Series comparison

 [PULL 0/6] loongarch-to-apply queue
-The following changes since commit 6f625ce2f21d6a1243065d236298277c56f972d5:
+The following changes since commit ffaf7f0376f8040ce9068d71ae9ae8722505c42e:
-  Merge tag 'pull-request-2024-10-21' of https://gitlab.com/thuth/qemu into staging (2024-10-21 17:12:59 +0100)
+  Merge tag 'pull-10.0-testing-and-gdstub-updates-100225-1' of https://gitlab.com/stsquad/qemu into staging (2025-02-10 13:26:17 -0500)
 are available in the Git repository at:
-  https://gitlab.com/gaosong/qemu.git tags/pull-loongarch-20241024
+  https://gitlab.com/bibo-mao/qemu.git tags/pull-loongarch-20250212
-for you to fetch changes up to c44e0d6ba280dcc6bdf4ed555020c61d564b526c:
+for you to fetch changes up to 456739ce4347c21b6fa2ec1b6585bc4a6504446f:
-  target/loongarch: Add steal time support on migration (2024-10-24 17:27:55 +0800)
+  hw/loongarch/virt: CPU irq line connection improvement (2025-02-12 10:05:22 +0800)
 ----------------------------------------------------------------
-pull-loongarch-20241024
+pull-loongarch-20250212 queue
 ----------------------------------------------------------------
 Bibo Mao (6):
-      target/loongarch: Add loongson binary translation feature
+      hw/loongarch/virt: Rename filename acpi-build with virt-acpi-build
-      target/loongarch: Implement lbt registers save/restore function
+      hw/loongarch/virt: Rename function prefix name
-      target/loongarch/kvm: Implement LoongArch PMU extension
+      hw/loongarch/virt: Add separate file for fdt building
-      linux-headers: loongarch: Add kvm_para.h and unistd_64.h
+      hw/loongarch/virt: Set iocsr address space when CPU is created
-      linux-headers: Update to Linux v6.12-rc3
+      hw/loongarch/virt: Remove unused ipistate
-      target/loongarch: Add steal time support on migration
+      hw/loongarch/virt: CPU irq line connection improvement
- include/standard-headers/drm/drm_fourcc.h          |  43 +++
+ hw/loongarch/meson.build                         |   6 +-
- include/standard-headers/linux/const.h             |  17 ++
+ hw/loongarch/{acpi-build.c => virt-acpi-build.c} |   6 +-
- include/standard-headers/linux/ethtool.h           | 226 +++++++++++++++
+ hw/loongarch/virt-fdt-build.c                    | 535 ++++++++++++++++++++
- include/standard-headers/linux/fuse.h              |  22 +-
+ hw/loongarch/virt.c                              | 593 ++---------------------
- include/standard-headers/linux/input-event-codes.h |   2 +
+ include/hw/loongarch/virt.h                      |   5 +-
- include/standard-headers/linux/pci_regs.h          |  41 ++-
+ target/loongarch/cpu.h                           |   2 -
- include/standard-headers/linux/virtio_balloon.h    |  16 +-
+files changed, 584 insertions(+), 563 deletions(-)
- include/standard-headers/linux/virtio_gpu.h        |   1 +
+ rename hw/loongarch/{acpi-build.c => virt-acpi-build.c} (99%)
- linux-headers/asm-arm64/mman.h                     |   9 +
+ create mode 100644 hw/loongarch/virt-fdt-build.c
  linux-headers/asm-arm64/unistd.h                   |  25 +-
  linux-headers/asm-generic/unistd.h                 |   6 +-
  linux-headers/asm-loongarch/kvm.h                  |  24 ++
  linux-headers/asm-loongarch/kvm_para.h             |  21 ++
  linux-headers/asm-loongarch/unistd.h               |   4 +-
  linux-headers/asm-loongarch/unistd_64.h            | 320 +++++++++++++++++++++
  linux-headers/asm-riscv/kvm.h                      |   7 +
  linux-headers/asm-riscv/unistd.h                   |  41 +--
  linux-headers/asm-x86/kvm.h                        |   2 +
  linux-headers/asm-x86/unistd_64.h                  |   1 +
  linux-headers/asm-x86/unistd_x32.h                 |   1 +
  linux-headers/linux/bits.h                         |   3 +
  linux-headers/linux/const.h                        |  17 ++
  linux-headers/linux/iommufd.h                      | 143 +++++++--
  linux-headers/linux/kvm.h                          |  23 +-
  linux-headers/linux/mman.h                         |   1 +
  linux-headers/linux/psp-sev.h                      |  28 ++
  scripts/update-linux-headers.sh                    |   4 +
  target/loongarch/cpu.c                             |  43 +++
  target/loongarch/cpu.h                             |  23 ++
  target/loongarch/kvm/kvm.c                         | 225 ++++++++++++++-
  target/loongarch/loongarch-qmp-cmds.c              |   2 +-
  target/loongarch/machine.c                         |  30 +-
 files changed, 1274 insertions(+), 97 deletions(-)
  create mode 100644 linux-headers/asm-loongarch/kvm_para.h
  create mode 100644 linux-headers/asm-loongarch/unistd_64.h

-[PULL 5/6] linux-headers: Update to Linux v6.12-rc3
+[PULL 1/6] hw/loongarch/virt: Rename filename acpi-build with virt-acpi-build
-From: Bibo Mao <maobibo@loongson.cn>
+File acpi-build.c is relative with virt machine type, rename it with
+virt-acpi-build.c
 This update contains the required header changes for LoongArch
 KVM LBT feature.
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Acked-by: Song Gao <gaosong@loongson.cn>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20241017020708.1728620-3-maobibo@loongson.cn>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- include/standard-headers/drm/drm_fourcc.h     |  43 +++
+ hw/loongarch/meson.build                         | 2 +-
- include/standard-headers/linux/const.h        |  17 +
+ hw/loongarch/{acpi-build.c => virt-acpi-build.c} | 0
- include/standard-headers/linux/ethtool.h      | 226 +++++++++++++
+files changed, 1 insertion(+), 1 deletion(-)
- include/standard-headers/linux/fuse.h         |  22 +-
+ rename hw/loongarch/{acpi-build.c => virt-acpi-build.c} (100%)
  .../linux/input-event-codes.h                 |   2 +
  include/standard-headers/linux/pci_regs.h     |  41 ++-
  .../standard-headers/linux/virtio_balloon.h   |  16 +-
  include/standard-headers/linux/virtio_gpu.h   |   1 +
  linux-headers/asm-arm64/mman.h                |   9 +
  linux-headers/asm-arm64/unistd.h              |  25 +-
  linux-headers/asm-generic/unistd.h            |   6 +-
  linux-headers/asm-loongarch/kvm.h             |  24 ++
  linux-headers/asm-loongarch/kvm_para.h        |  21 ++
  linux-headers/asm-loongarch/unistd.h          |   4 +-
  linux-headers/asm-loongarch/unistd_64.h       | 320 ++++++++++++++++++
  linux-headers/asm-riscv/kvm.h                 |   7 +
  linux-headers/asm-riscv/unistd.h              |  41 +--
  linux-headers/asm-x86/kvm.h                   |   2 +
  linux-headers/asm-x86/unistd_64.h             |   1 +
  linux-headers/asm-x86/unistd_x32.h            |   1 +
  linux-headers/linux/bits.h                    |   3 +
  linux-headers/linux/const.h                   |  17 +
  linux-headers/linux/iommufd.h                 | 143 ++++++--
  linux-headers/linux/kvm.h                     |  23 +-
  linux-headers/linux/mman.h                    |   1 +
  linux-headers/linux/psp-sev.h                 |  28 ++
 files changed, 951 insertions(+), 93 deletions(-)
  create mode 100644 linux-headers/asm-loongarch/kvm_para.h
  create mode 100644 linux-headers/asm-loongarch/unistd_64.h
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
+diff --git a/hw/loongarch/meson.build b/hw/loongarch/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/drm/drm_fourcc.h
+--- a/hw/loongarch/meson.build
-+++ b/include/standard-headers/drm/drm_fourcc.h
++++ b/hw/loongarch/meson.build
-@@ -XXX,XX +XXX,XX @@ extern "C" {
+@@ -XXX,XX +XXX,XX @@ loongarch_ss.add(files(
-  */
+ ))
- #define I915_FORMAT_MOD_4_TILED_MTL_RC_CCS_CC fourcc_mod_code(INTEL, 15)
+ common_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files('fw_cfg.c'))
+ loongarch_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files('virt.c'))
-+/*
+-loongarch_ss.add(when: 'CONFIG_ACPI', if_true: files('acpi-build.c'))
-+ * Intel Color Control Surfaces (CCS) for graphics ver. 20 unified compression
++loongarch_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
-+ * on integrated graphics
-+ *
+ hw_arch += {'loongarch': loongarch_ss}
-+ * The main surface is Tile 4 and at plane index 0. For semi-planar formats
+diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/virt-acpi-build.c
-+ * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
+similarity index 100%
-+ * 0 and 1, respectively. The CCS for all planes are stored outside of the
+rename from hw/loongarch/acpi-build.c
-+ * GEM object in a reserved memory area dedicated for the storage of the
+rename to hw/loongarch/virt-acpi-build.c
 + * CCS data for all compressible GEM objects.
 + */
 +#define I915_FORMAT_MOD_4_TILED_LNL_CCS fourcc_mod_code(INTEL, 16)
 +
 +/*
 + * Intel Color Control Surfaces (CCS) for graphics ver. 20 unified compression
 + * on discrete graphics
 + *
 + * The main surface is Tile 4 and at plane index 0. For semi-planar formats
 + * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
 + * 0 and 1, respectively. The CCS for all planes are stored outside of the
 + * GEM object in a reserved memory area dedicated for the storage of the
 + * CCS data for all compressible GEM objects. The GEM object must be stored in
 + * contiguous memory with a size aligned to 64KB
 + */
 +#define I915_FORMAT_MOD_4_TILED_BMG_CCS fourcc_mod_code(INTEL, 17)
 +
  /*
   * Tiled, NV12MT, grouped in 64 (pixels) x 32 (lines) -sized macroblocks
   *
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
  #define AMD_FMT_MOD_TILE_VER_GFX10 2
  #define AMD_FMT_MOD_TILE_VER_GFX10_RBPLUS 3
  #define AMD_FMT_MOD_TILE_VER_GFX11 4
 +#define AMD_FMT_MOD_TILE_VER_GFX12 5
  /*
   * 64K_S is the same for GFX9/GFX10/GFX10_RBPLUS and hence has GFX9 as canonical
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
  /*
   * 64K_D for non-32 bpp is the same for GFX9/GFX10/GFX10_RBPLUS and hence has
   * GFX9 as canonical version.
 + *
 + * 64K_D_2D on GFX12 is identical to 64K_D on GFX11.
   */
  #define AMD_FMT_MOD_TILE_GFX9_64K_D 10
  #define AMD_FMT_MOD_TILE_GFX9_64K_S_X 25
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
  #define AMD_FMT_MOD_TILE_GFX9_64K_R_X 27
  #define AMD_FMT_MOD_TILE_GFX11_256K_R_X 31
 +/* Gfx12 swizzle modes:
 + *    0 - LINEAR
 + *    1 - 256B_2D  - 2D block dimensions
 + *    2 - 4KB_2D
 + *    3 - 64KB_2D
 + *    4 - 256KB_2D
 + *    5 - 4KB_3D   - 3D block dimensions
 + *    6 - 64KB_3D
 + *    7 - 256KB_3D
 + */
 +#define AMD_FMT_MOD_TILE_GFX12_256B_2D 1
 +#define AMD_FMT_MOD_TILE_GFX12_4K_2D 2
 +#define AMD_FMT_MOD_TILE_GFX12_64K_2D 3
 +#define AMD_FMT_MOD_TILE_GFX12_256K_2D 4
 +
  #define AMD_FMT_MOD_DCC_BLOCK_64B 0
  #define AMD_FMT_MOD_DCC_BLOCK_128B 1
  #define AMD_FMT_MOD_DCC_BLOCK_256B 2
 diff --git a/include/standard-headers/linux/const.h b/include/standard-headers/linux/const.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/const.h
 +++ b/include/standard-headers/linux/const.h
@@ -XXX,XX +XXX,XX @@
  #define _BITUL(x)    (_UL(1) << (x))
  #define _BITULL(x)    (_ULL(1) << (x))
 +#if !defined(__ASSEMBLY__)
 +/*
 + * Missing __asm__ support
 + *
 + * __BIT128() would not work in the __asm__ code, as it shifts an
 + * 'unsigned __init128' data type as direct representation of
 + * 128 bit constants is not supported in the gcc compiler, as
 + * they get silently truncated.
 + *
 + * TODO: Please revisit this implementation when gcc compiler
 + * starts representing 128 bit constants directly like long
 + * and unsigned long etc. Subsequently drop the comment for
 + * GENMASK_U128() which would then start supporting __asm__ code.
 + */
 +#define _BIT128(x)    ((unsigned __int128)(1) << (x))
 +#endif
 +
  #define __ALIGN_KERNEL(x, a)        __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
  #define __ALIGN_KERNEL_MASK(x, mask)    (((x) + (mask)) & ~(mask))
 diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/ethtool.h
 +++ b/include/standard-headers/linux/ethtool.h
@@ -XXX,XX +XXX,XX @@ enum ethtool_module_power_mode {
      ETHTOOL_MODULE_POWER_MODE_HIGH,
  };
 +/**
 + * enum ethtool_c33_pse_ext_state - groups of PSE extended states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_STATE_ERROR_CONDITION: Group of error_condition states
 + * @ETHTOOL_C33_PSE_EXT_STATE_MR_MPS_VALID: Group of mr_mps_valid states
 + * @ETHTOOL_C33_PSE_EXT_STATE_MR_PSE_ENABLE: Group of mr_pse_enable states
 + * @ETHTOOL_C33_PSE_EXT_STATE_OPTION_DETECT_TED: Group of option_detect_ted
 + *    states
 + * @ETHTOOL_C33_PSE_EXT_STATE_OPTION_VPORT_LIM: Group of option_vport_lim states
 + * @ETHTOOL_C33_PSE_EXT_STATE_OVLD_DETECTED: Group of ovld_detected states
 + * @ETHTOOL_C33_PSE_EXT_STATE_PD_DLL_POWER_TYPE: Group of pd_dll_power_type
 + *    states
 + * @ETHTOOL_C33_PSE_EXT_STATE_POWER_NOT_AVAILABLE: Group of power_not_available
 + *    states
 + * @ETHTOOL_C33_PSE_EXT_STATE_SHORT_DETECTED: Group of short_detected states
 + */
 +enum ethtool_c33_pse_ext_state {
 +    ETHTOOL_C33_PSE_EXT_STATE_ERROR_CONDITION = 1,
 +    ETHTOOL_C33_PSE_EXT_STATE_MR_MPS_VALID,
 +    ETHTOOL_C33_PSE_EXT_STATE_MR_PSE_ENABLE,
 +    ETHTOOL_C33_PSE_EXT_STATE_OPTION_DETECT_TED,
 +    ETHTOOL_C33_PSE_EXT_STATE_OPTION_VPORT_LIM,
 +    ETHTOOL_C33_PSE_EXT_STATE_OVLD_DETECTED,
 +    ETHTOOL_C33_PSE_EXT_STATE_PD_DLL_POWER_TYPE,
 +    ETHTOOL_C33_PSE_EXT_STATE_POWER_NOT_AVAILABLE,
 +    ETHTOOL_C33_PSE_EXT_STATE_SHORT_DETECTED,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_mr_mps_valid - mr_mps_valid states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_DETECTED_UNDERLOAD: Underload
 + *    state
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_CONNECTION_OPEN: Port is not
 + *    connected
 + *
 + * The PSE monitors either the DC or AC Maintain Power Signature
 + * (MPS, see 33.2.9.1). This variable indicates the presence or absence of
 + * a valid MPS.
 + */
 +enum ethtool_c33_pse_ext_substate_mr_mps_valid {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_DETECTED_UNDERLOAD = 1,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_CONNECTION_OPEN,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_error_condition - error_condition states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_NON_EXISTING_PORT: Non-existing
 + *    port number
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNDEFINED_PORT: Undefined port
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_INTERNAL_HW_FAULT: Internal
 + *    hardware fault
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_COMM_ERROR_AFTER_FORCE_ON:
 + *    Communication error after force on
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNKNOWN_PORT_STATUS: Unknown
 + *    port status
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_TURN_OFF: Host
 + *    crash turn off
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_FORCE_SHUTDOWN:
 + *    Host crash force shutdown
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_CONFIG_CHANGE: Configuration
 + *    change
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_DETECTED_OVER_TEMP: Over
 + *    temperature detected
 + *
 + * error_condition is a variable indicating the status of
 + * implementation-specific fault conditions or optionally other system faults
 + * that prevent the PSE from meeting the specifications in Table 33–11 and that
 + * require the PSE not to source power. These error conditions are different
 + * from those monitored by the state diagrams in Figure 33–10.
 + */
 +enum ethtool_c33_pse_ext_substate_error_condition {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_NON_EXISTING_PORT = 1,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNDEFINED_PORT,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_INTERNAL_HW_FAULT,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_COMM_ERROR_AFTER_FORCE_ON,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNKNOWN_PORT_STATUS,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_TURN_OFF,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_FORCE_SHUTDOWN,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_CONFIG_CHANGE,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_DETECTED_OVER_TEMP,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_mr_pse_enable - mr_pse_enable states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_PSE_ENABLE_DISABLE_PIN_ACTIVE: Disable
 + *    pin active
 + *
 + * mr_pse_enable is control variable that selects PSE operation and test
 + * functions.
 + */
 +enum ethtool_c33_pse_ext_substate_mr_pse_enable {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_PSE_ENABLE_DISABLE_PIN_ACTIVE = 1,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_option_detect_ted - option_detect_ted
 + *    states functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_DET_IN_PROCESS: Detection
 + *    in process
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_CONNECTION_CHECK_ERROR:
 + *    Connection check error
 + *
 + * option_detect_ted is a variable indicating if detection can be performed
 + * by the PSE during the ted_timer interval.
 + */
 +enum ethtool_c33_pse_ext_substate_option_detect_ted {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_DET_IN_PROCESS = 1,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_CONNECTION_CHECK_ERROR,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_option_vport_lim - option_vport_lim states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_HIGH_VOLTAGE: Main supply
 + *    voltage is high
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_LOW_VOLTAGE: Main supply
 + *    voltage is low
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_VOLTAGE_INJECTION: Voltage
 + *    injection into the port
 + *
 + * option_vport_lim is an optional variable indicates if VPSE is out of the
 + * operating range during normal operating state.
 + */
 +enum ethtool_c33_pse_ext_substate_option_vport_lim {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_HIGH_VOLTAGE = 1,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_LOW_VOLTAGE,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_VOLTAGE_INJECTION,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_ovld_detected - ovld_detected states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OVLD_DETECTED_OVERLOAD: Overload state
 + *
 + * ovld_detected is a variable indicating if the PSE output current has been
 + * in an overload condition (see 33.2.7.6) for at least TCUT of a one-second
 + * sliding time.
 + */
 +enum ethtool_c33_pse_ext_substate_ovld_detected {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_OVLD_DETECTED_OVERLOAD = 1,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_power_not_available - power_not_available
 + *    states functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_BUDGET_EXCEEDED: Power
 + *    budget exceeded for the controller
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PORT_PW_LIMIT_EXCEEDS_CONTROLLER_BUDGET:
 + *    Configured port power limit exceeded controller power budget
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PD_REQUEST_EXCEEDS_PORT_LIMIT:
 + *    Power request from PD exceeds port limit
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_HW_PW_LIMIT: Power
 + *    denied due to Hardware power limit
 + *
 + * power_not_available is a variable that is asserted in an
 + * implementation-dependent manner when the PSE is no longer capable of
 + * sourcing sufficient power to support the attached PD. Sufficient power
 + * is defined by classification; see 33.2.6.
 + */
 +enum ethtool_c33_pse_ext_substate_power_not_available {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_BUDGET_EXCEEDED =  1,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PORT_PW_LIMIT_EXCEEDS_CONTROLLER_BUDGET,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PD_REQUEST_EXCEEDS_PORT_LIMIT,
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_HW_PW_LIMIT,
 +};
 +
 +/**
 + * enum ethtool_c33_pse_ext_substate_short_detected - short_detected states
 + *      functions. IEEE 802.3-2022 33.2.4.4 Variables
 + *
 + * @ETHTOOL_C33_PSE_EXT_SUBSTATE_SHORT_DETECTED_SHORT_CONDITION: Short
 + *    condition was detected
 + *
 + * short_detected is a variable indicating if the PSE output current has been
 + * in a short circuit condition for TLIM within a sliding window (see 33.2.7.7).
 + */
 +enum ethtool_c33_pse_ext_substate_short_detected {
 +    ETHTOOL_C33_PSE_EXT_SUBSTATE_SHORT_DETECTED_SHORT_CONDITION = 1,
 +};
 +
  /**
   * enum ethtool_pse_types - Types of PSE controller.
   * @ETHTOOL_PSE_UNKNOWN: Type of PSE controller is unknown
@@ -XXX,XX +XXX,XX @@ enum ethtool_mm_verify_status {
      ETHTOOL_MM_VERIFY_STATUS_DISABLED,
  };
 +/**
 + * enum ethtool_module_fw_flash_status - plug-in module firmware flashing status
 + * @ETHTOOL_MODULE_FW_FLASH_STATUS_STARTED: The firmware flashing process has
 + *    started.
 + * @ETHTOOL_MODULE_FW_FLASH_STATUS_IN_PROGRESS: The firmware flashing process
 + *    is in progress.
 + * @ETHTOOL_MODULE_FW_FLASH_STATUS_COMPLETED: The firmware flashing process was
 + *    completed successfully.
 + * @ETHTOOL_MODULE_FW_FLASH_STATUS_ERROR: The firmware flashing process was
 + *    stopped due to an error.
 + */
 +enum ethtool_module_fw_flash_status {
 +    ETHTOOL_MODULE_FW_FLASH_STATUS_STARTED = 1,
 +    ETHTOOL_MODULE_FW_FLASH_STATUS_IN_PROGRESS,
 +    ETHTOOL_MODULE_FW_FLASH_STATUS_COMPLETED,
 +    ETHTOOL_MODULE_FW_FLASH_STATUS_ERROR,
 +};
 +
  /**
   * struct ethtool_gstrings - string set for data tagging
   * @cmd: Command number = %ETHTOOL_GSTRINGS
@@ -XXX,XX +XXX,XX @@ enum ethtool_link_mode_bit_indices {
      ETHTOOL_LINK_MODE_10baseT1S_Full_BIT         = 99,
      ETHTOOL_LINK_MODE_10baseT1S_Half_BIT         = 100,
      ETHTOOL_LINK_MODE_10baseT1S_P2MP_Half_BIT     = 101,
 +    ETHTOOL_LINK_MODE_10baseT1BRR_Full_BIT         = 102,
      /* must be last entry */
      __ETHTOOL_LINK_MODE_MASK_NBITS
@@ -XXX,XX +XXX,XX @@ struct ethtool_link_settings {
       * uint32_t map_lp_advertising[link_mode_masks_nwords];
       */
  };
 +
 +/**
 + * enum phy_upstream - Represents the upstream component a given PHY device
 + * is connected to, as in what is on the other end of the MII bus. Most PHYs
 + * will be attached to an Ethernet MAC controller, but in some cases, there's
 + * an intermediate PHY used as a media-converter, which will driver another
 + * MII interface as its output.
 + * @PHY_UPSTREAM_MAC: Upstream component is a MAC (a switch port,
 + *              or ethernet controller)
 + * @PHY_UPSTREAM_PHY: Upstream component is a PHY (likely a media converter)
 + */
 +enum phy_upstream {
 +    PHY_UPSTREAM_MAC,
 +    PHY_UPSTREAM_PHY,
 +};
 +
  #endif /* _LINUX_ETHTOOL_H */
 diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/fuse.h
 +++ b/include/standard-headers/linux/fuse.h
@@ -XXX,XX +XXX,XX @@
   *  - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag
   *  - add FUSE_NO_EXPORT_SUPPORT init flag
   *  - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag
 + *
 + *  7.41
 + *  - add FUSE_ALLOW_IDMAP
   */
  #ifndef _LINUX_FUSE_H
@@ -XXX,XX +XXX,XX @@
  #define FUSE_KERNEL_VERSION 7
  /** Minor version number of this interface */
 -#define FUSE_KERNEL_MINOR_VERSION 40
 +#define FUSE_KERNEL_MINOR_VERSION 41
  /** The node ID of the root inode */
  #define FUSE_ROOT_ID 1
@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
   * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support
   * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
   *            of the request ID indicates resend requests
 + * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
   */
  #define FUSE_ASYNC_READ        (1 << 0)
  #define FUSE_POSIX_LOCKS    (1 << 1)
@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
  /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
  #define FUSE_DIRECT_IO_RELAX    FUSE_DIRECT_IO_ALLOW_MMAP
 +#define FUSE_ALLOW_IDMAP    (1ULL << 40)
  /**
   * CUSE INIT request/reply flags
@@ -XXX,XX +XXX,XX @@ struct fuse_fallocate_in {
   */
  #define FUSE_UNIQUE_RESEND (1ULL << 63)
 +/**
 + * This value will be set by the kernel to
 + * (struct fuse_in_header).{uid,gid} fields in
 + * case when:
 + * - fuse daemon enabled FUSE_ALLOW_IDMAP
 + * - idmapping information is not available and uid/gid
 + *   can not be mapped in accordance with an idmapping.
 + *
 + * Note: an idmapping information always available
 + * for inode creation operations like:
 + * FUSE_MKNOD, FUSE_SYMLINK, FUSE_MKDIR, FUSE_TMPFILE,
 + * FUSE_CREATE and FUSE_RENAME2 (with RENAME_WHITEOUT).
 + */
 +#define FUSE_INVALID_UIDGID ((uint32_t)(-1))
 +
  struct fuse_in_header {
      uint32_t    len;
      uint32_t    opcode;
 diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/input-event-codes.h
 +++ b/include/standard-headers/linux/input-event-codes.h
@@ -XXX,XX +XXX,XX @@
  #define KEY_CAMERA_ACCESS_ENABLE    0x24b    /* Enables programmatic access to camera devices. (HUTRR72) */
  #define KEY_CAMERA_ACCESS_DISABLE    0x24c    /* Disables programmatic access to camera devices. (HUTRR72) */
  #define KEY_CAMERA_ACCESS_TOGGLE    0x24d    /* Toggles the current state of the camera access control. (HUTRR72) */
 +#define KEY_ACCESSIBILITY        0x24e    /* Toggles the system bound accessibility UI/command (HUTRR116) */
 +#define KEY_DO_NOT_DISTURB        0x24f    /* Toggles the system-wide "Do Not Disturb" control (HUTRR94)*/
  #define KEY_BRIGHTNESS_MIN        0x250    /* Set Brightness to Minimum */
  #define KEY_BRIGHTNESS_MAX        0x251    /* Set Brightness to Maximum */
 diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/pci_regs.h
 +++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
  #define  PCI_EXP_RTCTL_SENFEE    0x0002    /* System Error on Non-Fatal Error */
  #define  PCI_EXP_RTCTL_SEFEE    0x0004    /* System Error on Fatal Error */
  #define  PCI_EXP_RTCTL_PMEIE    0x0008    /* PME Interrupt Enable */
 -#define  PCI_EXP_RTCTL_CRSSVE    0x0010    /* CRS Software Visibility Enable */
 +#define  PCI_EXP_RTCTL_RRS_SVE    0x0010    /* Config RRS Software Visibility Enable */
 +#define  PCI_EXP_RTCTL_CRSSVE PCI_EXP_RTCTL_RRS_SVE /* compatibility */
  #define PCI_EXP_RTCAP        0x1e    /* Root Capabilities */
 -#define  PCI_EXP_RTCAP_CRSVIS    0x0001    /* CRS Software Visibility capability */
 +#define  PCI_EXP_RTCAP_RRS_SV    0x0001    /* Config RRS Software Visibility */
 +#define  PCI_EXP_RTCAP_CRSVIS PCI_EXP_RTCAP_RRS_SV /* compatibility */
  #define PCI_EXP_RTSTA        0x20    /* Root Status */
  #define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
  #define  PCI_EXP_RTSTA_PME    0x00010000 /* PME status */
@@ -XXX,XX +XXX,XX @@
  #define PCI_EXT_CAP_ID_DVSEC    0x23    /* Designated Vendor-Specific */
  #define PCI_EXT_CAP_ID_DLF    0x25    /* Data Link Feature */
  #define PCI_EXT_CAP_ID_PL_16GT    0x26    /* Physical Layer 16.0 GT/s */
 +#define PCI_EXT_CAP_ID_NPEM    0x29    /* Native PCIe Enclosure Management */
  #define PCI_EXT_CAP_ID_PL_32GT  0x2A    /* Physical Layer 32.0 GT/s */
  #define PCI_EXT_CAP_ID_DOE    0x2E    /* Data Object Exchange */
  #define PCI_EXT_CAP_ID_MAX    PCI_EXT_CAP_ID_DOE
@@ -XXX,XX +XXX,XX @@
  #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK        0x000000F0
  #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT    4
 +/* Native PCIe Enclosure Management */
 +#define PCI_NPEM_CAP     0x04 /* NPEM capability register */
 +#define  PCI_NPEM_CAP_CAPABLE     0x00000001 /* NPEM Capable */
 +
 +#define PCI_NPEM_CTRL    0x08 /* NPEM control register */
 +#define  PCI_NPEM_CTRL_ENABLE     0x00000001 /* NPEM Enable */
 +
 +/*
 + * Native PCIe Enclosure Management indication bits and Reset command bit
 + * are corresponding for capability and control registers.
 + */
 +#define  PCI_NPEM_CMD_RESET       0x00000002 /* Reset Command */
 +#define  PCI_NPEM_IND_OK          0x00000004 /* OK */
 +#define  PCI_NPEM_IND_LOCATE      0x00000008 /* Locate */
 +#define  PCI_NPEM_IND_FAIL        0x00000010 /* Fail */
 +#define  PCI_NPEM_IND_REBUILD     0x00000020 /* Rebuild */
 +#define  PCI_NPEM_IND_PFA         0x00000040 /* Predicted Failure Analysis */
 +#define  PCI_NPEM_IND_HOTSPARE    0x00000080 /* Hot Spare */
 +#define  PCI_NPEM_IND_ICA         0x00000100 /* In Critical Array */
 +#define  PCI_NPEM_IND_IFA         0x00000200 /* In Failed Array */
 +#define  PCI_NPEM_IND_IDT         0x00000400 /* Device Type */
 +#define  PCI_NPEM_IND_DISABLED    0x00000800 /* Disabled */
 +#define  PCI_NPEM_IND_SPEC_0      0x01000000
 +#define  PCI_NPEM_IND_SPEC_1      0x02000000
 +#define  PCI_NPEM_IND_SPEC_2      0x04000000
 +#define  PCI_NPEM_IND_SPEC_3      0x08000000
 +#define  PCI_NPEM_IND_SPEC_4      0x10000000
 +#define  PCI_NPEM_IND_SPEC_5      0x20000000
 +#define  PCI_NPEM_IND_SPEC_6      0x40000000
 +#define  PCI_NPEM_IND_SPEC_7      0x80000000
 +
 +#define PCI_NPEM_STATUS  0x0c /* NPEM status register */
 +#define  PCI_NPEM_STATUS_CC       0x00000001 /* Command Completed */
 +
  /* Data Object Exchange */
  #define PCI_DOE_CAP        0x04    /* DOE Capabilities Register */
  #define  PCI_DOE_CAP_INT_SUP            0x00000001  /* Interrupt Support */
 diff --git a/include/standard-headers/linux/virtio_balloon.h b/include/standard-headers/linux/virtio_balloon.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/virtio_balloon.h
 +++ b/include/standard-headers/linux/virtio_balloon.h
@@ -XXX,XX +XXX,XX @@ struct virtio_balloon_config {
  #define VIRTIO_BALLOON_S_CACHES   7   /* Disk caches */
  #define VIRTIO_BALLOON_S_HTLB_PGALLOC  8  /* Hugetlb page allocations */
  #define VIRTIO_BALLOON_S_HTLB_PGFAIL   9  /* Hugetlb page allocation failures */
 -#define VIRTIO_BALLOON_S_NR       10
 +#define VIRTIO_BALLOON_S_OOM_KILL      10 /* OOM killer invocations */
 +#define VIRTIO_BALLOON_S_ALLOC_STALL   11 /* Stall count of memory allocatoin */
 +#define VIRTIO_BALLOON_S_ASYNC_SCAN    12 /* Amount of memory scanned asynchronously */
 +#define VIRTIO_BALLOON_S_DIRECT_SCAN   13 /* Amount of memory scanned directly */
 +#define VIRTIO_BALLOON_S_ASYNC_RECLAIM 14 /* Amount of memory reclaimed asynchronously */
 +#define VIRTIO_BALLOON_S_DIRECT_RECLAIM 15 /* Amount of memory reclaimed directly */
 +#define VIRTIO_BALLOON_S_NR       16
  #define VIRTIO_BALLOON_S_NAMES_WITH_PREFIX(VIRTIO_BALLOON_S_NAMES_prefix) { \
      VIRTIO_BALLOON_S_NAMES_prefix "swap-in", \
@@ -XXX,XX +XXX,XX @@ struct virtio_balloon_config {
      VIRTIO_BALLOON_S_NAMES_prefix "available-memory", \
      VIRTIO_BALLOON_S_NAMES_prefix "disk-caches", \
      VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-allocations", \
 -    VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures" \
 +    VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures", \
 +    VIRTIO_BALLOON_S_NAMES_prefix "oom-kills", \
 +    VIRTIO_BALLOON_S_NAMES_prefix "alloc-stalls", \
 +    VIRTIO_BALLOON_S_NAMES_prefix "async-scans", \
 +    VIRTIO_BALLOON_S_NAMES_prefix "direct-scans", \
 +    VIRTIO_BALLOON_S_NAMES_prefix "async-reclaims", \
 +    VIRTIO_BALLOON_S_NAMES_prefix "direct-reclaims" \
  }
  #define VIRTIO_BALLOON_S_NAMES VIRTIO_BALLOON_S_NAMES_WITH_PREFIX("")
 diff --git a/include/standard-headers/linux/virtio_gpu.h b/include/standard-headers/linux/virtio_gpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/virtio_gpu.h
 +++ b/include/standard-headers/linux/virtio_gpu.h
@@ -XXX,XX +XXX,XX @@ struct virtio_gpu_cmd_submit {
  #define VIRTIO_GPU_CAPSET_VIRGL2 2
  /* 3 is reserved for gfxstream */
  #define VIRTIO_GPU_CAPSET_VENUS 4
 +#define VIRTIO_GPU_CAPSET_DRM 6
  /* VIRTIO_GPU_CMD_GET_CAPSET_INFO */
  struct virtio_gpu_get_capset_info {
 diff --git a/linux-headers/asm-arm64/mman.h b/linux-headers/asm-arm64/mman.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-arm64/mman.h
 +++ b/linux-headers/asm-arm64/mman.h
@@ -XXX,XX +XXX,XX @@
  #define PROT_BTI    0x10        /* BTI guarded page */
  #define PROT_MTE    0x20        /* Normal Tagged mapping */
 +/* Override any generic PKEY permission defines */
 +#define PKEY_DISABLE_EXECUTE    0x4
 +#define PKEY_DISABLE_READ    0x8
 +#undef PKEY_ACCESS_MASK
 +#define PKEY_ACCESS_MASK       (PKEY_DISABLE_ACCESS |\
 +                PKEY_DISABLE_WRITE  |\
 +                PKEY_DISABLE_READ   |\
 +                PKEY_DISABLE_EXECUTE)
 +
  #endif /* ! _UAPI__ASM_MMAN_H */
 diff --git a/linux-headers/asm-arm64/unistd.h b/linux-headers/asm-arm64/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-arm64/unistd.h
 +++ b/linux-headers/asm-arm64/unistd.h
@@ -XXX,XX +XXX,XX @@
  /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 -/*
 - * Copyright (C) 2012 ARM Ltd.
 - *
 - * This program is free software; you can redistribute it and/or modify
 - * it under the terms of the GNU General Public License version 2 as
 - * published by the Free Software Foundation.
 - *
 - * This program is distributed in the hope that it will be useful,
 - * but WITHOUT ANY WARRANTY; without even the implied warranty of
 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 - * GNU General Public License for more details.
 - *
 - * You should have received a copy of the GNU General Public License
 - * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 - */
 -
 -#define __ARCH_WANT_RENAMEAT
 -#define __ARCH_WANT_NEW_STAT
 -#define __ARCH_WANT_SET_GET_RLIMIT
 -#define __ARCH_WANT_TIME32_SYSCALLS
 -#define __ARCH_WANT_SYS_CLONE3
 -#define __ARCH_WANT_MEMFD_SECRET
 -
 -#include <asm-generic/unistd.h>
 +#include <asm/unistd_64.h>
 diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-generic/unistd.h
 +++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SC_COMP(__NR_pselect6_time64, sys_pselect6, compat_sys_pselect6_time64)
  #define __NR_ppoll_time64 414
  __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64)
  #define __NR_io_pgetevents_time64 416
 -__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents)
 +__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64)
  #define __NR_recvmmsg_time64 417
  __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64)
  #define __NR_mq_timedsend_time64 418
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fsmount, sys_fsmount)
  __SYSCALL(__NR_fspick, sys_fspick)
  #define __NR_pidfd_open 434
  __SYSCALL(__NR_pidfd_open, sys_pidfd_open)
 -
 -#ifdef __ARCH_WANT_SYS_CLONE3
  #define __NR_clone3 435
  __SYSCALL(__NR_clone3, sys_clone3)
 -#endif
 -
  #define __NR_close_range 436
  __SYSCALL(__NR_close_range, sys_close_range)
  #define __NR_openat2 437
 diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-loongarch/kvm.h
 +++ b/linux-headers/asm-loongarch/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_fpu {
  #define KVM_REG_LOONGARCH_KVM        (KVM_REG_LOONGARCH | 0x20000ULL)
  #define KVM_REG_LOONGARCH_FPSIMD    (KVM_REG_LOONGARCH | 0x30000ULL)
  #define KVM_REG_LOONGARCH_CPUCFG    (KVM_REG_LOONGARCH | 0x40000ULL)
 +#define KVM_REG_LOONGARCH_LBT        (KVM_REG_LOONGARCH | 0x50000ULL)
  #define KVM_REG_LOONGARCH_MASK        (KVM_REG_LOONGARCH | 0x70000ULL)
  #define KVM_CSR_IDX_MASK        0x7fff
  #define KVM_CPUCFG_IDX_MASK        0x7fff
@@ -XXX,XX +XXX,XX @@ struct kvm_fpu {
  /* Debugging: Special instruction for software breakpoint */
  #define KVM_REG_LOONGARCH_DEBUG_INST    (KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 3)
 +/* LBT registers */
 +#define KVM_REG_LOONGARCH_LBT_SCR0    (KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 1)
 +#define KVM_REG_LOONGARCH_LBT_SCR1    (KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 2)
 +#define KVM_REG_LOONGARCH_LBT_SCR2    (KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 3)
 +#define KVM_REG_LOONGARCH_LBT_SCR3    (KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 4)
 +#define KVM_REG_LOONGARCH_LBT_EFLAGS    (KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 5)
 +#define KVM_REG_LOONGARCH_LBT_FTOP    (KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 6)
 +
  #define LOONGARCH_REG_SHIFT        3
  #define LOONGARCH_REG_64(TYPE, REG)    (TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
  #define KVM_IOC_CSRID(REG)        LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
  #define KVM_IOC_CPUCFG(REG)        LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
 +
 +/* Device Control API on vm fd */
 +#define KVM_LOONGARCH_VM_FEAT_CTRL        0
 +#define  KVM_LOONGARCH_VM_FEAT_LSX        0
 +#define  KVM_LOONGARCH_VM_FEAT_LASX        1
 +#define  KVM_LOONGARCH_VM_FEAT_X86BT        2
 +#define  KVM_LOONGARCH_VM_FEAT_ARMBT        3
 +#define  KVM_LOONGARCH_VM_FEAT_MIPSBT        4
 +#define  KVM_LOONGARCH_VM_FEAT_PMU        5
 +#define  KVM_LOONGARCH_VM_FEAT_PV_IPI        6
 +#define  KVM_LOONGARCH_VM_FEAT_PV_STEALTIME    7
 +
 +/* Device Control API on vcpu fd */
  #define KVM_LOONGARCH_VCPU_CPUCFG    0
 +#define KVM_LOONGARCH_VCPU_PVTIME_CTRL    1
 +#define  KVM_LOONGARCH_VCPU_PVTIME_GPA    0
  struct kvm_debug_exit_arch {
  };
 diff --git a/linux-headers/asm-loongarch/kvm_para.h b/linux-headers/asm-loongarch/kvm_para.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/linux-headers/asm-loongarch/kvm_para.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 +#ifndef _ASM_KVM_PARA_H
 +#define _ASM_KVM_PARA_H
 +
 +#include <linux/types.h>
 +
 +/*
 + * CPUCFG index area: 0x40000000 -- 0x400000ff
 + * SW emulation for KVM hypervirsor
 + */
 +#define CPUCFG_KVM_BASE            0x40000000
 +#define CPUCFG_KVM_SIZE            0x100
 +#define CPUCFG_KVM_SIG            (CPUCFG_KVM_BASE + 0)
 +#define  KVM_SIGNATURE            "KVM\0"
 +#define CPUCFG_KVM_FEATURE        (CPUCFG_KVM_BASE + 4)
 +#define  KVM_FEATURE_IPI        1
 +#define  KVM_FEATURE_STEAL_TIME        2
 +/* BIT 24 - 31 are features configurable by user space vmm */
 +#define  KVM_FEATURE_VIRT_EXTIOI    24
 +
 +#endif /* _ASM_KVM_PARA_H */
 diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-loongarch/unistd.h
 +++ b/linux-headers/asm-loongarch/unistd.h
@@ -XXX,XX +XXX,XX @@
  /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 -#define __ARCH_WANT_SYS_CLONE
 -#define __ARCH_WANT_SYS_CLONE3
 -#include <asm-generic/unistd.h>
 +#include <asm/unistd_64.h>
 diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/linux-headers/asm-loongarch/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 +#ifndef _ASM_UNISTD_64_H
 +#define _ASM_UNISTD_64_H
 +
 +#define __NR_io_setup 0
 +#define __NR_io_destroy 1
 +#define __NR_io_submit 2
 +#define __NR_io_cancel 3
 +#define __NR_io_getevents 4
 +#define __NR_setxattr 5
 +#define __NR_lsetxattr 6
 +#define __NR_fsetxattr 7
 +#define __NR_getxattr 8
 +#define __NR_lgetxattr 9
 +#define __NR_fgetxattr 10
 +#define __NR_listxattr 11
 +#define __NR_llistxattr 12
 +#define __NR_flistxattr 13
 +#define __NR_removexattr 14
 +#define __NR_lremovexattr 15
 +#define __NR_fremovexattr 16
 +#define __NR_getcwd 17
 +#define __NR_lookup_dcookie 18
 +#define __NR_eventfd2 19
 +#define __NR_epoll_create1 20
 +#define __NR_epoll_ctl 21
 +#define __NR_epoll_pwait 22
 +#define __NR_dup 23
 +#define __NR_dup3 24
 +#define __NR_fcntl 25
 +#define __NR_inotify_init1 26
 +#define __NR_inotify_add_watch 27
 +#define __NR_inotify_rm_watch 28
 +#define __NR_ioctl 29
 +#define __NR_ioprio_set 30
 +#define __NR_ioprio_get 31
 +#define __NR_flock 32
 +#define __NR_mknodat 33
 +#define __NR_mkdirat 34
 +#define __NR_unlinkat 35
 +#define __NR_symlinkat 36
 +#define __NR_linkat 37
 +#define __NR_umount2 39
 +#define __NR_mount 40
 +#define __NR_pivot_root 41
 +#define __NR_nfsservctl 42
 +#define __NR_statfs 43
 +#define __NR_fstatfs 44
 +#define __NR_truncate 45
 +#define __NR_ftruncate 46
 +#define __NR_fallocate 47
 +#define __NR_faccessat 48
 +#define __NR_chdir 49
 +#define __NR_fchdir 50
 +#define __NR_chroot 51
 +#define __NR_fchmod 52
 +#define __NR_fchmodat 53
 +#define __NR_fchownat 54
 +#define __NR_fchown 55
 +#define __NR_openat 56
 +#define __NR_close 57
 +#define __NR_vhangup 58
 +#define __NR_pipe2 59
 +#define __NR_quotactl 60
 +#define __NR_getdents64 61
 +#define __NR_lseek 62
 +#define __NR_read 63
 +#define __NR_write 64
 +#define __NR_readv 65
 +#define __NR_writev 66
 +#define __NR_pread64 67
 +#define __NR_pwrite64 68
 +#define __NR_preadv 69
 +#define __NR_pwritev 70
 +#define __NR_sendfile 71
 +#define __NR_pselect6 72
 +#define __NR_ppoll 73
 +#define __NR_signalfd4 74
 +#define __NR_vmsplice 75
 +#define __NR_splice 76
 +#define __NR_tee 77
 +#define __NR_readlinkat 78
 +#define __NR_newfstatat 79
 +#define __NR_fstat 80
 +#define __NR_sync 81
 +#define __NR_fsync 82
 +#define __NR_fdatasync 83
 +#define __NR_sync_file_range 84
 +#define __NR_timerfd_create 85
 +#define __NR_timerfd_settime 86
 +#define __NR_timerfd_gettime 87
 +#define __NR_utimensat 88
 +#define __NR_acct 89
 +#define __NR_capget 90
 +#define __NR_capset 91
 +#define __NR_personality 92
 +#define __NR_exit 93
 +#define __NR_exit_group 94
 +#define __NR_waitid 95
 +#define __NR_set_tid_address 96
 +#define __NR_unshare 97
 +#define __NR_futex 98
 +#define __NR_set_robust_list 99
 +#define __NR_get_robust_list 100
 +#define __NR_nanosleep 101
 +#define __NR_getitimer 102
 +#define __NR_setitimer 103
 +#define __NR_kexec_load 104
 +#define __NR_init_module 105
 +#define __NR_delete_module 106
 +#define __NR_timer_create 107
 +#define __NR_timer_gettime 108
 +#define __NR_timer_getoverrun 109
 +#define __NR_timer_settime 110
 +#define __NR_timer_delete 111
 +#define __NR_clock_settime 112
 +#define __NR_clock_gettime 113
 +#define __NR_clock_getres 114
 +#define __NR_clock_nanosleep 115
 +#define __NR_syslog 116
 +#define __NR_ptrace 117
 +#define __NR_sched_setparam 118
 +#define __NR_sched_setscheduler 119
 +#define __NR_sched_getscheduler 120
 +#define __NR_sched_getparam 121
 +#define __NR_sched_setaffinity 122
 +#define __NR_sched_getaffinity 123
 +#define __NR_sched_yield 124
 +#define __NR_sched_get_priority_max 125
 +#define __NR_sched_get_priority_min 126
 +#define __NR_sched_rr_get_interval 127
 +#define __NR_restart_syscall 128
 +#define __NR_kill 129
 +#define __NR_tkill 130
 +#define __NR_tgkill 131
 +#define __NR_sigaltstack 132
 +#define __NR_rt_sigsuspend 133
 +#define __NR_rt_sigaction 134
 +#define __NR_rt_sigprocmask 135
 +#define __NR_rt_sigpending 136
 +#define __NR_rt_sigtimedwait 137
 +#define __NR_rt_sigqueueinfo 138
 +#define __NR_rt_sigreturn 139
 +#define __NR_setpriority 140
 +#define __NR_getpriority 141
 +#define __NR_reboot 142
 +#define __NR_setregid 143
 +#define __NR_setgid 144
 +#define __NR_setreuid 145
 +#define __NR_setuid 146
 +#define __NR_setresuid 147
 +#define __NR_getresuid 148
 +#define __NR_setresgid 149
 +#define __NR_getresgid 150
 +#define __NR_setfsuid 151
 +#define __NR_setfsgid 152
 +#define __NR_times 153
 +#define __NR_setpgid 154
 +#define __NR_getpgid 155
 +#define __NR_getsid 156
 +#define __NR_setsid 157
 +#define __NR_getgroups 158
 +#define __NR_setgroups 159
 +#define __NR_uname 160
 +#define __NR_sethostname 161
 +#define __NR_setdomainname 162
 +#define __NR_getrusage 165
 +#define __NR_umask 166
 +#define __NR_prctl 167
 +#define __NR_getcpu 168
 +#define __NR_gettimeofday 169
 +#define __NR_settimeofday 170
 +#define __NR_adjtimex 171
 +#define __NR_getpid 172
 +#define __NR_getppid 173
 +#define __NR_getuid 174
 +#define __NR_geteuid 175
 +#define __NR_getgid 176
 +#define __NR_getegid 177
 +#define __NR_gettid 178
 +#define __NR_sysinfo 179
 +#define __NR_mq_open 180
 +#define __NR_mq_unlink 181
 +#define __NR_mq_timedsend 182
 +#define __NR_mq_timedreceive 183
 +#define __NR_mq_notify 184
 +#define __NR_mq_getsetattr 185
 +#define __NR_msgget 186
 +#define __NR_msgctl 187
 +#define __NR_msgrcv 188
 +#define __NR_msgsnd 189
 +#define __NR_semget 190
 +#define __NR_semctl 191
 +#define __NR_semtimedop 192
 +#define __NR_semop 193
 +#define __NR_shmget 194
 +#define __NR_shmctl 195
 +#define __NR_shmat 196
 +#define __NR_shmdt 197
 +#define __NR_socket 198
 +#define __NR_socketpair 199
 +#define __NR_bind 200
 +#define __NR_listen 201
 +#define __NR_accept 202
 +#define __NR_connect 203
 +#define __NR_getsockname 204
 +#define __NR_getpeername 205
 +#define __NR_sendto 206
 +#define __NR_recvfrom 207
 +#define __NR_setsockopt 208
 +#define __NR_getsockopt 209
 +#define __NR_shutdown 210
 +#define __NR_sendmsg 211
 +#define __NR_recvmsg 212
 +#define __NR_readahead 213
 +#define __NR_brk 214
 +#define __NR_munmap 215
 +#define __NR_mremap 216
 +#define __NR_add_key 217
 +#define __NR_request_key 218
 +#define __NR_keyctl 219
 +#define __NR_clone 220
 +#define __NR_execve 221
 +#define __NR_mmap 222
 +#define __NR_fadvise64 223
 +#define __NR_swapon 224
 +#define __NR_swapoff 225
 +#define __NR_mprotect 226
 +#define __NR_msync 227
 +#define __NR_mlock 228
 +#define __NR_munlock 229
 +#define __NR_mlockall 230
 +#define __NR_munlockall 231
 +#define __NR_mincore 232
 +#define __NR_madvise 233
 +#define __NR_remap_file_pages 234
 +#define __NR_mbind 235
 +#define __NR_get_mempolicy 236
 +#define __NR_set_mempolicy 237
 +#define __NR_migrate_pages 238
 +#define __NR_move_pages 239
 +#define __NR_rt_tgsigqueueinfo 240
 +#define __NR_perf_event_open 241
 +#define __NR_accept4 242
 +#define __NR_recvmmsg 243
 +#define __NR_wait4 260
 +#define __NR_prlimit64 261
 +#define __NR_fanotify_init 262
 +#define __NR_fanotify_mark 263
 +#define __NR_name_to_handle_at 264
 +#define __NR_open_by_handle_at 265
 +#define __NR_clock_adjtime 266
 +#define __NR_syncfs 267
 +#define __NR_setns 268
 +#define __NR_sendmmsg 269
 +#define __NR_process_vm_readv 270
 +#define __NR_process_vm_writev 271
 +#define __NR_kcmp 272
 +#define __NR_finit_module 273
 +#define __NR_sched_setattr 274
 +#define __NR_sched_getattr 275
 +#define __NR_renameat2 276
 +#define __NR_seccomp 277
 +#define __NR_getrandom 278
 +#define __NR_memfd_create 279
 +#define __NR_bpf 280
 +#define __NR_execveat 281
 +#define __NR_userfaultfd 282
 +#define __NR_membarrier 283
 +#define __NR_mlock2 284
 +#define __NR_copy_file_range 285
 +#define __NR_preadv2 286
 +#define __NR_pwritev2 287
 +#define __NR_pkey_mprotect 288
 +#define __NR_pkey_alloc 289
 +#define __NR_pkey_free 290
 +#define __NR_statx 291
 +#define __NR_io_pgetevents 292
 +#define __NR_rseq 293
 +#define __NR_kexec_file_load 294
 +#define __NR_pidfd_send_signal 424
 +#define __NR_io_uring_setup 425
 +#define __NR_io_uring_enter 426
 +#define __NR_io_uring_register 427
 +#define __NR_open_tree 428
 +#define __NR_move_mount 429
 +#define __NR_fsopen 430
 +#define __NR_fsconfig 431
 +#define __NR_fsmount 432
 +#define __NR_fspick 433
 +#define __NR_pidfd_open 434
 +#define __NR_clone3 435
 +#define __NR_close_range 436
 +#define __NR_openat2 437
 +#define __NR_pidfd_getfd 438
 +#define __NR_faccessat2 439
 +#define __NR_process_madvise 440
 +#define __NR_epoll_pwait2 441
 +#define __NR_mount_setattr 442
 +#define __NR_quotactl_fd 443
 +#define __NR_landlock_create_ruleset 444
 +#define __NR_landlock_add_rule 445
 +#define __NR_landlock_restrict_self 446
 +#define __NR_process_mrelease 448
 +#define __NR_futex_waitv 449
 +#define __NR_set_mempolicy_home_node 450
 +#define __NR_cachestat 451
 +#define __NR_fchmodat2 452
 +#define __NR_map_shadow_stack 453
 +#define __NR_futex_wake 454
 +#define __NR_futex_wait 455
 +#define __NR_futex_requeue 456
 +#define __NR_statmount 457
 +#define __NR_listmount 458
 +#define __NR_lsm_get_self_attr 459
 +#define __NR_lsm_set_self_attr 460
 +#define __NR_lsm_list_modules 461
 +#define __NR_mseal 462
 +
 +
 +#endif /* _ASM_UNISTD_64_H */
 diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-riscv/kvm.h
 +++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
      KVM_RISCV_ISA_EXT_ZTSO,
      KVM_RISCV_ISA_EXT_ZACAS,
      KVM_RISCV_ISA_EXT_SSCOFPMF,
 +    KVM_RISCV_ISA_EXT_ZIMOP,
 +    KVM_RISCV_ISA_EXT_ZCA,
 +    KVM_RISCV_ISA_EXT_ZCB,
 +    KVM_RISCV_ISA_EXT_ZCD,
 +    KVM_RISCV_ISA_EXT_ZCF,
 +    KVM_RISCV_ISA_EXT_ZCMOP,
 +    KVM_RISCV_ISA_EXT_ZAWRS,
      KVM_RISCV_ISA_EXT_MAX,
  };
 diff --git a/linux-headers/asm-riscv/unistd.h b/linux-headers/asm-riscv/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-riscv/unistd.h
 +++ b/linux-headers/asm-riscv/unistd.h
@@ -XXX,XX +XXX,XX @@
   * You should have received a copy of the GNU General Public License
   * along with this program.  If not, see <https://www.gnu.org/licenses/>.
   */
 +#include <asm/bitsperlong.h>
 -#if defined(__LP64__) && !defined(__SYSCALL_COMPAT)
 -#define __ARCH_WANT_NEW_STAT
 -#define __ARCH_WANT_SET_GET_RLIMIT
 -#endif /* __LP64__ */
 -
 -#define __ARCH_WANT_SYS_CLONE3
 -#define __ARCH_WANT_MEMFD_SECRET
 -
 -#include <asm-generic/unistd.h>
 -
 -/*
 - * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
 - * having a direct 'fence.i' instruction available to userspace (which we
 - * can't trap!), that's not actually viable when running on Linux because the
 - * kernel might schedule a process on another hart.  There is no way for
 - * userspace to handle this without invoking the kernel (as it doesn't know the
 - * thread->hart mappings), so we've defined a RISC-V specific system call to
 - * flush the instruction cache.
 - *
 - * __NR_riscv_flush_icache is defined to flush the instruction cache over an
 - * address range, with the flush applying to either all threads or just the
 - * caller.  We don't currently do anything with the address range, that's just
 - * in there for forwards compatibility.
 - */
 -#ifndef __NR_riscv_flush_icache
 -#define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
 -#endif
 -__SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
 -
 -/*
 - * Allows userspace to query the kernel for CPU architecture and
 - * microarchitecture details across a given set of CPUs.
 - */
 -#ifndef __NR_riscv_hwprobe
 -#define __NR_riscv_hwprobe (__NR_arch_specific_syscall + 14)
 +#if __BITS_PER_LONG == 64
 +#include <asm/unistd_64.h>
 +#else
 +#include <asm/unistd_32.h>
  #endif
 -__SYSCALL(__NR_riscv_hwprobe, sys_riscv_hwprobe)
 diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/kvm.h
 +++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_ioapic_state {
  #define KVM_RUN_X86_SMM         (1 << 0)
  #define KVM_RUN_X86_BUS_LOCK     (1 << 1)
 +#define KVM_RUN_X86_GUEST_MODE   (1 << 2)
  /* for KVM_GET_REGS and KVM_SET_REGS */
  struct kvm_regs {
@@ -XXX,XX +XXX,XX @@ struct kvm_sync_regs {
  #define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT    (1 << 4)
  #define KVM_X86_QUIRK_FIX_HYPERCALL_INSN    (1 << 5)
  #define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS    (1 << 6)
 +#define KVM_X86_QUIRK_SLOT_ZAP_ALL        (1 << 7)
  #define KVM_STATE_NESTED_FORMAT_VMX    0
  #define KVM_STATE_NESTED_FORMAT_SVM    1
 diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_64.h
 +++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_statx 332
  #define __NR_io_pgetevents 333
  #define __NR_rseq 334
 +#define __NR_uretprobe 335
  #define __NR_pidfd_send_signal 424
  #define __NR_io_uring_setup 425
  #define __NR_io_uring_enter 426
 diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_x32.h
 +++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_statx (__X32_SYSCALL_BIT + 332)
  #define __NR_io_pgetevents (__X32_SYSCALL_BIT + 333)
  #define __NR_rseq (__X32_SYSCALL_BIT + 334)
 +#define __NR_uretprobe (__X32_SYSCALL_BIT + 335)
  #define __NR_pidfd_send_signal (__X32_SYSCALL_BIT + 424)
  #define __NR_io_uring_setup (__X32_SYSCALL_BIT + 425)
  #define __NR_io_uring_enter (__X32_SYSCALL_BIT + 426)
 diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/bits.h
 +++ b/linux-headers/linux/bits.h
@@ -XXX,XX +XXX,XX @@
          (((~_ULL(0)) - (_ULL(1) << (l)) + 1) & \
           (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
 +#define __GENMASK_U128(h, l) \
 +    ((_BIT128((h)) << 1) - (_BIT128(l)))
 +
  #endif /* _LINUX_BITS_H */
 diff --git a/linux-headers/linux/const.h b/linux-headers/linux/const.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/const.h
 +++ b/linux-headers/linux/const.h
@@ -XXX,XX +XXX,XX @@
  #define _BITUL(x)    (_UL(1) << (x))
  #define _BITULL(x)    (_ULL(1) << (x))
 +#if !defined(__ASSEMBLY__)
 +/*
 + * Missing __asm__ support
 + *
 + * __BIT128() would not work in the __asm__ code, as it shifts an
 + * 'unsigned __init128' data type as direct representation of
 + * 128 bit constants is not supported in the gcc compiler, as
 + * they get silently truncated.
 + *
 + * TODO: Please revisit this implementation when gcc compiler
 + * starts representing 128 bit constants directly like long
 + * and unsigned long etc. Subsequently drop the comment for
 + * GENMASK_U128() which would then start supporting __asm__ code.
 + */
 +#define _BIT128(x)    ((unsigned __int128)(1) << (x))
 +#endif
 +
  #define __ALIGN_KERNEL(x, a)        __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
  #define __ALIGN_KERNEL_MASK(x, mask)    (((x) + (mask)) & ~(mask))
 diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/iommufd.h
 +++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@
  #ifndef _IOMMUFD_H
  #define _IOMMUFD_H
 -#include <linux/types.h>
  #include <linux/ioctl.h>
 +#include <linux/types.h>
  #define IOMMUFD_TYPE (';')
@@ -XXX,XX +XXX,XX @@
  enum {
      IOMMUFD_CMD_BASE = 0x80,
      IOMMUFD_CMD_DESTROY = IOMMUFD_CMD_BASE,
 -    IOMMUFD_CMD_IOAS_ALLOC,
 -    IOMMUFD_CMD_IOAS_ALLOW_IOVAS,
 -    IOMMUFD_CMD_IOAS_COPY,
 -    IOMMUFD_CMD_IOAS_IOVA_RANGES,
 -    IOMMUFD_CMD_IOAS_MAP,
 -    IOMMUFD_CMD_IOAS_UNMAP,
 -    IOMMUFD_CMD_OPTION,
 -    IOMMUFD_CMD_VFIO_IOAS,
 -    IOMMUFD_CMD_HWPT_ALLOC,
 -    IOMMUFD_CMD_GET_HW_INFO,
 -    IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
 -    IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
 -    IOMMUFD_CMD_HWPT_INVALIDATE,
 +    IOMMUFD_CMD_IOAS_ALLOC = 0x81,
 +    IOMMUFD_CMD_IOAS_ALLOW_IOVAS = 0x82,
 +    IOMMUFD_CMD_IOAS_COPY = 0x83,
 +    IOMMUFD_CMD_IOAS_IOVA_RANGES = 0x84,
 +    IOMMUFD_CMD_IOAS_MAP = 0x85,
 +    IOMMUFD_CMD_IOAS_UNMAP = 0x86,
 +    IOMMUFD_CMD_OPTION = 0x87,
 +    IOMMUFD_CMD_VFIO_IOAS = 0x88,
 +    IOMMUFD_CMD_HWPT_ALLOC = 0x89,
 +    IOMMUFD_CMD_GET_HW_INFO = 0x8a,
 +    IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING = 0x8b,
 +    IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP = 0x8c,
 +    IOMMUFD_CMD_HWPT_INVALIDATE = 0x8d,
 +    IOMMUFD_CMD_FAULT_QUEUE_ALLOC = 0x8e,
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
   *                                the parent HWPT in a nesting configuration.
   * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
   *                                   enforced on device attachment
 + * @IOMMU_HWPT_FAULT_ID_VALID: The fault_id field of hwpt allocation data is
 + *                             valid.
   */
  enum iommufd_hwpt_alloc_flags {
      IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
      IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
 +    IOMMU_HWPT_FAULT_ID_VALID = 1 << 2,
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_vtd_s1 {
   * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
   */
  enum iommu_hwpt_data_type {
 -    IOMMU_HWPT_DATA_NONE,
 -    IOMMU_HWPT_DATA_VTD_S1,
 +    IOMMU_HWPT_DATA_NONE = 0,
 +    IOMMU_HWPT_DATA_VTD_S1 = 1,
  };
  /**
@@ -XXX,XX +XXX,XX @@ enum iommu_hwpt_data_type {
   * @data_type: One of enum iommu_hwpt_data_type
   * @data_len: Length of the type specific data
   * @data_uptr: User pointer to the type specific data
 + * @fault_id: The ID of IOMMUFD_FAULT object. Valid only if flags field of
 + *            IOMMU_HWPT_FAULT_ID_VALID is set.
 + * @__reserved2: Padding to 64-bit alignment. Must be 0.
   *
   * Explicitly allocate a hardware page table object. This is the same object
   * type that is returned by iommufd_device_attach() and represents the
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_alloc {
      __u32 data_type;
      __u32 data_len;
      __aligned_u64 data_uptr;
 +    __u32 fault_id;
 +    __u32 __reserved2;
  };
  #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info_vtd {
   * @IOMMU_HW_INFO_TYPE_INTEL_VTD: Intel VT-d iommu info type
   */
  enum iommu_hw_info_type {
 -    IOMMU_HW_INFO_TYPE_NONE,
 -    IOMMU_HW_INFO_TYPE_INTEL_VTD,
 +    IOMMU_HW_INFO_TYPE_NONE = 0,
 +    IOMMU_HW_INFO_TYPE_INTEL_VTD = 1,
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_get_dirty_bitmap {
   * @IOMMU_HWPT_INVALIDATE_DATA_VTD_S1: Invalidation data for VTD_S1
   */
  enum iommu_hwpt_invalidate_data_type {
 -    IOMMU_HWPT_INVALIDATE_DATA_VTD_S1,
 +    IOMMU_HWPT_INVALIDATE_DATA_VTD_S1 = 0,
  };
  /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_invalidate {
      __u32 __reserved;
  };
  #define IOMMU_HWPT_INVALIDATE _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_INVALIDATE)
 +
 +/**
 + * enum iommu_hwpt_pgfault_flags - flags for struct iommu_hwpt_pgfault
 + * @IOMMU_PGFAULT_FLAGS_PASID_VALID: The pasid field of the fault data is
 + *                                   valid.
 + * @IOMMU_PGFAULT_FLAGS_LAST_PAGE: It's the last fault of a fault group.
 + */
 +enum iommu_hwpt_pgfault_flags {
 +    IOMMU_PGFAULT_FLAGS_PASID_VALID        = (1 << 0),
 +    IOMMU_PGFAULT_FLAGS_LAST_PAGE        = (1 << 1),
 +};
 +
 +/**
 + * enum iommu_hwpt_pgfault_perm - perm bits for struct iommu_hwpt_pgfault
 + * @IOMMU_PGFAULT_PERM_READ: request for read permission
 + * @IOMMU_PGFAULT_PERM_WRITE: request for write permission
 + * @IOMMU_PGFAULT_PERM_EXEC: (PCIE 10.4.1) request with a PASID that has the
 + *                           Execute Requested bit set in PASID TLP Prefix.
 + * @IOMMU_PGFAULT_PERM_PRIV: (PCIE 10.4.1) request with a PASID that has the
 + *                           Privileged Mode Requested bit set in PASID TLP
 + *                           Prefix.
 + */
 +enum iommu_hwpt_pgfault_perm {
 +    IOMMU_PGFAULT_PERM_READ            = (1 << 0),
 +    IOMMU_PGFAULT_PERM_WRITE        = (1 << 1),
 +    IOMMU_PGFAULT_PERM_EXEC            = (1 << 2),
 +    IOMMU_PGFAULT_PERM_PRIV            = (1 << 3),
 +};
 +
 +/**
 + * struct iommu_hwpt_pgfault - iommu page fault data
 + * @flags: Combination of enum iommu_hwpt_pgfault_flags
 + * @dev_id: id of the originated device
 + * @pasid: Process Address Space ID
 + * @grpid: Page Request Group Index
 + * @perm: Combination of enum iommu_hwpt_pgfault_perm
 + * @addr: Fault address
 + * @length: a hint of how much data the requestor is expecting to fetch. For
 + *          example, if the PRI initiator knows it is going to do a 10MB
 + *          transfer, it could fill in 10MB and the OS could pre-fault in
 + *          10MB of IOVA. It's default to 0 if there's no such hint.
 + * @cookie: kernel-managed cookie identifying a group of fault messages. The
 + *          cookie number encoded in the last page fault of the group should
 + *          be echoed back in the response message.
 + */
 +struct iommu_hwpt_pgfault {
 +    __u32 flags;
 +    __u32 dev_id;
 +    __u32 pasid;
 +    __u32 grpid;
 +    __u32 perm;
 +    __u64 addr;
 +    __u32 length;
 +    __u32 cookie;
 +};
 +
 +/**
 + * enum iommufd_page_response_code - Return status of fault handlers
 + * @IOMMUFD_PAGE_RESP_SUCCESS: Fault has been handled and the page tables
 + *                             populated, retry the access. This is the
 + *                             "Success" defined in PCI 10.4.2.1.
 + * @IOMMUFD_PAGE_RESP_INVALID: Could not handle this fault, don't retry the
 + *                             access. This is the "Invalid Request" in PCI
 + *                             10.4.2.1.
 + */
 +enum iommufd_page_response_code {
 +    IOMMUFD_PAGE_RESP_SUCCESS = 0,
 +    IOMMUFD_PAGE_RESP_INVALID = 1,
 +};
 +
 +/**
 + * struct iommu_hwpt_page_response - IOMMU page fault response
 + * @cookie: The kernel-managed cookie reported in the fault message.
 + * @code: One of response code in enum iommufd_page_response_code.
 + */
 +struct iommu_hwpt_page_response {
 +    __u32 cookie;
 +    __u32 code;
 +};
 +
 +/**
 + * struct iommu_fault_alloc - ioctl(IOMMU_FAULT_QUEUE_ALLOC)
 + * @size: sizeof(struct iommu_fault_alloc)
 + * @flags: Must be 0
 + * @out_fault_id: The ID of the new FAULT
 + * @out_fault_fd: The fd of the new FAULT
 + *
 + * Explicitly allocate a fault handling object.
 + */
 +struct iommu_fault_alloc {
 +    __u32 size;
 +    __u32 flags;
 +    __u32 out_fault_id;
 +    __u32 out_fault_fd;
 +};
 +#define IOMMU_FAULT_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_FAULT_QUEUE_ALLOC)
  #endif
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
  /* Flags that describe what fields in emulation_failure hold valid data. */
  #define KVM_INTERNAL_ERROR_EMULATION_FLAG_INSTRUCTION_BYTES (1ULL << 0)
 +/*
 + * struct kvm_run can be modified by userspace at any time, so KVM must be
 + * careful to avoid TOCTOU bugs. In order to protect KVM, HINT_UNSAFE_IN_KVM()
 + * renames fields in struct kvm_run from <symbol> to <symbol>__unsafe when
 + * compiled into the kernel, ensuring that any use within KVM is obvious and
 + * gets extra scrutiny.
 + */
 +#define HINT_UNSAFE_IN_KVM(_symbol) _symbol
 +
  /* for KVM_RUN, returned by mmap(vcpu_fd, offset=0) */
  struct kvm_run {
      /* in */
      __u8 request_interrupt_window;
 -    __u8 immediate_exit;
 +    __u8 HINT_UNSAFE_IN_KVM(immediate_exit);
      __u8 padding1[6];
      /* out */
@@ -XXX,XX +XXX,XX @@ struct kvm_enable_cap {
  #define KVM_CAP_MEMORY_ATTRIBUTES 233
  #define KVM_CAP_GUEST_MEMFD 234
  #define KVM_CAP_VM_TYPES 235
 +#define KVM_CAP_PRE_FAULT_MEMORY 236
 +#define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
 +#define KVM_CAP_X86_GUEST_MODE 238
  struct kvm_irq_routing_irqchip {
      __u32 irqchip;
@@ -XXX,XX +XXX,XX @@ struct kvm_create_guest_memfd {
      __u64 reserved[6];
  };
 +#define KVM_PRE_FAULT_MEMORY    _IOWR(KVMIO, 0xd5, struct kvm_pre_fault_memory)
 +
 +struct kvm_pre_fault_memory {
 +    __u64 gpa;
 +    __u64 size;
 +    __u64 flags;
 +    __u64 padding[5];
 +};
 +
  #endif /* __LINUX_KVM_H */
 diff --git a/linux-headers/linux/mman.h b/linux-headers/linux/mman.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/mman.h
 +++ b/linux-headers/linux/mman.h
@@ -XXX,XX +XXX,XX @@
  #define MAP_SHARED    0x01        /* Share changes */
  #define MAP_PRIVATE    0x02        /* Changes are private */
  #define MAP_SHARED_VALIDATE 0x03    /* share + validate extension flags */
 +#define MAP_DROPPABLE    0x08        /* Zero memory under memory pressure. */
  /*
   * Huge page size encoding when MAP_HUGETLB is specified, and a huge page
 diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/psp-sev.h
 +++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@ enum {
      SNP_PLATFORM_STATUS,
      SNP_COMMIT,
      SNP_SET_CONFIG,
 +    SNP_VLEK_LOAD,
      SEV_MAX,
  };
@@ -XXX,XX +XXX,XX @@ typedef enum {
      SEV_RET_INVALID_PLATFORM_STATE,
      SEV_RET_INVALID_GUEST_STATE,
      SEV_RET_INAVLID_CONFIG,
 +    SEV_RET_INVALID_CONFIG = SEV_RET_INAVLID_CONFIG,
      SEV_RET_INVALID_LEN,
      SEV_RET_ALREADY_OWNED,
      SEV_RET_INVALID_CERTIFICATE,
@@ -XXX,XX +XXX,XX @@ struct sev_user_data_snp_config {
      __u8 rsvd1[52];
  } __attribute__((packed));
 +/**
 + * struct sev_data_snp_vlek_load - SNP_VLEK_LOAD structure
 + *
 + * @len: length of the command buffer read by the PSP
 + * @vlek_wrapped_version: version of wrapped VLEK hashstick (Must be 0h)
 + * @rsvd: reserved
 + * @vlek_wrapped_address: address of a wrapped VLEK hashstick
 + *                        (struct sev_user_data_snp_wrapped_vlek_hashstick)
 + */
 +struct sev_user_data_snp_vlek_load {
 +    __u32 len;                /* In */
 +    __u8 vlek_wrapped_version;        /* In */
 +    __u8 rsvd[3];                /* In */
 +    __u64 vlek_wrapped_address;        /* In */
 +} __attribute__((packed));
 +
 +/**
 + * struct sev_user_data_snp_vlek_wrapped_vlek_hashstick - Wrapped VLEK data
 + *
 + * @data: Opaque data provided by AMD KDS (as described in SEV-SNP Firmware ABI
 + *        1.54, SNP_VLEK_LOAD)
 + */
 +struct sev_user_data_snp_wrapped_vlek_hashstick {
 +    __u8 data[432];                /* In */
 +} __attribute__((packed));
 +
  /**
   * struct sev_issue_cmd - SEV ioctl parameters
   *
 --
-.34.1
+.43.5

-[PULL 2/6] target/loongarch: Implement lbt registers save/restore function
+[PULL 2/6] hw/loongarch/virt: Rename function prefix name
-From: Bibo Mao <maobibo@loongson.cn>
+Replace function prefix name loongarch_xxx with virt_xxx in file
+virt-acpi-build.c
 Six registers scr0 - scr3, eflags and ftop are added in percpu vmstate.
 And two functions kvm_loongarch_get_lbt/kvm_loongarch_put_lbt are added
 to save/restore lbt registers.
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Reviewed-by: Song Gao <gaosong@loongson.cn>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20240929070405.235200-3-maobibo@loongson.cn>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- target/loongarch/cpu.h     | 12 ++++++++
+ hw/loongarch/virt-acpi-build.c | 6 +++---
- target/loongarch/kvm/kvm.c | 62 ++++++++++++++++++++++++++++++++++++++
+ hw/loongarch/virt.c            | 2 +-
- target/loongarch/machine.c | 24 +++++++++++++++
+ include/hw/loongarch/virt.h    | 2 +-
-files changed, 98 insertions(+)
+files changed, 5 insertions(+), 5 deletions(-)
-diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
+diff --git a/hw/loongarch/virt-acpi-build.c b/hw/loongarch/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.h
+--- a/hw/loongarch/virt-acpi-build.c
-+++ b/target/loongarch/cpu.h
++++ b/hw/loongarch/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ enum loongarch_features {
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_acpi_build = {
      LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
  };
 +typedef struct  LoongArchBT {
 +    /* scratch registers */
 +    uint64_t scr0;
 +    uint64_t scr1;
 +    uint64_t scr2;
 +    uint64_t scr3;
 +    /* loongarch eflags */
 +    uint32_t eflags;
 +    uint32_t ftop;
 +} lbt_t;
 +
  typedef struct CPUArchState {
      uint64_t gpr[32];
      uint64_t pc;
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
      fpr_t fpr[32];
      bool cf[8];
      uint32_t fcsr0;
 +    lbt_t  lbt;
      uint32_t cpucfg[21];
 diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/kvm/kvm.c
 +++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static int kvm_loongarch_put_regs_fp(CPUState *cs)
      return ret;
  }
 +static int kvm_loongarch_put_lbt(CPUState *cs)
 +{
 +    CPULoongArchState *env = cpu_env(cs);
 +    uint64_t val;
 +    int ret;
 +
 +    /* check whether vm support LBT firstly */
 +    if (FIELD_EX32(env->cpucfg[2], CPUCFG2, LBT_ALL) != 7) {
 +        return 0;
 +    }
 +
 +    /* set six LBT registers including scr0-scr3, eflags, ftop */
 +    ret = kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR0, &env->lbt.scr0);
 +    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR1, &env->lbt.scr1);
 +    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR2, &env->lbt.scr2);
 +    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR3, &env->lbt.scr3);
 +    /*
 +     * Be cautious, KVM_REG_LOONGARCH_LBT_FTOP is defined as 64-bit however
 +     * lbt.ftop is 32-bit; the same with KVM_REG_LOONGARCH_LBT_EFLAGS register
 +     */
 +    val = env->lbt.eflags;
 +    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_EFLAGS, &val);
 +    val = env->lbt.ftop;
 +    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_FTOP, &val);
 +
 +    return ret;
 +}
 +
 +static int kvm_loongarch_get_lbt(CPUState *cs)
 +{
 +    CPULoongArchState *env = cpu_env(cs);
 +    uint64_t val;
 +    int ret;
 +
 +    /* check whether vm support LBT firstly */
 +    if (FIELD_EX32(env->cpucfg[2], CPUCFG2, LBT_ALL) != 7) {
 +        return 0;
 +    }
 +
 +    /* get six LBT registers including scr0-scr3, eflags, ftop */
 +    ret = kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR0, &env->lbt.scr0);
 +    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR1, &env->lbt.scr1);
 +    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR2, &env->lbt.scr2);
 +    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR3, &env->lbt.scr3);
 +    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_EFLAGS, &val);
 +    env->lbt.eflags = (uint32_t)val;
 +    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_FTOP, &val);
 +    env->lbt.ftop = (uint32_t)val;
 +
 +    return ret;
 +}
 +
  void kvm_arch_reset_vcpu(CPUState *cs)
  {
      CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
          return ret;
      }
 +    ret = kvm_loongarch_get_lbt(cs);
 +    if (ret) {
 +        return ret;
 +    }
 +
      ret = kvm_loongarch_get_mpstate(cs);
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
          return ret;
      }
 +    ret = kvm_loongarch_put_lbt(cs);
 +    if (ret) {
 +        return ret;
 +    }
 +
      ret = kvm_loongarch_put_mpstate(cs);
      return ret;
  }
 diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/machine.c
 +++ b/target/loongarch/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lasx = {
      },
  };
-+static bool lbt_needed(void *opaque)
+-static bool loongarch_is_acpi_enabled(LoongArchVirtMachineState *lvms)
-+{
++static bool virt_is_acpi_enabled(LoongArchVirtMachineState *lvms)
 +    LoongArchCPU *cpu = opaque;
 +
 +    return !!FIELD_EX64(cpu->env.cpucfg[2], CPUCFG2, LBT_ALL);
 +}
 +
 +static const VMStateDescription vmstate_lbt = {
 +    .name = "cpu/lbt",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .needed = lbt_needed,
 +    .fields = (const VMStateField[]) {
 +        VMSTATE_UINT64(env.lbt.scr0,   LoongArchCPU),
 +        VMSTATE_UINT64(env.lbt.scr1,   LoongArchCPU),
 +        VMSTATE_UINT64(env.lbt.scr2,   LoongArchCPU),
 +        VMSTATE_UINT64(env.lbt.scr3,   LoongArchCPU),
 +        VMSTATE_UINT32(env.lbt.eflags, LoongArchCPU),
 +        VMSTATE_UINT32(env.lbt.ftop,   LoongArchCPU),
 +        VMSTATE_END_OF_LIST()
 +    },
 +};
 +
  #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool tlb_needed(void *opaque)
  {
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_loongarch_cpu = {
+     if (lvms->acpi == ON_OFF_AUTO_OFF) {
- #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+         return false;
-         &vmstate_tlb,
+@@ -XXX,XX +XXX,XX @@ static bool loongarch_is_acpi_enabled(LoongArchVirtMachineState *lvms)
      return true;
  }
 -void loongarch_acpi_setup(LoongArchVirtMachineState *lvms)
 +void virt_acpi_setup(LoongArchVirtMachineState *lvms)
  {
      AcpiBuildTables tables;
      AcpiBuildState *build_state;
@@ -XXX,XX +XXX,XX @@ void loongarch_acpi_setup(LoongArchVirtMachineState *lvms)
          return;
      }
 -    if (!loongarch_is_acpi_enabled(lvms)) {
 +    if (!virt_is_acpi_enabled(lvms)) {
          ACPI_BUILD_DPRINTF("ACPI disabled. Bailing out.\n");
          return;
      }
 diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/loongarch/virt.c
 +++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_done(Notifier *notifier, void *data)
      LoongArchVirtMachineState *lvms = container_of(notifier,
                                        LoongArchVirtMachineState, machine_done);
      virt_build_smbios(lvms);
 -    loongarch_acpi_setup(lvms);
 +    virt_acpi_setup(lvms);
      virt_fdt_setup(lvms);
  }
 diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/loongarch/virt.h
 +++ b/include/hw/loongarch/virt.h
@@ -XXX,XX +XXX,XX @@ struct LoongArchVirtMachineState {
  #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
  OBJECT_DECLARE_SIMPLE_TYPE(LoongArchVirtMachineState, LOONGARCH_VIRT_MACHINE)
 -void loongarch_acpi_setup(LoongArchVirtMachineState *lvms);
 +void virt_acpi_setup(LoongArchVirtMachineState *lvms);
  #endif
-+        &vmstate_lbt,
-         NULL
-     }
- };
 --
-.34.1
+.43.5

-[PULL 6/6] target/loongarch: Add steal time support on migration
+[PULL 3/6] hw/loongarch/virt: Add separate file for fdt building
-From: Bibo Mao <maobibo@loongson.cn>
+Similiar with virt-acpi-build.c, file virt-fdt-build.c is added here.
 And move functions relative with fdt table building to the file.
-With pv steal time supported, VM machine needs get physical address
+It is only code movement and there is no function change.
 of each vcpu and notify new host during migration. Here two
 functions kvm_get_stealtime/kvm_set_stealtime, and guest steal time
 physical address is only updated on KVM_PUT_FULL_STATE stage.
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Reviewed-by: Song Gao <gaosong@loongson.cn>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20240930064040.753929-1-maobibo@loongson.cn>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- target/loongarch/cpu.h     |  3 ++
+ hw/loongarch/meson.build      |   4 +-
- target/loongarch/kvm/kvm.c | 65 ++++++++++++++++++++++++++++++++++++++
+ hw/loongarch/virt-fdt-build.c | 535 ++++++++++++++++++++++++++++++++++
- target/loongarch/machine.c |  6 ++--
+ hw/loongarch/virt.c           | 524 ---------------------------------
-files changed, 72 insertions(+), 2 deletions(-)
+ include/hw/loongarch/virt.h   |   1 +
 files changed, 539 insertions(+), 525 deletions(-)
  create mode 100644 hw/loongarch/virt-fdt-build.c
-diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
+diff --git a/hw/loongarch/meson.build b/hw/loongarch/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.h
+--- a/hw/loongarch/meson.build
-+++ b/target/loongarch/cpu.h
++++ b/hw/loongarch/meson.build
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ loongarch_ss.add(files(
-     uint64_t CSR_DBG;
+     'boot.c',
-     uint64_t CSR_DERA;
+ ))
-     uint64_t CSR_DSAVE;
+ common_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files('fw_cfg.c'))
-+    struct {
+-loongarch_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files('virt.c'))
-+        uint64_t guest_addr;
++loongarch_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files(
-+    } stealtime;
++  'virt-fdt-build.c',
++  'virt.c'))
- #ifdef CONFIG_TCG
+ loongarch_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
-     float_status fp_status;
-diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
+ hw_arch += {'loongarch': loongarch_ss}
-index XXXXXXX..XXXXXXX 100644
+diff --git a/hw/loongarch/virt-fdt-build.c b/hw/loongarch/virt-fdt-build.c
---- a/target/loongarch/kvm/kvm.c
+new file mode 100644
-+++ b/target/loongarch/kvm/kvm.c
+index XXXXXXX..XXXXXXX
-@@ -XXX,XX +XXX,XX @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
+--- /dev/null
-     KVM_CAP_LAST_INFO
++++ b/hw/loongarch/virt-fdt-build.c
- };
+@@ -XXX,XX +XXX,XX @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
-+static int kvm_get_stealtime(CPUState *cs)
++/*
-+{
++ * Copyright (c) 2025 Loongson Technology Corporation Limited
-+    CPULoongArchState *env = cpu_env(cs);
++ */
-+    int err;
++#include "qemu/osdep.h"
-+    struct kvm_device_attr attr = {
++#include "qemu/error-report.h"
-+        .group = KVM_LOONGARCH_VCPU_PVTIME_CTRL,
++#include "qemu/guest-random.h"
-+        .attr = KVM_LOONGARCH_VCPU_PVTIME_GPA,
++#include <libfdt.h>
-+        .addr = (uint64_t)&env->stealtime.guest_addr,
++#include "hw/acpi/generic_event_device.h"
-+    };
++#include "hw/core/sysbus-fdt.h"
-+
++#include "hw/intc/loongarch_extioi.h"
-+    err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
++#include "hw/loader.h"
-+    if (err) {
++#include "hw/loongarch/virt.h"
-+        return 0;
++#include "hw/pci-host/gpex.h"
 +#include "hw/pci-host/ls7a.h"
 +#include "system/device_tree.h"
 +#include "system/reset.h"
 +#include "target/loongarch/cpu.h"
 +
 +static void create_fdt(LoongArchVirtMachineState *lvms)
 +{
 +    MachineState *ms = MACHINE(lvms);
 +    uint8_t rng_seed[32];
 +
 +    ms->fdt = create_device_tree(&lvms->fdt_size);
 +    if (!ms->fdt) {
 +        error_report("create_device_tree() failed");
 +        exit(1);
 +    }
 +
-+    err = kvm_vcpu_ioctl(cs, KVM_GET_DEVICE_ATTR, attr);
++    /* Header */
-+    if (err) {
++    qemu_fdt_setprop_string(ms->fdt, "/", "compatible",
-+        error_report("PVTIME: KVM_GET_DEVICE_ATTR: %s", strerror(errno));
++                            "linux,dummy-loongson3");
-+        return err;
++    qemu_fdt_setprop_cell(ms->fdt, "/", "#address-cells", 0x2);
 +    qemu_fdt_setprop_cell(ms->fdt, "/", "#size-cells", 0x2);
 +    qemu_fdt_add_subnode(ms->fdt, "/chosen");
 +
 +    /* Pass seed to RNG */
 +    qemu_guest_getrandom_nofail(rng_seed, sizeof(rng_seed));
 +    qemu_fdt_setprop(ms->fdt, "/chosen", "rng-seed", rng_seed, sizeof(rng_seed));
 +}
 +
 +static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
 +{
 +    int num;
 +    MachineState *ms = MACHINE(lvms);
 +    MachineClass *mc = MACHINE_GET_CLASS(ms);
 +    const CPUArchIdList *possible_cpus;
 +    LoongArchCPU *cpu;
 +    CPUState *cs;
 +    char *nodename, *map_path;
 +
 +    qemu_fdt_add_subnode(ms->fdt, "/cpus");
 +    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
 +    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
 +
 +    /* cpu nodes */
 +    possible_cpus = mc->possible_cpu_arch_ids(ms);
 +    for (num = 0; num < possible_cpus->len; num++) {
 +        cs = possible_cpus->cpus[num].cpu;
 +        if (cs == NULL) {
 +            continue;
 +        }
 +
 +        nodename = g_strdup_printf("/cpus/cpu@%d", num);
 +        cpu = LOONGARCH_CPU(cs);
 +
 +        qemu_fdt_add_subnode(ms->fdt, nodename);
 +        qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "cpu");
 +        qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 +                                cpu->dtb_compatible);
 +        if (possible_cpus->cpus[num].props.has_node_id) {
 +            qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id",
 +                possible_cpus->cpus[num].props.node_id);
 +        }
 +        qemu_fdt_setprop_cell(ms->fdt, nodename, "reg", num);
 +        qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle",
 +                              qemu_fdt_alloc_phandle(ms->fdt));
 +        g_free(nodename);
 +    }
 +
-+    return 0;
++    /*cpu map */
-+}
++    qemu_fdt_add_subnode(ms->fdt, "/cpus/cpu-map");
-+
++    for (num = 0; num < possible_cpus->len; num++) {
-+static int kvm_set_stealtime(CPUState *cs)
++        cs = possible_cpus->cpus[num].cpu;
-+{
++        if (cs == NULL) {
-+    CPULoongArchState *env = cpu_env(cs);
++            continue;
-+    int err;
++        }
-+    struct kvm_device_attr attr = {
++
-+        .group = KVM_LOONGARCH_VCPU_PVTIME_CTRL,
++        nodename = g_strdup_printf("/cpus/cpu@%d", num);
-+        .attr = KVM_LOONGARCH_VCPU_PVTIME_GPA,
++        if (ms->smp.threads > 1) {
-+        .addr = (uint64_t)&env->stealtime.guest_addr,
++            map_path = g_strdup_printf(
-+    };
++                "/cpus/cpu-map/socket%d/core%d/thread%d",
-+
++                num / (ms->smp.cores * ms->smp.threads),
-+    err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
++                (num / ms->smp.threads) % ms->smp.cores,
-+    if (err) {
++                num % ms->smp.threads);
-+        return 0;
++        } else {
 +            map_path = g_strdup_printf(
 +                "/cpus/cpu-map/socket%d/core%d",
 +                num / ms->smp.cores,
 +                num % ms->smp.cores);
 +        }
 +        qemu_fdt_add_path(ms->fdt, map_path);
 +        qemu_fdt_setprop_phandle(ms->fdt, map_path, "cpu", nodename);
 +
 +        g_free(map_path);
 +        g_free(nodename);
 +    }
-+
++}
-+    err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr);
++
-+    if (err) {
++static void fdt_add_memory_node(MachineState *ms,
-+        error_report("PVTIME: KVM_SET_DEVICE_ATTR %s with gpa "TARGET_FMT_lx,
++                                uint64_t base, uint64_t size, int node_id)
-+                      strerror(errno), env->stealtime.guest_addr);
++{
-+        return err;
++    char *nodename = g_strdup_printf("/memory@%" PRIx64, base);
 +
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", base >> 32, base,
 +                           size >> 32, size);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "memory");
 +
 +    if (ms->numa_state && ms->numa_state->num_nodes) {
 +        qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id", node_id);
 +    }
 +
-+    return 0;
++    g_free(nodename);
 +}
 +
- static int kvm_loongarch_get_regs_core(CPUState *cs)
++static void fdt_add_memory_nodes(MachineState *ms)
- {
++{
-     int ret = 0;
++    hwaddr base, size, ram_size, gap;
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
++    int i, nb_numa_nodes, nodes;
-         return ret;
++    NodeInfo *numa_info;
-     }
++
++    ram_size = ms->ram_size;
-+    ret = kvm_get_stealtime(cs);
++    base = VIRT_LOWMEM_BASE;
-+    if (ret) {
++    gap = VIRT_LOWMEM_SIZE;
-+        return ret;
++    nodes = nb_numa_nodes = ms->numa_state->num_nodes;
 +    numa_info = ms->numa_state->nodes;
 +    if (!nodes) {
 +        nodes = 1;
 +    }
 +
-     ret = kvm_loongarch_get_mpstate(cs);
++    for (i = 0; i < nodes; i++) {
-     return ret;
++        if (nb_numa_nodes) {
- }
++            size = numa_info[i].node_mem;
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
++        } else {
-         return ret;
++            size = ram_size;
-     }
++        }
++
 +    if (level >= KVM_PUT_FULL_STATE) {
 +        /*
-+         * only KVM_PUT_FULL_STATE is required, kvm kernel will clear
++         * memory for the node splited into two part
-+         * guest_addr for KVM_PUT_RESET_STATE
++         *   lowram:  [base, +gap)
 +         *   highram: [VIRT_HIGHMEM_BASE, +(len - gap))
 +         */
-+        ret = kvm_set_stealtime(cs);
++        if (size >= gap) {
-+        if (ret) {
++            fdt_add_memory_node(ms, base, gap, i);
-+            return ret;
++            size -= gap;
 +            base = VIRT_HIGHMEM_BASE;
 +            gap = ram_size - VIRT_LOWMEM_SIZE;
 +        }
 +
 +        if (size) {
 +            fdt_add_memory_node(ms, base, size, i);
 +            base += size;
 +            gap -= size;
 +        }
 +    }
-+
++}
-     ret = kvm_loongarch_put_mpstate(cs);
++
-     return ret;
++static void fdt_add_fw_cfg_node(const LoongArchVirtMachineState *lvms)
 +{
 +    char *nodename;
 +    hwaddr base = VIRT_FWCFG_BASE;
 +    const MachineState *ms = MACHINE(lvms);
 +
 +    nodename = g_strdup_printf("/fw_cfg@%" PRIx64, base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_string(ms->fdt, nodename,
 +                            "compatible", "qemu,fw-cfg-mmio");
 +    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
 +                                 2, base, 2, 0x18);
 +    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_flash_node(LoongArchVirtMachineState *lvms)
 +{
 +    MachineState *ms = MACHINE(lvms);
 +    char *nodename;
 +    MemoryRegion *flash_mem;
 +
 +    hwaddr flash0_base;
 +    hwaddr flash0_size;
 +
 +    hwaddr flash1_base;
 +    hwaddr flash1_size;
 +
 +    flash_mem = pflash_cfi01_get_memory(lvms->flash[0]);
 +    flash0_base = flash_mem->addr;
 +    flash0_size = memory_region_size(flash_mem);
 +
 +    flash_mem = pflash_cfi01_get_memory(lvms->flash[1]);
 +    flash1_base = flash_mem->addr;
 +    flash1_size = memory_region_size(flash_mem);
 +
 +    nodename = g_strdup_printf("/flash@%" PRIx64, flash0_base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "cfi-flash");
 +    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
 +                                 2, flash0_base, 2, flash0_size,
 +                                 2, flash1_base, 2, flash1_size);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "bank-width", 4);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_cpuic_node(LoongArchVirtMachineState *lvms,
 +                               uint32_t *cpuintc_phandle)
 +{
 +    MachineState *ms = MACHINE(lvms);
 +    char *nodename;
 +
 +    *cpuintc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 +    nodename = g_strdup_printf("/cpuic");
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *cpuintc_phandle);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 +                            "loongson,cpu-interrupt-controller");
 +    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_eiointc_node(LoongArchVirtMachineState *lvms,
 +                                  uint32_t *cpuintc_phandle,
 +                                  uint32_t *eiointc_phandle)
 +{
 +    MachineState *ms = MACHINE(lvms);
 +    char *nodename;
 +    hwaddr extioi_base = APIC_BASE;
 +    hwaddr extioi_size = EXTIOI_SIZE;
 +
 +    *eiointc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 +    nodename = g_strdup_printf("/eiointc@%" PRIx64, extioi_base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *eiointc_phandle);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 +                            "loongson,ls2k2000-eiointc");
 +    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 +                          *cpuintc_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupts", 3);
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0,
 +                           extioi_base, 0x0, extioi_size);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_pch_pic_node(LoongArchVirtMachineState *lvms,
 +                                 uint32_t *eiointc_phandle,
 +                                 uint32_t *pch_pic_phandle)
 +{
 +    MachineState *ms = MACHINE(lvms);
 +    char *nodename;
 +    hwaddr pch_pic_base = VIRT_PCH_REG_BASE;
 +    hwaddr pch_pic_size = VIRT_PCH_REG_SIZE;
 +
 +    *pch_pic_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 +    nodename = g_strdup_printf("/platic@%" PRIx64, pch_pic_base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_cell(ms->fdt,  nodename, "phandle", *pch_pic_phandle);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 +                            "loongson,pch-pic-1.0");
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0,
 +                           pch_pic_base, 0, pch_pic_size);
 +    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 2);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 +                          *eiointc_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,pic-base-vec", 0);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_pch_msi_node(LoongArchVirtMachineState *lvms,
 +                                 uint32_t *eiointc_phandle,
 +                                 uint32_t *pch_msi_phandle)
 +{
 +    MachineState *ms = MACHINE(lvms);
 +    char *nodename;
 +    hwaddr pch_msi_base = VIRT_PCH_MSI_ADDR_LOW;
 +    hwaddr pch_msi_size = VIRT_PCH_MSI_SIZE;
 +
 +    *pch_msi_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 +    nodename = g_strdup_printf("/msi@%" PRIx64, pch_msi_base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *pch_msi_phandle);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 +                            "loongson,pch-msi-1.0");
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg",
 +                           0, pch_msi_base,
 +                           0, pch_msi_size);
 +    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 +                          *eiointc_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-base-vec",
 +                          VIRT_PCH_PIC_IRQ_NUM);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-num-vecs",
 +                          EXTIOI_IRQS - VIRT_PCH_PIC_IRQ_NUM);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_pcie_irq_map_node(const LoongArchVirtMachineState *lvms,
 +                                      char *nodename,
 +                                      uint32_t *pch_pic_phandle)
 +{
 +    int pin, dev;
 +    uint32_t irq_map_stride = 0;
 +    uint32_t full_irq_map[PCI_NUM_PINS * PCI_NUM_PINS * 10] = {};
 +    uint32_t *irq_map = full_irq_map;
 +    const MachineState *ms = MACHINE(lvms);
 +
 +    /*
 +     * This code creates a standard swizzle of interrupts such that
 +     * each device's first interrupt is based on it's PCI_SLOT number.
 +     * (See pci_swizzle_map_irq_fn())
 +     *
 +     * We only need one entry per interrupt in the table (not one per
 +     * possible slot) seeing the interrupt-map-mask will allow the table
 +     * to wrap to any number of devices.
 +     */
 +
 +    for (dev = 0; dev < PCI_NUM_PINS; dev++) {
 +        int devfn = dev * 0x8;
 +
 +        for (pin = 0; pin < PCI_NUM_PINS; pin++) {
 +            int irq_nr = 16 + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
 +            int i = 0;
 +
 +            /* Fill PCI address cells */
 +            irq_map[i] = cpu_to_be32(devfn << 8);
 +            i += 3;
 +
 +            /* Fill PCI Interrupt cells */
 +            irq_map[i] = cpu_to_be32(pin + 1);
 +            i += 1;
 +
 +            /* Fill interrupt controller phandle and cells */
 +            irq_map[i++] = cpu_to_be32(*pch_pic_phandle);
 +            irq_map[i++] = cpu_to_be32(irq_nr);
 +
 +            if (!irq_map_stride) {
 +                irq_map_stride = i;
 +            }
 +            irq_map += irq_map_stride;
 +        }
 +    }
 +
 +
 +    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-map", full_irq_map,
 +                     PCI_NUM_PINS * PCI_NUM_PINS *
 +                     irq_map_stride * sizeof(uint32_t));
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupt-map-mask",
 +                     0x1800, 0, 0, 0x7);
 +}
 +
 +static void fdt_add_pcie_node(const LoongArchVirtMachineState *lvms,
 +                              uint32_t *pch_pic_phandle,
 +                              uint32_t *pch_msi_phandle)
 +{
 +    char *nodename;
 +    hwaddr base_mmio = VIRT_PCI_MEM_BASE;
 +    hwaddr size_mmio = VIRT_PCI_MEM_SIZE;
 +    hwaddr base_pio = VIRT_PCI_IO_BASE;
 +    hwaddr size_pio = VIRT_PCI_IO_SIZE;
 +    hwaddr base_pcie = VIRT_PCI_CFG_BASE;
 +    hwaddr size_pcie = VIRT_PCI_CFG_SIZE;
 +    hwaddr base = base_pcie;
 +    const MachineState *ms = MACHINE(lvms);
 +
 +    nodename = g_strdup_printf("/pcie@%" PRIx64, base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_string(ms->fdt, nodename,
 +                            "compatible", "pci-host-ecam-generic");
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "pci");
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "#address-cells", 3);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "#size-cells", 2);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "linux,pci-domain", 0);
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "bus-range", 0,
 +                           PCIE_MMCFG_BUS(VIRT_PCI_CFG_SIZE - 1));
 +    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
 +    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
 +                                 2, base_pcie, 2, size_pcie);
 +    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "ranges",
 +                                 1, FDT_PCI_RANGE_IOPORT, 2, VIRT_PCI_IO_OFFSET,
 +                                 2, base_pio, 2, size_pio,
 +                                 1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
 +                                 2, base_mmio, 2, size_mmio);
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "msi-map",
 +                           0, *pch_msi_phandle, 0, 0x10000);
 +    fdt_add_pcie_irq_map_node(lvms, nodename, pch_pic_phandle);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_uart_node(LoongArchVirtMachineState *lvms,
 +                              uint32_t *pch_pic_phandle, hwaddr base,
 +                              int irq, bool chosen)
 +{
 +    char *nodename;
 +    hwaddr size = VIRT_UART_SIZE;
 +    MachineState *ms = MACHINE(lvms);
 +
 +    nodename = g_strdup_printf("/serial@%" PRIx64, base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "ns16550a");
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0, base, 0x0, size);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "clock-frequency", 100000000);
 +    if (chosen) {
 +        qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", nodename);
 +    }
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq, 0x4);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 +                          *pch_pic_phandle);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_rtc_node(LoongArchVirtMachineState *lvms,
 +                             uint32_t *pch_pic_phandle)
 +{
 +    char *nodename;
 +    hwaddr base = VIRT_RTC_REG_BASE;
 +    hwaddr size = VIRT_RTC_LEN;
 +    MachineState *ms = MACHINE(lvms);
 +
 +    nodename = g_strdup_printf("/rtc@%" PRIx64, base);
 +    qemu_fdt_add_subnode(ms->fdt, nodename);
 +    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 +                            "loongson,ls7a-rtc");
 +    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
 +    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts",
 +                           VIRT_RTC_IRQ - VIRT_GSI_BASE , 0x4);
 +    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 +                          *pch_pic_phandle);
 +    g_free(nodename);
 +}
 +
 +static void fdt_add_ged_reset(LoongArchVirtMachineState *lvms)
 +{
 +    char *name;
 +    uint32_t ged_handle;
 +    MachineState *ms = MACHINE(lvms);
 +    hwaddr base = VIRT_GED_REG_ADDR;
 +    hwaddr size = ACPI_GED_REG_COUNT;
 +
 +    ged_handle = qemu_fdt_alloc_phandle(ms->fdt);
 +    name = g_strdup_printf("/ged@%" PRIx64, base);
 +    qemu_fdt_add_subnode(ms->fdt, name);
 +    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon");
 +    qemu_fdt_setprop_cells(ms->fdt, name, "reg", 0x0, base, 0x0, size);
 +    /* 8 bit registers */
 +    qemu_fdt_setprop_cell(ms->fdt, name, "reg-shift", 0);
 +    qemu_fdt_setprop_cell(ms->fdt, name, "reg-io-width", 1);
 +    qemu_fdt_setprop_cell(ms->fdt, name, "phandle", ged_handle);
 +    ged_handle = qemu_fdt_get_phandle(ms->fdt, name);
 +    g_free(name);
 +
 +    name = g_strdup_printf("/reboot");
 +    qemu_fdt_add_subnode(ms->fdt, name);
 +    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-reboot");
 +    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
 +    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_RESET);
 +    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_RESET_VALUE);
 +    g_free(name);
 +
 +    name = g_strdup_printf("/poweroff");
 +    qemu_fdt_add_subnode(ms->fdt, name);
 +    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-poweroff");
 +    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
 +    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_SLEEP_CTL);
 +    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_SLP_EN |
 +                          (ACPI_GED_SLP_TYP_S5 << ACPI_GED_SLP_TYP_POS));
 +    g_free(name);
 +}
 +
 +void virt_fdt_setup(LoongArchVirtMachineState *lvms)
 +{
 +    MachineState *machine = MACHINE(lvms);
 +    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
 +    int i;
 +
 +    create_fdt(lvms);
 +    fdt_add_cpu_nodes(lvms);
 +    fdt_add_memory_nodes(machine);
 +    fdt_add_fw_cfg_node(lvms);
 +    fdt_add_flash_node(lvms);
 +
 +    /* Add cpu interrupt-controller */
 +    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
 +    /* Add Extend I/O Interrupt Controller node */
 +    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
 +    /* Add PCH PIC node */
 +    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
 +    /* Add PCH MSI node */
 +    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
 +    /* Add pcie node */
 +    fdt_add_pcie_node(lvms, &pch_pic_phandle, &pch_msi_phandle);
 +
 +    /*
 +     * Create uart fdt node in reverse order so that they appear
 +     * in the finished device tree lowest address first
 +     */
 +    for (i = VIRT_UART_COUNT; i-- > 0;) {
 +        hwaddr base = VIRT_UART_BASE + i * VIRT_UART_SIZE;
 +        int irq = VIRT_UART_IRQ + i - VIRT_GSI_BASE;
 +        fdt_add_uart_node(lvms, &pch_pic_phandle, base, irq, i == 0);
 +    }
 +
 +    fdt_add_rtc_node(lvms, &pch_pic_phandle);
 +    fdt_add_ged_reset(lvms);
 +    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
 +                                   VIRT_PLATFORM_BUS_BASEADDRESS,
 +                                   VIRT_PLATFORM_BUS_SIZE,
 +                                   VIRT_PLATFORM_BUS_IRQ);
 +
 +    /*
 +     * Since lowmem region starts from 0 and Linux kernel legacy start address
 +     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
 +     * access. FDT size limit with 1 MiB.
 +     * Put the FDT into the memory map as a ROM image: this will ensure
 +     * the FDT is copied again upon reset, even if addr points into RAM.
 +     */
 +    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
 +    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
 +                          &address_space_memory);
 +    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
 +            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
 +}
 diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/loongarch/virt.c
 +++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/loongarch/fw_cfg.h"
  #include "target/loongarch/cpu.h"
  #include "hw/firmware/smbios.h"
 -#include "hw/acpi/aml-build.h"
  #include "qapi/qapi-visit-common.h"
  #include "hw/acpi/generic_event_device.h"
  #include "hw/mem/nvdimm.h"
 -#include "system/device_tree.h"
 -#include <libfdt.h>
 -#include "hw/core/sysbus-fdt.h"
  #include "hw/platform-bus.h"
  #include "hw/display/ramfb.h"
  #include "hw/mem/pc-dimm.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/block/flash.h"
  #include "hw/virtio/virtio-iommu.h"
  #include "qemu/error-report.h"
 -#include "qemu/guest-random.h"
  static bool virt_is_veiointc_enabled(LoongArchVirtMachineState *lvms)
  {
@@ -XXX,XX +XXX,XX @@ static void virt_flash_map(LoongArchVirtMachineState *lvms,
      virt_flash_map1(flash1, VIRT_FLASH1_BASE, VIRT_FLASH1_SIZE, sysmem);
  }
-diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
 -static void fdt_add_cpuic_node(LoongArchVirtMachineState *lvms,
 -                               uint32_t *cpuintc_phandle)
 -{
 -    MachineState *ms = MACHINE(lvms);
 -    char *nodename;
 -
 -    *cpuintc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 -    nodename = g_strdup_printf("/cpuic");
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *cpuintc_phandle);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 -                            "loongson,cpu-interrupt-controller");
 -    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_eiointc_node(LoongArchVirtMachineState *lvms,
 -                                  uint32_t *cpuintc_phandle,
 -                                  uint32_t *eiointc_phandle)
 -{
 -    MachineState *ms = MACHINE(lvms);
 -    char *nodename;
 -    hwaddr extioi_base = APIC_BASE;
 -    hwaddr extioi_size = EXTIOI_SIZE;
 -
 -    *eiointc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 -    nodename = g_strdup_printf("/eiointc@%" PRIx64, extioi_base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *eiointc_phandle);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 -                            "loongson,ls2k2000-eiointc");
 -    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 -                          *cpuintc_phandle);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupts", 3);
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0,
 -                           extioi_base, 0x0, extioi_size);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_pch_pic_node(LoongArchVirtMachineState *lvms,
 -                                 uint32_t *eiointc_phandle,
 -                                 uint32_t *pch_pic_phandle)
 -{
 -    MachineState *ms = MACHINE(lvms);
 -    char *nodename;
 -    hwaddr pch_pic_base = VIRT_PCH_REG_BASE;
 -    hwaddr pch_pic_size = VIRT_PCH_REG_SIZE;
 -
 -    *pch_pic_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 -    nodename = g_strdup_printf("/platic@%" PRIx64, pch_pic_base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_cell(ms->fdt,  nodename, "phandle", *pch_pic_phandle);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 -                            "loongson,pch-pic-1.0");
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0,
 -                           pch_pic_base, 0, pch_pic_size);
 -    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 2);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 -                          *eiointc_phandle);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,pic-base-vec", 0);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_pch_msi_node(LoongArchVirtMachineState *lvms,
 -                                 uint32_t *eiointc_phandle,
 -                                 uint32_t *pch_msi_phandle)
 -{
 -    MachineState *ms = MACHINE(lvms);
 -    char *nodename;
 -    hwaddr pch_msi_base = VIRT_PCH_MSI_ADDR_LOW;
 -    hwaddr pch_msi_size = VIRT_PCH_MSI_SIZE;
 -
 -    *pch_msi_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 -    nodename = g_strdup_printf("/msi@%" PRIx64, pch_msi_base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *pch_msi_phandle);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 -                            "loongson,pch-msi-1.0");
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg",
 -                           0, pch_msi_base,
 -                           0, pch_msi_size);
 -    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 -                          *eiointc_phandle);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-base-vec",
 -                          VIRT_PCH_PIC_IRQ_NUM);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-num-vecs",
 -                          EXTIOI_IRQS - VIRT_PCH_PIC_IRQ_NUM);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_flash_node(LoongArchVirtMachineState *lvms)
 -{
 -    MachineState *ms = MACHINE(lvms);
 -    char *nodename;
 -    MemoryRegion *flash_mem;
 -
 -    hwaddr flash0_base;
 -    hwaddr flash0_size;
 -
 -    hwaddr flash1_base;
 -    hwaddr flash1_size;
 -
 -    flash_mem = pflash_cfi01_get_memory(lvms->flash[0]);
 -    flash0_base = flash_mem->addr;
 -    flash0_size = memory_region_size(flash_mem);
 -
 -    flash_mem = pflash_cfi01_get_memory(lvms->flash[1]);
 -    flash1_base = flash_mem->addr;
 -    flash1_size = memory_region_size(flash_mem);
 -
 -    nodename = g_strdup_printf("/flash@%" PRIx64, flash0_base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "cfi-flash");
 -    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
 -                                 2, flash0_base, 2, flash0_size,
 -                                 2, flash1_base, 2, flash1_size);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "bank-width", 4);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_rtc_node(LoongArchVirtMachineState *lvms,
 -                             uint32_t *pch_pic_phandle)
 -{
 -    char *nodename;
 -    hwaddr base = VIRT_RTC_REG_BASE;
 -    hwaddr size = VIRT_RTC_LEN;
 -    MachineState *ms = MACHINE(lvms);
 -
 -    nodename = g_strdup_printf("/rtc@%" PRIx64, base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 -                            "loongson,ls7a-rtc");
 -    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts",
 -                           VIRT_RTC_IRQ - VIRT_GSI_BASE , 0x4);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 -                          *pch_pic_phandle);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_ged_reset(LoongArchVirtMachineState *lvms)
 -{
 -    char *name;
 -    uint32_t ged_handle;
 -    MachineState *ms = MACHINE(lvms);
 -    hwaddr base = VIRT_GED_REG_ADDR;
 -    hwaddr size = ACPI_GED_REG_COUNT;
 -
 -    ged_handle = qemu_fdt_alloc_phandle(ms->fdt);
 -    name = g_strdup_printf("/ged@%" PRIx64, base);
 -    qemu_fdt_add_subnode(ms->fdt, name);
 -    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon");
 -    qemu_fdt_setprop_cells(ms->fdt, name, "reg", 0x0, base, 0x0, size);
 -    /* 8 bit registers */
 -    qemu_fdt_setprop_cell(ms->fdt, name, "reg-shift", 0);
 -    qemu_fdt_setprop_cell(ms->fdt, name, "reg-io-width", 1);
 -    qemu_fdt_setprop_cell(ms->fdt, name, "phandle", ged_handle);
 -    ged_handle = qemu_fdt_get_phandle(ms->fdt, name);
 -    g_free(name);
 -
 -    name = g_strdup_printf("/reboot");
 -    qemu_fdt_add_subnode(ms->fdt, name);
 -    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-reboot");
 -    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
 -    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_RESET);
 -    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_RESET_VALUE);
 -    g_free(name);
 -
 -    name = g_strdup_printf("/poweroff");
 -    qemu_fdt_add_subnode(ms->fdt, name);
 -    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-poweroff");
 -    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
 -    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_SLEEP_CTL);
 -    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_SLP_EN |
 -                          (ACPI_GED_SLP_TYP_S5 << ACPI_GED_SLP_TYP_POS));
 -    g_free(name);
 -}
 -
 -static void fdt_add_uart_node(LoongArchVirtMachineState *lvms,
 -                              uint32_t *pch_pic_phandle, hwaddr base,
 -                              int irq, bool chosen)
 -{
 -    char *nodename;
 -    hwaddr size = VIRT_UART_SIZE;
 -    MachineState *ms = MACHINE(lvms);
 -
 -    nodename = g_strdup_printf("/serial@%" PRIx64, base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "ns16550a");
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0, base, 0x0, size);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "clock-frequency", 100000000);
 -    if (chosen) {
 -        qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", nodename);
 -    }
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq, 0x4);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
 -                          *pch_pic_phandle);
 -    g_free(nodename);
 -}
 -
 -static void create_fdt(LoongArchVirtMachineState *lvms)
 -{
 -    MachineState *ms = MACHINE(lvms);
 -    uint8_t rng_seed[32];
 -
 -    ms->fdt = create_device_tree(&lvms->fdt_size);
 -    if (!ms->fdt) {
 -        error_report("create_device_tree() failed");
 -        exit(1);
 -    }
 -
 -    /* Header */
 -    qemu_fdt_setprop_string(ms->fdt, "/", "compatible",
 -                            "linux,dummy-loongson3");
 -    qemu_fdt_setprop_cell(ms->fdt, "/", "#address-cells", 0x2);
 -    qemu_fdt_setprop_cell(ms->fdt, "/", "#size-cells", 0x2);
 -    qemu_fdt_add_subnode(ms->fdt, "/chosen");
 -
 -    /* Pass seed to RNG */
 -    qemu_guest_getrandom_nofail(rng_seed, sizeof(rng_seed));
 -    qemu_fdt_setprop(ms->fdt, "/chosen", "rng-seed", rng_seed, sizeof(rng_seed));
 -}
 -
 -static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
 -{
 -    int num;
 -    MachineState *ms = MACHINE(lvms);
 -    MachineClass *mc = MACHINE_GET_CLASS(ms);
 -    const CPUArchIdList *possible_cpus;
 -    LoongArchCPU *cpu;
 -    CPUState *cs;
 -    char *nodename, *map_path;
 -
 -    qemu_fdt_add_subnode(ms->fdt, "/cpus");
 -    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
 -    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
 -
 -    /* cpu nodes */
 -    possible_cpus = mc->possible_cpu_arch_ids(ms);
 -    for (num = 0; num < possible_cpus->len; num++) {
 -        cs = possible_cpus->cpus[num].cpu;
 -        if (cs == NULL) {
 -            continue;
 -        }
 -
 -        nodename = g_strdup_printf("/cpus/cpu@%d", num);
 -        cpu = LOONGARCH_CPU(cs);
 -
 -        qemu_fdt_add_subnode(ms->fdt, nodename);
 -        qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "cpu");
 -        qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
 -                                cpu->dtb_compatible);
 -        if (possible_cpus->cpus[num].props.has_node_id) {
 -            qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id",
 -                possible_cpus->cpus[num].props.node_id);
 -        }
 -        qemu_fdt_setprop_cell(ms->fdt, nodename, "reg", num);
 -        qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle",
 -                              qemu_fdt_alloc_phandle(ms->fdt));
 -        g_free(nodename);
 -    }
 -
 -    /*cpu map */
 -    qemu_fdt_add_subnode(ms->fdt, "/cpus/cpu-map");
 -    for (num = 0; num < possible_cpus->len; num++) {
 -        cs = possible_cpus->cpus[num].cpu;
 -        if (cs == NULL) {
 -            continue;
 -        }
 -
 -        nodename = g_strdup_printf("/cpus/cpu@%d", num);
 -        if (ms->smp.threads > 1) {
 -            map_path = g_strdup_printf(
 -                "/cpus/cpu-map/socket%d/core%d/thread%d",
 -                num / (ms->smp.cores * ms->smp.threads),
 -                (num / ms->smp.threads) % ms->smp.cores,
 -                num % ms->smp.threads);
 -        } else {
 -            map_path = g_strdup_printf(
 -                "/cpus/cpu-map/socket%d/core%d",
 -                num / ms->smp.cores,
 -                num % ms->smp.cores);
 -        }
 -        qemu_fdt_add_path(ms->fdt, map_path);
 -        qemu_fdt_setprop_phandle(ms->fdt, map_path, "cpu", nodename);
 -
 -        g_free(map_path);
 -        g_free(nodename);
 -    }
 -}
 -
 -static void fdt_add_fw_cfg_node(const LoongArchVirtMachineState *lvms)
 -{
 -    char *nodename;
 -    hwaddr base = VIRT_FWCFG_BASE;
 -    const MachineState *ms = MACHINE(lvms);
 -
 -    nodename = g_strdup_printf("/fw_cfg@%" PRIx64, base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_string(ms->fdt, nodename,
 -                            "compatible", "qemu,fw-cfg-mmio");
 -    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
 -                                 2, base, 2, 0x18);
 -    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_pcie_irq_map_node(const LoongArchVirtMachineState *lvms,
 -                                      char *nodename,
 -                                      uint32_t *pch_pic_phandle)
 -{
 -    int pin, dev;
 -    uint32_t irq_map_stride = 0;
 -    uint32_t full_irq_map[PCI_NUM_PINS * PCI_NUM_PINS * 10] = {};
 -    uint32_t *irq_map = full_irq_map;
 -    const MachineState *ms = MACHINE(lvms);
 -
 -    /* This code creates a standard swizzle of interrupts such that
 -     * each device's first interrupt is based on it's PCI_SLOT number.
 -     * (See pci_swizzle_map_irq_fn())
 -     *
 -     * We only need one entry per interrupt in the table (not one per
 -     * possible slot) seeing the interrupt-map-mask will allow the table
 -     * to wrap to any number of devices.
 -     */
 -
 -    for (dev = 0; dev < PCI_NUM_PINS; dev++) {
 -        int devfn = dev * 0x8;
 -
 -        for (pin = 0; pin < PCI_NUM_PINS; pin++) {
 -            int irq_nr = 16 + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
 -            int i = 0;
 -
 -            /* Fill PCI address cells */
 -            irq_map[i] = cpu_to_be32(devfn << 8);
 -            i += 3;
 -
 -            /* Fill PCI Interrupt cells */
 -            irq_map[i] = cpu_to_be32(pin + 1);
 -            i += 1;
 -
 -            /* Fill interrupt controller phandle and cells */
 -            irq_map[i++] = cpu_to_be32(*pch_pic_phandle);
 -            irq_map[i++] = cpu_to_be32(irq_nr);
 -
 -            if (!irq_map_stride) {
 -                irq_map_stride = i;
 -            }
 -            irq_map += irq_map_stride;
 -        }
 -    }
 -
 -
 -    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-map", full_irq_map,
 -                     PCI_NUM_PINS * PCI_NUM_PINS *
 -                     irq_map_stride * sizeof(uint32_t));
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupt-map-mask",
 -                     0x1800, 0, 0, 0x7);
 -}
 -
 -static void fdt_add_pcie_node(const LoongArchVirtMachineState *lvms,
 -                              uint32_t *pch_pic_phandle,
 -                              uint32_t *pch_msi_phandle)
 -{
 -    char *nodename;
 -    hwaddr base_mmio = VIRT_PCI_MEM_BASE;
 -    hwaddr size_mmio = VIRT_PCI_MEM_SIZE;
 -    hwaddr base_pio = VIRT_PCI_IO_BASE;
 -    hwaddr size_pio = VIRT_PCI_IO_SIZE;
 -    hwaddr base_pcie = VIRT_PCI_CFG_BASE;
 -    hwaddr size_pcie = VIRT_PCI_CFG_SIZE;
 -    hwaddr base = base_pcie;
 -
 -    const MachineState *ms = MACHINE(lvms);
 -
 -    nodename = g_strdup_printf("/pcie@%" PRIx64, base);
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_string(ms->fdt, nodename,
 -                            "compatible", "pci-host-ecam-generic");
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "pci");
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "#address-cells", 3);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "#size-cells", 2);
 -    qemu_fdt_setprop_cell(ms->fdt, nodename, "linux,pci-domain", 0);
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "bus-range", 0,
 -                           PCIE_MMCFG_BUS(VIRT_PCI_CFG_SIZE - 1));
 -    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
 -    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
 -                                 2, base_pcie, 2, size_pcie);
 -    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "ranges",
 -                                 1, FDT_PCI_RANGE_IOPORT, 2, VIRT_PCI_IO_OFFSET,
 -                                 2, base_pio, 2, size_pio,
 -                                 1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
 -                                 2, base_mmio, 2, size_mmio);
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "msi-map",
 -                           0, *pch_msi_phandle, 0, 0x10000);
 -
 -    fdt_add_pcie_irq_map_node(lvms, nodename, pch_pic_phandle);
 -
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_memory_node(MachineState *ms,
 -                                uint64_t base, uint64_t size, int node_id)
 -{
 -    char *nodename = g_strdup_printf("/memory@%" PRIx64, base);
 -
 -    qemu_fdt_add_subnode(ms->fdt, nodename);
 -    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", base >> 32, base,
 -                           size >> 32, size);
 -    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "memory");
 -
 -    if (ms->numa_state && ms->numa_state->num_nodes) {
 -        qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id", node_id);
 -    }
 -
 -    g_free(nodename);
 -}
 -
 -static void fdt_add_memory_nodes(MachineState *ms)
 -{
 -    hwaddr base, size, ram_size, gap;
 -    int i, nb_numa_nodes, nodes;
 -    NodeInfo *numa_info;
 -
 -    ram_size = ms->ram_size;
 -    base = VIRT_LOWMEM_BASE;
 -    gap = VIRT_LOWMEM_SIZE;
 -    nodes = nb_numa_nodes = ms->numa_state->num_nodes;
 -    numa_info = ms->numa_state->nodes;
 -    if (!nodes) {
 -        nodes = 1;
 -    }
 -
 -    for (i = 0; i < nodes; i++) {
 -        if (nb_numa_nodes) {
 -            size = numa_info[i].node_mem;
 -        } else {
 -            size = ram_size;
 -        }
 -
 -        /*
 -         * memory for the node splited into two part
 -         *   lowram:  [base, +gap)
 -         *   highram: [VIRT_HIGHMEM_BASE, +(len - gap))
 -         */
 -        if (size >= gap) {
 -            fdt_add_memory_node(ms, base, gap, i);
 -            size -= gap;
 -            base = VIRT_HIGHMEM_BASE;
 -            gap = ram_size - VIRT_LOWMEM_SIZE;
 -        }
 -
 -        if (size) {
 -            fdt_add_memory_node(ms, base, size, i);
 -            base += size;
 -            gap -= size;
 -        }
 -    }
 -}
 -
  static void virt_build_smbios(LoongArchVirtMachineState *lvms)
  {
      MachineState *ms = MACHINE(lvms);
@@ -XXX,XX +XXX,XX @@ static void virt_build_smbios(LoongArchVirtMachineState *lvms)
      }
  }
 -static void virt_fdt_setup(LoongArchVirtMachineState *lvms)
 -{
 -    MachineState *machine = MACHINE(lvms);
 -    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
 -    int i;
 -
 -    create_fdt(lvms);
 -    fdt_add_cpu_nodes(lvms);
 -    fdt_add_memory_nodes(machine);
 -    fdt_add_fw_cfg_node(lvms);
 -    fdt_add_flash_node(lvms);
 -
 -    /* Add cpu interrupt-controller */
 -    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
 -    /* Add Extend I/O Interrupt Controller node */
 -    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
 -    /* Add PCH PIC node */
 -    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
 -    /* Add PCH MSI node */
 -    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
 -    /* Add pcie node */
 -    fdt_add_pcie_node(lvms, &pch_pic_phandle, &pch_msi_phandle);
 -
 -    /*
 -     * Create uart fdt node in reverse order so that they appear
 -     * in the finished device tree lowest address first
 -     */
 -    for (i = VIRT_UART_COUNT; i-- > 0;) {
 -        hwaddr base = VIRT_UART_BASE + i * VIRT_UART_SIZE;
 -        int irq = VIRT_UART_IRQ + i - VIRT_GSI_BASE;
 -        fdt_add_uart_node(lvms, &pch_pic_phandle, base, irq, i == 0);
 -    }
 -
 -    fdt_add_rtc_node(lvms, &pch_pic_phandle);
 -    fdt_add_ged_reset(lvms);
 -    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
 -                                   VIRT_PLATFORM_BUS_BASEADDRESS,
 -                                   VIRT_PLATFORM_BUS_SIZE,
 -                                   VIRT_PLATFORM_BUS_IRQ);
 -
 -    /*
 -     * Since lowmem region starts from 0 and Linux kernel legacy start address
 -     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
 -     * access. FDT size limit with 1 MiB.
 -     * Put the FDT into the memory map as a ROM image: this will ensure
 -     * the FDT is copied again upon reset, even if addr points into RAM.
 -     */
 -    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
 -    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
 -                          &address_space_memory);
 -    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
 -            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
 -}
 -
  static void virt_done(Notifier *notifier, void *data)
  {
      LoongArchVirtMachineState *lvms = container_of(notifier,
 diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/machine.c
+--- a/include/hw/loongarch/virt.h
-+++ b/target/loongarch/machine.c
++++ b/include/hw/loongarch/virt.h
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tlb = {
+@@ -XXX,XX +XXX,XX @@ struct LoongArchVirtMachineState {
- /* LoongArch CPU state */
+ #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
- const VMStateDescription vmstate_loongarch_cpu = {
+ OBJECT_DECLARE_SIMPLE_TYPE(LoongArchVirtMachineState, LOONGARCH_VIRT_MACHINE)
-     .name = "cpu",
+ void virt_acpi_setup(LoongArchVirtMachineState *lvms);
--    .version_id = 2,
++void virt_fdt_setup(LoongArchVirtMachineState *lvms);
--    .minimum_version_id = 2,
+ #endif
 +    .version_id = 3,
 +    .minimum_version_id = 3,
      .fields = (const VMStateField[]) {
          VMSTATE_UINTTL_ARRAY(env.gpr, LoongArchCPU, 32),
          VMSTATE_UINTTL(env.pc, LoongArchCPU),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_loongarch_cpu = {
          VMSTATE_UINT64(env.CSR_DSAVE, LoongArchCPU),
          VMSTATE_UINT64(kvm_state_counter, LoongArchCPU),
 +        /* PV steal time */
 +        VMSTATE_UINT64(env.stealtime.guest_addr, LoongArchCPU),
          VMSTATE_END_OF_LIST()
      },
 --
-.34.1
+.43.5

-[PULL 4/6] linux-headers: loongarch: Add kvm_para.h and unistd_64.h
+[PULL 4/6] hw/loongarch/virt: Set iocsr address space when CPU is created
-From: Bibo Mao <maobibo@loongson.cn>
+There is only one iocsr address space for the whole virt-machine
 board. When CPU is created, the one of percpu points to that of
 the board.
-KVM LBT supports on LoongArch depends on the linux-header file
+Here set iocsr address space when CPU is created rather than IPI
-kvm_para.h, also unistd_64.h is required by unistd.h on LoongArch
+creation stage.
 since 6.11, otherwise there will be compiling error such as:
 linux-headers/asm/unistd.h:3:10: fatal error: asm/unistd_64.h: No such file or directory
  #include <asm/unistd_64.h>
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Acked-by: Song Gao <gaosong@loongson.cn>
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Message-Id: <20241017020708.1728620-2-maobibo@loongson.cn>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- scripts/update-linux-headers.sh | 4 ++++
+ hw/loongarch/virt.c | 2 +-
-file changed, 4 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/scripts/update-linux-headers.sh
+--- a/hw/loongarch/virt.c
-+++ b/scripts/update-linux-headers.sh
++++ b/hw/loongarch/virt.c
-@@ -XXX,XX +XXX,XX @@ EOF
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
-     if [ $arch = riscv ]; then
+         cpudev = DEVICE(cpu_state);
-         cp "$hdrdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
+         lacpu = LOONGARCH_CPU(cpu_state);
-     fi
+         env = &(lacpu->env);
-+    if [ $arch = loongarch ]; then
+-        env->address_space_iocsr = &lvms->as_iocsr;
-+        cp "$hdrdir/include/asm/kvm_para.h" "$output/linux-headers/asm-loongarch/"
-+        cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-loongarch/"
+         /* connect ipi irq to cpu irq */
-+    fi
+         qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
- done
+@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
- arch=
+         machine->possible_cpus->cpus[i].cpu = cpu;
          lacpu = LOONGARCH_CPU(cpu);
          lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
 +        lacpu->env.address_space_iocsr = &lvms->as_iocsr;
      }
      fw_cfg_add_memory(machine);
 --
-.34.1
+.43.5

-[PULL 3/6] target/loongarch/kvm: Implement LoongArch PMU extension
+[PULL 5/6] hw/loongarch/virt: Remove unused ipistate
-From: Bibo Mao <maobibo@loongson.cn>
+Field ipistate in LoongArch CPU object is not used any more,
 remove it here.
-Implement PMU extension for LoongArch kvm mode. Use OnOffAuto type
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-variable pmu to check the PMU feature. If the PMU Feature is not supported
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
-with KVM host, it reports error if there is pmu=on command line.
+---
  hw/loongarch/virt.c    | 5 -----
  target/loongarch/cpu.h | 2 --
 files changed, 7 deletions(-)
-If there is no any command line about pmu parameter, it checks whether
+diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
 KVM host supports the PMU Feature and set the corresponding value in cpucfg.
 This patch is based on lbt patch located at
   https://lore.kernel.org/qemu-devel/20240904061859.86615-1-maobibo@loongson.cn
 Co-developed-by: Song Gao <gaosong@loongson.cn>
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
 Reviewed-by: Song Gao <gaosong@loongson.cn>
 Message-Id: <20240918082315.2345034-1-maobibo@loongson.cn>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
  target/loongarch/cpu.c                | 19 +++++++++++++
  target/loongarch/cpu.h                |  2 ++
  target/loongarch/kvm/kvm.c            | 41 +++++++++++++++++++++++++++
  target/loongarch/loongarch-qmp-cmds.c |  2 +-
 files changed, 63 insertions(+), 1 deletion(-)
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.c
+--- a/hw/loongarch/virt.c
-+++ b/target/loongarch/cpu.c
++++ b/hw/loongarch/virt.c
-@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lbt(Object *obj, bool value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
-     cpu->lbt = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+     DeviceState *pch_pic, *pch_msi, *cpudev;
- }
+     DeviceState *ipi, *extioi;
+     SysBusDevice *d;
-+static bool loongarch_get_pmu(Object *obj, Error **errp)
+-    LoongArchCPU *lacpu;
-+{
+-    CPULoongArchState *env;
-+    return LOONGARCH_CPU(obj)->pmu != ON_OFF_AUTO_OFF;
+     CPUState *cpu_state;
-+}
+     int cpu, pin, i, start, num;
-+
-+static void loongarch_set_pmu(Object *obj, bool value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
-+{
+     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+         cpu_state = qemu_get_cpu(cpu);
-+
+         cpudev = DEVICE(cpu_state);
-+    cpu->pmu = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+-        lacpu = LOONGARCH_CPU(cpu_state);
-+}
+-        env = &(lacpu->env);
-+
- void loongarch_cpu_post_init(Object *obj)
+         /* connect ipi irq to cpu irq */
- {
+         qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
-     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+-        env->ipistate = ipi;
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
                                   loongarch_set_lbt);
          object_property_set_description(obj, "lbt",
                                     "Set off to disable Binary Tranlation.");
 +
 +        cpu->pmu = ON_OFF_AUTO_AUTO;
 +        object_property_add_bool(obj, "pmu", loongarch_get_pmu,
 +                                 loongarch_set_pmu);
 +        object_property_set_description(obj, "pmu",
 +                                   "Set off to performance monitor unit.");
 +
      } else {
          cpu->lbt = ON_OFF_AUTO_OFF;
      }
+     /* Create EXTIOI device */
 diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.h
 +++ b/target/loongarch/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct LoongArchTLB LoongArchTLB;
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+     bool load_elf;
- enum loongarch_features {
+     uint64_t elf_address;
-     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
+     uint32_t mp_state;
-+    LOONGARCH_FEATURE_PMU,
+-    /* Store ipistate to access from this struct */
- };
+-    DeviceState *ipistate;
- typedef struct  LoongArchBT {
+     struct loongarch_boot_info *boot_info;
-@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
+ #endif
      QEMUTimer timer;
      uint32_t  phy_id;
      OnOffAuto lbt;
 +    OnOffAuto pmu;
      /* 'compatible' string for this CPU for Linux device trees */
      const char *dtb_compatible;
 diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/kvm/kvm.c
 +++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
          attr.attr = KVM_LOONGARCH_VM_FEAT_MIPSBT;
          ret |= kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
          return (ret == 0);
 +
 +    case LOONGARCH_FEATURE_PMU:
 +        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
 +        attr.attr = KVM_LOONGARCH_VM_FEAT_PMU;
 +        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
 +        return (ret == 0);
 +
      default:
          return false;
      }
 +
 +    return false;
  }
  static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
@@ -XXX,XX +XXX,XX @@ static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
      return 0;
  }
 +static int kvm_cpu_check_pmu(CPUState *cs, Error **errp)
 +{
 +    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
 +    CPULoongArchState *env = cpu_env(cs);
 +    bool kvm_supported;
 +
 +    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_PMU);
 +    if (cpu->pmu == ON_OFF_AUTO_ON) {
 +        if (!kvm_supported) {
 +            error_setg(errp, "'pmu' feature not supported by KVM on the host");
 +            return -ENOTSUP;
 +        }
 +    } else if (cpu->pmu != ON_OFF_AUTO_AUTO) {
 +        /* disable pmu if ON_OFF_AUTO_OFF is set */
 +        kvm_supported = false;
 +    }
 +
 +    if (kvm_supported) {
 +        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, PMP, 1);
 +        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, PMNUM, 3);
 +        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, PMBITS, 63);
 +        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, UPM, 1);
 +    }
 +    return 0;
 +}
 +
  int kvm_arch_init_vcpu(CPUState *cs)
  {
      uint64_t val;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      if (ret < 0) {
          error_report_err(local_err);
      }
 +
 +    ret = kvm_cpu_check_pmu(cs, &local_err);
 +    if (ret < 0) {
 +        error_report_err(local_err);
 +    }
 +
      return ret;
  }
 diff --git a/target/loongarch/loongarch-qmp-cmds.c b/target/loongarch/loongarch-qmp-cmds.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/loongarch-qmp-cmds.c
 +++ b/target/loongarch/loongarch-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
  }
  static const char *cpu_model_advertised_features[] = {
 -    "lsx", "lasx", "lbt", NULL
 +    "lsx", "lasx", "lbt", "pmu", NULL
  };
  CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 --
-.34.1
+.43.5

-[PULL 1/6] target/loongarch: Add loongson binary translation feature
+[PULL 6/6] hw/loongarch/virt: CPU irq line connection improvement
-From: Bibo Mao <maobibo@loongson.cn>
+Interrupt controller extioi and ipi connect to CPU with irq line method.
+With command -smp x, -device la464-loongarch-cpu, smp.cpus is not
-Loongson Binary Translation (LBT) is used to accelerate binary
+accurate for all possible CPU objects, possible_cpu_arch_ids() is used.
 translation, which contains 4 scratch registers (scr0 to scr3), x86/ARM
 eflags (eflags) and x87 fpu stack pointer (ftop).
 Now LBT feature is added in kvm mode, not supported in TCG mode since
 it is not emulated. Feature variable lbt is added with OnOffAuto type,
 If lbt feature is not supported with KVM host, it reports error if there
 is lbt=on command line.
 If there is no any command line about lbt parameter, it checks whether
 KVM host supports lbt feature and set the corresponding value in cpucfg.
 Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Reviewed-by: Song Gao <gaosong@loongson.cn>
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 Message-Id: <20240929070405.235200-2-maobibo@loongson.cn>
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- target/loongarch/cpu.c                | 24 +++++++++++
+ hw/loongarch/virt.c         | 60 ++++++++++++++++++++++---------------
- target/loongarch/cpu.h                |  6 +++
+ include/hw/loongarch/virt.h |  2 ++
- target/loongarch/kvm/kvm.c            | 57 ++++++++++++++++++++++++++-
+files changed, 38 insertions(+), 24 deletions(-)
  target/loongarch/loongarch-qmp-cmds.c |  2 +-
 files changed, 87 insertions(+), 2 deletions(-)
-diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
+diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.c
+--- a/hw/loongarch/virt.c
-+++ b/target/loongarch/cpu.c
++++ b/hw/loongarch/virt.c
-@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
-     }
+     lvms->platform_bus_dev = create_platform_bus(pch_pic);
  }
-+static bool loongarch_get_lbt(Object *obj, Error **errp)
+-static void virt_irq_init(LoongArchVirtMachineState *lvms)
-+{
++static void virt_cpu_irq_init(LoongArchVirtMachineState *lvms)
-+    return LOONGARCH_CPU(obj)->lbt != ON_OFF_AUTO_OFF;
+ {
-+}
++    int num, pin;
      MachineState *ms = MACHINE(lvms);
 -    DeviceState *pch_pic, *pch_msi, *cpudev;
 +    MachineClass *mc = MACHINE_GET_CLASS(ms);
 +    const CPUArchIdList *possible_cpus;
 +    CPUState *cs;
 +
-+static void loongarch_set_lbt(Object *obj, bool value, Error **errp)
++    /* cpu nodes */
-+{
++    possible_cpus = mc->possible_cpu_arch_ids(ms);
-+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
++    for (num = 0; num < possible_cpus->len; num++) {
 +        cs = possible_cpus->cpus[num].cpu;
 +        if (cs == NULL) {
 +            continue;
 +        }
 +
-+    cpu->lbt = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
++        /* connect ipi irq to cpu irq */
-+}
++        qdev_connect_gpio_out(lvms->ipi, num,
 +                              qdev_get_gpio_in(DEVICE(cs), IRQ_IPI));
 +
- void loongarch_cpu_post_init(Object *obj)
- {
-+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-+
-     object_property_add_bool(obj, "lsx", loongarch_get_lsx,
-                              loongarch_set_lsx);
-     object_property_add_bool(obj, "lasx", loongarch_get_lasx,
-                              loongarch_set_lasx);
-+    /* lbt is enabled only in kvm mode, not supported in tcg mode */
-+    if (kvm_enabled()) {
-+        cpu->lbt = ON_OFF_AUTO_AUTO;
-+        object_property_add_bool(obj, "lbt", loongarch_get_lbt,
-+                                 loongarch_set_lbt);
-+        object_property_set_description(obj, "lbt",
-+                                   "Set off to disable Binary Tranlation.");
-+    } else {
-+        cpu->lbt = ON_OFF_AUTO_OFF;
-+    }
- }
- static void loongarch_cpu_init(Object *obj)
-diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu.h
-+++ b/target/loongarch/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(CPUCFG2, LLFTP_VER, 15, 3)
- FIELD(CPUCFG2, LBT_X86, 18, 1)
- FIELD(CPUCFG2, LBT_ARM, 19, 1)
- FIELD(CPUCFG2, LBT_MIPS, 20, 1)
-+FIELD(CPUCFG2, LBT_ALL, 18, 3)
- FIELD(CPUCFG2, LSPW, 21, 1)
- FIELD(CPUCFG2, LAM, 22, 1)
-@@ -XXX,XX +XXX,XX @@ struct LoongArchTLB {
- typedef struct LoongArchTLB LoongArchTLB;
- #endif
-+enum loongarch_features {
-+    LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
-+};
-+
- typedef struct CPUArchState {
-     uint64_t gpr[32];
-     uint64_t pc;
-@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
-     CPULoongArchState env;
-     QEMUTimer timer;
-     uint32_t  phy_id;
-+    OnOffAuto lbt;
-     /* 'compatible' string for this CPU for Linux device trees */
-     const char *dtb_compatible;
-diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/kvm/kvm.c
-+++ b/target/loongarch/kvm/kvm.c
-@@ -XXX,XX +XXX,XX @@
- #include <sys/ioctl.h>
- #include <linux/kvm.h>
-+#include "qapi/error.h"
- #include "qemu/timer.h"
- #include "qemu/error-report.h"
- #include "qemu/main-loop.h"
-@@ -XXX,XX +XXX,XX @@ static void kvm_loongarch_vm_stage_change(void *opaque, bool running,
-     }
- }
-+static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
-+{
-+    int ret;
-+    struct kvm_device_attr attr;
-+
-+    switch (feature) {
-+    case LOONGARCH_FEATURE_LBT:
 +        /*
-+         * Return all if all the LBT features are supported such as:
++         * connect ext irq to the cpu irq
-+         *  KVM_LOONGARCH_VM_FEAT_X86BT
++         * cpu_pin[9:2] <= intc_pin[7:0]
 +         *  KVM_LOONGARCH_VM_FEAT_ARMBT
 +         *  KVM_LOONGARCH_VM_FEAT_MIPSBT
 +         */
-+        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
++        for (pin = 0; pin < LS3A_INTC_IP; pin++) {
-+        attr.attr = KVM_LOONGARCH_VM_FEAT_X86BT;
++            qdev_connect_gpio_out(lvms->extioi, (num * LS3A_INTC_IP + pin),
-+        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
++                                  qdev_get_gpio_in(DEVICE(cs), pin + 2));
-+        attr.attr = KVM_LOONGARCH_VM_FEAT_ARMBT;
++        }
 +        ret |= kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
 +        attr.attr = KVM_LOONGARCH_VM_FEAT_MIPSBT;
 +        ret |= kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
 +        return (ret == 0);
 +    default:
 +        return false;
 +    }
 +}
 +
-+static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
++static void virt_irq_init(LoongArchVirtMachineState *lvms)
 +{
-+    CPULoongArchState *env = cpu_env(cs);
++    DeviceState *pch_pic, *pch_msi;
-+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+     DeviceState *ipi, *extioi;
-+    bool kvm_supported;
+     SysBusDevice *d;
-+
+-    CPUState *cpu_state;
-+    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_LBT);
+-    int cpu, pin, i, start, num;
-+    if (cpu->lbt == ON_OFF_AUTO_ON) {
++    int i, start, num;
-+        if (kvm_supported) {
-+            env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LBT_ALL, 7);
+     /*
-+        } else {
+      * Extended IRQ model.
-+            error_setg(errp, "'lbt' feature not supported by KVM on this host");
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
-+            return -ENOTSUP;
-+        }
+     /* Create IPI device */
-+    } else if ((cpu->lbt == ON_OFF_AUTO_AUTO) && kvm_supported) {
+     ipi = qdev_new(TYPE_LOONGARCH_IPI);
-+        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LBT_ALL, 7);
++    lvms->ipi = ipi;
-+    }
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(ipi), &error_fatal);
-+
-+    return 0;
+     /* IPI iocsr memory region */
-+}
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
-+
+     memory_region_add_subregion(&lvms->system_iocsr, MAIL_SEND_ADDR,
- int kvm_arch_init_vcpu(CPUState *cs)
+                    sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 1));
- {
-     uint64_t val;
+-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-+    int ret;
+-        cpu_state = qemu_get_cpu(cpu);
-+    Error *local_err = NULL;
+-        cpudev = DEVICE(cpu_state);
+-
-+    ret = 0;
+-        /* connect ipi irq to cpu irq */
-     qemu_add_vm_change_state_handler(kvm_loongarch_vm_stage_change, cs);
+-        qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
+-    }
-     if (!kvm_get_one_reg(cs, KVM_REG_LOONGARCH_DEBUG_INST, &val)) {
+-
-         brk_insn = val;
+     /* Create EXTIOI device */
      extioi = qdev_new(TYPE_LOONGARCH_EXTIOI);
 +    lvms->extioi = extioi;
      if (virt_is_veiointc_enabled(lvms)) {
          qdev_prop_set_bit(extioi, "has-virtualization-extension", true);
      }
+@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
--    return 0;
+                     sysbus_mmio_get_region(SYS_BUS_DEVICE(extioi), 1));
-+    ret = kvm_cpu_check_lbt(cs, &local_err);
+     }
-+    if (ret < 0) {
-+        error_report_err(local_err);
+-    /*
-+    }
+-     * connect ext irq to the cpu irq
-+    return ret;
+-     * cpu_pin[9:2] <= intc_pin[7:0]
- }
+-     */
+-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
- int kvm_arch_destroy_vcpu(CPUState *cs)
+-        cpudev = DEVICE(qemu_get_cpu(cpu));
-diff --git a/target/loongarch/loongarch-qmp-cmds.c b/target/loongarch/loongarch-qmp-cmds.c
+-        for (pin = 0; pin < LS3A_INTC_IP; pin++) {
 -            qdev_connect_gpio_out(extioi, (cpu * 8 + pin),
 -                                  qdev_get_gpio_in(cpudev, pin + 2));
 -        }
 -    }
 -
 +    virt_cpu_irq_init(lvms);
      pch_pic = qdev_new(TYPE_LOONGARCH_PIC);
      num = VIRT_PCH_PIC_IRQ_NUM;
      qdev_prop_set_uint32(pch_pic, "pch_pic_irq_num", num);
 diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/loongarch-qmp-cmds.c
+--- a/include/hw/loongarch/virt.h
-+++ b/target/loongarch/loongarch-qmp-cmds.c
++++ b/include/hw/loongarch/virt.h
-@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
+@@ -XXX,XX +XXX,XX @@ struct LoongArchVirtMachineState {
- }
+     MemoryRegion iocsr_mem;
+     AddressSpace as_iocsr;
- static const char *cpu_model_advertised_features[] = {
+     struct loongarch_boot_info bootinfo;
--    "lsx", "lasx", NULL
++    DeviceState *ipi;
-+    "lsx", "lasx", "lbt", NULL
++    DeviceState *extioi;
  };
- CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+ #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
 --
-.34.1
+.43.5

The following changes since commit 6f625ce2f21d6a1243065d236298277c56f972d5:

Merge tag 'pull-request-2024-10-21' of https://gitlab.com/thuth/qemu into staging (2024-10-21 17:12:59 +0100)

are available in the Git repository at:

https://gitlab.com/gaosong/qemu.git tags/pull-loongarch-20241024

for you to fetch changes up to c44e0d6ba280dcc6bdf4ed555020c61d564b526c:

target/loongarch: Add steal time support on migration (2024-10-24 17:27:55 +0800)

----------------------------------------------------------------
pull-loongarch-20241024

----------------------------------------------------------------
Bibo Mao (6):
      target/loongarch: Add loongson binary translation feature
      target/loongarch: Implement lbt registers save/restore function
      target/loongarch/kvm: Implement LoongArch PMU extension
      linux-headers: loongarch: Add kvm_para.h and unistd_64.h
      linux-headers: Update to Linux v6.12-rc3
      target/loongarch: Add steal time support on migration

include/standard-headers/drm/drm_fourcc.h          |  43 +++
 include/standard-headers/linux/const.h             |  17 ++
 include/standard-headers/linux/ethtool.h           | 226 +++++++++++++++
 include/standard-headers/linux/fuse.h              |  22 +-
 include/standard-headers/linux/input-event-codes.h |   2 +
 include/standard-headers/linux/pci_regs.h          |  41 ++-
 include/standard-headers/linux/virtio_balloon.h    |  16 +-
 include/standard-headers/linux/virtio_gpu.h        |   1 +
 linux-headers/asm-arm64/mman.h                     |   9 +
 linux-headers/asm-arm64/unistd.h                   |  25 +-
 linux-headers/asm-generic/unistd.h                 |   6 +-
 linux-headers/asm-loongarch/kvm.h                  |  24 ++
 linux-headers/asm-loongarch/kvm_para.h             |  21 ++
 linux-headers/asm-loongarch/unistd.h               |   4 +-
 linux-headers/asm-loongarch/unistd_64.h            | 320 +++++++++++++++++++++
 linux-headers/asm-riscv/kvm.h                      |   7 +
 linux-headers/asm-riscv/unistd.h                   |  41 +--
 linux-headers/asm-x86/kvm.h                        |   2 +
 linux-headers/asm-x86/unistd_64.h                  |   1 +
 linux-headers/asm-x86/unistd_x32.h                 |   1 +
 linux-headers/linux/bits.h                         |   3 +
 linux-headers/linux/const.h                        |  17 ++
 linux-headers/linux/iommufd.h                      | 143 +++++++--
 linux-headers/linux/kvm.h                          |  23 +-
 linux-headers/linux/mman.h                         |   1 +
 linux-headers/linux/psp-sev.h                      |  28 ++
 scripts/update-linux-headers.sh                    |   4 +
 target/loongarch/cpu.c                             |  43 +++
 target/loongarch/cpu.h                             |  23 ++
 target/loongarch/kvm/kvm.c                         | 225 ++++++++++++++-
 target/loongarch/loongarch-qmp-cmds.c              |   2 +-
 target/loongarch/machine.c                         |  30 +-
 32 files changed, 1274 insertions(+), 97 deletions(-)
 create mode 100644 linux-headers/asm-loongarch/kvm_para.h
 create mode 100644 linux-headers/asm-loongarch/unistd_64.h

From: Bibo Mao <maobibo@loongson.cn>

Loongson Binary Translation (LBT) is used to accelerate binary
translation, which contains 4 scratch registers (scr0 to scr3), x86/ARM
eflags (eflags) and x87 fpu stack pointer (ftop).

Now LBT feature is added in kvm mode, not supported in TCG mode since
it is not emulated. Feature variable lbt is added with OnOffAuto type,
If lbt feature is not supported with KVM host, it reports error if there
is lbt=on command line.

If there is no any command line about lbt parameter, it checks whether
KVM host supports lbt feature and set the corresponding value in cpucfg.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20240929070405.235200-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c                | 24 +++++++++++
 target/loongarch/cpu.h                |  6 +++
 target/loongarch/kvm/kvm.c            | 57 ++++++++++++++++++++++++++-
 target/loongarch/loongarch-qmp-cmds.c |  2 +-
 4 files changed, 87 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
     }
 }
 
+static bool loongarch_get_lbt(Object *obj, Error **errp)
+{
+    return LOONGARCH_CPU(obj)->lbt != ON_OFF_AUTO_OFF;
+}
+
+static void loongarch_set_lbt(Object *obj, bool value, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+
+    cpu->lbt = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+}
+
 void loongarch_cpu_post_init(Object *obj)
 {
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+
     object_property_add_bool(obj, "lsx", loongarch_get_lsx,
                              loongarch_set_lsx);
     object_property_add_bool(obj, "lasx", loongarch_get_lasx,
                              loongarch_set_lasx);
+    /* lbt is enabled only in kvm mode, not supported in tcg mode */
+    if (kvm_enabled()) {
+        cpu->lbt = ON_OFF_AUTO_AUTO;
+        object_property_add_bool(obj, "lbt", loongarch_get_lbt,
+                                 loongarch_set_lbt);
+        object_property_set_description(obj, "lbt",
+                                   "Set off to disable Binary Tranlation.");
+    } else {
+        cpu->lbt = ON_OFF_AUTO_OFF;
+    }
 }
 
 static void loongarch_cpu_init(Object *obj)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(CPUCFG2, LLFTP_VER, 15, 3)
 FIELD(CPUCFG2, LBT_X86, 18, 1)
 FIELD(CPUCFG2, LBT_ARM, 19, 1)
 FIELD(CPUCFG2, LBT_MIPS, 20, 1)
+FIELD(CPUCFG2, LBT_ALL, 18, 3)
 FIELD(CPUCFG2, LSPW, 21, 1)
 FIELD(CPUCFG2, LAM, 22, 1)
 
@@ -XXX,XX +XXX,XX @@ struct LoongArchTLB {
 typedef struct LoongArchTLB LoongArchTLB;
 #endif
 
+enum loongarch_features {
+    LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
+};
+
 typedef struct CPUArchState {
     uint64_t gpr[32];
     uint64_t pc;
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     CPULoongArchState env;
     QEMUTimer timer;
     uint32_t  phy_id;
+    OnOffAuto lbt;
 
     /* 'compatible' string for this CPU for Linux device trees */
     const char *dtb_compatible;
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/ioctl.h>
 #include <linux/kvm.h>
 
+#include "qapi/error.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
@@ -XXX,XX +XXX,XX @@ static void kvm_loongarch_vm_stage_change(void *opaque, bool running,
     }
 }
 
+static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
+{
+    int ret;
+    struct kvm_device_attr attr;
+
+    switch (feature) {
+    case LOONGARCH_FEATURE_LBT:
+        /*
+         * Return all if all the LBT features are supported such as:
+         *  KVM_LOONGARCH_VM_FEAT_X86BT
+         *  KVM_LOONGARCH_VM_FEAT_ARMBT
+         *  KVM_LOONGARCH_VM_FEAT_MIPSBT
+         */
+        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
+        attr.attr = KVM_LOONGARCH_VM_FEAT_X86BT;
+        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        attr.attr = KVM_LOONGARCH_VM_FEAT_ARMBT;
+        ret |= kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        attr.attr = KVM_LOONGARCH_VM_FEAT_MIPSBT;
+        ret |= kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        return (ret == 0);
+    default:
+        return false;
+    }
+}
+
+static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    bool kvm_supported;
+
+    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_LBT);
+    if (cpu->lbt == ON_OFF_AUTO_ON) {
+        if (kvm_supported) {
+            env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LBT_ALL, 7);
+        } else {
+            error_setg(errp, "'lbt' feature not supported by KVM on this host");
+            return -ENOTSUP;
+        }
+    } else if ((cpu->lbt == ON_OFF_AUTO_AUTO) && kvm_supported) {
+        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, LBT_ALL, 7);
+    }
+
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     uint64_t val;
+    int ret;
+    Error *local_err = NULL;
 
+    ret = 0;
     qemu_add_vm_change_state_handler(kvm_loongarch_vm_stage_change, cs);
 
     if (!kvm_get_one_reg(cs, KVM_REG_LOONGARCH_DEBUG_INST, &val)) {
         brk_insn = val;
     }
 
-    return 0;
+    ret = kvm_cpu_check_lbt(cs, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+    return ret;
 }
 
 int kvm_arch_destroy_vcpu(CPUState *cs)
diff --git a/target/loongarch/loongarch-qmp-cmds.c b/target/loongarch/loongarch-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/loongarch-qmp-cmds.c
+++ b/target/loongarch/loongarch-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
 }
 
 static const char *cpu_model_advertised_features[] = {
-    "lsx", "lasx", NULL
+    "lsx", "lasx", "lbt", NULL
 };
 
 CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
-- 
2.34.1

From: Bibo Mao <maobibo@loongson.cn>

Six registers scr0 - scr3, eflags and ftop are added in percpu vmstate.
And two functions kvm_loongarch_get_lbt/kvm_loongarch_put_lbt are added
to save/restore lbt registers.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20240929070405.235200-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.h     | 12 ++++++++
 target/loongarch/kvm/kvm.c | 62 ++++++++++++++++++++++++++++++++++++++
 target/loongarch/machine.c | 24 +++++++++++++++
 3 files changed, 98 insertions(+)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ enum loongarch_features {
     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
 };
 
+typedef struct  LoongArchBT {
+    /* scratch registers */
+    uint64_t scr0;
+    uint64_t scr1;
+    uint64_t scr2;
+    uint64_t scr3;
+    /* loongarch eflags */
+    uint32_t eflags;
+    uint32_t ftop;
+} lbt_t;
+
 typedef struct CPUArchState {
     uint64_t gpr[32];
     uint64_t pc;
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     fpr_t fpr[32];
     bool cf[8];
     uint32_t fcsr0;
+    lbt_t  lbt;
 
     uint32_t cpucfg[21];
 
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static int kvm_loongarch_put_regs_fp(CPUState *cs)
     return ret;
 }
 
+static int kvm_loongarch_put_lbt(CPUState *cs)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    uint64_t val;
+    int ret;
+
+    /* check whether vm support LBT firstly */
+    if (FIELD_EX32(env->cpucfg[2], CPUCFG2, LBT_ALL) != 7) {
+        return 0;
+    }
+
+    /* set six LBT registers including scr0-scr3, eflags, ftop */
+    ret = kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR0, &env->lbt.scr0);
+    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR1, &env->lbt.scr1);
+    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR2, &env->lbt.scr2);
+    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR3, &env->lbt.scr3);
+    /*
+     * Be cautious, KVM_REG_LOONGARCH_LBT_FTOP is defined as 64-bit however
+     * lbt.ftop is 32-bit; the same with KVM_REG_LOONGARCH_LBT_EFLAGS register
+     */
+    val = env->lbt.eflags;
+    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_EFLAGS, &val);
+    val = env->lbt.ftop;
+    ret |= kvm_set_one_reg(cs, KVM_REG_LOONGARCH_LBT_FTOP, &val);
+
+    return ret;
+}
+
+static int kvm_loongarch_get_lbt(CPUState *cs)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    uint64_t val;
+    int ret;
+
+    /* check whether vm support LBT firstly */
+    if (FIELD_EX32(env->cpucfg[2], CPUCFG2, LBT_ALL) != 7) {
+        return 0;
+    }
+
+    /* get six LBT registers including scr0-scr3, eflags, ftop */
+    ret = kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR0, &env->lbt.scr0);
+    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR1, &env->lbt.scr1);
+    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR2, &env->lbt.scr2);
+    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_SCR3, &env->lbt.scr3);
+    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_EFLAGS, &val);
+    env->lbt.eflags = (uint32_t)val;
+    ret |= kvm_get_one_reg(cs, KVM_REG_LOONGARCH_LBT_FTOP, &val);
+    env->lbt.ftop = (uint32_t)val;
+
+    return ret;
+}
+
 void kvm_arch_reset_vcpu(CPUState *cs)
 {
     CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
         return ret;
     }
 
+    ret = kvm_loongarch_get_lbt(cs);
+    if (ret) {
+        return ret;
+    }
+
     ret = kvm_loongarch_get_mpstate(cs);
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
         return ret;
     }
 
+    ret = kvm_loongarch_put_lbt(cs);
+    if (ret) {
+        return ret;
+    }
+
     ret = kvm_loongarch_put_mpstate(cs);
     return ret;
 }
diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/machine.c
+++ b/target/loongarch/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lasx = {
     },
 };
 
+static bool lbt_needed(void *opaque)
+{
+    LoongArchCPU *cpu = opaque;
+
+    return !!FIELD_EX64(cpu->env.cpucfg[2], CPUCFG2, LBT_ALL);
+}
+
+static const VMStateDescription vmstate_lbt = {
+    .name = "cpu/lbt",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .needed = lbt_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT64(env.lbt.scr0,   LoongArchCPU),
+        VMSTATE_UINT64(env.lbt.scr1,   LoongArchCPU),
+        VMSTATE_UINT64(env.lbt.scr2,   LoongArchCPU),
+        VMSTATE_UINT64(env.lbt.scr3,   LoongArchCPU),
+        VMSTATE_UINT32(env.lbt.eflags, LoongArchCPU),
+        VMSTATE_UINT32(env.lbt.ftop,   LoongArchCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool tlb_needed(void *opaque)
 {
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_loongarch_cpu = {
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
         &vmstate_tlb,
 #endif
+        &vmstate_lbt,
         NULL
     }
 };
-- 
2.34.1

From: Bibo Mao <maobibo@loongson.cn>

Implement PMU extension for LoongArch kvm mode. Use OnOffAuto type
variable pmu to check the PMU feature. If the PMU Feature is not supported
with KVM host, it reports error if there is pmu=on command line.

If there is no any command line about pmu parameter, it checks whether
KVM host supports the PMU Feature and set the corresponding value in cpucfg.

This patch is based on lbt patch located at
  https://lore.kernel.org/qemu-devel/20240904061859.86615-1-maobibo@loongson.cn

Co-developed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20240918082315.2345034-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c                | 19 +++++++++++++
 target/loongarch/cpu.h                |  2 ++
 target/loongarch/kvm/kvm.c            | 41 +++++++++++++++++++++++++++
 target/loongarch/loongarch-qmp-cmds.c |  2 +-
 4 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_set_lbt(Object *obj, bool value, Error **errp)
     cpu->lbt = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
 }
 
+static bool loongarch_get_pmu(Object *obj, Error **errp)
+{
+    return LOONGARCH_CPU(obj)->pmu != ON_OFF_AUTO_OFF;
+}
+
+static void loongarch_set_pmu(Object *obj, bool value, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+
+    cpu->pmu = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+}
+
 void loongarch_cpu_post_init(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
@@ -XXX,XX +XXX,XX @@ void loongarch_cpu_post_init(Object *obj)
                                  loongarch_set_lbt);
         object_property_set_description(obj, "lbt",
                                    "Set off to disable Binary Tranlation.");
+
+        cpu->pmu = ON_OFF_AUTO_AUTO;
+        object_property_add_bool(obj, "pmu", loongarch_get_pmu,
+                                 loongarch_set_pmu);
+        object_property_set_description(obj, "pmu",
+                                   "Set off to performance monitor unit.");
+
     } else {
         cpu->lbt = ON_OFF_AUTO_OFF;
     }
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct LoongArchTLB LoongArchTLB;
 
 enum loongarch_features {
     LOONGARCH_FEATURE_LBT, /* loongson binary translation extension */
+    LOONGARCH_FEATURE_PMU,
 };
 
 typedef struct  LoongArchBT {
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     QEMUTimer timer;
     uint32_t  phy_id;
     OnOffAuto lbt;
+    OnOffAuto pmu;
 
     /* 'compatible' string for this CPU for Linux device trees */
     const char *dtb_compatible;
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
         attr.attr = KVM_LOONGARCH_VM_FEAT_MIPSBT;
         ret |= kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
         return (ret == 0);
+
+    case LOONGARCH_FEATURE_PMU:
+        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
+        attr.attr = KVM_LOONGARCH_VM_FEAT_PMU;
+        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        return (ret == 0);
+
     default:
         return false;
     }
+
+    return false;
 }
 
 static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
@@ -XXX,XX +XXX,XX @@ static int kvm_cpu_check_lbt(CPUState *cs, Error **errp)
     return 0;
 }
 
+static int kvm_cpu_check_pmu(CPUState *cs, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    CPULoongArchState *env = cpu_env(cs);
+    bool kvm_supported;
+
+    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_PMU);
+    if (cpu->pmu == ON_OFF_AUTO_ON) {
+        if (!kvm_supported) {
+            error_setg(errp, "'pmu' feature not supported by KVM on the host");
+            return -ENOTSUP;
+        }
+    } else if (cpu->pmu != ON_OFF_AUTO_AUTO) {
+        /* disable pmu if ON_OFF_AUTO_OFF is set */
+        kvm_supported = false;
+    }
+
+    if (kvm_supported) {
+        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, PMP, 1);
+        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, PMNUM, 3);
+        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, PMBITS, 63);
+        env->cpucfg[6] = FIELD_DP32(env->cpucfg[6], CPUCFG6, UPM, 1);
+    }
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     uint64_t val;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     if (ret < 0) {
         error_report_err(local_err);
     }
+
+    ret = kvm_cpu_check_pmu(cs, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+
     return ret;
 }
 
diff --git a/target/loongarch/loongarch-qmp-cmds.c b/target/loongarch/loongarch-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/loongarch-qmp-cmds.c
+++ b/target/loongarch/loongarch-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
 }
 
 static const char *cpu_model_advertised_features[] = {
-    "lsx", "lasx", "lbt", NULL
+    "lsx", "lasx", "lbt", "pmu", NULL
 };
 
 CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
-- 
2.34.1

From: Bibo Mao <maobibo@loongson.cn>

KVM LBT supports on LoongArch depends on the linux-header file
kvm_para.h, also unistd_64.h is required by unistd.h on LoongArch
since 6.11, otherwise there will be compiling error such as:

linux-headers/asm/unistd.h:3:10: fatal error: asm/unistd_64.h: No such file or directory
 #include <asm/unistd_64.h>

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20241017020708.1728620-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 scripts/update-linux-headers.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -XXX,XX +XXX,XX @@ EOF
     if [ $arch = riscv ]; then
         cp "$hdrdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
     fi
+    if [ $arch = loongarch ]; then
+        cp "$hdrdir/include/asm/kvm_para.h" "$output/linux-headers/asm-loongarch/"
+        cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-loongarch/"
+    fi
 done
 arch=
 
-- 
2.34.1

From: Bibo Mao <maobibo@loongson.cn>

This update contains the required header changes for LoongArch
KVM LBT feature.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20241017020708.1728620-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 include/standard-headers/drm/drm_fourcc.h     |  43 +++
 include/standard-headers/linux/const.h        |  17 +
 include/standard-headers/linux/ethtool.h      | 226 +++++++++++++
 include/standard-headers/linux/fuse.h         |  22 +-
 .../linux/input-event-codes.h                 |   2 +
 include/standard-headers/linux/pci_regs.h     |  41 ++-
 .../standard-headers/linux/virtio_balloon.h   |  16 +-
 include/standard-headers/linux/virtio_gpu.h   |   1 +
 linux-headers/asm-arm64/mman.h                |   9 +
 linux-headers/asm-arm64/unistd.h              |  25 +-
 linux-headers/asm-generic/unistd.h            |   6 +-
 linux-headers/asm-loongarch/kvm.h             |  24 ++
 linux-headers/asm-loongarch/kvm_para.h        |  21 ++
 linux-headers/asm-loongarch/unistd.h          |   4 +-
 linux-headers/asm-loongarch/unistd_64.h       | 320 ++++++++++++++++++
 linux-headers/asm-riscv/kvm.h                 |   7 +
 linux-headers/asm-riscv/unistd.h              |  41 +--
 linux-headers/asm-x86/kvm.h                   |   2 +
 linux-headers/asm-x86/unistd_64.h             |   1 +
 linux-headers/asm-x86/unistd_x32.h            |   1 +
 linux-headers/linux/bits.h                    |   3 +
 linux-headers/linux/const.h                   |  17 +
 linux-headers/linux/iommufd.h                 | 143 ++++++--
 linux-headers/linux/kvm.h                     |  23 +-
 linux-headers/linux/mman.h                    |   1 +
 linux-headers/linux/psp-sev.h                 |  28 ++
 26 files changed, 951 insertions(+), 93 deletions(-)
 create mode 100644 linux-headers/asm-loongarch/kvm_para.h
 create mode 100644 linux-headers/asm-loongarch/unistd_64.h

diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -XXX,XX +XXX,XX @@ extern "C" {
  */
 #define I915_FORMAT_MOD_4_TILED_MTL_RC_CCS_CC fourcc_mod_code(INTEL, 15)
 
+/*
+ * Intel Color Control Surfaces (CCS) for graphics ver. 20 unified compression
+ * on integrated graphics
+ *
+ * The main surface is Tile 4 and at plane index 0. For semi-planar formats
+ * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
+ * 0 and 1, respectively. The CCS for all planes are stored outside of the
+ * GEM object in a reserved memory area dedicated for the storage of the
+ * CCS data for all compressible GEM objects.
+ */
+#define I915_FORMAT_MOD_4_TILED_LNL_CCS fourcc_mod_code(INTEL, 16)
+
+/*
+ * Intel Color Control Surfaces (CCS) for graphics ver. 20 unified compression
+ * on discrete graphics
+ *
+ * The main surface is Tile 4 and at plane index 0. For semi-planar formats
+ * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
+ * 0 and 1, respectively. The CCS for all planes are stored outside of the
+ * GEM object in a reserved memory area dedicated for the storage of the
+ * CCS data for all compressible GEM objects. The GEM object must be stored in
+ * contiguous memory with a size aligned to 64KB
+ */
+#define I915_FORMAT_MOD_4_TILED_BMG_CCS fourcc_mod_code(INTEL, 17)
+
 /*
  * Tiled, NV12MT, grouped in 64 (pixels) x 32 (lines) -sized macroblocks
  *
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
 #define AMD_FMT_MOD_TILE_VER_GFX10 2
 #define AMD_FMT_MOD_TILE_VER_GFX10_RBPLUS 3
 #define AMD_FMT_MOD_TILE_VER_GFX11 4
+#define AMD_FMT_MOD_TILE_VER_GFX12 5
 
 /*
  * 64K_S is the same for GFX9/GFX10/GFX10_RBPLUS and hence has GFX9 as canonical
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
 /*
  * 64K_D for non-32 bpp is the same for GFX9/GFX10/GFX10_RBPLUS and hence has
  * GFX9 as canonical version.
+ *
+ * 64K_D_2D on GFX12 is identical to 64K_D on GFX11.
  */
 #define AMD_FMT_MOD_TILE_GFX9_64K_D 10
 #define AMD_FMT_MOD_TILE_GFX9_64K_S_X 25
@@ -XXX,XX +XXX,XX @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
 #define AMD_FMT_MOD_TILE_GFX9_64K_R_X 27
 #define AMD_FMT_MOD_TILE_GFX11_256K_R_X 31
 
+/* Gfx12 swizzle modes:
+ *    0 - LINEAR
+ *    1 - 256B_2D  - 2D block dimensions
+ *    2 - 4KB_2D
+ *    3 - 64KB_2D
+ *    4 - 256KB_2D
+ *    5 - 4KB_3D   - 3D block dimensions
+ *    6 - 64KB_3D
+ *    7 - 256KB_3D
+ */
+#define AMD_FMT_MOD_TILE_GFX12_256B_2D 1
+#define AMD_FMT_MOD_TILE_GFX12_4K_2D 2
+#define AMD_FMT_MOD_TILE_GFX12_64K_2D 3
+#define AMD_FMT_MOD_TILE_GFX12_256K_2D 4
+
 #define AMD_FMT_MOD_DCC_BLOCK_64B 0
 #define AMD_FMT_MOD_DCC_BLOCK_128B 1
 #define AMD_FMT_MOD_DCC_BLOCK_256B 2
diff --git a/include/standard-headers/linux/const.h b/include/standard-headers/linux/const.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/const.h
+++ b/include/standard-headers/linux/const.h
@@ -XXX,XX +XXX,XX @@
 #define _BITUL(x)	(_UL(1) << (x))
 #define _BITULL(x)	(_ULL(1) << (x))
 
+#if !defined(__ASSEMBLY__)
+/*
+ * Missing __asm__ support
+ *
+ * __BIT128() would not work in the __asm__ code, as it shifts an
+ * 'unsigned __init128' data type as direct representation of
+ * 128 bit constants is not supported in the gcc compiler, as
+ * they get silently truncated.
+ *
+ * TODO: Please revisit this implementation when gcc compiler
+ * starts representing 128 bit constants directly like long
+ * and unsigned long etc. Subsequently drop the comment for
+ * GENMASK_U128() which would then start supporting __asm__ code.
+ */
+#define _BIT128(x)	((unsigned __int128)(1) << (x))
+#endif
+
 #define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
 #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
 
diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -XXX,XX +XXX,XX @@ enum ethtool_module_power_mode {
 	ETHTOOL_MODULE_POWER_MODE_HIGH,
 };
 
+/**
+ * enum ethtool_c33_pse_ext_state - groups of PSE extended states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_STATE_ERROR_CONDITION: Group of error_condition states
+ * @ETHTOOL_C33_PSE_EXT_STATE_MR_MPS_VALID: Group of mr_mps_valid states
+ * @ETHTOOL_C33_PSE_EXT_STATE_MR_PSE_ENABLE: Group of mr_pse_enable states
+ * @ETHTOOL_C33_PSE_EXT_STATE_OPTION_DETECT_TED: Group of option_detect_ted
+ *	states
+ * @ETHTOOL_C33_PSE_EXT_STATE_OPTION_VPORT_LIM: Group of option_vport_lim states
+ * @ETHTOOL_C33_PSE_EXT_STATE_OVLD_DETECTED: Group of ovld_detected states
+ * @ETHTOOL_C33_PSE_EXT_STATE_PD_DLL_POWER_TYPE: Group of pd_dll_power_type
+ *	states
+ * @ETHTOOL_C33_PSE_EXT_STATE_POWER_NOT_AVAILABLE: Group of power_not_available
+ *	states
+ * @ETHTOOL_C33_PSE_EXT_STATE_SHORT_DETECTED: Group of short_detected states
+ */
+enum ethtool_c33_pse_ext_state {
+	ETHTOOL_C33_PSE_EXT_STATE_ERROR_CONDITION = 1,
+	ETHTOOL_C33_PSE_EXT_STATE_MR_MPS_VALID,
+	ETHTOOL_C33_PSE_EXT_STATE_MR_PSE_ENABLE,
+	ETHTOOL_C33_PSE_EXT_STATE_OPTION_DETECT_TED,
+	ETHTOOL_C33_PSE_EXT_STATE_OPTION_VPORT_LIM,
+	ETHTOOL_C33_PSE_EXT_STATE_OVLD_DETECTED,
+	ETHTOOL_C33_PSE_EXT_STATE_PD_DLL_POWER_TYPE,
+	ETHTOOL_C33_PSE_EXT_STATE_POWER_NOT_AVAILABLE,
+	ETHTOOL_C33_PSE_EXT_STATE_SHORT_DETECTED,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_mr_mps_valid - mr_mps_valid states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_DETECTED_UNDERLOAD: Underload
+ *	state
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_CONNECTION_OPEN: Port is not
+ *	connected
+ *
+ * The PSE monitors either the DC or AC Maintain Power Signature
+ * (MPS, see 33.2.9.1). This variable indicates the presence or absence of
+ * a valid MPS.
+ */
+enum ethtool_c33_pse_ext_substate_mr_mps_valid {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_DETECTED_UNDERLOAD = 1,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_CONNECTION_OPEN,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_error_condition - error_condition states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_NON_EXISTING_PORT: Non-existing
+ *	port number
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNDEFINED_PORT: Undefined port
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_INTERNAL_HW_FAULT: Internal
+ *	hardware fault
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_COMM_ERROR_AFTER_FORCE_ON:
+ *	Communication error after force on
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNKNOWN_PORT_STATUS: Unknown
+ *	port status
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_TURN_OFF: Host
+ *	crash turn off
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_FORCE_SHUTDOWN:
+ *	Host crash force shutdown
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_CONFIG_CHANGE: Configuration
+ *	change
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_DETECTED_OVER_TEMP: Over
+ *	temperature detected
+ *
+ * error_condition is a variable indicating the status of
+ * implementation-specific fault conditions or optionally other system faults
+ * that prevent the PSE from meeting the specifications in Table 33–11 and that
+ * require the PSE not to source power. These error conditions are different
+ * from those monitored by the state diagrams in Figure 33–10.
+ */
+enum ethtool_c33_pse_ext_substate_error_condition {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_NON_EXISTING_PORT = 1,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNDEFINED_PORT,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_INTERNAL_HW_FAULT,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_COMM_ERROR_AFTER_FORCE_ON,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNKNOWN_PORT_STATUS,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_TURN_OFF,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_FORCE_SHUTDOWN,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_CONFIG_CHANGE,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_DETECTED_OVER_TEMP,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_mr_pse_enable - mr_pse_enable states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_PSE_ENABLE_DISABLE_PIN_ACTIVE: Disable
+ *	pin active
+ *
+ * mr_pse_enable is control variable that selects PSE operation and test
+ * functions.
+ */
+enum ethtool_c33_pse_ext_substate_mr_pse_enable {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_PSE_ENABLE_DISABLE_PIN_ACTIVE = 1,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_option_detect_ted - option_detect_ted
+ *	states functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_DET_IN_PROCESS: Detection
+ *	in process
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_CONNECTION_CHECK_ERROR:
+ *	Connection check error
+ *
+ * option_detect_ted is a variable indicating if detection can be performed
+ * by the PSE during the ted_timer interval.
+ */
+enum ethtool_c33_pse_ext_substate_option_detect_ted {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_DET_IN_PROCESS = 1,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_CONNECTION_CHECK_ERROR,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_option_vport_lim - option_vport_lim states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_HIGH_VOLTAGE: Main supply
+ *	voltage is high
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_LOW_VOLTAGE: Main supply
+ *	voltage is low
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_VOLTAGE_INJECTION: Voltage
+ *	injection into the port
+ *
+ * option_vport_lim is an optional variable indicates if VPSE is out of the
+ * operating range during normal operating state.
+ */
+enum ethtool_c33_pse_ext_substate_option_vport_lim {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_HIGH_VOLTAGE = 1,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_LOW_VOLTAGE,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_VOLTAGE_INJECTION,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_ovld_detected - ovld_detected states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OVLD_DETECTED_OVERLOAD: Overload state
+ *
+ * ovld_detected is a variable indicating if the PSE output current has been
+ * in an overload condition (see 33.2.7.6) for at least TCUT of a one-second
+ * sliding time.
+ */
+enum ethtool_c33_pse_ext_substate_ovld_detected {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OVLD_DETECTED_OVERLOAD = 1,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_power_not_available - power_not_available
+ *	states functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_BUDGET_EXCEEDED: Power
+ *	budget exceeded for the controller
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PORT_PW_LIMIT_EXCEEDS_CONTROLLER_BUDGET:
+ *	Configured port power limit exceeded controller power budget
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PD_REQUEST_EXCEEDS_PORT_LIMIT:
+ *	Power request from PD exceeds port limit
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_HW_PW_LIMIT: Power
+ *	denied due to Hardware power limit
+ *
+ * power_not_available is a variable that is asserted in an
+ * implementation-dependent manner when the PSE is no longer capable of
+ * sourcing sufficient power to support the attached PD. Sufficient power
+ * is defined by classification; see 33.2.6.
+ */
+enum ethtool_c33_pse_ext_substate_power_not_available {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_BUDGET_EXCEEDED =  1,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PORT_PW_LIMIT_EXCEEDS_CONTROLLER_BUDGET,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PD_REQUEST_EXCEEDS_PORT_LIMIT,
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_HW_PW_LIMIT,
+};
+
+/**
+ * enum ethtool_c33_pse_ext_substate_short_detected - short_detected states
+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
+ *
+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_SHORT_DETECTED_SHORT_CONDITION: Short
+ *	condition was detected
+ *
+ * short_detected is a variable indicating if the PSE output current has been
+ * in a short circuit condition for TLIM within a sliding window (see 33.2.7.7).
+ */
+enum ethtool_c33_pse_ext_substate_short_detected {
+	ETHTOOL_C33_PSE_EXT_SUBSTATE_SHORT_DETECTED_SHORT_CONDITION = 1,
+};
+
 /**
  * enum ethtool_pse_types - Types of PSE controller.
  * @ETHTOOL_PSE_UNKNOWN: Type of PSE controller is unknown
@@ -XXX,XX +XXX,XX @@ enum ethtool_mm_verify_status {
 	ETHTOOL_MM_VERIFY_STATUS_DISABLED,
 };
 
+/**
+ * enum ethtool_module_fw_flash_status - plug-in module firmware flashing status
+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_STARTED: The firmware flashing process has
+ *	started.
+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_IN_PROGRESS: The firmware flashing process
+ *	is in progress.
+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_COMPLETED: The firmware flashing process was
+ *	completed successfully.
+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_ERROR: The firmware flashing process was
+ *	stopped due to an error.
+ */
+enum ethtool_module_fw_flash_status {
+	ETHTOOL_MODULE_FW_FLASH_STATUS_STARTED = 1,
+	ETHTOOL_MODULE_FW_FLASH_STATUS_IN_PROGRESS,
+	ETHTOOL_MODULE_FW_FLASH_STATUS_COMPLETED,
+	ETHTOOL_MODULE_FW_FLASH_STATUS_ERROR,
+};
+
 /**
  * struct ethtool_gstrings - string set for data tagging
  * @cmd: Command number = %ETHTOOL_GSTRINGS
@@ -XXX,XX +XXX,XX @@ enum ethtool_link_mode_bit_indices {
 	ETHTOOL_LINK_MODE_10baseT1S_Full_BIT		 = 99,
 	ETHTOOL_LINK_MODE_10baseT1S_Half_BIT		 = 100,
 	ETHTOOL_LINK_MODE_10baseT1S_P2MP_Half_BIT	 = 101,
+	ETHTOOL_LINK_MODE_10baseT1BRR_Full_BIT		 = 102,
 
 	/* must be last entry */
 	__ETHTOOL_LINK_MODE_MASK_NBITS
@@ -XXX,XX +XXX,XX @@ struct ethtool_link_settings {
 	 * uint32_t map_lp_advertising[link_mode_masks_nwords];
 	 */
 };
+
+/**
+ * enum phy_upstream - Represents the upstream component a given PHY device
+ * is connected to, as in what is on the other end of the MII bus. Most PHYs
+ * will be attached to an Ethernet MAC controller, but in some cases, there's
+ * an intermediate PHY used as a media-converter, which will driver another
+ * MII interface as its output.
+ * @PHY_UPSTREAM_MAC: Upstream component is a MAC (a switch port,
+ *		      or ethernet controller)
+ * @PHY_UPSTREAM_PHY: Upstream component is a PHY (likely a media converter)
+ */
+enum phy_upstream {
+	PHY_UPSTREAM_MAC,
+	PHY_UPSTREAM_PHY,
+};
+
 #endif /* _LINUX_ETHTOOL_H */
diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/fuse.h
+++ b/include/standard-headers/linux/fuse.h
@@ -XXX,XX +XXX,XX @@
  *  - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag
  *  - add FUSE_NO_EXPORT_SUPPORT init flag
  *  - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag
+ *
+ *  7.41
+ *  - add FUSE_ALLOW_IDMAP
  */
 
 #ifndef _LINUX_FUSE_H
@@ -XXX,XX +XXX,XX @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 40
+#define FUSE_KERNEL_MINOR_VERSION 41
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
  * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support
  * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
  *		    of the request ID indicates resend requests
+ * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
  */
 #define FUSE_ASYNC_READ		(1 << 0)
 #define FUSE_POSIX_LOCKS	(1 << 1)
@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
 
 /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
 #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
+#define FUSE_ALLOW_IDMAP	(1ULL << 40)
 
 /**
  * CUSE INIT request/reply flags
@@ -XXX,XX +XXX,XX @@ struct fuse_fallocate_in {
  */
 #define FUSE_UNIQUE_RESEND (1ULL << 63)
 
+/**
+ * This value will be set by the kernel to
+ * (struct fuse_in_header).{uid,gid} fields in
+ * case when:
+ * - fuse daemon enabled FUSE_ALLOW_IDMAP
+ * - idmapping information is not available and uid/gid
+ *   can not be mapped in accordance with an idmapping.
+ *
+ * Note: an idmapping information always available
+ * for inode creation operations like:
+ * FUSE_MKNOD, FUSE_SYMLINK, FUSE_MKDIR, FUSE_TMPFILE,
+ * FUSE_CREATE and FUSE_RENAME2 (with RENAME_WHITEOUT).
+ */
+#define FUSE_INVALID_UIDGID ((uint32_t)(-1))
+
 struct fuse_in_header {
 	uint32_t	len;
 	uint32_t	opcode;
diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/input-event-codes.h
+++ b/include/standard-headers/linux/input-event-codes.h
@@ -XXX,XX +XXX,XX @@
 #define KEY_CAMERA_ACCESS_ENABLE	0x24b	/* Enables programmatic access to camera devices. (HUTRR72) */
 #define KEY_CAMERA_ACCESS_DISABLE	0x24c	/* Disables programmatic access to camera devices. (HUTRR72) */
 #define KEY_CAMERA_ACCESS_TOGGLE	0x24d	/* Toggles the current state of the camera access control. (HUTRR72) */
+#define KEY_ACCESSIBILITY		0x24e	/* Toggles the system bound accessibility UI/command (HUTRR116) */
+#define KEY_DO_NOT_DISTURB		0x24f	/* Toggles the system-wide "Do Not Disturb" control (HUTRR94)*/
 
 #define KEY_BRIGHTNESS_MIN		0x250	/* Set Brightness to Minimum */
 #define KEY_BRIGHTNESS_MAX		0x251	/* Set Brightness to Maximum */
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_RTCTL_SENFEE	0x0002	/* System Error on Non-Fatal Error */
 #define  PCI_EXP_RTCTL_SEFEE	0x0004	/* System Error on Fatal Error */
 #define  PCI_EXP_RTCTL_PMEIE	0x0008	/* PME Interrupt Enable */
-#define  PCI_EXP_RTCTL_CRSSVE	0x0010	/* CRS Software Visibility Enable */
+#define  PCI_EXP_RTCTL_RRS_SVE	0x0010	/* Config RRS Software Visibility Enable */
+#define  PCI_EXP_RTCTL_CRSSVE PCI_EXP_RTCTL_RRS_SVE /* compatibility */
 #define PCI_EXP_RTCAP		0x1e	/* Root Capabilities */
-#define  PCI_EXP_RTCAP_CRSVIS	0x0001	/* CRS Software Visibility capability */
+#define  PCI_EXP_RTCAP_RRS_SV	0x0001	/* Config RRS Software Visibility */
+#define  PCI_EXP_RTCAP_CRSVIS PCI_EXP_RTCAP_RRS_SV /* compatibility */
 #define PCI_EXP_RTSTA		0x20	/* Root Status */
 #define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
 #define  PCI_EXP_RTSTA_PME	0x00010000 /* PME status */
@@ -XXX,XX +XXX,XX @@
 #define PCI_EXT_CAP_ID_DVSEC	0x23	/* Designated Vendor-Specific */
 #define PCI_EXT_CAP_ID_DLF	0x25	/* Data Link Feature */
 #define PCI_EXT_CAP_ID_PL_16GT	0x26	/* Physical Layer 16.0 GT/s */
+#define PCI_EXT_CAP_ID_NPEM	0x29	/* Native PCIe Enclosure Management */
 #define PCI_EXT_CAP_ID_PL_32GT  0x2A    /* Physical Layer 32.0 GT/s */
 #define PCI_EXT_CAP_ID_DOE	0x2E	/* Data Object Exchange */
 #define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_DOE
@@ -XXX,XX +XXX,XX @@
 #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK		0x000000F0
 #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT	4
 
+/* Native PCIe Enclosure Management */
+#define PCI_NPEM_CAP     0x04 /* NPEM capability register */
+#define  PCI_NPEM_CAP_CAPABLE     0x00000001 /* NPEM Capable */
+
+#define PCI_NPEM_CTRL    0x08 /* NPEM control register */
+#define  PCI_NPEM_CTRL_ENABLE     0x00000001 /* NPEM Enable */
+
+/*
+ * Native PCIe Enclosure Management indication bits and Reset command bit
+ * are corresponding for capability and control registers.
+ */
+#define  PCI_NPEM_CMD_RESET       0x00000002 /* Reset Command */
+#define  PCI_NPEM_IND_OK          0x00000004 /* OK */
+#define  PCI_NPEM_IND_LOCATE      0x00000008 /* Locate */
+#define  PCI_NPEM_IND_FAIL        0x00000010 /* Fail */
+#define  PCI_NPEM_IND_REBUILD     0x00000020 /* Rebuild */
+#define  PCI_NPEM_IND_PFA         0x00000040 /* Predicted Failure Analysis */
+#define  PCI_NPEM_IND_HOTSPARE    0x00000080 /* Hot Spare */
+#define  PCI_NPEM_IND_ICA         0x00000100 /* In Critical Array */
+#define  PCI_NPEM_IND_IFA         0x00000200 /* In Failed Array */
+#define  PCI_NPEM_IND_IDT         0x00000400 /* Device Type */
+#define  PCI_NPEM_IND_DISABLED    0x00000800 /* Disabled */
+#define  PCI_NPEM_IND_SPEC_0      0x01000000
+#define  PCI_NPEM_IND_SPEC_1      0x02000000
+#define  PCI_NPEM_IND_SPEC_2      0x04000000
+#define  PCI_NPEM_IND_SPEC_3      0x08000000
+#define  PCI_NPEM_IND_SPEC_4      0x10000000
+#define  PCI_NPEM_IND_SPEC_5      0x20000000
+#define  PCI_NPEM_IND_SPEC_6      0x40000000
+#define  PCI_NPEM_IND_SPEC_7      0x80000000
+
+#define PCI_NPEM_STATUS  0x0c /* NPEM status register */
+#define  PCI_NPEM_STATUS_CC       0x00000001 /* Command Completed */
+
 /* Data Object Exchange */
 #define PCI_DOE_CAP		0x04    /* DOE Capabilities Register */
 #define  PCI_DOE_CAP_INT_SUP			0x00000001  /* Interrupt Support */
diff --git a/include/standard-headers/linux/virtio_balloon.h b/include/standard-headers/linux/virtio_balloon.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_balloon.h
+++ b/include/standard-headers/linux/virtio_balloon.h
@@ -XXX,XX +XXX,XX @@ struct virtio_balloon_config {
 #define VIRTIO_BALLOON_S_CACHES   7   /* Disk caches */
 #define VIRTIO_BALLOON_S_HTLB_PGALLOC  8  /* Hugetlb page allocations */
 #define VIRTIO_BALLOON_S_HTLB_PGFAIL   9  /* Hugetlb page allocation failures */
-#define VIRTIO_BALLOON_S_NR       10
+#define VIRTIO_BALLOON_S_OOM_KILL      10 /* OOM killer invocations */
+#define VIRTIO_BALLOON_S_ALLOC_STALL   11 /* Stall count of memory allocatoin */
+#define VIRTIO_BALLOON_S_ASYNC_SCAN    12 /* Amount of memory scanned asynchronously */
+#define VIRTIO_BALLOON_S_DIRECT_SCAN   13 /* Amount of memory scanned directly */
+#define VIRTIO_BALLOON_S_ASYNC_RECLAIM 14 /* Amount of memory reclaimed asynchronously */
+#define VIRTIO_BALLOON_S_DIRECT_RECLAIM 15 /* Amount of memory reclaimed directly */
+#define VIRTIO_BALLOON_S_NR       16
 
 #define VIRTIO_BALLOON_S_NAMES_WITH_PREFIX(VIRTIO_BALLOON_S_NAMES_prefix) { \
 	VIRTIO_BALLOON_S_NAMES_prefix "swap-in", \
@@ -XXX,XX +XXX,XX @@ struct virtio_balloon_config {
 	VIRTIO_BALLOON_S_NAMES_prefix "available-memory", \
 	VIRTIO_BALLOON_S_NAMES_prefix "disk-caches", \
 	VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-allocations", \
-	VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures" \
+	VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures", \
+	VIRTIO_BALLOON_S_NAMES_prefix "oom-kills", \
+	VIRTIO_BALLOON_S_NAMES_prefix "alloc-stalls", \
+	VIRTIO_BALLOON_S_NAMES_prefix "async-scans", \
+	VIRTIO_BALLOON_S_NAMES_prefix "direct-scans", \
+	VIRTIO_BALLOON_S_NAMES_prefix "async-reclaims", \
+	VIRTIO_BALLOON_S_NAMES_prefix "direct-reclaims" \
 }
 
 #define VIRTIO_BALLOON_S_NAMES VIRTIO_BALLOON_S_NAMES_WITH_PREFIX("")
diff --git a/include/standard-headers/linux/virtio_gpu.h b/include/standard-headers/linux/virtio_gpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_gpu.h
+++ b/include/standard-headers/linux/virtio_gpu.h
@@ -XXX,XX +XXX,XX @@ struct virtio_gpu_cmd_submit {
 #define VIRTIO_GPU_CAPSET_VIRGL2 2
 /* 3 is reserved for gfxstream */
 #define VIRTIO_GPU_CAPSET_VENUS 4
+#define VIRTIO_GPU_CAPSET_DRM 6
 
 /* VIRTIO_GPU_CMD_GET_CAPSET_INFO */
 struct virtio_gpu_get_capset_info {
diff --git a/linux-headers/asm-arm64/mman.h b/linux-headers/asm-arm64/mman.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm64/mman.h
+++ b/linux-headers/asm-arm64/mman.h
@@ -XXX,XX +XXX,XX @@
 #define PROT_BTI	0x10		/* BTI guarded page */
 #define PROT_MTE	0x20		/* Normal Tagged mapping */
 
+/* Override any generic PKEY permission defines */
+#define PKEY_DISABLE_EXECUTE	0x4
+#define PKEY_DISABLE_READ	0x8
+#undef PKEY_ACCESS_MASK
+#define PKEY_ACCESS_MASK       (PKEY_DISABLE_ACCESS |\
+				PKEY_DISABLE_WRITE  |\
+				PKEY_DISABLE_READ   |\
+				PKEY_DISABLE_EXECUTE)
+
 #endif /* ! _UAPI__ASM_MMAN_H */
diff --git a/linux-headers/asm-arm64/unistd.h b/linux-headers/asm-arm64/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm64/unistd.h
+++ b/linux-headers/asm-arm64/unistd.h
@@ -XXX,XX +XXX,XX @@
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#define __ARCH_WANT_RENAMEAT
-#define __ARCH_WANT_NEW_STAT
-#define __ARCH_WANT_SET_GET_RLIMIT
-#define __ARCH_WANT_TIME32_SYSCALLS
-#define __ARCH_WANT_SYS_CLONE3
-#define __ARCH_WANT_MEMFD_SECRET
-
-#include <asm-generic/unistd.h>
+#include <asm/unistd_64.h>
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SC_COMP(__NR_pselect6_time64, sys_pselect6, compat_sys_pselect6_time64)
 #define __NR_ppoll_time64 414
 __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64)
 #define __NR_io_pgetevents_time64 416
-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents)
+__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64)
 #define __NR_recvmmsg_time64 417
 __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64)
 #define __NR_mq_timedsend_time64 418
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fsmount, sys_fsmount)
 __SYSCALL(__NR_fspick, sys_fspick)
 #define __NR_pidfd_open 434
 __SYSCALL(__NR_pidfd_open, sys_pidfd_open)
-
-#ifdef __ARCH_WANT_SYS_CLONE3
 #define __NR_clone3 435
 __SYSCALL(__NR_clone3, sys_clone3)
-#endif
-
 #define __NR_close_range 436
 __SYSCALL(__NR_close_range, sys_close_range)
 #define __NR_openat2 437
diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-loongarch/kvm.h
+++ b/linux-headers/asm-loongarch/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_fpu {
 #define KVM_REG_LOONGARCH_KVM		(KVM_REG_LOONGARCH | 0x20000ULL)
 #define KVM_REG_LOONGARCH_FPSIMD	(KVM_REG_LOONGARCH | 0x30000ULL)
 #define KVM_REG_LOONGARCH_CPUCFG	(KVM_REG_LOONGARCH | 0x40000ULL)
+#define KVM_REG_LOONGARCH_LBT		(KVM_REG_LOONGARCH | 0x50000ULL)
 #define KVM_REG_LOONGARCH_MASK		(KVM_REG_LOONGARCH | 0x70000ULL)
 #define KVM_CSR_IDX_MASK		0x7fff
 #define KVM_CPUCFG_IDX_MASK		0x7fff
@@ -XXX,XX +XXX,XX @@ struct kvm_fpu {
 /* Debugging: Special instruction for software breakpoint */
 #define KVM_REG_LOONGARCH_DEBUG_INST	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 3)
 
+/* LBT registers */
+#define KVM_REG_LOONGARCH_LBT_SCR0	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 1)
+#define KVM_REG_LOONGARCH_LBT_SCR1	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 2)
+#define KVM_REG_LOONGARCH_LBT_SCR2	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 3)
+#define KVM_REG_LOONGARCH_LBT_SCR3	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 4)
+#define KVM_REG_LOONGARCH_LBT_EFLAGS	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 5)
+#define KVM_REG_LOONGARCH_LBT_FTOP	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 6)
+
 #define LOONGARCH_REG_SHIFT		3
 #define LOONGARCH_REG_64(TYPE, REG)	(TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
 #define KVM_IOC_CSRID(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
 #define KVM_IOC_CPUCFG(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
+
+/* Device Control API on vm fd */
+#define KVM_LOONGARCH_VM_FEAT_CTRL		0
+#define  KVM_LOONGARCH_VM_FEAT_LSX		0
+#define  KVM_LOONGARCH_VM_FEAT_LASX		1
+#define  KVM_LOONGARCH_VM_FEAT_X86BT		2
+#define  KVM_LOONGARCH_VM_FEAT_ARMBT		3
+#define  KVM_LOONGARCH_VM_FEAT_MIPSBT		4
+#define  KVM_LOONGARCH_VM_FEAT_PMU		5
+#define  KVM_LOONGARCH_VM_FEAT_PV_IPI		6
+#define  KVM_LOONGARCH_VM_FEAT_PV_STEALTIME	7
+
+/* Device Control API on vcpu fd */
 #define KVM_LOONGARCH_VCPU_CPUCFG	0
+#define KVM_LOONGARCH_VCPU_PVTIME_CTRL	1
+#define  KVM_LOONGARCH_VCPU_PVTIME_GPA	0
 
 struct kvm_debug_exit_arch {
 };
diff --git a/linux-headers/asm-loongarch/kvm_para.h b/linux-headers/asm-loongarch/kvm_para.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/kvm_para.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _ASM_KVM_PARA_H
+#define _ASM_KVM_PARA_H
+
+#include <linux/types.h>
+
+/*
+ * CPUCFG index area: 0x40000000 -- 0x400000ff
+ * SW emulation for KVM hypervirsor
+ */
+#define CPUCFG_KVM_BASE			0x40000000
+#define CPUCFG_KVM_SIZE			0x100
+#define CPUCFG_KVM_SIG			(CPUCFG_KVM_BASE + 0)
+#define  KVM_SIGNATURE			"KVM\0"
+#define CPUCFG_KVM_FEATURE		(CPUCFG_KVM_BASE + 4)
+#define  KVM_FEATURE_IPI		1
+#define  KVM_FEATURE_STEAL_TIME		2
+/* BIT 24 - 31 are features configurable by user space vmm */
+#define  KVM_FEATURE_VIRT_EXTIOI	24
+
+#endif /* _ASM_KVM_PARA_H */
diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-loongarch/unistd.h
+++ b/linux-headers/asm-loongarch/unistd.h
@@ -XXX,XX +XXX,XX @@
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#define __ARCH_WANT_SYS_CLONE
-#define __ARCH_WANT_SYS_CLONE3
 
-#include <asm-generic/unistd.h>
+#include <asm/unistd_64.h>
diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-loongarch/unistd_64.h
@@ -XXX,XX +XXX,XX @@
+#ifndef _ASM_UNISTD_64_H
+#define _ASM_UNISTD_64_H
+
+#define __NR_io_setup 0
+#define __NR_io_destroy 1
+#define __NR_io_submit 2
+#define __NR_io_cancel 3
+#define __NR_io_getevents 4
+#define __NR_setxattr 5
+#define __NR_lsetxattr 6
+#define __NR_fsetxattr 7
+#define __NR_getxattr 8
+#define __NR_lgetxattr 9
+#define __NR_fgetxattr 10
+#define __NR_listxattr 11
+#define __NR_llistxattr 12
+#define __NR_flistxattr 13
+#define __NR_removexattr 14
+#define __NR_lremovexattr 15
+#define __NR_fremovexattr 16
+#define __NR_getcwd 17
+#define __NR_lookup_dcookie 18
+#define __NR_eventfd2 19
+#define __NR_epoll_create1 20
+#define __NR_epoll_ctl 21
+#define __NR_epoll_pwait 22
+#define __NR_dup 23
+#define __NR_dup3 24
+#define __NR_fcntl 25
+#define __NR_inotify_init1 26
+#define __NR_inotify_add_watch 27
+#define __NR_inotify_rm_watch 28
+#define __NR_ioctl 29
+#define __NR_ioprio_set 30
+#define __NR_ioprio_get 31
+#define __NR_flock 32
+#define __NR_mknodat 33
+#define __NR_mkdirat 34
+#define __NR_unlinkat 35
+#define __NR_symlinkat 36
+#define __NR_linkat 37
+#define __NR_umount2 39
+#define __NR_mount 40
+#define __NR_pivot_root 41
+#define __NR_nfsservctl 42
+#define __NR_statfs 43
+#define __NR_fstatfs 44
+#define __NR_truncate 45
+#define __NR_ftruncate 46
+#define __NR_fallocate 47
+#define __NR_faccessat 48
+#define __NR_chdir 49
+#define __NR_fchdir 50
+#define __NR_chroot 51
+#define __NR_fchmod 52
+#define __NR_fchmodat 53
+#define __NR_fchownat 54
+#define __NR_fchown 55
+#define __NR_openat 56
+#define __NR_close 57
+#define __NR_vhangup 58
+#define __NR_pipe2 59
+#define __NR_quotactl 60
+#define __NR_getdents64 61
+#define __NR_lseek 62
+#define __NR_read 63
+#define __NR_write 64
+#define __NR_readv 65
+#define __NR_writev 66
+#define __NR_pread64 67
+#define __NR_pwrite64 68
+#define __NR_preadv 69
+#define __NR_pwritev 70
+#define __NR_sendfile 71
+#define __NR_pselect6 72
+#define __NR_ppoll 73
+#define __NR_signalfd4 74
+#define __NR_vmsplice 75
+#define __NR_splice 76
+#define __NR_tee 77
+#define __NR_readlinkat 78
+#define __NR_newfstatat 79
+#define __NR_fstat 80
+#define __NR_sync 81
+#define __NR_fsync 82
+#define __NR_fdatasync 83
+#define __NR_sync_file_range 84
+#define __NR_timerfd_create 85
+#define __NR_timerfd_settime 86
+#define __NR_timerfd_gettime 87
+#define __NR_utimensat 88
+#define __NR_acct 89
+#define __NR_capget 90
+#define __NR_capset 91
+#define __NR_personality 92
+#define __NR_exit 93
+#define __NR_exit_group 94
+#define __NR_waitid 95
+#define __NR_set_tid_address 96
+#define __NR_unshare 97
+#define __NR_futex 98
+#define __NR_set_robust_list 99
+#define __NR_get_robust_list 100
+#define __NR_nanosleep 101
+#define __NR_getitimer 102
+#define __NR_setitimer 103
+#define __NR_kexec_load 104
+#define __NR_init_module 105
+#define __NR_delete_module 106
+#define __NR_timer_create 107
+#define __NR_timer_gettime 108
+#define __NR_timer_getoverrun 109
+#define __NR_timer_settime 110
+#define __NR_timer_delete 111
+#define __NR_clock_settime 112
+#define __NR_clock_gettime 113
+#define __NR_clock_getres 114
+#define __NR_clock_nanosleep 115
+#define __NR_syslog 116
+#define __NR_ptrace 117
+#define __NR_sched_setparam 118
+#define __NR_sched_setscheduler 119
+#define __NR_sched_getscheduler 120
+#define __NR_sched_getparam 121
+#define __NR_sched_setaffinity 122
+#define __NR_sched_getaffinity 123
+#define __NR_sched_yield 124
+#define __NR_sched_get_priority_max 125
+#define __NR_sched_get_priority_min 126
+#define __NR_sched_rr_get_interval 127
+#define __NR_restart_syscall 128
+#define __NR_kill 129
+#define __NR_tkill 130
+#define __NR_tgkill 131
+#define __NR_sigaltstack 132
+#define __NR_rt_sigsuspend 133
+#define __NR_rt_sigaction 134
+#define __NR_rt_sigprocmask 135
+#define __NR_rt_sigpending 136
+#define __NR_rt_sigtimedwait 137
+#define __NR_rt_sigqueueinfo 138
+#define __NR_rt_sigreturn 139
+#define __NR_setpriority 140
+#define __NR_getpriority 141
+#define __NR_reboot 142
+#define __NR_setregid 143
+#define __NR_setgid 144
+#define __NR_setreuid 145
+#define __NR_setuid 146
+#define __NR_setresuid 147
+#define __NR_getresuid 148
+#define __NR_setresgid 149
+#define __NR_getresgid 150
+#define __NR_setfsuid 151
+#define __NR_setfsgid 152
+#define __NR_times 153
+#define __NR_setpgid 154
+#define __NR_getpgid 155
+#define __NR_getsid 156
+#define __NR_setsid 157
+#define __NR_getgroups 158
+#define __NR_setgroups 159
+#define __NR_uname 160
+#define __NR_sethostname 161
+#define __NR_setdomainname 162
+#define __NR_getrusage 165
+#define __NR_umask 166
+#define __NR_prctl 167
+#define __NR_getcpu 168
+#define __NR_gettimeofday 169
+#define __NR_settimeofday 170
+#define __NR_adjtimex 171
+#define __NR_getpid 172
+#define __NR_getppid 173
+#define __NR_getuid 174
+#define __NR_geteuid 175
+#define __NR_getgid 176
+#define __NR_getegid 177
+#define __NR_gettid 178
+#define __NR_sysinfo 179
+#define __NR_mq_open 180
+#define __NR_mq_unlink 181
+#define __NR_mq_timedsend 182
+#define __NR_mq_timedreceive 183
+#define __NR_mq_notify 184
+#define __NR_mq_getsetattr 185
+#define __NR_msgget 186
+#define __NR_msgctl 187
+#define __NR_msgrcv 188
+#define __NR_msgsnd 189
+#define __NR_semget 190
+#define __NR_semctl 191
+#define __NR_semtimedop 192
+#define __NR_semop 193
+#define __NR_shmget 194
+#define __NR_shmctl 195
+#define __NR_shmat 196
+#define __NR_shmdt 197
+#define __NR_socket 198
+#define __NR_socketpair 199
+#define __NR_bind 200
+#define __NR_listen 201
+#define __NR_accept 202
+#define __NR_connect 203
+#define __NR_getsockname 204
+#define __NR_getpeername 205
+#define __NR_sendto 206
+#define __NR_recvfrom 207
+#define __NR_setsockopt 208
+#define __NR_getsockopt 209
+#define __NR_shutdown 210
+#define __NR_sendmsg 211
+#define __NR_recvmsg 212
+#define __NR_readahead 213
+#define __NR_brk 214
+#define __NR_munmap 215
+#define __NR_mremap 216
+#define __NR_add_key 217
+#define __NR_request_key 218
+#define __NR_keyctl 219
+#define __NR_clone 220
+#define __NR_execve 221
+#define __NR_mmap 222
+#define __NR_fadvise64 223
+#define __NR_swapon 224
+#define __NR_swapoff 225
+#define __NR_mprotect 226
+#define __NR_msync 227
+#define __NR_mlock 228
+#define __NR_munlock 229
+#define __NR_mlockall 230
+#define __NR_munlockall 231
+#define __NR_mincore 232
+#define __NR_madvise 233
+#define __NR_remap_file_pages 234
+#define __NR_mbind 235
+#define __NR_get_mempolicy 236
+#define __NR_set_mempolicy 237
+#define __NR_migrate_pages 238
+#define __NR_move_pages 239
+#define __NR_rt_tgsigqueueinfo 240
+#define __NR_perf_event_open 241
+#define __NR_accept4 242
+#define __NR_recvmmsg 243
+#define __NR_wait4 260
+#define __NR_prlimit64 261
+#define __NR_fanotify_init 262
+#define __NR_fanotify_mark 263
+#define __NR_name_to_handle_at 264
+#define __NR_open_by_handle_at 265
+#define __NR_clock_adjtime 266
+#define __NR_syncfs 267
+#define __NR_setns 268
+#define __NR_sendmmsg 269
+#define __NR_process_vm_readv 270
+#define __NR_process_vm_writev 271
+#define __NR_kcmp 272
+#define __NR_finit_module 273
+#define __NR_sched_setattr 274
+#define __NR_sched_getattr 275
+#define __NR_renameat2 276
+#define __NR_seccomp 277
+#define __NR_getrandom 278
+#define __NR_memfd_create 279
+#define __NR_bpf 280
+#define __NR_execveat 281
+#define __NR_userfaultfd 282
+#define __NR_membarrier 283
+#define __NR_mlock2 284
+#define __NR_copy_file_range 285
+#define __NR_preadv2 286
+#define __NR_pwritev2 287
+#define __NR_pkey_mprotect 288
+#define __NR_pkey_alloc 289
+#define __NR_pkey_free 290
+#define __NR_statx 291
+#define __NR_io_pgetevents 292
+#define __NR_rseq 293
+#define __NR_kexec_file_load 294
+#define __NR_pidfd_send_signal 424
+#define __NR_io_uring_setup 425
+#define __NR_io_uring_enter 426
+#define __NR_io_uring_register 427
+#define __NR_open_tree 428
+#define __NR_move_mount 429
+#define __NR_fsopen 430
+#define __NR_fsconfig 431
+#define __NR_fsmount 432
+#define __NR_fspick 433
+#define __NR_pidfd_open 434
+#define __NR_clone3 435
+#define __NR_close_range 436
+#define __NR_openat2 437
+#define __NR_pidfd_getfd 438
+#define __NR_faccessat2 439
+#define __NR_process_madvise 440
+#define __NR_epoll_pwait2 441
+#define __NR_mount_setattr 442
+#define __NR_quotactl_fd 443
+#define __NR_landlock_create_ruleset 444
+#define __NR_landlock_add_rule 445
+#define __NR_landlock_restrict_self 446
+#define __NR_process_mrelease 448
+#define __NR_futex_waitv 449
+#define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
+#define __NR_fchmodat2 452
+#define __NR_map_shadow_stack 453
+#define __NR_futex_wake 454
+#define __NR_futex_wait 455
+#define __NR_futex_requeue 456
+#define __NR_statmount 457
+#define __NR_listmount 458
+#define __NR_lsm_get_self_attr 459
+#define __NR_lsm_set_self_attr 460
+#define __NR_lsm_list_modules 461
+#define __NR_mseal 462
+
+
+#endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_ZTSO,
 	KVM_RISCV_ISA_EXT_ZACAS,
 	KVM_RISCV_ISA_EXT_SSCOFPMF,
+	KVM_RISCV_ISA_EXT_ZIMOP,
+	KVM_RISCV_ISA_EXT_ZCA,
+	KVM_RISCV_ISA_EXT_ZCB,
+	KVM_RISCV_ISA_EXT_ZCD,
+	KVM_RISCV_ISA_EXT_ZCF,
+	KVM_RISCV_ISA_EXT_ZCMOP,
+	KVM_RISCV_ISA_EXT_ZAWRS,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
diff --git a/linux-headers/asm-riscv/unistd.h b/linux-headers/asm-riscv/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-riscv/unistd.h
+++ b/linux-headers/asm-riscv/unistd.h
@@ -XXX,XX +XXX,XX @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
+#include <asm/bitsperlong.h>
 
-#if defined(__LP64__) && !defined(__SYSCALL_COMPAT)
-#define __ARCH_WANT_NEW_STAT
-#define __ARCH_WANT_SET_GET_RLIMIT
-#endif /* __LP64__ */
-
-#define __ARCH_WANT_SYS_CLONE3
-#define __ARCH_WANT_MEMFD_SECRET
-
-#include <asm-generic/unistd.h>
-
-/*
- * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
- * having a direct 'fence.i' instruction available to userspace (which we
- * can't trap!), that's not actually viable when running on Linux because the
- * kernel might schedule a process on another hart.  There is no way for
- * userspace to handle this without invoking the kernel (as it doesn't know the
- * thread->hart mappings), so we've defined a RISC-V specific system call to
- * flush the instruction cache.
- *
- * __NR_riscv_flush_icache is defined to flush the instruction cache over an
- * address range, with the flush applying to either all threads or just the
- * caller.  We don't currently do anything with the address range, that's just
- * in there for forwards compatibility.
- */
-#ifndef __NR_riscv_flush_icache
-#define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
-#endif
-__SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
-
-/*
- * Allows userspace to query the kernel for CPU architecture and
- * microarchitecture details across a given set of CPUs.
- */
-#ifndef __NR_riscv_hwprobe
-#define __NR_riscv_hwprobe (__NR_arch_specific_syscall + 14)
+#if __BITS_PER_LONG == 64
+#include <asm/unistd_64.h>
+#else
+#include <asm/unistd_32.h>
 #endif
-__SYSCALL(__NR_riscv_hwprobe, sys_riscv_hwprobe)
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_ioapic_state {
 
 #define KVM_RUN_X86_SMM		 (1 << 0)
 #define KVM_RUN_X86_BUS_LOCK     (1 << 1)
+#define KVM_RUN_X86_GUEST_MODE   (1 << 2)
 
 /* for KVM_GET_REGS and KVM_SET_REGS */
 struct kvm_regs {
@@ -XXX,XX +XXX,XX @@ struct kvm_sync_regs {
 #define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT	(1 << 4)
 #define KVM_X86_QUIRK_FIX_HYPERCALL_INSN	(1 << 5)
 #define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS	(1 << 6)
+#define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
 
 #define KVM_STATE_NESTED_FORMAT_VMX	0
 #define KVM_STATE_NESTED_FORMAT_SVM	1
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_statx 332
 #define __NR_io_pgetevents 333
 #define __NR_rseq 334
+#define __NR_uretprobe 335
 #define __NR_pidfd_send_signal 424
 #define __NR_io_uring_setup 425
 #define __NR_io_uring_enter 426
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_statx (__X32_SYSCALL_BIT + 332)
 #define __NR_io_pgetevents (__X32_SYSCALL_BIT + 333)
 #define __NR_rseq (__X32_SYSCALL_BIT + 334)
+#define __NR_uretprobe (__X32_SYSCALL_BIT + 335)
 #define __NR_pidfd_send_signal (__X32_SYSCALL_BIT + 424)
 #define __NR_io_uring_setup (__X32_SYSCALL_BIT + 425)
 #define __NR_io_uring_enter (__X32_SYSCALL_BIT + 426)
diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/bits.h
+++ b/linux-headers/linux/bits.h
@@ -XXX,XX +XXX,XX @@
         (((~_ULL(0)) - (_ULL(1) << (l)) + 1) & \
          (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
 
+#define __GENMASK_U128(h, l) \
+	((_BIT128((h)) << 1) - (_BIT128(l)))
+
 #endif /* _LINUX_BITS_H */
diff --git a/linux-headers/linux/const.h b/linux-headers/linux/const.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/const.h
+++ b/linux-headers/linux/const.h
@@ -XXX,XX +XXX,XX @@
 #define _BITUL(x)	(_UL(1) << (x))
 #define _BITULL(x)	(_ULL(1) << (x))
 
+#if !defined(__ASSEMBLY__)
+/*
+ * Missing __asm__ support
+ *
+ * __BIT128() would not work in the __asm__ code, as it shifts an
+ * 'unsigned __init128' data type as direct representation of
+ * 128 bit constants is not supported in the gcc compiler, as
+ * they get silently truncated.
+ *
+ * TODO: Please revisit this implementation when gcc compiler
+ * starts representing 128 bit constants directly like long
+ * and unsigned long etc. Subsequently drop the comment for
+ * GENMASK_U128() which would then start supporting __asm__ code.
+ */
+#define _BIT128(x)	((unsigned __int128)(1) << (x))
+#endif
+
 #define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
 #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
 
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@
 #ifndef _IOMMUFD_H
 #define _IOMMUFD_H
 
-#include <linux/types.h>
 #include <linux/ioctl.h>
+#include <linux/types.h>
 
 #define IOMMUFD_TYPE (';')
 
@@ -XXX,XX +XXX,XX @@
 enum {
 	IOMMUFD_CMD_BASE = 0x80,
 	IOMMUFD_CMD_DESTROY = IOMMUFD_CMD_BASE,
-	IOMMUFD_CMD_IOAS_ALLOC,
-	IOMMUFD_CMD_IOAS_ALLOW_IOVAS,
-	IOMMUFD_CMD_IOAS_COPY,
-	IOMMUFD_CMD_IOAS_IOVA_RANGES,
-	IOMMUFD_CMD_IOAS_MAP,
-	IOMMUFD_CMD_IOAS_UNMAP,
-	IOMMUFD_CMD_OPTION,
-	IOMMUFD_CMD_VFIO_IOAS,
-	IOMMUFD_CMD_HWPT_ALLOC,
-	IOMMUFD_CMD_GET_HW_INFO,
-	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
-	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
-	IOMMUFD_CMD_HWPT_INVALIDATE,
+	IOMMUFD_CMD_IOAS_ALLOC = 0x81,
+	IOMMUFD_CMD_IOAS_ALLOW_IOVAS = 0x82,
+	IOMMUFD_CMD_IOAS_COPY = 0x83,
+	IOMMUFD_CMD_IOAS_IOVA_RANGES = 0x84,
+	IOMMUFD_CMD_IOAS_MAP = 0x85,
+	IOMMUFD_CMD_IOAS_UNMAP = 0x86,
+	IOMMUFD_CMD_OPTION = 0x87,
+	IOMMUFD_CMD_VFIO_IOAS = 0x88,
+	IOMMUFD_CMD_HWPT_ALLOC = 0x89,
+	IOMMUFD_CMD_GET_HW_INFO = 0x8a,
+	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING = 0x8b,
+	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP = 0x8c,
+	IOMMUFD_CMD_HWPT_INVALIDATE = 0x8d,
+	IOMMUFD_CMD_FAULT_QUEUE_ALLOC = 0x8e,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
  *                                the parent HWPT in a nesting configuration.
  * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
  *                                   enforced on device attachment
+ * @IOMMU_HWPT_FAULT_ID_VALID: The fault_id field of hwpt allocation data is
+ *                             valid.
  */
 enum iommufd_hwpt_alloc_flags {
 	IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
 	IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
+	IOMMU_HWPT_FAULT_ID_VALID = 1 << 2,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_vtd_s1 {
  * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
  */
 enum iommu_hwpt_data_type {
-	IOMMU_HWPT_DATA_NONE,
-	IOMMU_HWPT_DATA_VTD_S1,
+	IOMMU_HWPT_DATA_NONE = 0,
+	IOMMU_HWPT_DATA_VTD_S1 = 1,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ enum iommu_hwpt_data_type {
  * @data_type: One of enum iommu_hwpt_data_type
  * @data_len: Length of the type specific data
  * @data_uptr: User pointer to the type specific data
+ * @fault_id: The ID of IOMMUFD_FAULT object. Valid only if flags field of
+ *            IOMMU_HWPT_FAULT_ID_VALID is set.
+ * @__reserved2: Padding to 64-bit alignment. Must be 0.
  *
  * Explicitly allocate a hardware page table object. This is the same object
  * type that is returned by iommufd_device_attach() and represents the
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_alloc {
 	__u32 data_type;
 	__u32 data_len;
 	__aligned_u64 data_uptr;
+	__u32 fault_id;
+	__u32 __reserved2;
 };
 #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
 
@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info_vtd {
  * @IOMMU_HW_INFO_TYPE_INTEL_VTD: Intel VT-d iommu info type
  */
 enum iommu_hw_info_type {
-	IOMMU_HW_INFO_TYPE_NONE,
-	IOMMU_HW_INFO_TYPE_INTEL_VTD,
+	IOMMU_HW_INFO_TYPE_NONE = 0,
+	IOMMU_HW_INFO_TYPE_INTEL_VTD = 1,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_get_dirty_bitmap {
  * @IOMMU_HWPT_INVALIDATE_DATA_VTD_S1: Invalidation data for VTD_S1
  */
 enum iommu_hwpt_invalidate_data_type {
-	IOMMU_HWPT_INVALIDATE_DATA_VTD_S1,
+	IOMMU_HWPT_INVALIDATE_DATA_VTD_S1 = 0,
 };
 
 /**
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_invalidate {
 	__u32 __reserved;
 };
 #define IOMMU_HWPT_INVALIDATE _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_INVALIDATE)
+
+/**
+ * enum iommu_hwpt_pgfault_flags - flags for struct iommu_hwpt_pgfault
+ * @IOMMU_PGFAULT_FLAGS_PASID_VALID: The pasid field of the fault data is
+ *                                   valid.
+ * @IOMMU_PGFAULT_FLAGS_LAST_PAGE: It's the last fault of a fault group.
+ */
+enum iommu_hwpt_pgfault_flags {
+	IOMMU_PGFAULT_FLAGS_PASID_VALID		= (1 << 0),
+	IOMMU_PGFAULT_FLAGS_LAST_PAGE		= (1 << 1),
+};
+
+/**
+ * enum iommu_hwpt_pgfault_perm - perm bits for struct iommu_hwpt_pgfault
+ * @IOMMU_PGFAULT_PERM_READ: request for read permission
+ * @IOMMU_PGFAULT_PERM_WRITE: request for write permission
+ * @IOMMU_PGFAULT_PERM_EXEC: (PCIE 10.4.1) request with a PASID that has the
+ *                           Execute Requested bit set in PASID TLP Prefix.
+ * @IOMMU_PGFAULT_PERM_PRIV: (PCIE 10.4.1) request with a PASID that has the
+ *                           Privileged Mode Requested bit set in PASID TLP
+ *                           Prefix.
+ */
+enum iommu_hwpt_pgfault_perm {
+	IOMMU_PGFAULT_PERM_READ			= (1 << 0),
+	IOMMU_PGFAULT_PERM_WRITE		= (1 << 1),
+	IOMMU_PGFAULT_PERM_EXEC			= (1 << 2),
+	IOMMU_PGFAULT_PERM_PRIV			= (1 << 3),
+};
+
+/**
+ * struct iommu_hwpt_pgfault - iommu page fault data
+ * @flags: Combination of enum iommu_hwpt_pgfault_flags
+ * @dev_id: id of the originated device
+ * @pasid: Process Address Space ID
+ * @grpid: Page Request Group Index
+ * @perm: Combination of enum iommu_hwpt_pgfault_perm
+ * @addr: Fault address
+ * @length: a hint of how much data the requestor is expecting to fetch. For
+ *          example, if the PRI initiator knows it is going to do a 10MB
+ *          transfer, it could fill in 10MB and the OS could pre-fault in
+ *          10MB of IOVA. It's default to 0 if there's no such hint.
+ * @cookie: kernel-managed cookie identifying a group of fault messages. The
+ *          cookie number encoded in the last page fault of the group should
+ *          be echoed back in the response message.
+ */
+struct iommu_hwpt_pgfault {
+	__u32 flags;
+	__u32 dev_id;
+	__u32 pasid;
+	__u32 grpid;
+	__u32 perm;
+	__u64 addr;
+	__u32 length;
+	__u32 cookie;
+};
+
+/**
+ * enum iommufd_page_response_code - Return status of fault handlers
+ * @IOMMUFD_PAGE_RESP_SUCCESS: Fault has been handled and the page tables
+ *                             populated, retry the access. This is the
+ *                             "Success" defined in PCI 10.4.2.1.
+ * @IOMMUFD_PAGE_RESP_INVALID: Could not handle this fault, don't retry the
+ *                             access. This is the "Invalid Request" in PCI
+ *                             10.4.2.1.
+ */
+enum iommufd_page_response_code {
+	IOMMUFD_PAGE_RESP_SUCCESS = 0,
+	IOMMUFD_PAGE_RESP_INVALID = 1,
+};
+
+/**
+ * struct iommu_hwpt_page_response - IOMMU page fault response
+ * @cookie: The kernel-managed cookie reported in the fault message.
+ * @code: One of response code in enum iommufd_page_response_code.
+ */
+struct iommu_hwpt_page_response {
+	__u32 cookie;
+	__u32 code;
+};
+
+/**
+ * struct iommu_fault_alloc - ioctl(IOMMU_FAULT_QUEUE_ALLOC)
+ * @size: sizeof(struct iommu_fault_alloc)
+ * @flags: Must be 0
+ * @out_fault_id: The ID of the new FAULT
+ * @out_fault_fd: The fd of the new FAULT
+ *
+ * Explicitly allocate a fault handling object.
+ */
+struct iommu_fault_alloc {
+	__u32 size;
+	__u32 flags;
+	__u32 out_fault_id;
+	__u32 out_fault_fd;
+};
+#define IOMMU_FAULT_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_FAULT_QUEUE_ALLOC)
 #endif
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_exit {
 /* Flags that describe what fields in emulation_failure hold valid data. */
 #define KVM_INTERNAL_ERROR_EMULATION_FLAG_INSTRUCTION_BYTES (1ULL << 0)
 
+/*
+ * struct kvm_run can be modified by userspace at any time, so KVM must be
+ * careful to avoid TOCTOU bugs. In order to protect KVM, HINT_UNSAFE_IN_KVM()
+ * renames fields in struct kvm_run from <symbol> to <symbol>__unsafe when
+ * compiled into the kernel, ensuring that any use within KVM is obvious and
+ * gets extra scrutiny.
+ */
+#define HINT_UNSAFE_IN_KVM(_symbol) _symbol
+
 /* for KVM_RUN, returned by mmap(vcpu_fd, offset=0) */
 struct kvm_run {
 	/* in */
 	__u8 request_interrupt_window;
-	__u8 immediate_exit;
+	__u8 HINT_UNSAFE_IN_KVM(immediate_exit);
 	__u8 padding1[6];
 
 	/* out */
@@ -XXX,XX +XXX,XX @@ struct kvm_enable_cap {
 #define KVM_CAP_MEMORY_ATTRIBUTES 233
 #define KVM_CAP_GUEST_MEMFD 234
 #define KVM_CAP_VM_TYPES 235
+#define KVM_CAP_PRE_FAULT_MEMORY 236
+#define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
+#define KVM_CAP_X86_GUEST_MODE 238
 
 struct kvm_irq_routing_irqchip {
 	__u32 irqchip;
@@ -XXX,XX +XXX,XX @@ struct kvm_create_guest_memfd {
 	__u64 reserved[6];
 };
 
+#define KVM_PRE_FAULT_MEMORY	_IOWR(KVMIO, 0xd5, struct kvm_pre_fault_memory)
+
+struct kvm_pre_fault_memory {
+	__u64 gpa;
+	__u64 size;
+	__u64 flags;
+	__u64 padding[5];
+};
+
 #endif /* __LINUX_KVM_H */
diff --git a/linux-headers/linux/mman.h b/linux-headers/linux/mman.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/mman.h
+++ b/linux-headers/linux/mman.h
@@ -XXX,XX +XXX,XX @@
 #define MAP_SHARED	0x01		/* Share changes */
 #define MAP_PRIVATE	0x02		/* Changes are private */
 #define MAP_SHARED_VALIDATE 0x03	/* share + validate extension flags */
+#define MAP_DROPPABLE	0x08		/* Zero memory under memory pressure. */
 
 /*
  * Huge page size encoding when MAP_HUGETLB is specified, and a huge page
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@ enum {
 	SNP_PLATFORM_STATUS,
 	SNP_COMMIT,
 	SNP_SET_CONFIG,
+	SNP_VLEK_LOAD,
 
 	SEV_MAX,
 };
@@ -XXX,XX +XXX,XX @@ typedef enum {
 	SEV_RET_INVALID_PLATFORM_STATE,
 	SEV_RET_INVALID_GUEST_STATE,
 	SEV_RET_INAVLID_CONFIG,
+	SEV_RET_INVALID_CONFIG = SEV_RET_INAVLID_CONFIG,
 	SEV_RET_INVALID_LEN,
 	SEV_RET_ALREADY_OWNED,
 	SEV_RET_INVALID_CERTIFICATE,
@@ -XXX,XX +XXX,XX @@ struct sev_user_data_snp_config {
 	__u8 rsvd1[52];
 } __attribute__((packed));
 
+/**
+ * struct sev_data_snp_vlek_load - SNP_VLEK_LOAD structure
+ *
+ * @len: length of the command buffer read by the PSP
+ * @vlek_wrapped_version: version of wrapped VLEK hashstick (Must be 0h)
+ * @rsvd: reserved
+ * @vlek_wrapped_address: address of a wrapped VLEK hashstick
+ *                        (struct sev_user_data_snp_wrapped_vlek_hashstick)
+ */
+struct sev_user_data_snp_vlek_load {
+	__u32 len;				/* In */
+	__u8 vlek_wrapped_version;		/* In */
+	__u8 rsvd[3];				/* In */
+	__u64 vlek_wrapped_address;		/* In */
+} __attribute__((packed));
+
+/**
+ * struct sev_user_data_snp_vlek_wrapped_vlek_hashstick - Wrapped VLEK data
+ *
+ * @data: Opaque data provided by AMD KDS (as described in SEV-SNP Firmware ABI
+ *        1.54, SNP_VLEK_LOAD)
+ */
+struct sev_user_data_snp_wrapped_vlek_hashstick {
+	__u8 data[432];				/* In */
+} __attribute__((packed));
+
 /**
  * struct sev_issue_cmd - SEV ioctl parameters
  *
-- 
2.34.1

From: Bibo Mao <maobibo@loongson.cn>

With pv steal time supported, VM machine needs get physical address
of each vcpu and notify new host during migration. Here two
functions kvm_get_stealtime/kvm_set_stealtime, and guest steal time
physical address is only updated on KVM_PUT_FULL_STATE stage.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20240930064040.753929-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.h     |  3 ++
 target/loongarch/kvm/kvm.c | 65 ++++++++++++++++++++++++++++++++++++++
 target/loongarch/machine.c |  6 ++--
 3 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     uint64_t CSR_DBG;
     uint64_t CSR_DERA;
     uint64_t CSR_DSAVE;
+    struct {
+        uint64_t guest_addr;
+    } stealtime;
 
 #ifdef CONFIG_TCG
     float_status fp_status;
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -XXX,XX +XXX,XX @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
 
+static int kvm_get_stealtime(CPUState *cs)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    int err;
+    struct kvm_device_attr attr = {
+        .group = KVM_LOONGARCH_VCPU_PVTIME_CTRL,
+        .attr = KVM_LOONGARCH_VCPU_PVTIME_GPA,
+        .addr = (uint64_t)&env->stealtime.guest_addr,
+    };
+
+    err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
+    if (err) {
+        return 0;
+    }
+
+    err = kvm_vcpu_ioctl(cs, KVM_GET_DEVICE_ATTR, attr);
+    if (err) {
+        error_report("PVTIME: KVM_GET_DEVICE_ATTR: %s", strerror(errno));
+        return err;
+    }
+
+    return 0;
+}
+
+static int kvm_set_stealtime(CPUState *cs)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    int err;
+    struct kvm_device_attr attr = {
+        .group = KVM_LOONGARCH_VCPU_PVTIME_CTRL,
+        .attr = KVM_LOONGARCH_VCPU_PVTIME_GPA,
+        .addr = (uint64_t)&env->stealtime.guest_addr,
+    };
+
+    err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
+    if (err) {
+        return 0;
+    }
+
+    err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr);
+    if (err) {
+        error_report("PVTIME: KVM_SET_DEVICE_ATTR %s with gpa "TARGET_FMT_lx,
+                      strerror(errno), env->stealtime.guest_addr);
+        return err;
+    }
+
+    return 0;
+}
+
 static int kvm_loongarch_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
         return ret;
     }
 
+    ret = kvm_get_stealtime(cs);
+    if (ret) {
+        return ret;
+    }
+
     ret = kvm_loongarch_get_mpstate(cs);
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
         return ret;
     }
 
+    if (level >= KVM_PUT_FULL_STATE) {
+        /*
+         * only KVM_PUT_FULL_STATE is required, kvm kernel will clear
+         * guest_addr for KVM_PUT_RESET_STATE
+         */
+        ret = kvm_set_stealtime(cs);
+        if (ret) {
+            return ret;
+        }
+    }
+
     ret = kvm_loongarch_put_mpstate(cs);
     return ret;
 }
diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/machine.c
+++ b/target/loongarch/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tlb = {
 /* LoongArch CPU state */
 const VMStateDescription vmstate_loongarch_cpu = {
     .name = "cpu",
-    .version_id = 2,
-    .minimum_version_id = 2,
+    .version_id = 3,
+    .minimum_version_id = 3,
     .fields = (const VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, LoongArchCPU, 32),
         VMSTATE_UINTTL(env.pc, LoongArchCPU),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_loongarch_cpu = {
         VMSTATE_UINT64(env.CSR_DSAVE, LoongArchCPU),
 
         VMSTATE_UINT64(kvm_state_counter, LoongArchCPU),
+        /* PV steal time */
+        VMSTATE_UINT64(env.stealtime.guest_addr, LoongArchCPU),
 
         VMSTATE_END_OF_LIST()
     },
-- 
2.34.1

The following changes since commit ffaf7f0376f8040ce9068d71ae9ae8722505c42e:

Merge tag 'pull-10.0-testing-and-gdstub-updates-100225-1' of https://gitlab.com/stsquad/qemu into staging (2025-02-10 13:26:17 -0500)

are available in the Git repository at:

https://gitlab.com/bibo-mao/qemu.git tags/pull-loongarch-20250212

for you to fetch changes up to 456739ce4347c21b6fa2ec1b6585bc4a6504446f:

hw/loongarch/virt: CPU irq line connection improvement (2025-02-12 10:05:22 +0800)

----------------------------------------------------------------
pull-loongarch-20250212 queue

----------------------------------------------------------------
Bibo Mao (6):
      hw/loongarch/virt: Rename filename acpi-build with virt-acpi-build
      hw/loongarch/virt: Rename function prefix name
      hw/loongarch/virt: Add separate file for fdt building
      hw/loongarch/virt: Set iocsr address space when CPU is created
      hw/loongarch/virt: Remove unused ipistate
      hw/loongarch/virt: CPU irq line connection improvement

hw/loongarch/meson.build                         |   6 +-
 hw/loongarch/{acpi-build.c => virt-acpi-build.c} |   6 +-
 hw/loongarch/virt-fdt-build.c                    | 535 ++++++++++++++++++++
 hw/loongarch/virt.c                              | 593 ++---------------------
 include/hw/loongarch/virt.h                      |   5 +-
 target/loongarch/cpu.h                           |   2 -
 6 files changed, 584 insertions(+), 563 deletions(-)
 rename hw/loongarch/{acpi-build.c => virt-acpi-build.c} (99%)
 create mode 100644 hw/loongarch/virt-fdt-build.c

File acpi-build.c is relative with virt machine type, rename it with
virt-acpi-build.c

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/loongarch/meson.build                         | 2 +-
 hw/loongarch/{acpi-build.c => virt-acpi-build.c} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename hw/loongarch/{acpi-build.c => virt-acpi-build.c} (100%)

Replace function prefix name loongarch_xxx with virt_xxx in file
virt-acpi-build.c

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/loongarch/virt-acpi-build.c | 6 +++---
 hw/loongarch/virt.c            | 2 +-
 include/hw/loongarch/virt.h    | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/loongarch/virt-acpi-build.c b/hw/loongarch/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt-acpi-build.c
+++ b/hw/loongarch/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_acpi_build = {
     },
 };
 
-static bool loongarch_is_acpi_enabled(LoongArchVirtMachineState *lvms)
+static bool virt_is_acpi_enabled(LoongArchVirtMachineState *lvms)
 {
     if (lvms->acpi == ON_OFF_AUTO_OFF) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool loongarch_is_acpi_enabled(LoongArchVirtMachineState *lvms)
     return true;
 }
 
-void loongarch_acpi_setup(LoongArchVirtMachineState *lvms)
+void virt_acpi_setup(LoongArchVirtMachineState *lvms)
 {
     AcpiBuildTables tables;
     AcpiBuildState *build_state;
@@ -XXX,XX +XXX,XX @@ void loongarch_acpi_setup(LoongArchVirtMachineState *lvms)
         return;
     }
 
-    if (!loongarch_is_acpi_enabled(lvms)) {
+    if (!virt_is_acpi_enabled(lvms)) {
         ACPI_BUILD_DPRINTF("ACPI disabled. Bailing out.\n");
         return;
     }
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_done(Notifier *notifier, void *data)
     LoongArchVirtMachineState *lvms = container_of(notifier,
                                       LoongArchVirtMachineState, machine_done);
     virt_build_smbios(lvms);
-    loongarch_acpi_setup(lvms);
+    virt_acpi_setup(lvms);
     virt_fdt_setup(lvms);
 }
 
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -XXX,XX +XXX,XX @@ struct LoongArchVirtMachineState {
 
 #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
 OBJECT_DECLARE_SIMPLE_TYPE(LoongArchVirtMachineState, LOONGARCH_VIRT_MACHINE)
-void loongarch_acpi_setup(LoongArchVirtMachineState *lvms);
+void virt_acpi_setup(LoongArchVirtMachineState *lvms);
 #endif
-- 
2.43.5

Similiar with virt-acpi-build.c, file virt-fdt-build.c is added here.
And move functions relative with fdt table building to the file.

It is only code movement and there is no function change.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/loongarch/meson.build      |   4 +-
 hw/loongarch/virt-fdt-build.c | 535 ++++++++++++++++++++++++++++++++++
 hw/loongarch/virt.c           | 524 ---------------------------------
 include/hw/loongarch/virt.h   |   1 +
 4 files changed, 539 insertions(+), 525 deletions(-)
 create mode 100644 hw/loongarch/virt-fdt-build.c

diff --git a/hw/loongarch/meson.build b/hw/loongarch/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/meson.build
+++ b/hw/loongarch/meson.build
@@ -XXX,XX +XXX,XX @@ loongarch_ss.add(files(
     'boot.c',
 ))
 common_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files('fw_cfg.c'))
-loongarch_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files('virt.c'))
+loongarch_ss.add(when: 'CONFIG_LOONGARCH_VIRT', if_true: files(
+  'virt-fdt-build.c',
+  'virt.c'))
 loongarch_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 
 hw_arch += {'loongarch': loongarch_ss}
diff --git a/hw/loongarch/virt-fdt-build.c b/hw/loongarch/virt-fdt-build.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/loongarch/virt-fdt-build.c
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2025 Loongson Technology Corporation Limited
+ */
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qemu/guest-random.h"
+#include <libfdt.h>
+#include "hw/acpi/generic_event_device.h"
+#include "hw/core/sysbus-fdt.h"
+#include "hw/intc/loongarch_extioi.h"
+#include "hw/loader.h"
+#include "hw/loongarch/virt.h"
+#include "hw/pci-host/gpex.h"
+#include "hw/pci-host/ls7a.h"
+#include "system/device_tree.h"
+#include "system/reset.h"
+#include "target/loongarch/cpu.h"
+
+static void create_fdt(LoongArchVirtMachineState *lvms)
+{
+    MachineState *ms = MACHINE(lvms);
+    uint8_t rng_seed[32];
+
+    ms->fdt = create_device_tree(&lvms->fdt_size);
+    if (!ms->fdt) {
+        error_report("create_device_tree() failed");
+        exit(1);
+    }
+
+    /* Header */
+    qemu_fdt_setprop_string(ms->fdt, "/", "compatible",
+                            "linux,dummy-loongson3");
+    qemu_fdt_setprop_cell(ms->fdt, "/", "#address-cells", 0x2);
+    qemu_fdt_setprop_cell(ms->fdt, "/", "#size-cells", 0x2);
+    qemu_fdt_add_subnode(ms->fdt, "/chosen");
+
+    /* Pass seed to RNG */
+    qemu_guest_getrandom_nofail(rng_seed, sizeof(rng_seed));
+    qemu_fdt_setprop(ms->fdt, "/chosen", "rng-seed", rng_seed, sizeof(rng_seed));
+}
+
+static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
+{
+    int num;
+    MachineState *ms = MACHINE(lvms);
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+    const CPUArchIdList *possible_cpus;
+    LoongArchCPU *cpu;
+    CPUState *cs;
+    char *nodename, *map_path;
+
+    qemu_fdt_add_subnode(ms->fdt, "/cpus");
+    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
+    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
+
+    /* cpu nodes */
+    possible_cpus = mc->possible_cpu_arch_ids(ms);
+    for (num = 0; num < possible_cpus->len; num++) {
+        cs = possible_cpus->cpus[num].cpu;
+        if (cs == NULL) {
+            continue;
+        }
+
+        nodename = g_strdup_printf("/cpus/cpu@%d", num);
+        cpu = LOONGARCH_CPU(cs);
+
+        qemu_fdt_add_subnode(ms->fdt, nodename);
+        qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "cpu");
+        qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
+                                cpu->dtb_compatible);
+        if (possible_cpus->cpus[num].props.has_node_id) {
+            qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id",
+                possible_cpus->cpus[num].props.node_id);
+        }
+        qemu_fdt_setprop_cell(ms->fdt, nodename, "reg", num);
+        qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle",
+                              qemu_fdt_alloc_phandle(ms->fdt));
+        g_free(nodename);
+    }
+
+    /*cpu map */
+    qemu_fdt_add_subnode(ms->fdt, "/cpus/cpu-map");
+    for (num = 0; num < possible_cpus->len; num++) {
+        cs = possible_cpus->cpus[num].cpu;
+        if (cs == NULL) {
+            continue;
+        }
+
+        nodename = g_strdup_printf("/cpus/cpu@%d", num);
+        if (ms->smp.threads > 1) {
+            map_path = g_strdup_printf(
+                "/cpus/cpu-map/socket%d/core%d/thread%d",
+                num / (ms->smp.cores * ms->smp.threads),
+                (num / ms->smp.threads) % ms->smp.cores,
+                num % ms->smp.threads);
+        } else {
+            map_path = g_strdup_printf(
+                "/cpus/cpu-map/socket%d/core%d",
+                num / ms->smp.cores,
+                num % ms->smp.cores);
+        }
+        qemu_fdt_add_path(ms->fdt, map_path);
+        qemu_fdt_setprop_phandle(ms->fdt, map_path, "cpu", nodename);
+
+        g_free(map_path);
+        g_free(nodename);
+    }
+}
+
+static void fdt_add_memory_node(MachineState *ms,
+                                uint64_t base, uint64_t size, int node_id)
+{
+    char *nodename = g_strdup_printf("/memory@%" PRIx64, base);
+
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", base >> 32, base,
+                           size >> 32, size);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "memory");
+
+    if (ms->numa_state && ms->numa_state->num_nodes) {
+        qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id", node_id);
+    }
+
+    g_free(nodename);
+}
+
+static void fdt_add_memory_nodes(MachineState *ms)
+{
+    hwaddr base, size, ram_size, gap;
+    int i, nb_numa_nodes, nodes;
+    NodeInfo *numa_info;
+
+    ram_size = ms->ram_size;
+    base = VIRT_LOWMEM_BASE;
+    gap = VIRT_LOWMEM_SIZE;
+    nodes = nb_numa_nodes = ms->numa_state->num_nodes;
+    numa_info = ms->numa_state->nodes;
+    if (!nodes) {
+        nodes = 1;
+    }
+
+    for (i = 0; i < nodes; i++) {
+        if (nb_numa_nodes) {
+            size = numa_info[i].node_mem;
+        } else {
+            size = ram_size;
+        }
+
+        /*
+         * memory for the node splited into two part
+         *   lowram:  [base, +gap)
+         *   highram: [VIRT_HIGHMEM_BASE, +(len - gap))
+         */
+        if (size >= gap) {
+            fdt_add_memory_node(ms, base, gap, i);
+            size -= gap;
+            base = VIRT_HIGHMEM_BASE;
+            gap = ram_size - VIRT_LOWMEM_SIZE;
+        }
+
+        if (size) {
+            fdt_add_memory_node(ms, base, size, i);
+            base += size;
+            gap -= size;
+        }
+    }
+}
+
+static void fdt_add_fw_cfg_node(const LoongArchVirtMachineState *lvms)
+{
+    char *nodename;
+    hwaddr base = VIRT_FWCFG_BASE;
+    const MachineState *ms = MACHINE(lvms);
+
+    nodename = g_strdup_printf("/fw_cfg@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename,
+                            "compatible", "qemu,fw-cfg-mmio");
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
+                                 2, base, 2, 0x18);
+    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
+    g_free(nodename);
+}
+
+static void fdt_add_flash_node(LoongArchVirtMachineState *lvms)
+{
+    MachineState *ms = MACHINE(lvms);
+    char *nodename;
+    MemoryRegion *flash_mem;
+
+    hwaddr flash0_base;
+    hwaddr flash0_size;
+
+    hwaddr flash1_base;
+    hwaddr flash1_size;
+
+    flash_mem = pflash_cfi01_get_memory(lvms->flash[0]);
+    flash0_base = flash_mem->addr;
+    flash0_size = memory_region_size(flash_mem);
+
+    flash_mem = pflash_cfi01_get_memory(lvms->flash[1]);
+    flash1_base = flash_mem->addr;
+    flash1_size = memory_region_size(flash_mem);
+
+    nodename = g_strdup_printf("/flash@%" PRIx64, flash0_base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "cfi-flash");
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
+                                 2, flash0_base, 2, flash0_size,
+                                 2, flash1_base, 2, flash1_size);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "bank-width", 4);
+    g_free(nodename);
+}
+
+static void fdt_add_cpuic_node(LoongArchVirtMachineState *lvms,
+                               uint32_t *cpuintc_phandle)
+{
+    MachineState *ms = MACHINE(lvms);
+    char *nodename;
+
+    *cpuintc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
+    nodename = g_strdup_printf("/cpuic");
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *cpuintc_phandle);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
+                            "loongson,cpu-interrupt-controller");
+    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
+    g_free(nodename);
+}
+
+static void fdt_add_eiointc_node(LoongArchVirtMachineState *lvms,
+                                  uint32_t *cpuintc_phandle,
+                                  uint32_t *eiointc_phandle)
+{
+    MachineState *ms = MACHINE(lvms);
+    char *nodename;
+    hwaddr extioi_base = APIC_BASE;
+    hwaddr extioi_size = EXTIOI_SIZE;
+
+    *eiointc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
+    nodename = g_strdup_printf("/eiointc@%" PRIx64, extioi_base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *eiointc_phandle);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
+                            "loongson,ls2k2000-eiointc");
+    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
+                          *cpuintc_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupts", 3);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0,
+                           extioi_base, 0x0, extioi_size);
+    g_free(nodename);
+}
+
+static void fdt_add_pch_pic_node(LoongArchVirtMachineState *lvms,
+                                 uint32_t *eiointc_phandle,
+                                 uint32_t *pch_pic_phandle)
+{
+    MachineState *ms = MACHINE(lvms);
+    char *nodename;
+    hwaddr pch_pic_base = VIRT_PCH_REG_BASE;
+    hwaddr pch_pic_size = VIRT_PCH_REG_SIZE;
+
+    *pch_pic_phandle = qemu_fdt_alloc_phandle(ms->fdt);
+    nodename = g_strdup_printf("/platic@%" PRIx64, pch_pic_base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_cell(ms->fdt,  nodename, "phandle", *pch_pic_phandle);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
+                            "loongson,pch-pic-1.0");
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0,
+                           pch_pic_base, 0, pch_pic_size);
+    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 2);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
+                          *eiointc_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,pic-base-vec", 0);
+    g_free(nodename);
+}
+
+static void fdt_add_pch_msi_node(LoongArchVirtMachineState *lvms,
+                                 uint32_t *eiointc_phandle,
+                                 uint32_t *pch_msi_phandle)
+{
+    MachineState *ms = MACHINE(lvms);
+    char *nodename;
+    hwaddr pch_msi_base = VIRT_PCH_MSI_ADDR_LOW;
+    hwaddr pch_msi_size = VIRT_PCH_MSI_SIZE;
+
+    *pch_msi_phandle = qemu_fdt_alloc_phandle(ms->fdt);
+    nodename = g_strdup_printf("/msi@%" PRIx64, pch_msi_base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *pch_msi_phandle);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
+                            "loongson,pch-msi-1.0");
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg",
+                           0, pch_msi_base,
+                           0, pch_msi_size);
+    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
+                          *eiointc_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-base-vec",
+                          VIRT_PCH_PIC_IRQ_NUM);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-num-vecs",
+                          EXTIOI_IRQS - VIRT_PCH_PIC_IRQ_NUM);
+    g_free(nodename);
+}
+
+static void fdt_add_pcie_irq_map_node(const LoongArchVirtMachineState *lvms,
+                                      char *nodename,
+                                      uint32_t *pch_pic_phandle)
+{
+    int pin, dev;
+    uint32_t irq_map_stride = 0;
+    uint32_t full_irq_map[PCI_NUM_PINS * PCI_NUM_PINS * 10] = {};
+    uint32_t *irq_map = full_irq_map;
+    const MachineState *ms = MACHINE(lvms);
+
+    /*
+     * This code creates a standard swizzle of interrupts such that
+     * each device's first interrupt is based on it's PCI_SLOT number.
+     * (See pci_swizzle_map_irq_fn())
+     *
+     * We only need one entry per interrupt in the table (not one per
+     * possible slot) seeing the interrupt-map-mask will allow the table
+     * to wrap to any number of devices.
+     */
+
+    for (dev = 0; dev < PCI_NUM_PINS; dev++) {
+        int devfn = dev * 0x8;
+
+        for (pin = 0; pin < PCI_NUM_PINS; pin++) {
+            int irq_nr = 16 + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
+            int i = 0;
+
+            /* Fill PCI address cells */
+            irq_map[i] = cpu_to_be32(devfn << 8);
+            i += 3;
+
+            /* Fill PCI Interrupt cells */
+            irq_map[i] = cpu_to_be32(pin + 1);
+            i += 1;
+
+            /* Fill interrupt controller phandle and cells */
+            irq_map[i++] = cpu_to_be32(*pch_pic_phandle);
+            irq_map[i++] = cpu_to_be32(irq_nr);
+
+            if (!irq_map_stride) {
+                irq_map_stride = i;
+            }
+            irq_map += irq_map_stride;
+        }
+    }
+
+
+    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-map", full_irq_map,
+                     PCI_NUM_PINS * PCI_NUM_PINS *
+                     irq_map_stride * sizeof(uint32_t));
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupt-map-mask",
+                     0x1800, 0, 0, 0x7);
+}
+
+static void fdt_add_pcie_node(const LoongArchVirtMachineState *lvms,
+                              uint32_t *pch_pic_phandle,
+                              uint32_t *pch_msi_phandle)
+{
+    char *nodename;
+    hwaddr base_mmio = VIRT_PCI_MEM_BASE;
+    hwaddr size_mmio = VIRT_PCI_MEM_SIZE;
+    hwaddr base_pio = VIRT_PCI_IO_BASE;
+    hwaddr size_pio = VIRT_PCI_IO_SIZE;
+    hwaddr base_pcie = VIRT_PCI_CFG_BASE;
+    hwaddr size_pcie = VIRT_PCI_CFG_SIZE;
+    hwaddr base = base_pcie;
+    const MachineState *ms = MACHINE(lvms);
+
+    nodename = g_strdup_printf("/pcie@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename,
+                            "compatible", "pci-host-ecam-generic");
+    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "pci");
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#address-cells", 3);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#size-cells", 2);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "linux,pci-domain", 0);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "bus-range", 0,
+                           PCIE_MMCFG_BUS(VIRT_PCI_CFG_SIZE - 1));
+    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
+                                 2, base_pcie, 2, size_pcie);
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "ranges",
+                                 1, FDT_PCI_RANGE_IOPORT, 2, VIRT_PCI_IO_OFFSET,
+                                 2, base_pio, 2, size_pio,
+                                 1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
+                                 2, base_mmio, 2, size_mmio);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "msi-map",
+                           0, *pch_msi_phandle, 0, 0x10000);
+    fdt_add_pcie_irq_map_node(lvms, nodename, pch_pic_phandle);
+    g_free(nodename);
+}
+
+static void fdt_add_uart_node(LoongArchVirtMachineState *lvms,
+                              uint32_t *pch_pic_phandle, hwaddr base,
+                              int irq, bool chosen)
+{
+    char *nodename;
+    hwaddr size = VIRT_UART_SIZE;
+    MachineState *ms = MACHINE(lvms);
+
+    nodename = g_strdup_printf("/serial@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "ns16550a");
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0, base, 0x0, size);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "clock-frequency", 100000000);
+    if (chosen) {
+        qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", nodename);
+    }
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq, 0x4);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
+                          *pch_pic_phandle);
+    g_free(nodename);
+}
+
+static void fdt_add_rtc_node(LoongArchVirtMachineState *lvms,
+                             uint32_t *pch_pic_phandle)
+{
+    char *nodename;
+    hwaddr base = VIRT_RTC_REG_BASE;
+    hwaddr size = VIRT_RTC_LEN;
+    MachineState *ms = MACHINE(lvms);
+
+    nodename = g_strdup_printf("/rtc@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
+                            "loongson,ls7a-rtc");
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts",
+                           VIRT_RTC_IRQ - VIRT_GSI_BASE , 0x4);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
+                          *pch_pic_phandle);
+    g_free(nodename);
+}
+
+static void fdt_add_ged_reset(LoongArchVirtMachineState *lvms)
+{
+    char *name;
+    uint32_t ged_handle;
+    MachineState *ms = MACHINE(lvms);
+    hwaddr base = VIRT_GED_REG_ADDR;
+    hwaddr size = ACPI_GED_REG_COUNT;
+
+    ged_handle = qemu_fdt_alloc_phandle(ms->fdt);
+    name = g_strdup_printf("/ged@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, name);
+    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon");
+    qemu_fdt_setprop_cells(ms->fdt, name, "reg", 0x0, base, 0x0, size);
+    /* 8 bit registers */
+    qemu_fdt_setprop_cell(ms->fdt, name, "reg-shift", 0);
+    qemu_fdt_setprop_cell(ms->fdt, name, "reg-io-width", 1);
+    qemu_fdt_setprop_cell(ms->fdt, name, "phandle", ged_handle);
+    ged_handle = qemu_fdt_get_phandle(ms->fdt, name);
+    g_free(name);
+
+    name = g_strdup_printf("/reboot");
+    qemu_fdt_add_subnode(ms->fdt, name);
+    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-reboot");
+    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
+    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_RESET);
+    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_RESET_VALUE);
+    g_free(name);
+
+    name = g_strdup_printf("/poweroff");
+    qemu_fdt_add_subnode(ms->fdt, name);
+    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-poweroff");
+    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
+    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_SLEEP_CTL);
+    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_SLP_EN |
+                          (ACPI_GED_SLP_TYP_S5 << ACPI_GED_SLP_TYP_POS));
+    g_free(name);
+}
+
+void virt_fdt_setup(LoongArchVirtMachineState *lvms)
+{
+    MachineState *machine = MACHINE(lvms);
+    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
+    int i;
+
+    create_fdt(lvms);
+    fdt_add_cpu_nodes(lvms);
+    fdt_add_memory_nodes(machine);
+    fdt_add_fw_cfg_node(lvms);
+    fdt_add_flash_node(lvms);
+
+    /* Add cpu interrupt-controller */
+    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
+    /* Add Extend I/O Interrupt Controller node */
+    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
+    /* Add PCH PIC node */
+    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
+    /* Add PCH MSI node */
+    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
+    /* Add pcie node */
+    fdt_add_pcie_node(lvms, &pch_pic_phandle, &pch_msi_phandle);
+
+    /*
+     * Create uart fdt node in reverse order so that they appear
+     * in the finished device tree lowest address first
+     */
+    for (i = VIRT_UART_COUNT; i-- > 0;) {
+        hwaddr base = VIRT_UART_BASE + i * VIRT_UART_SIZE;
+        int irq = VIRT_UART_IRQ + i - VIRT_GSI_BASE;
+        fdt_add_uart_node(lvms, &pch_pic_phandle, base, irq, i == 0);
+    }
+
+    fdt_add_rtc_node(lvms, &pch_pic_phandle);
+    fdt_add_ged_reset(lvms);
+    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
+                                   VIRT_PLATFORM_BUS_BASEADDRESS,
+                                   VIRT_PLATFORM_BUS_SIZE,
+                                   VIRT_PLATFORM_BUS_IRQ);
+
+    /*
+     * Since lowmem region starts from 0 and Linux kernel legacy start address
+     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
+     * access. FDT size limit with 1 MiB.
+     * Put the FDT into the memory map as a ROM image: this will ensure
+     * the FDT is copied again upon reset, even if addr points into RAM.
+     */
+    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
+    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
+                          &address_space_memory);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
+}
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/loongarch/fw_cfg.h"
 #include "target/loongarch/cpu.h"
 #include "hw/firmware/smbios.h"
-#include "hw/acpi/aml-build.h"
 #include "qapi/qapi-visit-common.h"
 #include "hw/acpi/generic_event_device.h"
 #include "hw/mem/nvdimm.h"
-#include "system/device_tree.h"
-#include <libfdt.h>
-#include "hw/core/sysbus-fdt.h"
 #include "hw/platform-bus.h"
 #include "hw/display/ramfb.h"
 #include "hw/mem/pc-dimm.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/block/flash.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "qemu/error-report.h"
-#include "qemu/guest-random.h"
 
 static bool virt_is_veiointc_enabled(LoongArchVirtMachineState *lvms)
 {
@@ -XXX,XX +XXX,XX @@ static void virt_flash_map(LoongArchVirtMachineState *lvms,
     virt_flash_map1(flash1, VIRT_FLASH1_BASE, VIRT_FLASH1_SIZE, sysmem);
 }
 
-static void fdt_add_cpuic_node(LoongArchVirtMachineState *lvms,
-                               uint32_t *cpuintc_phandle)
-{
-    MachineState *ms = MACHINE(lvms);
-    char *nodename;
-
-    *cpuintc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
-    nodename = g_strdup_printf("/cpuic");
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *cpuintc_phandle);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
-                            "loongson,cpu-interrupt-controller");
-    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
-    g_free(nodename);
-}
-
-static void fdt_add_eiointc_node(LoongArchVirtMachineState *lvms,
-                                  uint32_t *cpuintc_phandle,
-                                  uint32_t *eiointc_phandle)
-{
-    MachineState *ms = MACHINE(lvms);
-    char *nodename;
-    hwaddr extioi_base = APIC_BASE;
-    hwaddr extioi_size = EXTIOI_SIZE;
-
-    *eiointc_phandle = qemu_fdt_alloc_phandle(ms->fdt);
-    nodename = g_strdup_printf("/eiointc@%" PRIx64, extioi_base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *eiointc_phandle);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
-                            "loongson,ls2k2000-eiointc");
-    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
-                          *cpuintc_phandle);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupts", 3);
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0,
-                           extioi_base, 0x0, extioi_size);
-    g_free(nodename);
-}
-
-static void fdt_add_pch_pic_node(LoongArchVirtMachineState *lvms,
-                                 uint32_t *eiointc_phandle,
-                                 uint32_t *pch_pic_phandle)
-{
-    MachineState *ms = MACHINE(lvms);
-    char *nodename;
-    hwaddr pch_pic_base = VIRT_PCH_REG_BASE;
-    hwaddr pch_pic_size = VIRT_PCH_REG_SIZE;
-
-    *pch_pic_phandle = qemu_fdt_alloc_phandle(ms->fdt);
-    nodename = g_strdup_printf("/platic@%" PRIx64, pch_pic_base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_cell(ms->fdt,  nodename, "phandle", *pch_pic_phandle);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
-                            "loongson,pch-pic-1.0");
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0,
-                           pch_pic_base, 0, pch_pic_size);
-    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 2);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
-                          *eiointc_phandle);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,pic-base-vec", 0);
-    g_free(nodename);
-}
-
-static void fdt_add_pch_msi_node(LoongArchVirtMachineState *lvms,
-                                 uint32_t *eiointc_phandle,
-                                 uint32_t *pch_msi_phandle)
-{
-    MachineState *ms = MACHINE(lvms);
-    char *nodename;
-    hwaddr pch_msi_base = VIRT_PCH_MSI_ADDR_LOW;
-    hwaddr pch_msi_size = VIRT_PCH_MSI_SIZE;
-
-    *pch_msi_phandle = qemu_fdt_alloc_phandle(ms->fdt);
-    nodename = g_strdup_printf("/msi@%" PRIx64, pch_msi_base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", *pch_msi_phandle);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
-                            "loongson,pch-msi-1.0");
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg",
-                           0, pch_msi_base,
-                           0, pch_msi_size);
-    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
-                          *eiointc_phandle);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-base-vec",
-                          VIRT_PCH_PIC_IRQ_NUM);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "loongson,msi-num-vecs",
-                          EXTIOI_IRQS - VIRT_PCH_PIC_IRQ_NUM);
-    g_free(nodename);
-}
-
-static void fdt_add_flash_node(LoongArchVirtMachineState *lvms)
-{
-    MachineState *ms = MACHINE(lvms);
-    char *nodename;
-    MemoryRegion *flash_mem;
-
-    hwaddr flash0_base;
-    hwaddr flash0_size;
-
-    hwaddr flash1_base;
-    hwaddr flash1_size;
-
-    flash_mem = pflash_cfi01_get_memory(lvms->flash[0]);
-    flash0_base = flash_mem->addr;
-    flash0_size = memory_region_size(flash_mem);
-
-    flash_mem = pflash_cfi01_get_memory(lvms->flash[1]);
-    flash1_base = flash_mem->addr;
-    flash1_size = memory_region_size(flash_mem);
-
-    nodename = g_strdup_printf("/flash@%" PRIx64, flash0_base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "cfi-flash");
-    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
-                                 2, flash0_base, 2, flash0_size,
-                                 2, flash1_base, 2, flash1_size);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "bank-width", 4);
-    g_free(nodename);
-}
-
-static void fdt_add_rtc_node(LoongArchVirtMachineState *lvms,
-                             uint32_t *pch_pic_phandle)
-{
-    char *nodename;
-    hwaddr base = VIRT_RTC_REG_BASE;
-    hwaddr size = VIRT_RTC_LEN;
-    MachineState *ms = MACHINE(lvms);
-
-    nodename = g_strdup_printf("/rtc@%" PRIx64, base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
-                            "loongson,ls7a-rtc");
-    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts",
-                           VIRT_RTC_IRQ - VIRT_GSI_BASE , 0x4);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
-                          *pch_pic_phandle);
-    g_free(nodename);
-}
-
-static void fdt_add_ged_reset(LoongArchVirtMachineState *lvms)
-{
-    char *name;
-    uint32_t ged_handle;
-    MachineState *ms = MACHINE(lvms);
-    hwaddr base = VIRT_GED_REG_ADDR;
-    hwaddr size = ACPI_GED_REG_COUNT;
-
-    ged_handle = qemu_fdt_alloc_phandle(ms->fdt);
-    name = g_strdup_printf("/ged@%" PRIx64, base);
-    qemu_fdt_add_subnode(ms->fdt, name);
-    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon");
-    qemu_fdt_setprop_cells(ms->fdt, name, "reg", 0x0, base, 0x0, size);
-    /* 8 bit registers */
-    qemu_fdt_setprop_cell(ms->fdt, name, "reg-shift", 0);
-    qemu_fdt_setprop_cell(ms->fdt, name, "reg-io-width", 1);
-    qemu_fdt_setprop_cell(ms->fdt, name, "phandle", ged_handle);
-    ged_handle = qemu_fdt_get_phandle(ms->fdt, name);
-    g_free(name);
-
-    name = g_strdup_printf("/reboot");
-    qemu_fdt_add_subnode(ms->fdt, name);
-    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-reboot");
-    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
-    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_RESET);
-    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_RESET_VALUE);
-    g_free(name);
-
-    name = g_strdup_printf("/poweroff");
-    qemu_fdt_add_subnode(ms->fdt, name);
-    qemu_fdt_setprop_string(ms->fdt, name, "compatible", "syscon-poweroff");
-    qemu_fdt_setprop_cell(ms->fdt, name, "regmap", ged_handle);
-    qemu_fdt_setprop_cell(ms->fdt, name, "offset", ACPI_GED_REG_SLEEP_CTL);
-    qemu_fdt_setprop_cell(ms->fdt, name, "value", ACPI_GED_SLP_EN |
-                          (ACPI_GED_SLP_TYP_S5 << ACPI_GED_SLP_TYP_POS));
-    g_free(name);
-}
-
-static void fdt_add_uart_node(LoongArchVirtMachineState *lvms,
-                              uint32_t *pch_pic_phandle, hwaddr base,
-                              int irq, bool chosen)
-{
-    char *nodename;
-    hwaddr size = VIRT_UART_SIZE;
-    MachineState *ms = MACHINE(lvms);
-
-    nodename = g_strdup_printf("/serial@%" PRIx64, base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "ns16550a");
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", 0x0, base, 0x0, size);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "clock-frequency", 100000000);
-    if (chosen) {
-        qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", nodename);
-    }
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq, 0x4);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
-                          *pch_pic_phandle);
-    g_free(nodename);
-}
-
-static void create_fdt(LoongArchVirtMachineState *lvms)
-{
-    MachineState *ms = MACHINE(lvms);
-    uint8_t rng_seed[32];
-
-    ms->fdt = create_device_tree(&lvms->fdt_size);
-    if (!ms->fdt) {
-        error_report("create_device_tree() failed");
-        exit(1);
-    }
-
-    /* Header */
-    qemu_fdt_setprop_string(ms->fdt, "/", "compatible",
-                            "linux,dummy-loongson3");
-    qemu_fdt_setprop_cell(ms->fdt, "/", "#address-cells", 0x2);
-    qemu_fdt_setprop_cell(ms->fdt, "/", "#size-cells", 0x2);
-    qemu_fdt_add_subnode(ms->fdt, "/chosen");
-
-    /* Pass seed to RNG */
-    qemu_guest_getrandom_nofail(rng_seed, sizeof(rng_seed));
-    qemu_fdt_setprop(ms->fdt, "/chosen", "rng-seed", rng_seed, sizeof(rng_seed));
-}
-
-static void fdt_add_cpu_nodes(const LoongArchVirtMachineState *lvms)
-{
-    int num;
-    MachineState *ms = MACHINE(lvms);
-    MachineClass *mc = MACHINE_GET_CLASS(ms);
-    const CPUArchIdList *possible_cpus;
-    LoongArchCPU *cpu;
-    CPUState *cs;
-    char *nodename, *map_path;
-
-    qemu_fdt_add_subnode(ms->fdt, "/cpus");
-    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#address-cells", 0x1);
-    qemu_fdt_setprop_cell(ms->fdt, "/cpus", "#size-cells", 0x0);
-
-    /* cpu nodes */
-    possible_cpus = mc->possible_cpu_arch_ids(ms);
-    for (num = 0; num < possible_cpus->len; num++) {
-        cs = possible_cpus->cpus[num].cpu;
-        if (cs == NULL) {
-            continue;
-        }
-
-        nodename = g_strdup_printf("/cpus/cpu@%d", num);
-        cpu = LOONGARCH_CPU(cs);
-
-        qemu_fdt_add_subnode(ms->fdt, nodename);
-        qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "cpu");
-        qemu_fdt_setprop_string(ms->fdt, nodename, "compatible",
-                                cpu->dtb_compatible);
-        if (possible_cpus->cpus[num].props.has_node_id) {
-            qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id",
-                possible_cpus->cpus[num].props.node_id);
-        }
-        qemu_fdt_setprop_cell(ms->fdt, nodename, "reg", num);
-        qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle",
-                              qemu_fdt_alloc_phandle(ms->fdt));
-        g_free(nodename);
-    }
-
-    /*cpu map */
-    qemu_fdt_add_subnode(ms->fdt, "/cpus/cpu-map");
-    for (num = 0; num < possible_cpus->len; num++) {
-        cs = possible_cpus->cpus[num].cpu;
-        if (cs == NULL) {
-            continue;
-        }
-
-        nodename = g_strdup_printf("/cpus/cpu@%d", num);
-        if (ms->smp.threads > 1) {
-            map_path = g_strdup_printf(
-                "/cpus/cpu-map/socket%d/core%d/thread%d",
-                num / (ms->smp.cores * ms->smp.threads),
-                (num / ms->smp.threads) % ms->smp.cores,
-                num % ms->smp.threads);
-        } else {
-            map_path = g_strdup_printf(
-                "/cpus/cpu-map/socket%d/core%d",
-                num / ms->smp.cores,
-                num % ms->smp.cores);
-        }
-        qemu_fdt_add_path(ms->fdt, map_path);
-        qemu_fdt_setprop_phandle(ms->fdt, map_path, "cpu", nodename);
-
-        g_free(map_path);
-        g_free(nodename);
-    }
-}
-
-static void fdt_add_fw_cfg_node(const LoongArchVirtMachineState *lvms)
-{
-    char *nodename;
-    hwaddr base = VIRT_FWCFG_BASE;
-    const MachineState *ms = MACHINE(lvms);
-
-    nodename = g_strdup_printf("/fw_cfg@%" PRIx64, base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_string(ms->fdt, nodename,
-                            "compatible", "qemu,fw-cfg-mmio");
-    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
-                                 2, base, 2, 0x18);
-    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
-    g_free(nodename);
-}
-
-static void fdt_add_pcie_irq_map_node(const LoongArchVirtMachineState *lvms,
-                                      char *nodename,
-                                      uint32_t *pch_pic_phandle)
-{
-    int pin, dev;
-    uint32_t irq_map_stride = 0;
-    uint32_t full_irq_map[PCI_NUM_PINS * PCI_NUM_PINS * 10] = {};
-    uint32_t *irq_map = full_irq_map;
-    const MachineState *ms = MACHINE(lvms);
-
-    /* This code creates a standard swizzle of interrupts such that
-     * each device's first interrupt is based on it's PCI_SLOT number.
-     * (See pci_swizzle_map_irq_fn())
-     *
-     * We only need one entry per interrupt in the table (not one per
-     * possible slot) seeing the interrupt-map-mask will allow the table
-     * to wrap to any number of devices.
-     */
-
-    for (dev = 0; dev < PCI_NUM_PINS; dev++) {
-        int devfn = dev * 0x8;
-
-        for (pin = 0; pin < PCI_NUM_PINS; pin++) {
-            int irq_nr = 16 + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
-            int i = 0;
-
-            /* Fill PCI address cells */
-            irq_map[i] = cpu_to_be32(devfn << 8);
-            i += 3;
-
-            /* Fill PCI Interrupt cells */
-            irq_map[i] = cpu_to_be32(pin + 1);
-            i += 1;
-
-            /* Fill interrupt controller phandle and cells */
-            irq_map[i++] = cpu_to_be32(*pch_pic_phandle);
-            irq_map[i++] = cpu_to_be32(irq_nr);
-
-            if (!irq_map_stride) {
-                irq_map_stride = i;
-            }
-            irq_map += irq_map_stride;
-        }
-    }
-
-
-    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-map", full_irq_map,
-                     PCI_NUM_PINS * PCI_NUM_PINS *
-                     irq_map_stride * sizeof(uint32_t));
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupt-map-mask",
-                     0x1800, 0, 0, 0x7);
-}
-
-static void fdt_add_pcie_node(const LoongArchVirtMachineState *lvms,
-                              uint32_t *pch_pic_phandle,
-                              uint32_t *pch_msi_phandle)
-{
-    char *nodename;
-    hwaddr base_mmio = VIRT_PCI_MEM_BASE;
-    hwaddr size_mmio = VIRT_PCI_MEM_SIZE;
-    hwaddr base_pio = VIRT_PCI_IO_BASE;
-    hwaddr size_pio = VIRT_PCI_IO_SIZE;
-    hwaddr base_pcie = VIRT_PCI_CFG_BASE;
-    hwaddr size_pcie = VIRT_PCI_CFG_SIZE;
-    hwaddr base = base_pcie;
-
-    const MachineState *ms = MACHINE(lvms);
-
-    nodename = g_strdup_printf("/pcie@%" PRIx64, base);
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_string(ms->fdt, nodename,
-                            "compatible", "pci-host-ecam-generic");
-    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "pci");
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "#address-cells", 3);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "#size-cells", 2);
-    qemu_fdt_setprop_cell(ms->fdt, nodename, "linux,pci-domain", 0);
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "bus-range", 0,
-                           PCIE_MMCFG_BUS(VIRT_PCI_CFG_SIZE - 1));
-    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
-    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
-                                 2, base_pcie, 2, size_pcie);
-    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "ranges",
-                                 1, FDT_PCI_RANGE_IOPORT, 2, VIRT_PCI_IO_OFFSET,
-                                 2, base_pio, 2, size_pio,
-                                 1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
-                                 2, base_mmio, 2, size_mmio);
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "msi-map",
-                           0, *pch_msi_phandle, 0, 0x10000);
-
-    fdt_add_pcie_irq_map_node(lvms, nodename, pch_pic_phandle);
-
-    g_free(nodename);
-}
-
-static void fdt_add_memory_node(MachineState *ms,
-                                uint64_t base, uint64_t size, int node_id)
-{
-    char *nodename = g_strdup_printf("/memory@%" PRIx64, base);
-
-    qemu_fdt_add_subnode(ms->fdt, nodename);
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "reg", base >> 32, base,
-                           size >> 32, size);
-    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "memory");
-
-    if (ms->numa_state && ms->numa_state->num_nodes) {
-        qemu_fdt_setprop_cell(ms->fdt, nodename, "numa-node-id", node_id);
-    }
-
-    g_free(nodename);
-}
-
-static void fdt_add_memory_nodes(MachineState *ms)
-{
-    hwaddr base, size, ram_size, gap;
-    int i, nb_numa_nodes, nodes;
-    NodeInfo *numa_info;
-
-    ram_size = ms->ram_size;
-    base = VIRT_LOWMEM_BASE;
-    gap = VIRT_LOWMEM_SIZE;
-    nodes = nb_numa_nodes = ms->numa_state->num_nodes;
-    numa_info = ms->numa_state->nodes;
-    if (!nodes) {
-        nodes = 1;
-    }
-
-    for (i = 0; i < nodes; i++) {
-        if (nb_numa_nodes) {
-            size = numa_info[i].node_mem;
-        } else {
-            size = ram_size;
-        }
-
-        /*
-         * memory for the node splited into two part
-         *   lowram:  [base, +gap)
-         *   highram: [VIRT_HIGHMEM_BASE, +(len - gap))
-         */
-        if (size >= gap) {
-            fdt_add_memory_node(ms, base, gap, i);
-            size -= gap;
-            base = VIRT_HIGHMEM_BASE;
-            gap = ram_size - VIRT_LOWMEM_SIZE;
-        }
-
-        if (size) {
-            fdt_add_memory_node(ms, base, size, i);
-            base += size;
-            gap -= size;
-        }
-    }
-}
-
 static void virt_build_smbios(LoongArchVirtMachineState *lvms)
 {
     MachineState *ms = MACHINE(lvms);
@@ -XXX,XX +XXX,XX @@ static void virt_build_smbios(LoongArchVirtMachineState *lvms)
     }
 }
 
-static void virt_fdt_setup(LoongArchVirtMachineState *lvms)
-{
-    MachineState *machine = MACHINE(lvms);
-    uint32_t cpuintc_phandle, eiointc_phandle, pch_pic_phandle, pch_msi_phandle;
-    int i;
-
-    create_fdt(lvms);
-    fdt_add_cpu_nodes(lvms);
-    fdt_add_memory_nodes(machine);
-    fdt_add_fw_cfg_node(lvms);
-    fdt_add_flash_node(lvms);
-
-    /* Add cpu interrupt-controller */
-    fdt_add_cpuic_node(lvms, &cpuintc_phandle);
-    /* Add Extend I/O Interrupt Controller node */
-    fdt_add_eiointc_node(lvms, &cpuintc_phandle, &eiointc_phandle);
-    /* Add PCH PIC node */
-    fdt_add_pch_pic_node(lvms, &eiointc_phandle, &pch_pic_phandle);
-    /* Add PCH MSI node */
-    fdt_add_pch_msi_node(lvms, &eiointc_phandle, &pch_msi_phandle);
-    /* Add pcie node */
-    fdt_add_pcie_node(lvms, &pch_pic_phandle, &pch_msi_phandle);
-
-    /*
-     * Create uart fdt node in reverse order so that they appear
-     * in the finished device tree lowest address first
-     */
-    for (i = VIRT_UART_COUNT; i-- > 0;) {
-        hwaddr base = VIRT_UART_BASE + i * VIRT_UART_SIZE;
-        int irq = VIRT_UART_IRQ + i - VIRT_GSI_BASE;
-        fdt_add_uart_node(lvms, &pch_pic_phandle, base, irq, i == 0);
-    }
-
-    fdt_add_rtc_node(lvms, &pch_pic_phandle);
-    fdt_add_ged_reset(lvms);
-    platform_bus_add_all_fdt_nodes(machine->fdt, "/platic",
-                                   VIRT_PLATFORM_BUS_BASEADDRESS,
-                                   VIRT_PLATFORM_BUS_SIZE,
-                                   VIRT_PLATFORM_BUS_IRQ);
-
-    /*
-     * Since lowmem region starts from 0 and Linux kernel legacy start address
-     * at 2 MiB, FDT base address is located at 1 MiB to avoid NULL pointer
-     * access. FDT size limit with 1 MiB.
-     * Put the FDT into the memory map as a ROM image: this will ensure
-     * the FDT is copied again upon reset, even if addr points into RAM.
-     */
-    qemu_fdt_dumpdtb(machine->fdt, lvms->fdt_size);
-    rom_add_blob_fixed_as("fdt", machine->fdt, lvms->fdt_size, FDT_BASE,
-                          &address_space_memory);
-    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
-            rom_ptr_for_as(&address_space_memory, FDT_BASE, lvms->fdt_size));
-}
-
 static void virt_done(Notifier *notifier, void *data)
 {
     LoongArchVirtMachineState *lvms = container_of(notifier,
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -XXX,XX +XXX,XX @@ struct LoongArchVirtMachineState {
 #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
 OBJECT_DECLARE_SIMPLE_TYPE(LoongArchVirtMachineState, LOONGARCH_VIRT_MACHINE)
 void virt_acpi_setup(LoongArchVirtMachineState *lvms);
+void virt_fdt_setup(LoongArchVirtMachineState *lvms);
 #endif
-- 
2.43.5

There is only one iocsr address space for the whole virt-machine
board. When CPU is created, the one of percpu points to that of
the board.

Here set iocsr address space when CPU is created rather than IPI
creation stage.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 hw/loongarch/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
         cpudev = DEVICE(cpu_state);
         lacpu = LOONGARCH_CPU(cpu_state);
         env = &(lacpu->env);
-        env->address_space_iocsr = &lvms->as_iocsr;
 
         /* connect ipi irq to cpu irq */
         qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
         machine->possible_cpus->cpus[i].cpu = cpu;
         lacpu = LOONGARCH_CPU(cpu);
         lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
+        lacpu->env.address_space_iocsr = &lvms->as_iocsr;
     }
     fw_cfg_add_memory(machine);
 
-- 
2.43.5

Field ipistate in LoongArch CPU object is not used any more,
remove it here.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 hw/loongarch/virt.c    | 5 -----
 target/loongarch/cpu.h | 2 --
 2 files changed, 7 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     DeviceState *pch_pic, *pch_msi, *cpudev;
     DeviceState *ipi, *extioi;
     SysBusDevice *d;
-    LoongArchCPU *lacpu;
-    CPULoongArchState *env;
     CPUState *cpu_state;
     int cpu, pin, i, start, num;
 
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         cpu_state = qemu_get_cpu(cpu);
         cpudev = DEVICE(cpu_state);
-        lacpu = LOONGARCH_CPU(cpu_state);
-        env = &(lacpu->env);
 
         /* connect ipi irq to cpu irq */
         qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
-        env->ipistate = ipi;
     }
 
     /* Create EXTIOI device */
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     bool load_elf;
     uint64_t elf_address;
     uint32_t mp_state;
-    /* Store ipistate to access from this struct */
-    DeviceState *ipistate;
 
     struct loongarch_boot_info *boot_info;
 #endif
-- 
2.43.5

Interrupt controller extioi and ipi connect to CPU with irq line method.
With command -smp x, -device la464-loongarch-cpu, smp.cpus is not
accurate for all possible CPU objects, possible_cpu_arch_ids() is used.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 hw/loongarch/virt.c         | 60 ++++++++++++++++++++++---------------
 include/hw/loongarch/virt.h |  2 ++
 2 files changed, 38 insertions(+), 24 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_devices_init(DeviceState *pch_pic,
     lvms->platform_bus_dev = create_platform_bus(pch_pic);
 }
 
-static void virt_irq_init(LoongArchVirtMachineState *lvms)
+static void virt_cpu_irq_init(LoongArchVirtMachineState *lvms)
 {
+    int num, pin;
     MachineState *ms = MACHINE(lvms);
-    DeviceState *pch_pic, *pch_msi, *cpudev;
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+    const CPUArchIdList *possible_cpus;
+    CPUState *cs;
+
+    /* cpu nodes */
+    possible_cpus = mc->possible_cpu_arch_ids(ms);
+    for (num = 0; num < possible_cpus->len; num++) {
+        cs = possible_cpus->cpus[num].cpu;
+        if (cs == NULL) {
+            continue;
+        }
+
+        /* connect ipi irq to cpu irq */
+        qdev_connect_gpio_out(lvms->ipi, num,
+                              qdev_get_gpio_in(DEVICE(cs), IRQ_IPI));
+
+        /*
+         * connect ext irq to the cpu irq
+         * cpu_pin[9:2] <= intc_pin[7:0]
+         */
+        for (pin = 0; pin < LS3A_INTC_IP; pin++) {
+            qdev_connect_gpio_out(lvms->extioi, (num * LS3A_INTC_IP + pin),
+                                  qdev_get_gpio_in(DEVICE(cs), pin + 2));
+        }
+    }
+}
+
+static void virt_irq_init(LoongArchVirtMachineState *lvms)
+{
+    DeviceState *pch_pic, *pch_msi;
     DeviceState *ipi, *extioi;
     SysBusDevice *d;
-    CPUState *cpu_state;
-    int cpu, pin, i, start, num;
+    int i, start, num;
 
     /*
      * Extended IRQ model.
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
 
     /* Create IPI device */
     ipi = qdev_new(TYPE_LOONGARCH_IPI);
+    lvms->ipi = ipi;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(ipi), &error_fatal);
 
     /* IPI iocsr memory region */
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     memory_region_add_subregion(&lvms->system_iocsr, MAIL_SEND_ADDR,
                    sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 1));
 
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        cpu_state = qemu_get_cpu(cpu);
-        cpudev = DEVICE(cpu_state);
-
-        /* connect ipi irq to cpu irq */
-        qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
-    }
-
     /* Create EXTIOI device */
     extioi = qdev_new(TYPE_LOONGARCH_EXTIOI);
+    lvms->extioi = extioi;
     if (virt_is_veiointc_enabled(lvms)) {
         qdev_prop_set_bit(extioi, "has-virtualization-extension", true);
     }
@@ -XXX,XX +XXX,XX @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
                     sysbus_mmio_get_region(SYS_BUS_DEVICE(extioi), 1));
     }
 
-    /*
-     * connect ext irq to the cpu irq
-     * cpu_pin[9:2] <= intc_pin[7:0]
-     */
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        cpudev = DEVICE(qemu_get_cpu(cpu));
-        for (pin = 0; pin < LS3A_INTC_IP; pin++) {
-            qdev_connect_gpio_out(extioi, (cpu * 8 + pin),
-                                  qdev_get_gpio_in(cpudev, pin + 2));
-        }
-    }
-
+    virt_cpu_irq_init(lvms);
     pch_pic = qdev_new(TYPE_LOONGARCH_PIC);
     num = VIRT_PCH_PIC_IRQ_NUM;
     qdev_prop_set_uint32(pch_pic, "pch_pic_irq_num", num);
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -XXX,XX +XXX,XX @@ struct LoongArchVirtMachineState {
     MemoryRegion iocsr_mem;
     AddressSpace as_iocsr;
     struct loongarch_boot_info bootinfo;
+    DeviceState *ipi;
+    DeviceState *extioi;
 };
 
 #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
-- 
2.43.5