.ext_zicond = true;
+    cpu->cfg.ext_zicsr = true;
+    cpu->cfg.ext_zifencei = true;
+    cpu->cfg.ext_zihintntl = true;
+    cpu->cfg.ext_zihintpause = true;
+    cpu->cfg.ext_zihpm = true;
+    cpu->cfg.ext_zimop = true;
+    cpu->cfg.ext_zawrs = true;
+    cpu->cfg.ext_zfa = true;
+    cpu->cfg.ext_zfbfmin = true;
+    cpu->cfg.ext_zfh = true;
+    cpu->cfg.ext_zfhmin = true;
+    cpu->cfg.ext_zcb = true;
+    cpu->cfg.ext_zcmop = true;
+    cpu->cfg.ext_zba = true;
+    cpu->cfg.ext_zbb = true;
+    cpu->cfg.ext_zbs = true;
+    cpu->cfg.ext_zkt = true;
+    cpu->cfg.ext_zvbb = true;
+    cpu->cfg.ext_zvbc = true;
+    cpu->cfg.ext_zvfbfmin = true;
+    cpu->cfg.ext_zvfbfwma = true;
+    cpu->cfg.ext_zvfh = true;
+    cpu->cfg.ext_zvfhmin = true;
+    cpu->cfg.ext_zvkng = true;
+    cpu->cfg.ext_smaia = true;
+    cpu->cfg.ext_smstateen = true;
+    cpu->cfg.ext_ssaia = true;
+    cpu->cfg.ext_sscofpmf = true;
+    cpu->cfg.ext_sstc = true;
+    cpu->cfg.ext_svade = true;
+    cpu->cfg.ext_svinval = true;
+    cpu->cfg.ext_svnapot = true;
+    cpu->cfg.ext_svpbmt = true;
+
+#ifndef CONFIG_USER_ONLY
+    set_satp_mode_max_supported(cpu, VM_1_10_SV57);
+#endif
+}
+
 #ifdef CONFIG_TCG
 static void rv128_base_cpu_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54, MXL_RV64,  rv64_sifive_u_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,   MXL_RV64,  rv64_sifive_u_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
 #ifdef CONFIG_TCG
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The helper is_kvm_aia() is checking not only for AIA, but for
aplic-imsic (i.e. "aia=aplic-imsic" in 'virt' RISC-V machine) with an
in-kernel chip present.

Rename it to be a bit clear what the helper is doing since we'll add
more AIA helpers in the next patches.

Make the helper public because the 'virt' machine will use it as well.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/riscv_aplic.h | 1 +
 hw/intc/riscv_aplic.c         | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/hw/intc/riscv_aplic.h b/include/hw/intc/riscv_aplic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/riscv_aplic.h
+++ b/include/hw/intc/riscv_aplic.h
@@ -XXX,XX +XXX,XX @@ struct RISCVAPLICState {
 };
 
 void riscv_aplic_add_child(DeviceState *parent, DeviceState *child);
+bool riscv_is_kvm_aia_aplic_imsic(bool msimode);
 
 DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
  * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
  * APLIC Wired.
  */
-static bool is_kvm_aia(bool msimode)
+bool riscv_is_kvm_aia_aplic_imsic(bool msimode)
 {
     return kvm_irqchip_in_kernel() && msimode;
 }
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    if (!is_kvm_aia(aplic->msimode)) {
+    if (!riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
         aplic->state = g_new0(uint32_t, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
+        if (kvm_enabled() && riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    if (!is_kvm_aia(msimode)) {
+    if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     }
 
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In create_fdt_sockets() we have the following pattern:

if (kvm_enabled() && virt_use_kvm_aia(s)) {
        (... do stuff ...)
    } else {
        (... do other stuff ...)
    }
    if (kvm_enabled() && virt_use_kvm_aia(s)) {
        (... do more stuff ...)
    } else {
        (... do more other stuff)
    }

Do everything in a single if/else clause to reduce the usage of
virt_use_kvm_aia() helper and to make the code a bit less repetitive.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
                                 ms->smp.cpus);
+
+        *irq_mmio_phandle = xplic_phandles[0];
+        *irq_virtio_phandle = xplic_phandles[0];
+        *irq_pcie_phandle = xplic_phandles[0];
     } else {
         phandle_pos = ms->smp.cpus;
         for (socket = (socket_count - 1); socket >= 0; socket--) {
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                         s->soc[socket].num_harts);
             }
         }
-    }
 
-    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-        *irq_mmio_phandle = xplic_phandles[0];
-        *irq_virtio_phandle = xplic_phandles[0];
-        *irq_pcie_phandle = xplic_phandles[0];
-    } else {
         for (socket = 0; socket < socket_count; socket++) {
             if (socket == 0) {
                 *irq_mmio_phandle = xplic_phandles[socket];
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Similar to the riscv_is_kvm_aia_aplic_imsic() helper from riscv_aplic.c,
the existing virt_use_kvm_aia() is testing for KVM aia=aplic-imsic with
in-kernel irqchip enabled. It is not checking for a generic AIA support.

Rename the helper to virt_use_kvm_aia_aplic_imsic() to reflect what the
helper is doing, and use the existing riscv_is_kvm_aia_aplic_imsic() to
obscure details such as the presence of the in-kernel irqchip.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/virtio/virtio-iommu.h"
 
 /* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
-static bool virt_use_kvm_aia(RISCVVirtState *s)
+static bool virt_use_kvm_aia_aplic_imsic(RISCVVirtAIAType aia_type)
 {
-    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+
+    return riscv_is_kvm_aia_aplic_imsic(msimode);
 }
 
 static bool virt_aclint_allowed(void)
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    /* KVM AIA only has one APLIC instance */
-    if (kvm_enabled() && virt_use_kvm_aia(s)) {
+    /* KVM AIA aplic-imsic only has one APLIC instance */
+    if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
-    if (kvm_enabled() && virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                              memmap[VIRT_APLIC_S].base,
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Before adding support to kernel-irqchip=split when using KVM AIA we need
to change how we create the in-kernel AIA device.

In the use case we have so far, i.e. in-kernel irqchip without split
mode, both the s-mode APLIC and IMSIC controllers are provided by the
irqchip. In irqchip_split() mode we'll emulate the s-mode APLIC
controller, which will send MSIs to the in-kernel IMSIC controller. To
do that we need to change kvm_riscv_aia_create() to not create the
in-kernel s-mode APLIC controller.

In the kernel source arch/riscv/kvm/aia_aplic.c, function
kvm_riscv_aia_aplic_init(), we verify that the APLIC controller won't be
instantiated by KVM if we do not set 'nr_sources', which is set via
KVM_DEV_RISCV_AIA_CONFIG_SRCS. For QEMU this means that we should not
set 'aia_irq_num' during kvm_riscv_aia_create() in irqchip_split() mode.

In this same condition, skip KVM_DEV_RISCV_AIA_ADDR_APLIC as well since
it is used to set the base address for the in-kernel APLIC controller.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         }
     }
 
-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
-                            &aia_irq_num, true, NULL);
-    if (ret < 0) {
-        error_report("KVM AIA: failed to set number of input irq lines");
-        exit(1);
-    }
+    /*
+     * Skip APLIC creation in KVM if we're running split mode.
+     * This is done by leaving KVM_DEV_RISCV_AIA_CONFIG_SRCS
+     * unset. We can also skip KVM_DEV_RISCV_AIA_ADDR_APLIC
+     * since KVM won't be using it.
+     */
+    if (!kvm_kernel_irqchip_split()) {
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_SRCS,
+                                &aia_irq_num, true, NULL);
+        if (ret < 0) {
+            error_report("KVM AIA: failed to set number of input irq lines");
+            exit(1);
+        }
+
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                                KVM_DEV_RISCV_AIA_ADDR_APLIC,
+                                &aplic_base, true, NULL);
+        if (ret < 0) {
+            error_report("KVM AIA: failed to set the base address of APLIC");
+            exit(1);
+        }
+     }
 
     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
                             KVM_DEV_RISCV_AIA_CONFIG_IDS,
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         exit(1);
     }
 
-    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
-                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
-                            &aplic_base, true, NULL);
-    if (ret < 0) {
-        error_report("KVM AIA: failed to set the base address of APLIC");
-        exit(1);
-    }
-
     for (socket = 0; socket < socket_count; socket++) {
         socket_imsic_base = imsic_base + socket * (1U << group_shift);
         hart_count = riscv_socket_hart_count(machine, socket);
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The current logic to determine if we don't need an emulated APLIC
controller, i.e. KVM will provide for us, is to determine if we're
running KVM, with in-kernel irqchip support, and running
aia=aplic-imsic. This is modelled by riscv_is_kvm_aia_aplic_imsic() and
virt_use_kvm_aia_aplic_imsic().

This won't suffice to support irqchip_split() mode: it will match
exactly the same conditions as the one above, but setting the irqchip to
'split' mode will now require us to emulate an APLIC s-mode controller,
like we're doing with 'aia=aplic'.

Create a new riscv_use_emulated_aplic() helper that will encapsulate
this logic. Replace the uses of "riscv_is_kvm_aia_aplic_imsic()" with
this helper every time we're taking a decision on emulate an APLIC
controller or not. Do the same in virt.c with virt_use_emulated_aplic().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/riscv_aplic.h |  1 +
 hw/intc/riscv_aplic.c         | 24 +++++++++++++++++++++---
 hw/riscv/virt.c               | 14 ++++++++++++--
 3 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/include/hw/intc/riscv_aplic.h b/include/hw/intc/riscv_aplic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/riscv_aplic.h
+++ b/include/hw/intc/riscv_aplic.h
@@ -XXX,XX +XXX,XX @@ struct RISCVAPLICState {
 
 void riscv_aplic_add_child(DeviceState *parent, DeviceState *child);
 bool riscv_is_kvm_aia_aplic_imsic(bool msimode);
+bool riscv_use_emulated_aplic(bool msimode);
 
 DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "kvm/kvm_riscv.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ bool riscv_is_kvm_aia_aplic_imsic(bool msimode)
     return kvm_irqchip_in_kernel() && msimode;
 }
 
+bool riscv_use_emulated_aplic(bool msimode)
+{
+#ifdef CONFIG_KVM
+    if (tcg_enabled()) {
+        return true;
+    }
+
+    if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
+        return true;
+    }
+
+    return kvm_kernel_irqchip_split();
+#else
+    return true;
+#endif
+}
+
 static bool riscv_aplic_irq_rectified_val(RISCVAPLICState *aplic,
                                           uint32_t irq)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    if (!riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
+    if (riscv_use_emulated_aplic(aplic->msimode)) {
         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
         aplic->state = g_new0(uint32_t, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (kvm_enabled() && riscv_is_kvm_aia_aplic_imsic(aplic->msimode)) {
+        if (kvm_enabled() && !riscv_use_emulated_aplic(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
+    if (riscv_use_emulated_aplic(msimode)) {
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     }
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static bool virt_use_kvm_aia_aplic_imsic(RISCVVirtAIAType aia_type)
     return riscv_is_kvm_aia_aplic_imsic(msimode);
 }
 
+static bool virt_use_emulated_aplic(RISCVVirtAIAType aia_type)
+{
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+
+    return riscv_use_emulated_aplic(msimode);
+}
+
 static bool virt_aclint_allowed(void)
 {
     return tcg_enabled() || qtest_enabled();
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    /* KVM AIA aplic-imsic only has one APLIC instance */
-    if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
+    /*
+     * With KVM AIA aplic-imsic, using an irqchip without split
+     * mode, we'll use only one APLIC instance.
+     */
+    if (!virt_use_emulated_aplic(s->aia_type)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The last step to enable KVM AIA aplic-imsic with irqchip in split mode
is to deal with how MSIs are going to be sent. In our current design we
don't allow an APLIC controller to send MSIs unless it's on m-mode. And
we also do not allow Supervisor MSI address configuration via the
'smsiaddrcfg' and 'smsiaddrcfgh' registers unless it's also a m-mode
APLIC controller.

Add a new RISCVACPLICState attribute called 'kvm_msicfgaddr'. This
attribute represents the base configuration address for MSIs, in our
case the base addr of the IMSIC controller. This attribute is being set
only when running irqchip_split() mode with aia=aplic-imsic.

During riscv_aplic_msi_send() we'll check if the attribute was set to
skip the check for a m-mode APLIC controller and to change the resulting
MSI addr by adding kvm_msicfgaddr right before address_space_stl_le().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/riscv_aplic.h |  6 +++++
 hw/intc/riscv_aplic.c         | 42 +++++++++++++++++++++++++++--------
 hw/riscv/virt.c               |  6 ++++-
 3 files changed, 44 insertions(+), 10 deletions(-)

diff --git a/include/hw/intc/riscv_aplic.h b/include/hw/intc/riscv_aplic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/riscv_aplic.h
+++ b/include/hw/intc/riscv_aplic.h
@@ -XXX,XX +XXX,XX @@ struct RISCVAPLICState {
     uint32_t num_irqs;
     bool msimode;
     bool mmode;
+
+    /* To support KVM aia=aplic-imsic with irqchip split mode */
+    bool kvm_splitmode;
+    uint32_t kvm_msicfgaddr;
+    uint32_t kvm_msicfgaddrH;
 };
 
 void riscv_aplic_add_child(DeviceState *parent, DeviceState *child);
 bool riscv_is_kvm_aia_aplic_imsic(bool msimode);
 bool riscv_use_emulated_aplic(bool msimode);
+void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr);
 
 DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ bool riscv_use_emulated_aplic(bool msimode)
 #endif
 }
 
+void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr)
+{
+#ifdef CONFIG_KVM
+    if (riscv_use_emulated_aplic(aplic->msimode)) {
+        aplic->kvm_msicfgaddr = extract64(addr, 0, 32);
+        aplic->kvm_msicfgaddrH = extract64(addr, 32, 32);
+    }
+#endif
+}
+
 static bool riscv_aplic_irq_rectified_val(RISCVAPLICState *aplic,
                                           uint32_t irq)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
     uint32_t lhxs, lhxw, hhxs, hhxw, group_idx, msicfgaddr, msicfgaddrH;
 
     aplic_m = aplic;
-    while (aplic_m && !aplic_m->mmode) {
-        aplic_m = aplic_m->parent;
-    }
-    if (!aplic_m) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
-                      __func__);
-        return;
+
+    if (!aplic->kvm_splitmode) {
+        while (aplic_m && !aplic_m->mmode) {
+            aplic_m = aplic_m->parent;
+        }
+        if (!aplic_m) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
+                          __func__);
+            return;
+        }
     }
 
     if (aplic->mmode) {
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
 
+    if (aplic->kvm_splitmode) {
+        addr |= aplic->kvm_msicfgaddr;
+        addr |= ((uint64_t)aplic->kvm_msicfgaddrH << 32);
+    }
+
     address_space_stl_le(&address_space_memory, addr,
                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
     if (result != MEMTX_OK) {
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
         memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
                               aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
         sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+
+        if (kvm_enabled()) {
+            aplic->kvm_splitmode = true;
+        }
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static const Property riscv_aplic_properties[] = {
 
 static const VMStateDescription vmstate_riscv_aplic = {
     .name = "riscv_aplic",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (const VMStateField[]) {
             VMSTATE_UINT32(domaincfg, RISCVAPLICState),
             VMSTATE_UINT32(mmsicfgaddr, RISCVAPLICState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_riscv_aplic = {
             VMSTATE_UINT32(smsicfgaddr, RISCVAPLICState),
             VMSTATE_UINT32(smsicfgaddrH, RISCVAPLICState),
             VMSTATE_UINT32(genmsi, RISCVAPLICState),
+            VMSTATE_UINT32(kvm_msicfgaddr, RISCVAPLICState),
+            VMSTATE_UINT32(kvm_msicfgaddrH, RISCVAPLICState),
             VMSTATE_VARRAY_UINT32(sourcecfg, RISCVAPLICState,
                                   num_irqs, 0,
                                   vmstate_info_uint32, uint32_t),
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
                                     int base_hartid, int hart_count)
 {
     int i;
-    hwaddr addr;
+    hwaddr addr = 0;
     uint32_t guest_bits;
     DeviceState *aplic_s = NULL;
     DeviceState *aplic_m = NULL;
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
                                  VIRT_IRQCHIP_NUM_PRIO_BITS,
                                  msimode, false, aplic_m);
 
+    if (kvm_enabled() && msimode) {
+        riscv_aplic_set_kvm_msicfgaddr(RISCV_APLIC(aplic_s), addr);
+    }
+
     return kvm_enabled() ? aplic_s : aplic_m;
 }
 
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Remove the 'irqchip_split()' restriction in kvm_arch_init() now that
we have support for "-accel kvm,kernel-irqchip=split".

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    if (kvm_kernel_irqchip_split()) {
-        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
-        exit(1);
-    }
-
     /*
      * We can create the VAIA using the newer device control API.
      */
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Also add a new page, docs/specs/riscv-aia.rst, where we're documenting
the state of AIA support in QEMU w.r.t the controllers being emulated or
not depending on the AIA and accelerator settings.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241119191706.718860-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/specs/index.rst       |  1 +
 docs/specs/riscv-aia.rst   | 83 ++++++++++++++++++++++++++++++++++++++
 docs/system/riscv/virt.rst |  7 ++++
 3 files changed, 91 insertions(+)
 create mode 100644 docs/specs/riscv-aia.rst

diff --git a/docs/specs/index.rst b/docs/specs/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/index.rst
+++ b/docs/specs/index.rst
@@ -XXX,XX +XXX,XX @@ guest hardware that is specific to QEMU.
    rapl-msr
    rocker
    riscv-iommu
+   riscv-aia
diff --git a/docs/specs/riscv-aia.rst b/docs/specs/riscv-aia.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/specs/riscv-aia.rst
@@ -XXX,XX +XXX,XX @@
+.. _riscv-aia:
+
+RISC-V AIA support for RISC-V machines
+======================================
+
+AIA (Advanced Interrupt Architecture) support is implemented in the ``virt``
+RISC-V machine for TCG and KVM accelerators.
+
+The support consists of two main modes:
+
+- "aia=aplic": adds one or more APLIC (Advanced Platform Level Interrupt Controller)
+  devices
+- "aia=aplic-imsic": adds one or more APLIC device and an IMSIC (Incoming MSI
+   Controller) device for each CPU
+
+From an user standpoint, these modes will behave the same regardless of the accelerator
+used.  From a developer standpoint the accelerator settings will change what it being
+emulated in userspace versus what is being emulated by an in-kernel irqchip.
+
+When running TCG, all controllers are emulated in userspace, including machine mode
+(m-mode) APLIC and IMSIC (when applicable).
+
+When running KVM:
+
+- no m-mode is provided, so there is no m-mode APLIC or IMSIC emulation regardless of
+  the AIA mode chosen
+- with "aia=aplic", s-mode APLIC will be emulated by userspace
+- with "aia=aplic-imsic" there are two possibilities.  If no additional KVM option
+  is provided there will be no APLIC or IMSIC emulation in userspace, and the virtual
+  machine will use the provided in-kernel APLIC and IMSIC controllers.  If the user
+  chooses to use the irqchip in split mode via "-accel kvm,kernel-irqchip=split",
+  s-mode APLIC will be emulated while using the s-mode IMSIC from the irqchip
+
+The following table summarizes how the AIA and accelerator options defines what
+we will emulate in userspace:
+
+
+.. list-table:: How AIA and accel options changes controller emulation
+   :widths: 25 25 25 25 25 25 25
+   :header-rows: 1
+
+   * - Accel
+     - Accel props
+     - AIA type
+     - APLIC m-mode
+     - IMSIC m-mode
+     - APLIC s-mode
+     - IMSIC s-mode
+   * - tcg
+     - ---
+     - aplic
+     - emul
+     - n/a
+     - emul
+     - n/a
+   * - tcg
+     - ---
+     - aplic-imsic
+     - emul
+     - emul
+     - emul
+     - emul
+   * - kvm
+     - ---
+     - aplic
+     - n/a
+     - n/a
+     - emul
+     - n/a
+   * - kvm
+     - none
+     - aplic-imsic
+     - n/a
+     - n/a
+     - in-kernel
+     - in-kernel
+   * - kvm
+     - irqchip=split
+     - aplic-imsic
+     - n/a
+     - n/a
+     - emul
+     - in-kernel
diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
   MSIs. When not specified, this option is assumed to be "none" which selects
   SiFive PLIC to handle wired interrupts.
 
+  This option also interacts with '-accel kvm'.  When using "aia=aplic-imsic"
+  with KVM, it is possible to set the use of the kernel irqchip in split mode
+  by using "-accel kvm,kernel-irqchip=split".  In this case the ``virt`` machine
+  will emulate the APLIC controller instead of using the APLIC controller from
+  the irqchip.  See :ref:`riscv-aia` for more details on all available AIA
+  modes.
+
 - aia-guests=nnn
 
   The number of per-HART VS-level AIA IMSIC pages to be emulated for a guest
-- 
2.47.1

From: Sai Pavan Boddu <sai.pavan.boddu@amd.com>

Add a basic board with interrupt controller (intc), timer, serial
(uartlite), small memory called LMB@0 (128kB) and DDR@0x80000000
(configured via command line eg. -m 2g).
This is basic configuration which matches HW generated out of AMD Vivado
(design tools). But initial configuration is going beyond what it is
configured by default because validation should be done on other
configurations too. That's why wire also additional uart16500, axi
ethernet(with axi dma).
GPIOs, i2c and qspi is also listed for completeness.

IRQ map is: (addr)
0 - timer (0x41c00000)
1 - uartlite (0x40600000)
2 - i2c (0x40800000)
3 - qspi (0x44a00000)
4 - uart16550 (0x44a10000)
5 - emaclite (0x40e00000)
6 - timer2 (0x41c10000)
7 - axi emac (0x40c00000)
8 - axi dma (0x41e00000)
9 - axi dma
10 - gpio (0x40000000)
11 - gpio2 (0x40010000)
12 - gpio3 (0x40020000)

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241125134739.18189-1-sai.pavan.boddu@amd.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS                                |   6 +
 docs/system/riscv/microblaze-v-generic.rst |  42 +++++
 docs/system/target-riscv.rst               |   1 +
 hw/riscv/microblaze-v-generic.c            | 184 +++++++++++++++++++++
 hw/riscv/Kconfig                           |   8 +
 hw/riscv/meson.build                       |   1 +
 6 files changed, 242 insertions(+)
 create mode 100644 docs/system/riscv/microblaze-v-generic.rst
 create mode 100644 hw/riscv/microblaze-v-generic.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: docs/system/riscv/sifive_u.rst
 F: hw/*/*sifive*.c
 F: include/hw/*/*sifive*.h
 
+AMD Microblaze-V Generic Board
+M: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
+S: Maintained
+F: hw/riscv/microblaze-v-generic.c
+F: docs/system/riscv/microblaze-v-generic.rst
+
 RX Machines
 -----------
 rx-gdbsim
diff --git a/docs/system/riscv/microblaze-v-generic.rst b/docs/system/riscv/microblaze-v-generic.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/riscv/microblaze-v-generic.rst
@@ -XXX,XX +XXX,XX @@
+Microblaze-V generic board (``amd-microblaze-v-generic``)
+=========================================================
+The AMD MicroBlaze™ V processor is a soft-core RISC-V processor IP for AMD
+adaptive SoCs and FPGAs. The MicroBlaze™ V processor is based on the 32-bit (or
+64-bit) RISC-V instruction set architecture (ISA) and contains interfaces
+compatible with the classic MicroBlaze™ V processor (i.e it is a drop in
+replacement for the classic MicroBlaze™ processor in existing RTL designs).
+More information can be found in below document.
+
+https://docs.amd.com/r/en-US/ug1629-microblaze-v-user-guide/MicroBlaze-V-Architecture
+
+The MicroBlaze™ V generic board in QEMU has following supported devices:
+
+    - timer
+    - uartlite
+    - uart16550
+    - emaclite
+    - timer2
+    - axi emac
+    - axi dma
+
+The MicroBlaze™ V core in QEMU has the following configuration:
+
+    - RV32I base integer instruction set
+    - "Zicsr" Control and Status register instructions
+    - "Zifencei" instruction-fetch
+    - Extensions: m, a, f, c
+
+Running
+"""""""
+Below is an example command line for launching mainline U-boot
+(xilinx_mbv32_defconfig) on the Microblaze-V generic board.
+
+.. code-block:: bash
+
+   $ qemu-system-riscv32 -M amd-microblaze-v-generic \
+     -display none \
+     -device loader,addr=0x80000000,file=u-boot-spl.bin,cpu-num=0 \
+     -device loader,addr=0x80200000,file=u-boot.img \
+     -serial mon:stdio \
+     -device loader,addr=0x83000000,file=system.dtb \
+     -m 2g
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
 .. toctree::
    :maxdepth: 1
 
+   riscv/microblaze-v-generic
    riscv/microchip-icicle-kit
    riscv/shakti-c
    riscv/sifive_u
diff --git a/hw/riscv/microblaze-v-generic.c b/hw/riscv/microblaze-v-generic.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/riscv/microblaze-v-generic.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of Microblaze V generic board.
+ *
+ * based on hw/microblaze/petalogix_ml605_mmu.c
+ *
+ * Copyright (c) 2011 Michal Simek <monstr@monstr.eu>
+ * Copyright (c) 2011 PetaLogix
+ * Copyright (c) 2009 Edgar E. Iglesias.
+ * Copyright (C) 2024, Advanced Micro Devices, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Sai Pavan Boddu <sai.pavan.boddu@amd.com
+ *     and by Michal Simek <michal.simek@amd.com>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "cpu.h"
+#include "hw/sysbus.h"
+#include "sysemu/sysemu.h"
+#include "net/net.h"
+#include "hw/boards.h"
+#include "hw/char/serial-mm.h"
+#include "exec/address-spaces.h"
+#include "hw/char/xilinx_uartlite.h"
+#include "hw/misc/unimp.h"
+
+#define LMB_BRAM_SIZE (128 * KiB)
+#define MEMORY_BASEADDR 0x80000000
+#define INTC_BASEADDR 0x41200000
+#define TIMER_BASEADDR 0x41c00000
+#define TIMER_BASEADDR2 0x41c10000
+#define UARTLITE_BASEADDR 0x40600000
+#define ETHLITE_BASEADDR 0x40e00000
+#define UART16550_BASEADDR 0x44a10000
+#define AXIENET_BASEADDR 0x40c00000
+#define AXIDMA_BASEADDR 0x41e00000
+#define GPIO_BASEADDR 0x40000000
+#define GPIO_BASEADDR2 0x40010000
+#define GPIO_BASEADDR3 0x40020000
+#define I2C_BASEADDR 0x40800000
+#define QSPI_BASEADDR 0x44a00000
+
+#define TIMER_IRQ           0
+#define UARTLITE_IRQ        1
+#define UART16550_IRQ       4
+#define ETHLITE_IRQ         5
+#define TIMER_IRQ2          6
+#define AXIENET_IRQ         7
+#define AXIDMA_IRQ1         8
+#define AXIDMA_IRQ0         9
+
+static void mb_v_generic_init(MachineState *machine)
+{
+    ram_addr_t ram_size = machine->ram_size;
+    DeviceState *dev, *dma, *eth0;
+    Object *ds, *cs;
+    int i;
+    RISCVCPU *cpu;
+    hwaddr ddr_base = MEMORY_BASEADDR;
+    MemoryRegion *phys_lmb_bram = g_new(MemoryRegion, 1);
+    MemoryRegion *phys_ram = g_new(MemoryRegion, 1);
+    qemu_irq irq[32];
+    MemoryRegion *sysmem = get_system_memory();
+
+    cpu = RISCV_CPU(object_new(machine->cpu_type));
+    object_property_set_bool(OBJECT(cpu), "h", false, NULL);
+    object_property_set_bool(OBJECT(cpu), "d", false, NULL);
+    qdev_realize(DEVICE(cpu), NULL, &error_abort);
+    /* Attach emulated BRAM through the LMB.  */
+    memory_region_init_ram(phys_lmb_bram, NULL,
+                           "mb_v.lmb_bram", LMB_BRAM_SIZE,
+                           &error_fatal);
+    memory_region_add_subregion(sysmem, 0x00000000, phys_lmb_bram);
+
+    memory_region_init_ram(phys_ram, NULL, "mb_v.ram",
+                           ram_size, &error_fatal);
+    memory_region_add_subregion(sysmem, ddr_base, phys_ram);
+
+    dev = qdev_new("xlnx.xps-intc");
+    qdev_prop_set_uint32(dev, "kind-of-intr",
+                         1 << UARTLITE_IRQ);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, INTC_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(DEVICE(cpu), 11));
+    for (i = 0; i < 32; i++) {
+        irq[i] = qdev_get_gpio_in(dev, i);
+    }
+
+    /* Uartlite */
+    dev = qdev_new(TYPE_XILINX_UARTLITE);
+    qdev_prop_set_chr(dev, "chardev", serial_hd(0));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, UARTLITE_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[UARTLITE_IRQ]);
+
+    /* Full uart */
+    serial_mm_init(sysmem, UART16550_BASEADDR + 0x1000, 2,
+                   irq[UART16550_IRQ], 115200, serial_hd(1),
+                   DEVICE_LITTLE_ENDIAN);
+
+    /* 2 timers at irq 0 @ 100 Mhz.  */
+    dev = qdev_new("xlnx.xps-timer");
+    qdev_prop_set_uint32(dev, "one-timer-only", 0);
+    qdev_prop_set_uint32(dev, "clock-frequency", 100000000);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, TIMER_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[TIMER_IRQ]);
+
+    /* 2 timers at irq 3 @ 100 Mhz.  */
+    dev = qdev_new("xlnx.xps-timer");
+    qdev_prop_set_uint32(dev, "one-timer-only", 0);
+    qdev_prop_set_uint32(dev, "clock-frequency", 100000000);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, TIMER_BASEADDR2);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[TIMER_IRQ2]);
+
+    /* Emaclite */
+    dev = qdev_new("xlnx.xps-ethernetlite");
+    qemu_configure_nic_device(dev, true, NULL);
+    qdev_prop_set_uint32(dev, "tx-ping-pong", 0);
+    qdev_prop_set_uint32(dev, "rx-ping-pong", 0);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, ETHLITE_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[ETHLITE_IRQ]);
+
+    /* axi ethernet and dma initialization. */
+    eth0 = qdev_new("xlnx.axi-ethernet");
+    dma = qdev_new("xlnx.axi-dma");
+
+    /* FIXME: attach to the sysbus instead */
+    object_property_add_child(qdev_get_machine(), "xilinx-eth", OBJECT(eth0));
+    object_property_add_child(qdev_get_machine(), "xilinx-dma", OBJECT(dma));
+
+    ds = object_property_get_link(OBJECT(dma),
+                                  "axistream-connected-target", NULL);
+    cs = object_property_get_link(OBJECT(dma),
+                                  "axistream-control-connected-target", NULL);
+    qemu_configure_nic_device(eth0, true, NULL);
+    qdev_prop_set_uint32(eth0, "rxmem", 0x1000);
+    qdev_prop_set_uint32(eth0, "txmem", 0x1000);
+    object_property_set_link(OBJECT(eth0), "axistream-connected", ds,
+                             &error_abort);
+    object_property_set_link(OBJECT(eth0), "axistream-control-connected", cs,
+                             &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(eth0), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(eth0), 0, AXIENET_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(eth0), 0, irq[AXIENET_IRQ]);
+
+    ds = object_property_get_link(OBJECT(eth0),
+                                  "axistream-connected-target", NULL);
+    cs = object_property_get_link(OBJECT(eth0),
+                                  "axistream-control-connected-target", NULL);
+    qdev_prop_set_uint32(dma, "freqhz", 100000000);
+    object_property_set_link(OBJECT(dma), "axistream-connected", ds,
+                             &error_abort);
+    object_property_set_link(OBJECT(dma), "axistream-control-connected", cs,
+                             &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dma), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dma), 0, AXIDMA_BASEADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dma), 0, irq[AXIDMA_IRQ0]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dma), 1, irq[AXIDMA_IRQ1]);
+
+    /* unimplemented devices */
+    create_unimplemented_device("gpio", GPIO_BASEADDR, 0x10000);
+    create_unimplemented_device("gpio2", GPIO_BASEADDR2, 0x10000);
+    create_unimplemented_device("gpio3", GPIO_BASEADDR3, 0x10000);
+    create_unimplemented_device("i2c", I2C_BASEADDR, 0x10000);
+    create_unimplemented_device("qspi", QSPI_BASEADDR, 0x10000);
+}
+
+static void mb_v_generic_machine_init(MachineClass *mc)
+{
+    mc->desc = "AMD Microblaze-V generic platform";
+    mc->init = mb_v_generic_init;
+    mc->min_cpus = 1;
+    mc->max_cpus = 1;
+    mc->default_cpu_type = TYPE_RISCV_CPU_BASE;
+    mc->default_cpus = 1;
+}
+
+DEFINE_MACHINE("amd-microblaze-v-generic", mb_v_generic_machine_init)
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select SIFIVE_PLIC
     select UNIMP
 
+config MICROBLAZE_V
+    bool
+    default y
+    depends on RISCV32 || RISCV64
+    select XILINX
+    select XILINX_AXI
+    select XILINX_ETHLITE
+
 config OPENTITAN
     bool
     default y
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
 riscv_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files('riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c'))
+riscv_ss.add(when: 'CONFIG_MICROBLAZE_V', if_true: files('microblaze-v-generic.c'))
 
 hw_arch += {'riscv': riscv_ss}
-- 
2.47.1

From: Sia Jee Heng <jeeheng.sia@starfivetech.com>

Update the SPCR table to accommodate the SPCR Table revision 4 [1].
The SPCR table has been modified to adhere to the revision 4 format [2].

[1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table
[2]: https://github.com/acpica/acpica/pull/931

Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20241028015744.624943-3-jeeheng.sia@starfivetech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/acpi/acpi-defs.h |  7 +++++--
 include/hw/acpi/aml-build.h |  2 +-
 hw/acpi/aml-build.c         | 20 ++++++++++++++++----
 hw/arm/virt-acpi-build.c    |  8 ++++++--
 hw/loongarch/acpi-build.c   |  6 +++++-
 hw/riscv/virt-acpi-build.c  | 12 +++++++++---
 6 files changed, 42 insertions(+), 13 deletions(-)

diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/acpi/acpi-defs.h
+++ b/include/hw/acpi/acpi-defs.h
@@ -XXX,XX +XXX,XX @@ typedef struct AcpiSpcrData {
     uint8_t flow_control;
     uint8_t terminal_type;
     uint8_t language;
-    uint8_t reserved1;
     uint16_t pci_device_id;    /* Must be 0xffff if not PCI device */
     uint16_t pci_vendor_id;    /* Must be 0xffff if not PCI device */
     uint8_t pci_bus;
@@ -XXX,XX +XXX,XX @@ typedef struct AcpiSpcrData {
     uint8_t pci_function;
     uint32_t pci_flags;
     uint8_t pci_segment;
-    uint32_t reserved2;
+    uint32_t uart_clk_freq;
+    uint32_t precise_baudrate;
+    uint32_t namespace_string_length;
+    uint32_t namespace_string_offset;
+    char namespace_string[];
 } AcpiSpcrData;
 
 #define ACPI_FADT_ARM_PSCI_COMPLIANT  (1 << 0)
diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/acpi/aml-build.h
+++ b/include/hw/acpi/aml-build.h
@@ -XXX,XX +XXX,XX @@ void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog,
 
 void build_spcr(GArray *table_data, BIOSLinker *linker,
                 const AcpiSpcrData *f, const uint8_t rev,
-                const char *oem_id, const char *oem_table_id);
+                const char *oem_id, const char *oem_table_id, const char *name);
 #endif
diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -XXX,XX +XXX,XX @@ static void build_processor_hierarchy_node(GArray *tbl, uint32_t flags,
 
 void build_spcr(GArray *table_data, BIOSLinker *linker,
                 const AcpiSpcrData *f, const uint8_t rev,
-                const char *oem_id, const char *oem_table_id)
+                const char *oem_id, const char *oem_table_id, const char *name)
 {
     AcpiTable table = { .sig = "SPCR", .rev = rev, .oem_id = oem_id,
                         .oem_table_id = oem_table_id };
@@ -XXX,XX +XXX,XX @@ void build_spcr(GArray *table_data, BIOSLinker *linker,
     build_append_int_noprefix(table_data, f->pci_flags, 4);
     /* PCI Segment */
     build_append_int_noprefix(table_data, f->pci_segment, 1);
-    /* Reserved */
-    build_append_int_noprefix(table_data, 0, 4);
-
+    if (rev < 4) {
+        /* Reserved */
+        build_append_int_noprefix(table_data, 0, 4);
+    } else {
+        /* UartClkFreq */
+        build_append_int_noprefix(table_data, f->uart_clk_freq, 4);
+        /* PreciseBaudrate */
+        build_append_int_noprefix(table_data, f->precise_baudrate, 4);
+        /* NameSpaceStringLength */
+        build_append_int_noprefix(table_data, f->namespace_string_length, 2);
+        /* NameSpaceStringOffset */
+        build_append_int_noprefix(table_data, f->namespace_string_offset, 2);
+        /* NamespaceString[] */
+        g_array_append_vals(table_data, name, f->namespace_string_length);
+    }
     acpi_table_end(linker, &table);
 }
 /*
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ spcr_setup(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         .pci_flags = 0,
         .pci_segment = 0,
     };
-
-    build_spcr(table_data, linker, &serial, 2, vms->oem_id, vms->oem_table_id);
+    /*
+     * Passing NULL as the SPCR Table for Revision 2 doesn't support
+     * NameSpaceString.
+     */
+    build_spcr(table_data, linker, &serial, 2, vms->oem_id, vms->oem_table_id,
+               NULL);
 }
 
 /*
diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/acpi-build.c
+++ b/hw/loongarch/acpi-build.c
@@ -XXX,XX +XXX,XX @@ spcr_setup(GArray *table_data, BIOSLinker *linker, MachineState *machine)
     };
 
     lvms = LOONGARCH_VIRT_MACHINE(machine);
+    /*
+     * Passing NULL as the SPCR Table for Revision 2 doesn't support
+     * NameSpaceString.
+     */
     build_spcr(table_data, linker, &serial, 2, lvms->oem_id,
-               lvms->oem_table_id);
+               lvms->oem_table_id, NULL);
 }
 
 typedef
diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
 
 /*
  * Serial Port Console Redirection Table (SPCR)
- * Rev: 1.07
+ * Rev: 1.10
  */
 
 static void
 spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
 {
+    const char name[] = ".";
     AcpiSpcrData serial = {
-        .interface_type = 0,       /* 16550 compatible */
+        .interface_type = 0x12,       /* 16550 compatible */
         .base_addr.id = AML_AS_SYSTEM_MEMORY,
         .base_addr.width = 32,
         .base_addr.offset = 0,
@@ -XXX,XX +XXX,XX @@ spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
         .pci_function = 0,
         .pci_flags = 0,
         .pci_segment = 0,
+        .uart_clk_freq = 0,
+        .precise_baudrate = 0,
+        .namespace_string_length = sizeof(name),
+        .namespace_string_offset = 88,
     };
 
-    build_spcr(table_data, linker, &serial, 2, s->oem_id, s->oem_table_id);
+    build_spcr(table_data, linker, &serial, 4, s->oem_id, s->oem_table_id,
+               name);
 }
 
 /* RHCT Node[N] starts at offset 56 */
-- 
2.47.1

From: Sia Jee Heng <jeeheng.sia@starfivetech.com>

Update the virt SPCR golden reference file for RISC-V to accommodate the
SPCR Table revision 4 [1], utilizing the iasl binary compiled from the
latest ACPICA repository. The SPCR table has been modified to
adhere to the revision 4 format [2].

[1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table
[2]: https://github.com/acpica/acpica/pull/931

Diffs from iasl:
/*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20200925 (64-bit version)
  * Copyright (c) 2000 - 2020 Intel Corporation
  *
- * Disassembly of tests/data/acpi/riscv64/virt/SPCR, Wed Aug 28 18:28:19 2024
+ * Disassembly of /tmp/aml-MN0NS2, Wed Aug 28 18:28:19 2024
  *
  * ACPI Data Table [SPCR]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
  */

[000h 0000   4]                    Signature : "SPCR"    [Serial Port Console Redirection table]
-[004h 0004   4]                 Table Length : 00000050
-[008h 0008   1]                     Revision : 02
-[009h 0009   1]                     Checksum : B9
+[004h 0004   4]                 Table Length : 0000005A
+[008h 0008   1]                     Revision : 04
+[009h 0009   1]                     Checksum : 13
 [00Ah 0010   6]                       Oem ID : "BOCHS "
 [010h 0016   8]                 Oem Table ID : "BXPC    "
 [018h 0024   4]                 Oem Revision : 00000001
 [01Ch 0028   4]              Asl Compiler ID : "BXPC"
 [020h 0032   4]        Asl Compiler Revision : 00000001

-[024h 0036   1]               Interface Type : 00
+[024h 0036   1]               Interface Type : 12
 [025h 0037   3]                     Reserved : 000000

[028h 0040  12]         Serial Port Register : [Generic Address Structure]
 [028h 0040   1]                     Space ID : 00 [SystemMemory]
 [029h 0041   1]                    Bit Width : 20
 [02Ah 0042   1]                   Bit Offset : 00
 [02Bh 0043   1]         Encoded Access Width : 01 [Byte Access:8]
 [02Ch 0044   8]                      Address : 0000000010000000

[034h 0052   1]               Interrupt Type : 10
 [035h 0053   1]          PCAT-compatible IRQ : 00
 [036h 0054   4]                    Interrupt : 0000000A
 [03Ah 0058   1]                    Baud Rate : 07
 [03Bh 0059   1]                       Parity : 00
 [03Ch 0060   1]                    Stop Bits : 01
 [03Dh 0061   1]                 Flow Control : 00
 [03Eh 0062   1]                Terminal Type : 00
 [04Ch 0076   1]                     Reserved : 00
 [040h 0064   2]                PCI Device ID : FFFF
 [042h 0066   2]                PCI Vendor ID : FFFF
 [044h 0068   1]                      PCI Bus : 00
 [045h 0069   1]                   PCI Device : 00
 [046h 0070   1]                 PCI Function : 00
 [047h 0071   4]                    PCI Flags : 00000000
 [04Bh 0075   1]                  PCI Segment : 00
-[04Ch 0076   4]                     Reserved : 00000000
+[04Ch 0076 004h]             Uart Clock Freq : 00000000
+[050h 0080 004h]           Precise Baud rate : 00000000
+[054h 0084 002h]       NameSpaceStringLength : 0002
+[056h 0086 002h]       NameSpaceStringOffset : 0058
+[058h 0088 002h]             NamespaceString : "."

-Raw Table Data: Length 80 (0x50)
+Raw Table Data: Length 90 (0x5A)

-    0000: 53 50 43 52 50 00 00 00 02 B9 42 4F 43 48 53 20  // SPCRP.....BOCHS
+    0000: 53 50 43 52 5A 00 00 00 04 13 42 4F 43 48 53 20  // SPCRZ.....BOCHS
     0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
-    0020: 01 00 00 00 00 00 00 00 00 20 00 01 00 00 00 10  // ......... ......
+    0020: 01 00 00 00 12 00 00 00 00 20 00 01 00 00 00 10  // ......... ......
     0030: 00 00 00 00 10 00 0A 00 00 00 07 00 01 00 00 03  // ................
     0040: FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00  // ................
+    0050: 00 00 00 00 02 00 58 00 2E 00                    // ......X...

Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Message-ID: <20241028015744.624943-4-jeeheng.sia@starfivetech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 tests/data/acpi/riscv64/virt/SPCR           | Bin 80 -> 90 bytes
 2 files changed, 1 deletion(-)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/riscv64/virt/SPCR",
diff --git a/tests/data/acpi/riscv64/virt/SPCR b/tests/data/acpi/riscv64/virt/SPCR
index XXXXXXX..XXXXXXX 100644
Binary files a/tests/data/acpi/riscv64/virt/SPCR and b/tests/data/acpi/riscv64/virt/SPCR differ
-- 
2.47.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Since our RISC-V system emulation is only built for little
endian, the HTIF device aims to interface with little endian
memory accesses, thus we can explicit htif_mm_ops:endianness
being DEVICE_LITTLE_ENDIAN.

In that case tswap64() is equivalent to le64_to_cpu(), as in
"convert this 64-bit little-endian value into host cpu order".
Replace to simplify.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241129154304.34946-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
-#include "exec/tswap.h"
+#include "qemu/bswap.h"
 #include "sysemu/dma.h"
 #include "sysemu/runstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             } else {
                 uint64_t syscall[8];
                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
-                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
-                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
+                if (le64_to_cpu(syscall[0]) == PK_SYS_WRITE &&
+                    le64_to_cpu(syscall[1]) == HTIF_DEV_CONSOLE &&
+                    le64_to_cpu(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                     uint8_t ch;
-                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
+                    cpu_physical_memory_read(le64_to_cpu(syscall[2]), &ch, 1);
                     /*
                      * XXX this blocks entire thread. Rewrite to use
                      * qemu_chr_fe_write and background I/O callbacks
@@ -XXX,XX +XXX,XX @@ static void htif_mm_write(void *opaque, hwaddr addr,
 static const MemoryRegionOps htif_mm_ops = {
     .read = htif_mm_read,
     .write = htif_mm_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
-- 
2.47.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Looking at htif_mm_ops[] read/write handlers, we notice they
expect 32-bit values to accumulate into to the 'fromhost' and
'tohost' 64-bit variables. Explicit by setting the .impl
min/max fields.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241129154304.34946-4-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps htif_mm_ops = {
     .read = htif_mm_read,
     .write = htif_mm_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
 };
 
 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
-- 
2.47.1

From: Jim Shu <jim.shu@sifive.com>

Larger initrd image will overlap the DTB at 3GB address. Since 64-bit
system doesn't have 32-bit addressable issue, we just load DTB to the end
of dram in 64-bit system.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241120153935.24706-2-jim.shu@sifive.com>
[ Changes by AF
 -  Store fdt_load_addr_hi32 in the reset vector
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h    |  2 +-
 hw/riscv/boot.c            | 14 +++++++++-----
 hw/riscv/microchip_pfsoc.c |  4 ++--
 hw/riscv/sifive_u.c        |  8 +++++---
 hw/riscv/spike.c           |  4 ++--
 hw/riscv/virt.c            |  2 +-
 6 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(MachineState *machine,
                                bool load_initrd,
                                symbol_fn_t sym_cb);
 uint64_t riscv_compute_fdt_addr(hwaddr dram_start, uint64_t dram_size,
-                                MachineState *ms);
+                                MachineState *ms, RISCVHartArrayState *harts);
 void riscv_load_fdt(hwaddr fdt_addr, void *fdt);
 void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts,
                                hwaddr saddr,
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ out:
  * The FDT is fdt_packed() during the calculation.
  */
 uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
-                                MachineState *ms)
+                                MachineState *ms, RISCVHartArrayState *harts)
 {
     int ret = fdt_pack(ms->fdt);
     hwaddr dram_end, temp;
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
 
     /*
      * We should put fdt as far as possible to avoid kernel/initrd overwriting
-     * its content. But it should be addressable by 32 bit system as well.
-     * Thus, put it at an 2MB aligned address that less than fdt size from the
-     * end of dram or 3GB whichever is lesser.
+     * its content. But it should be addressable by 32 bit system as well in RV32.
+     * Thus, put it near to the end of dram in RV64, and put it near to the end
+     * of dram or 3GB whichever is lesser in RV32.
      */
-    temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
+    if (!riscv_is_32bit(harts)) {
+        temp = dram_end;
+    } else {
+        temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
+    }
 
     return QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
 }
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     bool kernel_as_payload = false;
     target_ulong firmware_end_addr, kernel_start_addr;
     uint64_t kernel_entry;
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     DriveInfo *dinfo = drive_get(IF_SD, 0, 0);
 
     /* Sanity check on RAM size */
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
         /* Compute the fdt load address in dram */
         fdt_load_addr = riscv_compute_fdt_addr(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
                                                memmap[MICROCHIP_PFSOC_DRAM_LO].size,
-                                               machine);
+                                               machine, &s->soc.u_cpus);
         riscv_load_fdt(fdt_load_addr, machine->fdt);
 
         /* Load the reset vector */
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     target_ulong firmware_end_addr, kernel_start_addr;
     const char *firmware_name;
     uint32_t start_addr_hi32 = 0x00000000;
+    uint32_t fdt_load_addr_hi32 = 0x00000000;
     int i;
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     uint64_t kernel_entry;
     DriveInfo *dinfo;
     BlockBackend *blk;
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
 
     fdt_load_addr = riscv_compute_fdt_addr(memmap[SIFIVE_U_DEV_DRAM].base,
                                            memmap[SIFIVE_U_DEV_DRAM].size,
-                                           machine);
+                                           machine, &s->soc.u_cpus);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     if (!riscv_is_32bit(&s->soc.u_cpus)) {
         start_addr_hi32 = (uint64_t)start_addr >> 32;
+        fdt_load_addr_hi32 = fdt_load_addr >> 32;
     }
 
     /* reset vector */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
         start_addr,                    /* start: .dword */
         start_addr_hi32,
         fdt_load_addr,                 /* fdt_laddr: .dword */
-        0x00000000,
+        fdt_load_addr_hi32,
         0x00000000,
                                        /* fw_dyn: */
     };
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     hwaddr firmware_load_addr = memmap[SPIKE_DRAM].base;
     target_ulong kernel_start_addr;
     char *firmware_name;
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     uint64_t kernel_entry;
     char *soc_name;
     int i, base_hartid, hart_count;
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
 
     fdt_load_addr = riscv_compute_fdt_addr(memmap[SPIKE_DRAM].base,
                                            memmap[SPIKE_DRAM].size,
-                                           machine);
+                                           machine, &s->soc[0]);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     /* load the reset vector */
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
 
     fdt_load_addr = riscv_compute_fdt_addr(memmap[VIRT_DRAM].base,
                                            memmap[VIRT_DRAM].size,
-                                           machine);
+                                           machine, &s->soc[0]);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     /* load the reset vector */
-- 
2.47.1

From: Jim Shu <jim.shu@sifive.com>

Add a new struct RISCVBootInfo to sync boot information between multiple
boot functions.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241120153935.24706-3-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h    | 25 ++++++++++-----
 hw/riscv/boot.c            | 65 ++++++++++++++++++++++----------------
 hw/riscv/microchip_pfsoc.c | 11 ++++---
 hw/riscv/opentitan.c       |  4 ++-
 hw/riscv/sifive_e.c        |  4 ++-
 hw/riscv/sifive_u.c        | 12 ++++---
 hw/riscv/spike.c           | 12 ++++---
 hw/riscv/virt.c            | 13 +++++---
 8 files changed, 90 insertions(+), 56 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@
 #define RISCV32_BIOS_BIN    "opensbi-riscv32-generic-fw_dynamic.bin"
 #define RISCV64_BIOS_BIN    "opensbi-riscv64-generic-fw_dynamic.bin"
 
+typedef struct RISCVBootInfo {
+    ssize_t kernel_size;
+    hwaddr image_low_addr;
+    hwaddr image_high_addr;
+
+    bool is_32bit;
+} RISCVBootInfo;
+
 bool riscv_is_32bit(RISCVHartArrayState *harts);
 
 char *riscv_plic_hart_config_string(int hart_count);
 
-target_ulong riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
+void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts);
+target_ulong riscv_calc_kernel_start_addr(RISCVBootInfo *info,
                                           target_ulong firmware_end_addr);
 target_ulong riscv_find_and_load_firmware(MachineState *machine,
                                           const char *default_machine_firmware,
@@ -XXX,XX +XXX,XX @@ char *riscv_find_firmware(const char *firmware_filename,
 target_ulong riscv_load_firmware(const char *firmware_filename,
                                  hwaddr *firmware_load_addr,
                                  symbol_fn_t sym_cb);
-target_ulong riscv_load_kernel(MachineState *machine,
-                               RISCVHartArrayState *harts,
-                               target_ulong firmware_end_addr,
-                               bool load_initrd,
-                               symbol_fn_t sym_cb);
-uint64_t riscv_compute_fdt_addr(hwaddr dram_start, uint64_t dram_size,
-                                MachineState *ms, RISCVHartArrayState *harts);
+void riscv_load_kernel(MachineState *machine,
+                       RISCVBootInfo *info,
+                       target_ulong kernel_start_addr,
+                       bool load_initrd,
+                       symbol_fn_t sym_cb);
+uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
+                                MachineState *ms, RISCVBootInfo *info);
 void riscv_load_fdt(hwaddr fdt_addr, void *fdt);
 void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts,
                                hwaddr saddr,
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ char *riscv_plic_hart_config_string(int hart_count)
     return g_strjoinv(",", (char **)vals);
 }
 
-target_ulong riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
+void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts)
+{
+    info->kernel_size = 0;
+    info->is_32bit = riscv_is_32bit(harts);
+}
+
+target_ulong riscv_calc_kernel_start_addr(RISCVBootInfo *info,
                                           target_ulong firmware_end_addr) {
-    if (riscv_is_32bit(harts)) {
+    if (info->is_32bit) {
         return QEMU_ALIGN_UP(firmware_end_addr, 4 * MiB);
     } else {
         return QEMU_ALIGN_UP(firmware_end_addr, 2 * MiB);
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_firmware(const char *firmware_filename,
     exit(1);
 }
 
-static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
+static void riscv_load_initrd(MachineState *machine, RISCVBootInfo *info)
 {
     const char *filename = machine->initrd_filename;
     uint64_t mem_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
      * halfway into RAM, and for boards with 1GB of RAM or more we put
      * the initrd at 512MB.
      */
-    start = kernel_entry + MIN(mem_size / 2, 512 * MiB);
+    start = info->image_low_addr + MIN(mem_size / 2, 512 * MiB);
 
     size = load_ramdisk(filename, start, mem_size - start);
     if (size == -1) {
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
     }
 }
 
-target_ulong riscv_load_kernel(MachineState *machine,
-                               RISCVHartArrayState *harts,
-                               target_ulong kernel_start_addr,
-                               bool load_initrd,
-                               symbol_fn_t sym_cb)
+void riscv_load_kernel(MachineState *machine,
+                       RISCVBootInfo *info,
+                       target_ulong kernel_start_addr,
+                       bool load_initrd,
+                       symbol_fn_t sym_cb)
 {
     const char *kernel_filename = machine->kernel_filename;
-    uint64_t kernel_load_base, kernel_entry;
+    ssize_t kernel_size;
     void *fdt = machine->fdt;
 
     g_assert(kernel_filename != NULL);
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(MachineState *machine,
      * the (expected) load address load address. This allows kernels to have
      * separate SBI and ELF entry points (used by FreeBSD, for example).
      */
-    if (load_elf_ram_sym(kernel_filename, NULL, NULL, NULL,
-                         NULL, &kernel_load_base, NULL, NULL, 0,
-                         EM_RISCV, 1, 0, NULL, true, sym_cb) > 0) {
-        kernel_entry = kernel_load_base;
+    kernel_size = load_elf_ram_sym(kernel_filename, NULL, NULL, NULL, NULL,
+                                   &info->image_low_addr, &info->image_high_addr,
+                                   NULL, 0, EM_RISCV, 1, 0, NULL, true, sym_cb);
+    if (kernel_size > 0) {
+        info->kernel_size = kernel_size;
         goto out;
     }
 
-    if (load_uimage_as(kernel_filename, &kernel_entry, NULL, NULL,
-                       NULL, NULL, NULL) > 0) {
+    kernel_size = load_uimage_as(kernel_filename, &info->image_low_addr,
+                                 NULL, NULL, NULL, NULL, NULL);
+    if (kernel_size > 0) {
+        info->kernel_size = kernel_size;
+        info->image_high_addr = info->image_low_addr + kernel_size;
         goto out;
     }
 
-    if (load_image_targphys_as(kernel_filename, kernel_start_addr,
-                               current_machine->ram_size, NULL) > 0) {
-        kernel_entry = kernel_start_addr;
+    kernel_size = load_image_targphys_as(kernel_filename, kernel_start_addr,
+                                         current_machine->ram_size, NULL);
+    if (kernel_size > 0) {
+        info->kernel_size = kernel_size;
+        info->image_low_addr = kernel_start_addr;
+        info->image_high_addr = info->image_low_addr + kernel_size;
         goto out;
     }
 
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(MachineState *machine,
 
 out:
     /*
-     * For 32 bit CPUs 'kernel_entry' can be sign-extended by
+     * For 32 bit CPUs 'image_low_addr' can be sign-extended by
      * load_elf_ram_sym().
      */
-    if (riscv_is_32bit(harts)) {
-        kernel_entry = extract64(kernel_entry, 0, 32);
+    if (info->is_32bit) {
+        info->image_low_addr = extract64(info->image_low_addr, 0, 32);
     }
 
     if (load_initrd && machine->initrd_filename) {
-        riscv_load_initrd(machine, kernel_entry);
+        riscv_load_initrd(machine, info);
     }
 
     if (fdt && machine->kernel_cmdline && *machine->kernel_cmdline) {
         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
                                 machine->kernel_cmdline);
     }
-
-    return kernel_entry;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ out:
  * The FDT is fdt_packed() during the calculation.
  */
 uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
-                                MachineState *ms, RISCVHartArrayState *harts)
+                                MachineState *ms, RISCVBootInfo *info)
 {
     int ret = fdt_pack(ms->fdt);
     hwaddr dram_end, temp;
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
      * Thus, put it near to the end of dram in RV64, and put it near to the end
      * of dram or 3GB whichever is lesser in RV32.
      */
-    if (!riscv_is_32bit(harts)) {
+    if (!info->is_32bit) {
         temp = dram_end;
     } else {
         temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     uint64_t kernel_entry;
     uint64_t fdt_load_addr;
     DriveInfo *dinfo = drive_get(IF_SD, 0, 0);
+    RISCVBootInfo boot_info;
 
     /* Sanity check on RAM size */
     if (machine->ram_size < mc->default_ram_size) {
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
                                                      &firmware_load_addr, NULL);
 
+    riscv_boot_info_init(&boot_info, &s->soc.u_cpus);
     if (kernel_as_payload) {
-        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc.u_cpus,
+        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                          firmware_end_addr);
 
-        kernel_entry = riscv_load_kernel(machine, &s->soc.u_cpus,
-                                         kernel_start_addr, true, NULL);
+        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
+                          true, NULL);
+        kernel_entry = boot_info.image_low_addr;
 
         /* Compute the fdt load address in dram */
         fdt_load_addr = riscv_compute_fdt_addr(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
                                                memmap[MICROCHIP_PFSOC_DRAM_LO].size,
-                                               machine, &s->soc.u_cpus);
+                                               machine, &boot_info);
         riscv_load_fdt(fdt_load_addr, machine->fdt);
 
         /* Load the reset vector */
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void opentitan_machine_init(MachineState *machine)
     OpenTitanState *s = OPENTITAN_MACHINE(machine);
     const MemMapEntry *memmap = ibex_memmap;
     MemoryRegion *sys_mem = get_system_memory();
+    RISCVBootInfo boot_info;
 
     if (machine->ram_size != mc->default_ram_size) {
         char *sz = size_to_str(mc->default_ram_size);
@@ -XXX,XX +XXX,XX @@ static void opentitan_machine_init(MachineState *machine)
         riscv_load_firmware(machine->firmware, &firmware_load_addr, NULL);
     }
 
+    riscv_boot_info_init(&boot_info, &s->soc.cpus);
     if (machine->kernel_filename) {
-        riscv_load_kernel(machine, &s->soc.cpus,
+        riscv_load_kernel(machine, &boot_info,
                           memmap[IBEX_DEV_RAM].base,
                           false, NULL);
     }
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_machine_init(MachineState *machine)
     SiFiveEState *s = RISCV_E_MACHINE(machine);
     MemoryRegion *sys_mem = get_system_memory();
     int i;
+    RISCVBootInfo boot_info;
 
     if (machine->ram_size != mc->default_ram_size) {
         char *sz = size_to_str(mc->default_ram_size);
@@ -XXX,XX +XXX,XX @@ static void sifive_e_machine_init(MachineState *machine)
     rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                           memmap[SIFIVE_E_DEV_MROM].base, &address_space_memory);
 
+    riscv_boot_info_init(&boot_info, &s->soc.cpus);
     if (machine->kernel_filename) {
-        riscv_load_kernel(machine, &s->soc.cpus,
+        riscv_load_kernel(machine, &boot_info,
                           memmap[SIFIVE_E_DEV_DTIM].base,
                           false, NULL);
     }
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     BlockBackend *blk;
     DeviceState *flash_dev, *sd_dev, *card_dev;
     qemu_irq flash_cs, sd_cs;
+    RISCVBootInfo boot_info;
 
     /* Initialize SoC */
     object_initialize_child(OBJECT(machine), "soc", &s->soc, TYPE_RISCV_U_SOC);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
                                                      &start_addr, NULL);
 
+    riscv_boot_info_init(&boot_info, &s->soc.u_cpus);
     if (machine->kernel_filename) {
-        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc.u_cpus,
+        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                          firmware_end_addr);
-
-        kernel_entry = riscv_load_kernel(machine, &s->soc.u_cpus,
-                                         kernel_start_addr, true, NULL);
+        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
+                          true, NULL);
+        kernel_entry = boot_info.image_low_addr;
     } else {
        /*
         * If dynamic firmware is used, it doesn't know where is the next mode
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
 
     fdt_load_addr = riscv_compute_fdt_addr(memmap[SIFIVE_U_DEV_DRAM].base,
                                            memmap[SIFIVE_U_DEV_DRAM].size,
-                                           machine, &s->soc.u_cpus);
+                                           machine, &boot_info);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     if (!riscv_is_32bit(&s->soc.u_cpus)) {
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     char *soc_name;
     int i, base_hartid, hart_count;
     bool htif_custom_base = false;
+    RISCVBootInfo boot_info;
 
     /* Check socket count limit */
     if (SPIKE_SOCKETS_MAX < riscv_socket_count(machine)) {
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     create_fdt(s, memmap, riscv_is_32bit(&s->soc[0]), htif_custom_base);
 
     /* Load kernel */
+    riscv_boot_info_init(&boot_info, &s->soc[0]);
     if (machine->kernel_filename) {
-        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
+        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                          firmware_end_addr);
 
-        kernel_entry = riscv_load_kernel(machine, &s->soc[0],
-                                         kernel_start_addr,
-                                         true, htif_symbol_callback);
+        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
+                          true, htif_symbol_callback);
+        kernel_entry = boot_info.image_low_addr;
     } else {
        /*
         * If dynamic firmware is used, it doesn't know where is the next mode
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
 
     fdt_load_addr = riscv_compute_fdt_addr(memmap[SPIKE_DRAM].base,
                                            memmap[SPIKE_DRAM].size,
-                                           machine, &s->soc[0]);
+                                           machine, &boot_info);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     /* load the reset vector */
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
     uint64_t fdt_load_addr;
     uint64_t kernel_entry = 0;
     BlockBackend *pflash_blk0;
+    RISCVBootInfo boot_info;
 
     /*
      * An user provided dtb must include everything, including
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
         }
     }
 
+    riscv_boot_info_init(&boot_info, &s->soc[0]);
+
     if (machine->kernel_filename && !kernel_entry) {
-        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
+        kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                          firmware_end_addr);
-
-        kernel_entry = riscv_load_kernel(machine, &s->soc[0],
-                                         kernel_start_addr, true, NULL);
+        riscv_load_kernel(machine, &boot_info, kernel_start_addr,
+                          true, NULL);
+        kernel_entry = boot_info.image_low_addr;
     }
 
     fdt_load_addr = riscv_compute_fdt_addr(memmap[VIRT_DRAM].base,
                                            memmap[VIRT_DRAM].size,
-                                           machine, &s->soc[0]);
+                                           machine, &boot_info);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     /* load the reset vector */
-- 
2.47.1

From: Jim Shu <jim.shu@sifive.com>

DTB is placed to the end of memory, so we will check if the start
address of DTB overlaps to the address of kernel/initrd.

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVBootInfo {
     hwaddr image_low_addr;
     hwaddr image_high_addr;
 
+    hwaddr initrd_start;
+    ssize_t initrd_size;
+
     bool is_32bit;
 } RISCVBootInfo;
 
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ char *riscv_plic_hart_config_string(int hart_count)
 void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts)
 {
     info->kernel_size = 0;
+    info->initrd_size = 0;
     info->is_32bit = riscv_is_32bit(harts);
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, RISCVBootInfo *info)
         }
     }
 
+    info->initrd_start = start;
+    info->initrd_size = size;
+
     /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
     if (fdt) {
         end = start + size;
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
     int ret = fdt_pack(ms->fdt);
     hwaddr dram_end, temp;
     int fdtsize;
+    uint64_t dtb_start, dtb_start_limit;
 
     /* Should only fail if we've built a corrupted tree */
     g_assert(ret == 0);
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
         exit(1);
     }
 
+    if (info->initrd_size) {
+        /* If initrd is successfully loaded, place DTB after it. */
+        dtb_start_limit = info->initrd_start + info->initrd_size;
+    } else if (info->kernel_size) {
+        /* If only kernel is successfully loaded, place DTB after it. */
+        dtb_start_limit = info->image_high_addr;
+    } else {
+        /* Otherwise, do not check DTB overlapping */
+        dtb_start_limit = 0;
+    }
+
     /*
      * A dram_size == 0, usually from a MemMapEntry[].size element,
      * means that the DRAM block goes all the way to ms->ram_size.
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_compute_fdt_addr(hwaddr dram_base, hwaddr dram_size,
         temp = (dram_base < 3072 * MiB) ? MIN(dram_end, 3072 * MiB) : dram_end;
     }
 
-    return QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
+    dtb_start = QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
+
+    if (dtb_start_limit && (dtb_start < dtb_start_limit)) {
+        error_report("No enough memory to place DTB after kernel/initrd");
+        exit(1);
+    }
+
+    return dtb_start;
 }
 
 /*
-- 
2.47.1

From: "Fea.Wang" <fea.wang@sifive.com>

Refer to the draft of svukte extension from:
https://github.com/riscv/riscv-isa-manual/pull/1564

Svukte provides a means to make user-mode accesses to supervisor memory
raise page faults in constant time, mitigating attacks that attempt to
discover the supervisor software's address-space layout.

Signed-off-by: Fea.Wang <fea.wang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241203034932.25185-2-fea.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 1 +
 1 file changed, 1 insertion(+)

From: "Fea.Wang" <fea.wang@sifive.com>

Svukte extension add UKTE bit, bit[8] in senvcfg CSR. The bit will be
supported when the svukte extension is enabled.

When senvcfg[UKTE] bit is set, the memory access from U-mode should do
the svukte check only except HLV/HLVX/HSV H-mode instructions which
depend on hstatus[HUKTE].

Signed-off-by: Fea.Wang <fea.wang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241203034932.25185-3-fea.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 1 +
 target/riscv/csr.c      | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define SENVCFG_CBIE                       MENVCFG_CBIE
 #define SENVCFG_CBCFE                      MENVCFG_CBCFE
 #define SENVCFG_CBZE                       MENVCFG_CBZE
+#define SENVCFG_UKTE                       BIT(8)
 
 #define HENVCFG_FIOM                       MENVCFG_FIOM
 #define HENVCFG_LPE                        MENVCFG_LPE
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
         mask |= SENVCFG_SSE;
     }
 
+    if (env_archcpu(env)->cfg.ext_svukte) {
+        mask |= SENVCFG_UKTE;
+    }
+
     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
     return RISCV_EXCP_NONE;
 }
-- 
2.47.1

From: "Fea.Wang" <fea.wang@sifive.com>

Svukte extension add HUKTE bit, bit[24] in hstatus CSR. The written
value will be masked when the svukte extension is not enabled.

When hstatus[HUKTE] bit is set, HLV/HLVX/HSV work in the U-mode should
do svukte check.

Signed-off-by: Fea.Wang <fea.wang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241203034932.25185-4-fea.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 1 +
 target/riscv/csr.c      | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define HSTATUS_VTVM         0x00100000
 #define HSTATUS_VTW          0x00200000
 #define HSTATUS_VTSR         0x00400000
+#define HSTATUS_HUKTE        0x01000000
 #define HSTATUS_VSXL         0x300000000
 
 #define HSTATUS32_WPRI       0xFF8FF87E
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
                                     target_ulong val)
 {
+    if (!env_archcpu(env)->cfg.ext_svukte) {
+        val = val & (~HSTATUS_HUKTE);
+    }
     env->hstatus = val;
     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
         qemu_log_mask(LOG_UNIMP,
-- 
2.47.1

From: "Fea.Wang" <fea.wang@sifive.com>

Follow the Svukte spec, do the memory access address checking

1. Include instruction fetches or explicit memory accesses
2. System run in effective privilege U or VU
3. Check senvcfg[UKTE] being set, or hstatus[HUKTE] being set if
instruction is HLV, HLVX, HSV and execute from U mode to VU mode
4. Depend on Sv39 and check virtual addresses bit[SXLEN-1]
5. Raises a page-fault exception corresponding to the original access
type.

Ref: https://github.com/riscv/riscv-isa-manual/pull/1564/files

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Fea.Wang <fea.wang@sifive.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241203034932.25185-5-fea.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 55 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot, hwaddr addr,
     return TRANSLATE_SUCCESS;
 }
 
+/* Returns 'true' if a svukte address check is needed */
+static bool do_svukte_check(CPURISCVState *env, bool first_stage,
+                             int mode, bool virt)
+{
+    /* Svukte extension depends on Sv39. */
+    if (!(env_archcpu(env)->cfg.ext_svukte ||
+        !first_stage ||
+        VM_1_10_SV39 != get_field(env->satp, SATP64_MODE))) {
+        return false;
+    }
+
+    /*
+     * Check hstatus.HUKTE if the effective mode is switched to VU-mode by
+     * executing HLV/HLVX/HSV in U-mode.
+     * For other cases, check senvcfg.UKTE.
+     */
+    if (env->priv == PRV_U && !env->virt_enabled && virt) {
+        if (!get_field(env->hstatus, HSTATUS_HUKTE)) {
+            return false;
+        }
+    } else if (!get_field(env->senvcfg, SENVCFG_UKTE)) {
+        return false;
+    }
+
+    /*
+     * Svukte extension is qualified only in U or VU-mode.
+     *
+     * Effective mode can be switched to U or VU-mode by:
+     *   - M-mode + mstatus.MPRV=1 + mstatus.MPP=U-mode.
+     *   - Execute HLV/HLVX/HSV from HS-mode + hstatus.SPVP=0.
+     *   - U-mode.
+     *   - VU-mode.
+     *   - Execute HLV/HLVX/HSV from U-mode + hstatus.HU=1.
+     */
+    if (mode != PRV_U) {
+        return false;
+    }
+
+    return true;
+}
+
+static bool check_svukte_addr(CPURISCVState *env, vaddr addr)
+{
+    /* svukte extension excludes RV32 */
+    uint32_t sxlen = 32 * riscv_cpu_sxl(env);
+    uint64_t high_bit = addr & (1UL << (sxlen - 1));
+    return !high_bit;
+}
+
 /*
  * get_physical_address - get the physical address for this virtual address
  *
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     MemTxResult res;
     MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     int mode = mmuidx_priv(mmu_idx);
+    bool virt = mmuidx_2stage(mmu_idx);
     bool use_background = false;
     hwaddr ppn;
     int napot_bits = 0;
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     bool is_sstack_idx = ((mmu_idx & MMU_IDX_SS_WRITE) == MMU_IDX_SS_WRITE);
     bool sstack_page = false;
 
+    if (do_svukte_check(env, first_stage, mode, virt) &&
+        !check_svukte_addr(env, addr)) {
+        return TRANSLATE_FAIL;
+    }
+
     /*
      * Check if we should use the background registers for the two
      * stage translation. We don't need to check if we actually need
-- 
2.47.1

From: "Fea.Wang" <fea.wang@sifive.com>

Add "svukte" in the ISA string when svukte extension is enabled.

Signed-off-by: Fea.Wang <fea.wang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241203034932.25185-6-fea.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
     ISA_EXT_DATA_ENTRY(svpbmt, PRIV_VERSION_1_12_0, ext_svpbmt),
+    ISA_EXT_DATA_ENTRY(svukte, PRIV_VERSION_1_13_0, ext_svukte),
     ISA_EXT_DATA_ENTRY(svvptc, PRIV_VERSION_1_13_0, ext_svvptc),
     ISA_EXT_DATA_ENTRY(xtheadba, PRIV_VERSION_1_11_0, ext_xtheadba),
     ISA_EXT_DATA_ENTRY(xtheadbb, PRIV_VERSION_1_11_0, ext_xtheadbb),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[] = {
 
 /* These are experimental so mark with 'x-' */
 const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
+    MULTI_EXT_CFG_BOOL("x-svukte", ext_svukte, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.47.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Rather than relying on implicit includes, explicit them,
in order to avoid when refactoring unrelated headers:

target/riscv/vector_internals.h:36:12: error: call to undeclared function 'FIELD_EX32'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     36 |     return FIELD_EX32(simd_data(desc), VDATA, NF);
        |            ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241203200828.47311-2-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_RISCV_VECTOR_INTERNALS_H
 
 #include "qemu/bitops.h"
+#include "hw/registerfields.h"
 #include "cpu.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
-- 
2.47.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Rather than relying on implicit includes, explicit them,
in order to avoid when refactoring unrelated headers:

target/riscv/internals.h:49:15: error: use of undeclared identifier 'PRV_S'
     49 |         ret = PRV_S;
        |               ^
  target/riscv/internals.h:93:9: error: call to undeclared function 'env_archcpu'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     93 |     if (env_archcpu(env)->cfg.ext_zfinx) {
        |         ^
  target/riscv/internals.h:101:15: error: unknown type name 'float32'; did you mean 'float'?
    101 | static inline float32 check_nanbox_s(CPURISCVState *env, uint64_t f)
        |               ^~~~~~~
        |               float

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241203200828.47311-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/internals.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@
 #ifndef RISCV_CPU_INTERNALS_H
 #define RISCV_CPU_INTERNALS_H
 
+#include "exec/cpu-common.h"
 #include "hw/registerfields.h"
+#include "fpu/softfloat-types.h"
+#include "target/riscv/cpu_bits.h"
 
 /*
  * The current MMU Modes are:
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 68c9e54bea handled a situation where a warning was being shown
when using the 'sifive_e' cpu when disabling the named extension zic64b.
It makes little sense to show user warnings for named extensions that
users can't control, and the solution taken was to disable zic64b
manually in riscv_cpu_update_named_features().

This solution won't scale well when adding more named features, and can
eventually end up repeating riscv_cpu_disable_priv_spec_isa_exts().

Change riscv_cpu_disable_priv_spec_isa_exts() to not show warnings when
disabling a named feature. This will accomplish the same thing we're
doing today while avoiding having two points where we're disabling
exts via priv_ver mismatch.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20241113171755.978109-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
             }
 
             isa_ext_update_enabled(cpu, edata->ext_enable_offset, false);
+
+            /*
+             * Do not show user warnings for named features that users
+             * can't enable/disable in the command line. See commit
+             * 68c9e54bea for more info.
+             */
+            if (cpu_cfg_offset_is_named_feat(edata->ext_enable_offset)) {
+                continue;
+            }
 #ifndef CONFIG_USER_ONLY
             warn_report("disabling %s extension for hart 0x" TARGET_FMT_lx
                         " because privilege spec version does not match",
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
         cpu->cfg.has_priv_1_13 = true;
     }
 
-    /* zic64b is 1.12 or later */
     cpu->cfg.ext_zic64b = cpu->cfg.cbom_blocksize == 64 &&
                           cpu->cfg.cbop_blocksize == 64 &&
-                          cpu->cfg.cboz_blocksize == 64 &&
-                          cpu->cfg.has_priv_1_12;
+                          cpu->cfg.cboz_blocksize == 64;
 }
 
 static void riscv_cpu_validate_g(RISCVCPU *cpu)
-- 
2.47.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

ssstateen is defined in RVA22 as:

"Supervisor-mode view of the state-enable extension. The supervisor-mode
(sstateen0-3) and hypervisor-mode (hstateen0-3) state-enable registers
must be provided."

Add ssstateen as a named feature that is available if we also have
smstateen.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20241113171755.978109-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     | 1 +
 target/riscv/cpu.c         | 2 ++
 target/riscv/tcg/tcg-cpu.c | 9 ++++++++-
 3 files changed, 11 insertions(+), 1 deletion(-)

From: MollyChen <xiaoou@iscas.ac.cn>

Add a CPU entry for the RV64 XiangShan NANHU CPU which
supports single-core and dual-core configurations. More
details can be found at
https://docs.xiangshan.cc/zh-cn/latest/integration/overview

Signed-off-by: MollyChen <xiaoou@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20241205073622.46052-1-xiaoou@iscas.ac.cn>
[ Changes by AF
 - Fixup code formatting
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
 #define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
 #define TYPE_RISCV_CPU_TT_ASCALON       RISCV_CPU_TYPE_NAME("tt-ascalon")
+#define TYPE_RISCV_CPU_XIANGSHAN_NANHU  RISCV_CPU_TYPE_NAME("xiangshan-nanhu")
 #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
 
 OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_tt_ascalon_cpu_init(Object *obj)
 #endif
 }
 
+static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
+{
+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+
+    riscv_cpu_set_misa_ext(env, RVG | RVC | RVB | RVS | RVU);
+    env->priv_ver = PRIV_VERSION_1_12_0;
+
+    /* Enable ISA extensions */
+    cpu->cfg.ext_zbc = true;
+    cpu->cfg.ext_zbkb = true;
+    cpu->cfg.ext_zbkc = true;
+    cpu->cfg.ext_zbkx = true;
+    cpu->cfg.ext_zknd = true;
+    cpu->cfg.ext_zkne = true;
+    cpu->cfg.ext_zknh = true;
+    cpu->cfg.ext_zksed = true;
+    cpu->cfg.ext_zksh = true;
+    cpu->cfg.ext_svinval = true;
+
+    cpu->cfg.mmu = true;
+    cpu->cfg.pmp = true;
+
+#ifndef CONFIG_USER_ONLY
+    set_satp_mode_max_supported(cpu, VM_1_10_SV39);
+#endif
+}
+
 #ifdef CONFIG_TCG
 static void rv128_base_cpu_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
+    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
+                                                 MXL_RV64, rv64_xiangshan_nanhu_cpu_init),
 #ifdef CONFIG_TCG
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
 #endif /* CONFIG_TCG */
-- 
2.47.1