[PATCH v5 00/26] Introduce enablemenant of dom0less

[PATCH v5 00/26] Introduce enablemenant of dom0less

[Oleksii Kurochko]

This patch series reprensent a bunch of patches necessary to enable common part
of Dom0less.
The stuff necessary to start/launch domains will be introduced separately.

CI tests: https://gitlab.com/xen-project/people/olkur/xen/-/pipelines/2654761158

---
Changes in v5:
 - Add new patch (xen/riscv: do a 4th linking pass if necessary) which fixes
   randconfig job issue.
 - Address comments from ML.
---
Changes in v4:
 - Address comments from ML.
---
Changes in v3:
 - Drop dependency from other patch series
   ([1] https://lore.kernel.org/xen-devel/cover.1778140240.git.oleksii.kurochko@gmail.com/T/#t)
   as it was merged.
 - Reorder patches:
   - move common patches to the start.
   - Move some patches to separate patch series (will be introduced later)
 - Address comments from ML.
---
Changes in v2:
 - Move patch "[PATCH v1 04/27] xen/riscv: rework G-stage mode handling" to
   patch series [1]
 - Address the comments from ML.
 - The following patches were folded into one:
   # xen/riscv: implement init_intc_phandle()
   # xen/riscv: call do_initcalls() in start_xen()
   # xen/riscv: setup system domains
 - The following patch were folded into one:
   # xen/riscv: add vaplic access check
   # xen/riscv: emulate guest writes to virtual APLIC MMIO
   # xen/riscv: emulate guest reads from virtual APLIC MMIO
 - Add new bug fix, not really necessary to this patch series:
   xen/riscv: manage IRQ_DISABLED flag in APLIC irq enable/disable callbacks
---

Oleksii Kurochko (26):
  xen/dom0less: turn max_init_domid into a common variable
  xen: arm: move declaration of map_device_irqs_to_domain() to common
    header
  xen: arm: update p2m_set_allocation() prototype
  xen/Kconfig: introduce HAS_STATIC_MEMORY
  xen/riscv: rename enum intc_version to intc_variant
  xen/riscv: Implement ARCH_PAGING_MEMPOOL
  xen/riscv: Implement construct_domain()
  xen/riscv: implement prerequisites for domain_create()
  xen/riscv: introduce guest riscv,isa string
  xen/riscv: implement make_cpus_node()
  xen/riscv: implement make_timer_node()
  xen/riscv: implement make_arch_nodes()
  xen/riscv: introduce init interrupt controller operations
  xen/riscv: implement make_intc_domU_node()
  xen/riscv: introduce aia_init() and aia_usable()
  xen/riscv: introduce per-vCPU IMSIC state
  xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure
  xen/riscv: introduce (de)initialization helpers for vINTC
  xen/riscv: generate IMSIC DT node for guest domains
  xen/riscv: create APLIC DT node for guest domains
  xen/riscv: implement IRQ routing for device passthrough
  xen/riscv: implement init_intc_phandle()
  xen/riscv: initialize RCU, scheduler, and system domains in
    start_xen()
  xen/riscv: provide init_vuart()
  xen/riscv: add initial dom0less infrastructure support
  xen/riscv: do a 4th linking pass if necessary

 build/tools/fixdep                        | Bin 0 -> 13632 bytes
 xen/arch/arm/Kconfig                      |   1 +
 xen/arch/arm/device.c                     |   9 +-
 xen/arch/arm/include/asm/p2m.h            |   1 -
 xen/arch/arm/include/asm/setup.h          |   5 -
 xen/arch/arm/mmu/p2m.c                    |  24 +--
 xen/arch/arm/setup.c                      |   2 -
 xen/arch/ppc/include/asm/setup.h          |   2 -
 xen/arch/riscv/Kconfig                    |   3 +
 xen/arch/riscv/Makefile                   |  20 +-
 xen/arch/riscv/aia.c                      |  23 +++
 xen/arch/riscv/aplic-priv.h               |  14 ++
 xen/arch/riscv/aplic.c                    |  16 +-
 xen/arch/riscv/cpufeature.c               | 132 +++++++++---
 xen/arch/riscv/device.c                   |  94 +++++++++
 xen/arch/riscv/dom0less-build.c           |  40 ++++
 xen/arch/riscv/domain-build.c             | 211 +++++++++++++++++++
 xen/arch/riscv/domain.c                   |  45 +++-
 xen/arch/riscv/imsic.c                    | 179 +++++++++++++++-
 xen/arch/riscv/include/asm/aia.h          |  10 +
 xen/arch/riscv/include/asm/aplic.h        |  10 +
 xen/arch/riscv/include/asm/cpufeature.h   |   6 +
 xen/arch/riscv/include/asm/domain.h       |   7 +
 xen/arch/riscv/include/asm/guest-layout.h |  24 +++
 xen/arch/riscv/include/asm/imsic.h        |  25 +++
 xen/arch/riscv/include/asm/intc.h         |  48 ++++-
 xen/arch/riscv/include/asm/irq.h          |   5 +
 xen/arch/riscv/include/asm/paging.h       |   2 +-
 xen/arch/riscv/include/asm/setup.h        |   2 -
 xen/arch/riscv/include/asm/vaplic.h       |  34 ++++
 xen/arch/riscv/intc.c                     | 102 +++++++++-
 xen/arch/riscv/irq.c                      | 238 ++++++++++++++++++++++
 xen/arch/riscv/p2m.c                      |  33 ++-
 xen/arch/riscv/paging.c                   |   7 +-
 xen/arch/riscv/setup.c                    |  12 ++
 xen/arch/riscv/stubs.c                    |  17 --
 xen/arch/riscv/vaplic.c                   | 142 +++++++++++++
 xen/arch/x86/include/asm/setup.h          |   2 -
 xen/common/Kconfig                        |   4 +
 xen/common/device-tree/dom0less-build.c   |   2 +-
 xen/common/domid.c                        |   5 +
 xen/drivers/char/console.c                |   1 +
 xen/include/xen/dom0less-build.h          |   7 +
 xen/include/xen/fdt-domain-build.h        |  13 ++
 xen/include/xen/p2m-common.h              |   8 +
 45 files changed, 1470 insertions(+), 117 deletions(-)
 create mode 100755 build/tools/fixdep
 create mode 100644 xen/arch/riscv/aia.c
 create mode 100644 xen/arch/riscv/device.c
 create mode 100644 xen/arch/riscv/domain-build.c
 create mode 100644 xen/arch/riscv/include/asm/aia.h
 create mode 100644 xen/arch/riscv/include/asm/vaplic.h
 create mode 100644 xen/arch/riscv/vaplic.c

-- 
2.54.0

[PATCH v5 01/26] xen/dom0less: turn max_init_domid into a common variable

[Oleksii Kurochko]

Until now every architecture carried its own notion of max_init_domid:
Arm defined a real variable (declared in asm/setup.h, defined in
setup.c), while ppc, riscv and x86 each provided a "#define
max_init_domid (0)" stub in their asm/setup.h. This duplicated the same
declaration across all arches and placed a purely dom0less concept in
arch setup headers.

Now that the dom0less build code lives in common (xen/common/
device-tree/dom0less-build.c sets max_init_domid, and the console
serial-input switcher reads it), there is no reason for the symbol to be
per-arch. Provide a single declaration in <xen/dom0less-build.h>, with
the !CONFIG_DOM0LESS_BOOT stub kept there as well, so there is one source
of truth and the arch headers no longer need to mention it. Update
console.c to include <xen/dom0less-build.h> for the declaration instead
of relying on asm/setup.h.

Place the definition in xen/common/domid.c rather than in dom0less-
build.c. The latter is built as dom0less-build.init.o, i.e. the whole
object is relocated into the .init.* sections and freed after boot,
whereas max_init_domid must outlive boot because it is read at runtime
by the console serial-input switcher. domid.c is always linked (obj-y)
and resides in regular (non-init) sections, so it is a correct home for
the variable. It is marked __ro_after_init since it is only updated
while creating boot-time domains and read-only afterwards, and guarded
by CONFIG_DOM0LESS_BOOT as domid.c itself is unconditional.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Add Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v4:
 - New patch.
---
---
 xen/arch/arm/include/asm/setup.h   | 2 --
 xen/arch/arm/setup.c               | 2 --
 xen/arch/ppc/include/asm/setup.h   | 2 --
 xen/arch/riscv/include/asm/setup.h | 2 --
 xen/arch/x86/include/asm/setup.h   | 2 --
 xen/common/domid.c                 | 5 +++++
 xen/drivers/char/console.c         | 1 +
 xen/include/xen/dom0less-build.h   | 7 +++++++
 8 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/xen/arch/arm/include/asm/setup.h b/xen/arch/arm/include/asm/setup.h
index 0d29b46ea52b..14fa92d5c1db 100644
--- a/xen/arch/arm/include/asm/setup.h
+++ b/xen/arch/arm/include/asm/setup.h
@@ -25,8 +25,6 @@ struct map_range_data
     struct rangeset *irq_ranges;
 };
 
-extern domid_t max_init_domid;
-
 void copy_from_paddr(void *dst, paddr_t paddr, unsigned long len);
 
 size_t estimate_efi_size(unsigned int mem_nr_banks);
diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c
index 6310a47d68b6..86532d0a35b6 100644
--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -62,8 +62,6 @@ struct cpuinfo_arm __read_mostly system_cpuinfo;
 bool __read_mostly acpi_disabled;
 #endif
 
-domid_t __read_mostly max_init_domid;
-
 static __used void noreturn init_done(void)
 {
     /* Must be done past setting system_state. */
diff --git a/xen/arch/ppc/include/asm/setup.h b/xen/arch/ppc/include/asm/setup.h
index e4f64879b68c..956fa6985adb 100644
--- a/xen/arch/ppc/include/asm/setup.h
+++ b/xen/arch/ppc/include/asm/setup.h
@@ -1,6 +1,4 @@
 #ifndef __ASM_PPC_SETUP_H__
 #define __ASM_PPC_SETUP_H__
 
-#define max_init_domid (0)
-
 #endif /* __ASM_PPC_SETUP_H__ */
diff --git a/xen/arch/riscv/include/asm/setup.h b/xen/arch/riscv/include/asm/setup.h
index 2215894cfbb1..73ce2f293348 100644
--- a/xen/arch/riscv/include/asm/setup.h
+++ b/xen/arch/riscv/include/asm/setup.h
@@ -5,8 +5,6 @@
 
 #include <xen/types.h>
 
-#define max_init_domid (0)
-
 void setup_mm(void);
 
 void copy_from_paddr(void *dst, paddr_t paddr, unsigned long len);
diff --git a/xen/arch/x86/include/asm/setup.h b/xen/arch/x86/include/asm/setup.h
index b01e83a8ed9f..5925c5f39cff 100644
--- a/xen/arch/x86/include/asm/setup.h
+++ b/xen/arch/x86/include/asm/setup.h
@@ -68,6 +68,4 @@ extern bool opt_dom0_verbose;
 extern bool opt_dom0_cpuid_faulting;
 extern bool opt_dom0_msr_relaxed;
 
-#define max_init_domid (0)
-
 #endif
diff --git a/xen/common/domid.c b/xen/common/domid.c
index b0258e477c1a..cd46cf952be6 100644
--- a/xen/common/domid.c
+++ b/xen/common/domid.c
@@ -9,6 +9,11 @@
  */
 
 #include <xen/domain.h>
+#include <xen/dom0less-build.h>
+
+#ifdef CONFIG_DOM0LESS_BOOT
+domid_t __ro_after_init max_init_domid;
+#endif
 
 static DEFINE_SPINLOCK(domid_lock);
 static DECLARE_BITMAP(domid_bitmap, DOMID_FIRST_RESERVED);
diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index bcd6d261491b..4c09f4c7a984 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -31,6 +31,7 @@
 #include <xen/warning.h>
 #include <xen/pv_console.h>
 #include <asm/setup.h>
+#include <xen/dom0less-build.h>
 #include <xen/sections.h>
 #include <xen/consoled.h>
 
diff --git a/xen/include/xen/dom0less-build.h b/xen/include/xen/dom0less-build.h
index 4118dec76c0a..8d4da16d1f0a 100644
--- a/xen/include/xen/dom0less-build.h
+++ b/xen/include/xen/dom0less-build.h
@@ -5,6 +5,8 @@
 
 #include <xen/stdbool.h>
 
+#include <public/xen.h>
+
 struct domain;
 
 #ifdef CONFIG_DOM0LESS_BOOT
@@ -13,6 +15,9 @@ struct boot_domain;
 struct dt_device_node;
 struct kernel_info;
 
+/* Highest domain ID assigned to a boot-time (dom0less) domain. */
+extern domid_t max_init_domid;
+
 /*
  * List of possible features for dom0less domUs
  *
@@ -72,6 +77,8 @@ static inline bool is_dom0less_mode(void)
 }
 static inline void set_xs_domain(struct domain *d) {}
 
+#define max_init_domid 0
+
 #endif /* CONFIG_DOM0LESS_BOOT */
 
 #endif /* __ASM_GENERIC_DOM0LESS_BUILD_H__ */
-- 
2.54.0

[PATCH v5 02/26] xen: arm: move declaration of map_device_irqs_to_domain() to common header

[Oleksii Kurochko]

As map_device_irqs_to_domain() is used unconditionally by common part of
dom0less code, move the prototype to a common header.

fdt-domain-build.h is chosen as map_device_irqs_to_domain() could be
also called indirectly in Arm's DOM0-related code and DT overlay feature.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
Changes in v5:
 - Add Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
Changes in v4:
 - Reword commit message: use imperative mood ("move the prototype") and
   mention the DT overlay feature alongside Arm's DOM0-related code.
 - Add #include <xen/fdt-domain-build.h> to Arm's device.c so the definition
   site sees the prototype.
 - Drop the duplicated function description above the definition in device.c
   (it now lives only on the prototype in fdt-domain-build.h).
---
Changes in v3:
 - Add tag arm and move this patch earlier before RISC-V-related patches.
---
Changes in v2:
 - New patch.
---
---
 xen/arch/arm/device.c              |  9 +--------
 xen/arch/arm/include/asm/setup.h   |  3 ---
 xen/include/xen/fdt-domain-build.h | 13 +++++++++++++
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/xen/arch/arm/device.c b/xen/arch/arm/device.c
index 7d9644fd8b6d..b11366d722ef 100644
--- a/xen/arch/arm/device.c
+++ b/xen/arch/arm/device.c
@@ -11,6 +11,7 @@
 #include <xen/device_tree.h>
 #include <xen/dt-overlay.h>
 #include <xen/errno.h>
+#include <xen/fdt-domain-build.h>
 #include <xen/iocap.h>
 #include <xen/lib.h>
 
@@ -117,14 +118,6 @@ int __overlay_init map_range_to_domain(const struct dt_device_node *dev,
     return 0;
 }
 
-/*
- * map_device_irqs_to_domain retrieves the interrupts configuration from
- * a device tree node and maps those interrupts to the target domain.
- *
- * Returns:
- *   < 0 error
- *   0   success
- */
 int __overlay_init map_device_irqs_to_domain(struct domain *d,
                                              struct dt_device_node *dev,
                                              bool need_mapping,
diff --git a/xen/arch/arm/include/asm/setup.h b/xen/arch/arm/include/asm/setup.h
index 14fa92d5c1db..2af780512540 100644
--- a/xen/arch/arm/include/asm/setup.h
+++ b/xen/arch/arm/include/asm/setup.h
@@ -51,9 +51,6 @@ void init_traps(void);
 int handle_device(struct domain *d, struct dt_device_node *dev, p2m_type_t p2mt,
                   struct rangeset *iomem_ranges, struct rangeset *irq_ranges);
 
-int map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev,
-                              bool need_mapping, struct rangeset *irq_ranges);
-
 int map_irq_to_domain(struct domain *d, unsigned int irq,
                       bool need_mapping, const char *devname);
 
diff --git a/xen/include/xen/fdt-domain-build.h b/xen/include/xen/fdt-domain-build.h
index 671486c1c837..8612e98dfda5 100644
--- a/xen/include/xen/fdt-domain-build.h
+++ b/xen/include/xen/fdt-domain-build.h
@@ -12,6 +12,7 @@
 
 struct domain;
 struct page_info;
+struct rangeset;
 struct membanks;
 
 typedef bool (*alloc_domheap_mem_cb)(struct domain *d, struct page_info *pg,
@@ -79,6 +80,18 @@ static inline void set_domain_type(struct domain *d, const struct kernel_info *k
 #endif
 }
 
+/*
+ * Retrieves the interrupts configuration from a device tree node and maps
+ * those interrupts to the target domain.
+ *
+ * Returns:
+ *   < 0 error
+ *   0   success
+ */
+int map_device_irqs_to_domain(struct domain *d, struct dt_device_node *dev,
+                              bool need_mapping,
+                              struct rangeset *irq_ranges);
+
 #endif /* __XEN_FDT_DOMAIN_BUILD_H__ */
 
 /*
-- 
2.54.0

[PATCH v5 03/26] xen: arm: update p2m_set_allocation() prototype

[Oleksii Kurochko]

p2m_set_allocation() uses a bool *preempted out-argument that overloads two
meanings. When non-NULL, the value written back (true) duplicates information
already carried by the -ERESTART return code — pure redundancy, which the
caller-side ASSERT(preempted == (rc == -ERESTART)) only documents. Separately,
a NULL pointer is an implicit calling convention meaning "preemption is not
permitted in this context".

Replace the pointer with a plain bool can_preempt that explicitly controls
whether the preemption check runs, making the NULL-to-suppress convention
type-safe and self-documenting, and rely on the -ERESTART return code alone to
report that preemption occurred.

Since p2m_set_allocation() is called by the common dom0less build code,
move its declaration from the ARM-specific asm/p2m.h to xen/p2m-common.h.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
Changes in v5:
 - Add Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
Changes in v4:
 - Reword commit message: a NULL pointer was a calling convention meaning
   "preemption not permitted", not pure redundancy.
 - Annotate the explicit can_preempt arguments at the call sites with
   /* can_preempt */ comments for readability.
 - Move the function's doc comment to the prototype in xen/p2m-common.h
   (dropping the duplicate above the Arm and RISC-V definitions) and clarify
   that -ERESTART is only returned when can_preempt is true.
 - Add __must_check to the prototype, since the return code is now the only
   preemption-status indicator.
---
Changes in v3:
 - Nothing changed. Only rebase.
---
Changes in v2:
 - new patch
---
---
 xen/arch/arm/include/asm/p2m.h          |  1 -
 xen/arch/arm/mmu/p2m.c                  | 24 ++++++------------------
 xen/arch/riscv/include/asm/paging.h     |  2 +-
 xen/arch/riscv/p2m.c                    |  9 ++-------
 xen/arch/riscv/paging.c                 |  7 ++-----
 xen/common/device-tree/dom0less-build.c |  2 +-
 xen/include/xen/p2m-common.h            |  8 ++++++++
 7 files changed, 20 insertions(+), 33 deletions(-)

diff --git a/xen/arch/arm/include/asm/p2m.h b/xen/arch/arm/include/asm/p2m.h
index 4a4913716bdd..737da60dcf58 100644
--- a/xen/arch/arm/include/asm/p2m.h
+++ b/xen/arch/arm/include/asm/p2m.h
@@ -238,7 +238,6 @@ void p2m_restore_state(struct vcpu *n);
 /* Print debugging/statistial info about a domain's p2m */
 void p2m_dump_info(struct domain *d);
 
-int p2m_set_allocation(struct domain *d, unsigned long pages, bool *preempted);
 int p2m_teardown_allocation(struct domain *d);
 
 static inline void p2m_write_lock(struct p2m_domain *p2m)
diff --git a/xen/arch/arm/mmu/p2m.c b/xen/arch/arm/mmu/p2m.c
index 51abf3504fcf..2cf35d8a3709 100644
--- a/xen/arch/arm/mmu/p2m.c
+++ b/xen/arch/arm/mmu/p2m.c
@@ -65,12 +65,7 @@ int arch_get_paging_mempool_size(struct domain *d, uint64_t *size)
     return 0;
 }
 
-/*
- * Set the pool of pages to the required number of pages.
- * Returns 0 for success, non-zero for failure.
- * Call with d->arch.paging.lock held.
- */
-int p2m_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
+int p2m_set_allocation(struct domain *d, unsigned long pages, bool can_preempt)
 {
     struct page_info *pg;
 
@@ -112,11 +107,8 @@ int p2m_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
             break;
 
         /* Check to see if we need to yield and try again */
-        if ( preempted && general_preempt_check() )
-        {
-            *preempted = true;
+        if ( can_preempt && general_preempt_check() )
             return -ERESTART;
-        }
     }
 
     return 0;
@@ -125,7 +117,6 @@ int p2m_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
 int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
 {
     unsigned long pages = size >> PAGE_SHIFT;
-    bool preempted = false;
     int rc;
 
     if ( (size & ~PAGE_MASK) ||          /* Non page-sized request? */
@@ -133,27 +124,24 @@ int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
         return -EINVAL;
 
     spin_lock(&d->arch.paging.lock);
-    rc = p2m_set_allocation(d, pages, &preempted);
+    rc = p2m_set_allocation(d, pages, /* can_preempt */ true);
     spin_unlock(&d->arch.paging.lock);
 
-    ASSERT(preempted == (rc == -ERESTART));
-
     return rc;
 }
 
 int p2m_teardown_allocation(struct domain *d)
 {
     int ret = 0;
-    bool preempted = false;
 
     spin_lock(&d->arch.paging.lock);
     if ( d->arch.paging.p2m_total_pages != 0 )
     {
-        ret = p2m_set_allocation(d, 0, &preempted);
-        if ( preempted )
+        ret = p2m_set_allocation(d, 0, /* can_preempt */ true);
+        if ( ret == -ERESTART )
         {
             spin_unlock(&d->arch.paging.lock);
-            return -ERESTART;
+            return ret;
         }
         ASSERT(d->arch.paging.p2m_total_pages == 0);
     }
diff --git a/xen/arch/riscv/include/asm/paging.h b/xen/arch/riscv/include/asm/paging.h
index e487c89a4ccd..103384723dc5 100644
--- a/xen/arch/riscv/include/asm/paging.h
+++ b/xen/arch/riscv/include/asm/paging.h
@@ -9,7 +9,7 @@ struct page_info;
 int paging_domain_init(struct domain *d);
 
 int paging_freelist_adjust(struct domain *d, unsigned long pages,
-                           bool *preempted);
+                           bool can_preempt);
 
 int paging_ret_to_domheap(struct domain *d, unsigned int nr_pages);
 int paging_refill_from_domheap(struct domain *d, unsigned int nr_pages);
diff --git a/xen/arch/riscv/p2m.c b/xen/arch/riscv/p2m.c
index 703b9f4d2540..566266e3e78f 100644
--- a/xen/arch/riscv/p2m.c
+++ b/xen/arch/riscv/p2m.c
@@ -428,17 +428,12 @@ int p2m_init(struct domain *d, const struct xen_domctl_createdomain *config)
     return 0;
 }
 
-/*
- * Set the pool of pages to the required number of pages.
- * Returns 0 for success, non-zero for failure.
- * Call with d->arch.paging.lock held.
- */
-int p2m_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
+int p2m_set_allocation(struct domain *d, unsigned long pages, bool can_preempt)
 {
     struct p2m_domain *p2m = p2m_get_hostp2m(d);
     int rc;
 
-    if ( (rc = paging_freelist_adjust(d, pages, preempted)) )
+    if ( (rc = paging_freelist_adjust(d, pages, can_preempt)) )
         return rc;
 
     /*
diff --git a/xen/arch/riscv/paging.c b/xen/arch/riscv/paging.c
index 76a203edbb0c..35f572689a7c 100644
--- a/xen/arch/riscv/paging.c
+++ b/xen/arch/riscv/paging.c
@@ -47,7 +47,7 @@ static int _paging_add_to_freelist(struct domain *d)
 }
 
 int paging_freelist_adjust(struct domain *d, unsigned long pages,
-                           bool *preempted)
+                           bool can_preempt)
 {
     ASSERT(spin_is_locked(&d->arch.paging.lock));
 
@@ -66,11 +66,8 @@ int paging_freelist_adjust(struct domain *d, unsigned long pages,
             return rc;
 
         /* Check to see if we need to yield and try again */
-        if ( preempted && general_preempt_check() )
-        {
-            *preempted = true;
+        if ( can_preempt && general_preempt_check() )
             return -ERESTART;
-        }
     }
 
     return 0;
diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c
index eacfd93087ae..6f0b574755c5 100644
--- a/xen/common/device-tree/dom0less-build.c
+++ b/xen/common/device-tree/dom0less-build.c
@@ -747,7 +747,7 @@ static int __init domain_p2m_set_allocation(struct domain *d, uint64_t mem,
                 domain_p2m_pages(mem, d->max_vcpus);
 
     spin_lock(&d->arch.paging.lock);
-    rc = p2m_set_allocation(d, p2m_pages, NULL);
+    rc = p2m_set_allocation(d, p2m_pages, /* can_preempt */ false);
     spin_unlock(&d->arch.paging.lock);
 
     return rc;
diff --git a/xen/include/xen/p2m-common.h b/xen/include/xen/p2m-common.h
index f0bd9a6b9896..0eb061991283 100644
--- a/xen/include/xen/p2m-common.h
+++ b/xen/include/xen/p2m-common.h
@@ -43,5 +43,13 @@ int __must_check check_get_page_from_gfn(struct domain *d, gfn_t gfn,
                                          bool readonly, p2m_type_t *p2mt_p,
                                          struct page_info **page_p);
 
+/*
+ * Set the pool of pages to the required number of pages.
+ * Returns 0 for success, -ERESTART if preempted (only when can_preempt is
+ * true), or a negative error code on failure.
+ * Call with d->arch.paging.lock held.
+ */
+int __must_check p2m_set_allocation(struct domain *d, unsigned long pages,
+                                    bool can_preempt);
 
 #endif /* _XEN_P2M_COMMON_H */
-- 
2.54.0

[PATCH v5 04/26] xen/Kconfig: introduce HAS_STATIC_MEMORY

[Oleksii Kurochko]

Introduce HAS_STATIC_MEMORY so that STATIC_MEMORY can be enabled or
disabled on a per-architecture basis. ARM selects the new flag; RISC-V
does not, so CONFIG_STATIC_MEMORY is unavailable on RISC-V and
randconfig builds no longer require an explicit STATIC_MEMORY=n override
to avoid a compilation error.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
Changes in v5:
 - Add R-by: Jan and Michal.
---
Changes in v4:
 - Reword the commit message to explain that HAS_STATIC_MEMORY allows
   STATIC_MEMORY to be {en,dis}abled per-arch, dropping the reference to
   guest_physmap_add_pages().
 - Split the STATIC_MEMORY dependency into two separate "depends on"
   lines.
---
Changes in v3:
 - New patch.
---
---
 xen/arch/arm/Kconfig | 1 +
 xen/common/Kconfig   | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig
index 683ab7d25a1e..d748404e82da 100644
--- a/xen/arch/arm/Kconfig
+++ b/xen/arch/arm/Kconfig
@@ -22,6 +22,7 @@ config ARM
 	select HAS_GRANT_CACHE_FLUSH if GRANT_TABLE
 	select HAS_SHARED_INFO
 	select HAS_STACK_PROTECTOR
+	select HAS_STATIC_MEMORY
 	select HAS_UBSAN
 
 config ARCH_DEFCONFIG
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 8b48d84c79e8..5b289e444fa5 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -161,6 +161,9 @@ config HAS_SCHED_GRANULARITY
 config HAS_SHARED_INFO
 	bool
 
+config HAS_STATIC_MEMORY
+	bool
+
 config HAS_SOFT_RESET
 	bool
 
@@ -196,6 +199,7 @@ config NUMA
 
 config STATIC_MEMORY
 	bool "Static Allocation Support (UNSUPPORTED)" if UNSUPPORTED
+	depends on HAS_STATIC_MEMORY
 	depends on DOM0LESS_BOOT && HAS_DEVICE_TREE_DISCOVERY
 	help
 	  Static Allocation refers to system or sub-system(domains) for
-- 
2.54.0

Re: [PATCH v5 04/26] xen/Kconfig: introduce HAS_STATIC_MEMORY

[Jan Beulich]

On 06.07.2026 17:57, Oleksii Kurochko wrote:
> --- a/xen/arch/arm/Kconfig
> +++ b/xen/arch/arm/Kconfig
> @@ -22,6 +22,7 @@ config ARM
>  	select HAS_GRANT_CACHE_FLUSH if GRANT_TABLE
>  	select HAS_SHARED_INFO
>  	select HAS_STACK_PROTECTOR
> +	select HAS_STATIC_MEMORY
>  	select HAS_UBSAN

Both here and ...

> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -161,6 +161,9 @@ config HAS_SCHED_GRANULARITY
>  config HAS_SHARED_INFO
>  	bool
>  
> +config HAS_STATIC_MEMORY
> +	bool
> +

... here it is clearly visible from context that this patch is assumed
to go on top of "xen: introduce CONFIG_HAS_SHARED_INFO for archs without
a shared page", yet that's not said anywhere. Perhaps that other patch
would better have been part of this series?

Jan

Re: [PATCH v5 04/26] xen/Kconfig: introduce HAS_STATIC_MEMORY

[Oleksii Kurochko]

On 7/7/26 11:52 AM, Jan Beulich wrote:
> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>> --- a/xen/arch/arm/Kconfig
>> +++ b/xen/arch/arm/Kconfig
>> @@ -22,6 +22,7 @@ config ARM
>>   	select HAS_GRANT_CACHE_FLUSH if GRANT_TABLE
>>   	select HAS_SHARED_INFO
>>   	select HAS_STACK_PROTECTOR
>> +	select HAS_STATIC_MEMORY
>>   	select HAS_UBSAN
> 
> Both here and ...
> 
>> --- a/xen/common/Kconfig
>> +++ b/xen/common/Kconfig
>> @@ -161,6 +161,9 @@ config HAS_SCHED_GRANULARITY
>>   config HAS_SHARED_INFO
>>   	bool
>>   
>> +config HAS_STATIC_MEMORY
>> +	bool
>> +
> 
> ... here it is clearly visible from context that this patch is assumed
> to go on top of "xen: introduce CONFIG_HAS_SHARED_INFO for archs without
> a shared page", yet that's not said anywhere. Perhaps that other patch
> would better have been part of this series?

Good point, I think you are right and it would be better to put "xen: 
introduce CONFIG_HAS_SHARED_INFO for archs without a shared page" just 
into this series.
I will do that during preparation of next version of this series.

Thanks.

~ Oleksii

[PATCH v5 05/26] xen/riscv: rename enum intc_version to intc_variant

[Oleksii Kurochko]

Rename the enum to intc_variant and the structure member from hw_version
to hw_variant to better reflect that these values select between
different controller variants, not versions of the same one.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Add Suggested-by and Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v4:
 - New patch. Prereq for the next patch.
---
---
 xen/arch/riscv/aplic.c            | 2 +-
 xen/arch/riscv/include/asm/intc.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c
index 739e8dab3498..6a1255c5f403 100644
--- a/xen/arch/riscv/aplic.c
+++ b/xen/arch/riscv/aplic.c
@@ -35,7 +35,7 @@ static struct aplic_priv aplic = {
 };
 
 static struct intc_info __ro_after_init aplic_info = {
-    .hw_version = INTC_APLIC,
+    .hw_variant = INTC_APLIC,
 };
 
 static void __init aplic_init_hw_interrupts(void)
diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h
index ecdc8a5e6577..675f703ec97f 100644
--- a/xen/arch/riscv/include/asm/intc.h
+++ b/xen/arch/riscv/include/asm/intc.h
@@ -10,7 +10,7 @@
 
 struct dt_device_node;
 
-enum intc_version {
+enum intc_variant {
     INTC_APLIC,
 };
 
@@ -18,7 +18,7 @@ struct cpu_user_regs;
 struct irq_desc;
 
 struct intc_info {
-    enum intc_version hw_version;
+    enum intc_variant hw_variant;
     const struct dt_device_node *node;
 
     /* number of irqs */
-- 
2.54.0

Re: [PATCH v5 05/26] xen/riscv: rename enum intc_version to intc_variant

[Jan Beulich]

On 06.07.2026 17:57, Oleksii Kurochko wrote:
> Rename the enum to intc_variant and the structure member from hw_version
> to hw_variant to better reflect that these values select between
> different controller variants, not versions of the same one.
> 
> Suggested-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
> Acked-by: Jan Beulich <jbeulich@suse.com>

Didn't you say you'd drop this if already committed by the posting of v5?

Jan

Re: [PATCH v5 05/26] xen/riscv: rename enum intc_version to intc_variant

[Oleksii Kurochko]

On 7/6/26 6:05 PM, Jan Beulich wrote:
> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>> Rename the enum to intc_variant and the structure member from hw_version
>> to hw_variant to better reflect that these values select between
>> different controller variants, not versions of the same one.
>>
>> Suggested-by: Jan Beulich <jbeulich@suse.com>
>> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
>> Acked-by: Jan Beulich <jbeulich@suse.com>
> 
> Didn't you say you'd drop this if already committed by the posting of v5?

I just missed doing a proper rebase on top of staging, but I can see 
that this patch is already there.

Sorry for the inconvenience.

~ Oleksii

[PATCH v5 06/26] xen/riscv: Implement ARCH_PAGING_MEMPOOL

[Oleksii Kurochko]

The p2m_freelist is used to allocate pages for the P2M. To initialize
this list, domain_p2m_set_allocation() may be called from construct_domU()
in the common Dom0less code, so RISC-V provides an implementation and
enables CONFIG_ARCH_PAGING_MEMPOOL unconditionally.

Additionally, implement arch_{set,get}_paging_mempool_size(). They are
not directly used yet, but are required to support the
XEN_DOMCTL_{get,set}_paging_mempool_size hypercalls.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v4-v5:
 - Nothing changed. Only rebase.
---
Changes in v3:
 - Drop stray blank space in arch_get_paging_mempool_size().
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v2:
 - Turn on CONFIG_ARCH_PAGING_MEMPOOL=y unconditionally and drop all ifdef-s
   related to this config.
 - Optimize check inside arch_set_paging_mempool_size which verify size
   argument.
 - Use pfn_to_paddr() inside arch_get_paging_mempool_size() instead of open
   coding the stuff.
 - Drop ASSERT() from arch_set_paging_mempool_size() as it is impossible to
   have here preempted = true and rc != -ERESTART.
---
---
 xen/arch/riscv/Kconfig |  1 +
 xen/arch/riscv/p2m.c   | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/xen/arch/riscv/Kconfig b/xen/arch/riscv/Kconfig
index 41426c205292..48520588fe40 100644
--- a/xen/arch/riscv/Kconfig
+++ b/xen/arch/riscv/Kconfig
@@ -1,5 +1,6 @@
 config RISCV
 	def_bool y
+	select ARCH_PAGING_MEMPOOL
 	select DOMAIN_BUILD_HELPERS
 	select FUNCTION_ALIGNMENT_16B
 	select GENERIC_BUG_FRAME
diff --git a/xen/arch/riscv/p2m.c b/xen/arch/riscv/p2m.c
index 566266e3e78f..1cea86512c8c 100644
--- a/xen/arch/riscv/p2m.c
+++ b/xen/arch/riscv/p2m.c
@@ -1600,3 +1600,27 @@ struct page_info *get_page_from_gfn(struct domain *d, unsigned long gfn,
 
     return p2m_get_page_from_gfn(p2m_get_hostp2m(d), _gfn(gfn), t);
 }
+
+int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
+{
+    unsigned long pages = PFN_DOWN(size);
+    int rc;
+
+    /* Non page-sized request or 32-bit overflow? */
+    if ( pfn_to_paddr(pages) != size )
+        return -EINVAL;
+
+    spin_lock(&d->arch.paging.lock);
+    rc = p2m_set_allocation(d, pages, true);
+    spin_unlock(&d->arch.paging.lock);
+
+    return rc;
+}
+
+/* Return the size of the pool, in bytes. */
+int arch_get_paging_mempool_size(struct domain *d, uint64_t *size)
+{
+    *size = pfn_to_paddr(ACCESS_ONCE(d->arch.paging.total_pages));
+
+    return 0;
+}
-- 
2.54.0

[PATCH v5 07/26] xen/riscv: Implement construct_domain()

[Oleksii Kurochko]

Implement construct_domain() function for RISC-V, which performs initial setup
for the domain's first vCPU, loads the kernel, initrd, and device tree,
and sets up guest CPU registers for boot.

It also creates additional vCPUs up to max_vcpus and assigns the device tree
address and boot cpuid in registers.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Only rebase. Nothing changed.
---
Changes in v4:
 - Drop the blank before v%u in the printk() failure message so the output
   matches that of %pv.
 - Restore Acked-by that was lost in v3.
---
Changes in v3:
 - s/%d/%u for printing vCPU index in the failure message.
 - Drop dprintk() for successful vCPU creation.
---
Changes in v2:
 - Rework construct_domain() to print that vCPU1...n are created using %pv.
 - Use true instead of 1 for initialization of v->is_initialised.
 - Drop unnessary BUG_ON() in construct_domain().
 - Add TODO comment above *_load() functions.
---
---
 xen/arch/riscv/Makefile       |  1 +
 xen/arch/riscv/domain-build.c | 50 +++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 xen/arch/riscv/domain-build.c

diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile
index 8f7fd625dddd..fd5e499eb4b9 100644
--- a/xen/arch/riscv/Makefile
+++ b/xen/arch/riscv/Makefile
@@ -1,6 +1,7 @@
 obj-y += aplic.o
 obj-y += cpufeature.o
 obj-y += domain.o
+obj-y += domain-build.init.o
 obj-$(CONFIG_DOM0LESS_BOOT) += dom0less-build.init.o
 obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
 obj-y += entry.o
diff --git a/xen/arch/riscv/domain-build.c b/xen/arch/riscv/domain-build.c
new file mode 100644
index 000000000000..5f6f4b6248a5
--- /dev/null
+++ b/xen/arch/riscv/domain-build.c
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include <xen/fdt-domain-build.h>
+#include <xen/fdt-kernel.h>
+#include <xen/init.h>
+#include <xen/sched.h>
+
+#include <asm/current.h>
+#include <asm/guest_access.h>
+
+int __init construct_domain(struct domain *d, struct kernel_info *kinfo)
+{
+    struct vcpu *v = d->vcpu[0];
+    struct cpu_user_regs *regs = vcpu_guest_cpu_user_regs(v);
+
+    BUG_ON(v->is_initialised);
+
+    /*
+     * At the moment *_load() don't return value and will just panic()
+     * inside.
+     * TODO: it will be good to change that.
+     */
+    kernel_load(kinfo);
+    initrd_load(kinfo, copy_to_guest_phys);
+    dtb_load(kinfo, copy_to_guest_phys);
+
+    regs->sepc = kinfo->entry;
+
+    /* Guest boot cpuid = 0 */
+    regs->a0 = 0;
+    regs->a1 = kinfo->dtb_paddr;
+
+    for ( unsigned int i = 1; i < d->max_vcpus; i++ )
+    {
+        const struct vcpu *tmp_v = vcpu_create(d, i);
+
+        if ( !tmp_v )
+        {
+            printk("Failed to allocate %pdv%u\n", d, i);
+            break;
+        }
+    }
+
+    domain_update_node_affinity(d);
+
+    v->is_initialised = true;
+    clear_bit(_VPF_down, &v->pause_flags);
+
+    return 0;
+}
-- 
2.54.0

[PATCH v5 08/26] xen/riscv: implement prerequisites for domain_create()

[Oleksii Kurochko]

arch_domain_create() and arch_sanitise_domain_config() are prerequisites for
domain_create().

arch_sanitise_domain_config() currently returns 0, as there is no specific
work required at this stage.

arch_domain_create() performs basic initialization, such as setting up the P2M
and initializing of next unused phandle.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Only review. Nothing changed.
---
Changes in v4:
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v3:
 - Move arch_domain_destroy() from stubs.c to domain.c next to arch_domain_create().
 - Drop d->is_dying = DOMDYING_dead from arch_domain_create()'s fail label as domain_create() already does it.
 - Replace BUG_ON("unimplemented") with printk() in arch_domain_destroy().
---
Changes in v2:
 - update the commit message.
 - Drop vcpu_switch_to_aarch64_mode() from riscv/stubs. It shouldn't be under
   riscv/ at all.
 - Drop next_phandle as it is now in common code.
---
---
 xen/arch/riscv/domain.c | 29 +++++++++++++++++++++++++++++
 xen/arch/riscv/stubs.c  | 17 -----------------
 2 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/xen/arch/riscv/domain.c b/xen/arch/riscv/domain.c
index c77be3b827eb..2819ff4e7c92 100644
--- a/xen/arch/riscv/domain.c
+++ b/xen/arch/riscv/domain.c
@@ -289,6 +289,35 @@ void sync_vcpu_execstate(struct vcpu *v)
     /* Nothing to do -- no lazy switching */
 }
 
+int arch_sanitise_domain_config(struct xen_domctl_createdomain *config)
+{
+    return 0;
+}
+
+void arch_domain_destroy(struct domain *d)
+{
+    printk(XENLOG_WARNING "%s: unimplemented\n", __func__);
+}
+
+int arch_domain_create(struct domain *d,
+                       struct xen_domctl_createdomain *config,
+                       unsigned int flags)
+{
+    int rc = 0;
+
+    if ( is_idle_domain(d) )
+        return 0;
+
+    if ( (rc = p2m_init(d, config)) != 0)
+        goto fail;
+
+    return rc;
+
+ fail:
+    arch_domain_destroy(d);
+    return rc;
+}
+
 static void __init __maybe_unused build_assertions(void)
 {
     /*
diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c
index acbb5b9123ea..3a7953593d93 100644
--- a/xen/arch/riscv/stubs.c
+++ b/xen/arch/riscv/stubs.c
@@ -101,28 +101,11 @@ void dump_pageframe_info(struct domain *d)
     BUG_ON("unimplemented");
 }
 
-int arch_sanitise_domain_config(struct xen_domctl_createdomain *config)
-{
-    BUG_ON("unimplemented");
-}
-
-int arch_domain_create(struct domain *d,
-                       struct xen_domctl_createdomain *config,
-                       unsigned int flags)
-{
-    BUG_ON("unimplemented");
-}
-
 int arch_domain_teardown(struct domain *d)
 {
     BUG_ON("unimplemented");
 }
 
-void arch_domain_destroy(struct domain *d)
-{
-    BUG_ON("unimplemented");
-}
-
 void arch_domain_shutdown(struct domain *d)
 {
     BUG_ON("unimplemented");
-- 
2.54.0

[PATCH v5 09/26] xen/riscv: introduce guest riscv,isa string

[Oleksii Kurochko]

Introduce build_guest_isa_str() to generate the riscv,isa string to be
passed to the guest via the Device Tree riscv,isa property.

Introduce the per-domain guest ISA bitmap, populated during domain
creation by calling init_guest_isa().

Introduce struct riscv_isa_ext_entry with a new guest_supported field
to filter out ISA extensions that should not be exposed to guests:

- f/d/q/v: FPU and vector context save/restore are not yet implemented
  for guests.
- Z*inx are not exposed either: they aren't in riscv_isa_ext[], so they
  can never be set in riscv_isa and thus never reach a guest, and no
  current hardware/guest-OS advertises or expects them. Supporting them
  would be cheaper than F/D/Q (FP values stay in integer registers Xen
  already context-switches), but is left as future work.
- h: Nested virtualisation is not supported.
- sstc: Xen owns the supervisor timer; guests must use SBI.
- svade: Xen manages hardware A/D bit updates in stage-2 page tables.
- svpbmt: Page-based memory types are not yet wired up in stage-2 code.

Drop __initconst for riscv_isa_ext[] as it can be used after init stage
by init_guest_isa().

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
- Introduce struct riscv_isa_ext_entry with a guest_supported field and
  RISCV_ISA_EXT_ENTRY(name, guest_supp) macro for riscv_isa_ext[],
  replacing the ad-hoc guest_unsupp bitmap and init_guest_unsupp().
  Every entry now carries an explicit true/false decision, enforced at
  compile time.
- init_guest_isa() builds d->arch.isa by iterating riscv_isa_ext[]
  directly instead of using bitmap_andnot() against guest_unsupp.
- init_guest_isa() changed to void as it can no longer fail.
- Drop isa_str from struct arch_domain; the ISA string does not need to
  persist over the domain lifetime. build_guest_isa_str() is made
  non-static and declared in cpufeature.h for use when building the
  guest device tree.
- Updated the fix of underflow in build_guest_isa_str().
- Drop unnecessary empty line in cpufeature.h before enum riscv_isa_ext_id.
---
Changes in v4:
 - Add an explicit overflow guard in build_guest_isa_str(): return
   -ENOSPC when buf is non-NULL and total >= size, to avoid the
   size - total underflow being passed to snprintf().
 - Expand the commit message to explain why Zfinx/Zdinx/Zqinx are not
   added to guest_unsupp (not in riscv_isa_ext[], so never set in
   riscv_isa nor exposed to a guest; left as future work)
---
Changes in v3:
 - s/set_bit/__set_bit in init_guest_unsupp() as atomicity isn't needed at
   init time.
 - Drop RISCV_GUEST_ISA_STR_MAX; allocate isa_str dynamically with
   xvmalloc_array().
 - Drop "guest" prefix from d->arch.guest_isa and d->arch.guest_isa_str.
 - Introduce build_guest_isa_str() using snprintf(NULL, 0, ...) to determine
   the needed buffer size; init_guest_isa() calls it once for sizing and once
   to fill, keeping both in a single function so they can't go out of sync.
 - Scope ret inside the loop; initialize total directly from the prefix
   snprintf().
 - Merge "_" separator and extension name into a single snprintf() with
   "%s%s".
 - Replace ASSERT with an explicit error check: if the fill call returns a
   different length, free isa_str and return -EINVAL.
---
Changes in v2:
 - s/guest_unsupp_bmp/guest_unsupp.
 - Drop guest_isa_str.
 - Provide init_guest_isa() instead of polluting match_isa_ext().
 - Drop xlen.
 - Add the comment about guest_unsupp.
 - Update the way how guest_unsupp is init-ed.
 - Drop __initconst for riscv_isa_ext[] as it is used in init_guest_isa()
   which isn't marked as __init as it could be used after init stage.
---
---
 xen/arch/riscv/cpufeature.c             | 132 +++++++++++++++++++-----
 xen/arch/riscv/domain.c                 |   2 +
 xen/arch/riscv/include/asm/cpufeature.h |   6 ++
 xen/arch/riscv/include/asm/domain.h     |   3 +
 4 files changed, 119 insertions(+), 24 deletions(-)

diff --git a/xen/arch/riscv/cpufeature.c b/xen/arch/riscv/cpufeature.c
index 92235fdfd5ab..5002ddc92a22 100644
--- a/xen/arch/riscv/cpufeature.c
+++ b/xen/arch/riscv/cpufeature.c
@@ -14,6 +14,7 @@
 #include <xen/errno.h>
 #include <xen/init.h>
 #include <xen/lib.h>
+#include <xen/sched.h>
 #include <xen/sections.h>
 
 #include <asm/cpufeature.h>
@@ -34,6 +35,19 @@ struct riscv_isa_ext_data {
     .name = #ext_name,                          \
 }
 
+struct riscv_isa_ext_entry {
+    unsigned int id;
+    const char *name;
+    bool guest_supported;
+};
+
+#define RISCV_ISA_EXT_ENTRY(ext_name, guest_supp)       \
+{                                                       \
+    .id              = RISCV_ISA_EXT_ ## ext_name,      \
+    .name            = #ext_name,                       \
+    .guest_supported = guest_supp,                      \
+}
+
 /* Host ISA bitmap */
 static __ro_after_init DECLARE_BITMAP(riscv_isa, RISCV_ISA_EXT_MAX);
 
@@ -120,29 +134,30 @@ static int __init dt_get_cpuid_from_node(const struct dt_device_node *cpu,
  * and strncmp() is used in match_isa_ext() to compare extension names instead
  * of strncasecmp().
  */
-const struct riscv_isa_ext_data __initconst riscv_isa_ext[] = {
-    RISCV_ISA_EXT_DATA(i),
-    RISCV_ISA_EXT_DATA(m),
-    RISCV_ISA_EXT_DATA(a),
-    RISCV_ISA_EXT_DATA(f),
-    RISCV_ISA_EXT_DATA(d),
-    RISCV_ISA_EXT_DATA(q),
-    RISCV_ISA_EXT_DATA(c),
-    RISCV_ISA_EXT_DATA(h),
-    RISCV_ISA_EXT_DATA(zicntr),
-    RISCV_ISA_EXT_DATA(zicsr),
-    RISCV_ISA_EXT_DATA(zifencei),
-    RISCV_ISA_EXT_DATA(zihintpause),
-    RISCV_ISA_EXT_DATA(zihpm),
-    RISCV_ISA_EXT_DATA(zba),
-    RISCV_ISA_EXT_DATA(zbb),
-    RISCV_ISA_EXT_DATA(zbs),
-    RISCV_ISA_EXT_DATA(smaia),
-    RISCV_ISA_EXT_DATA(smstateen),
-    RISCV_ISA_EXT_DATA(ssaia),
-    RISCV_ISA_EXT_DATA(sstc),
-    RISCV_ISA_EXT_DATA(svade),
-    RISCV_ISA_EXT_DATA(svpbmt),
+const struct riscv_isa_ext_entry riscv_isa_ext[] = {
+    RISCV_ISA_EXT_ENTRY(i,            true),
+    RISCV_ISA_EXT_ENTRY(m,            true),
+    RISCV_ISA_EXT_ENTRY(a,            true),
+    RISCV_ISA_EXT_ENTRY(f,            false),
+    RISCV_ISA_EXT_ENTRY(d,            false),
+    RISCV_ISA_EXT_ENTRY(q,            false),
+    RISCV_ISA_EXT_ENTRY(c,            true),
+    RISCV_ISA_EXT_ENTRY(v,            false),
+    RISCV_ISA_EXT_ENTRY(h,            false),
+    RISCV_ISA_EXT_ENTRY(zicntr,       true),
+    RISCV_ISA_EXT_ENTRY(zicsr,        true),
+    RISCV_ISA_EXT_ENTRY(zifencei,     true),
+    RISCV_ISA_EXT_ENTRY(zihintpause,  true),
+    RISCV_ISA_EXT_ENTRY(zihpm,        true),
+    RISCV_ISA_EXT_ENTRY(zba,          true),
+    RISCV_ISA_EXT_ENTRY(zbb,          true),
+    RISCV_ISA_EXT_ENTRY(zbs,          true),
+    RISCV_ISA_EXT_ENTRY(smaia,        true),
+    RISCV_ISA_EXT_ENTRY(smstateen,    true),
+    RISCV_ISA_EXT_ENTRY(ssaia,        true),
+    RISCV_ISA_EXT_ENTRY(sstc,         false),
+    RISCV_ISA_EXT_ENTRY(svade,        false),
+    RISCV_ISA_EXT_ENTRY(svpbmt,       false),
 };
 
 static const struct riscv_isa_ext_data __initconst required_extensions[] = {
@@ -181,7 +196,7 @@ static void __init match_isa_ext(const char *name, const char *name_end,
 
     for ( unsigned int i = 0; i < riscv_isa_ext_count; i++ )
     {
-        const struct riscv_isa_ext_data *ext = &riscv_isa_ext[i];
+        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
 
         /*
          * `ext->name` (according to initialization of riscv_isa_ext[]
@@ -480,6 +495,74 @@ bool riscv_isa_extension_available(const unsigned long *isa_bitmap,
     return test_bit(id, isa_bitmap);
 }
 
+int build_guest_isa_str(char *buf, size_t size,
+                        const unsigned long *isa_bitmap)
+{
+    char *p = buf;
+    size_t left = size;
+    int total;
+
+#if defined(CONFIG_RISCV_32)
+    total = snprintf(p, left, "rv32");
+#elif defined(CONFIG_RISCV_64)
+    total = snprintf(p, left, "rv64");
+#else
+# error "Unsupported RISC-V bitness"
+#endif
+
+    if ( total < 0 )
+        return total;
+
+    if ( buf )
+    {
+        if ( (size_t)total >= left )
+            return -ENOSPC;
+
+        p += total;
+        left -= total;
+    }
+
+    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
+    {
+        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
+        int ret;
+
+        if ( !riscv_isa_extension_available(isa_bitmap, ext->id) )
+            continue;
+
+        ret = snprintf(p, left, "%s%s",
+                       ext->id >= RISCV_ISA_EXT_BASE ? "_" : "",
+                       ext->name);
+        if ( ret < 0 )
+            return ret;
+
+        total += ret;
+
+        if ( buf )
+        {
+            if ( (size_t)ret >= left )
+                return -ENOSPC;
+
+            p += ret;
+            left -= ret;
+        }
+    }
+
+    return total;
+}
+
+void init_guest_isa(struct domain *d)
+{
+    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
+    {
+        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
+
+        if ( ext->guest_supported &&
+             riscv_isa_extension_available(NULL, ext->id) )
+            __set_bit(ext->id, d->arch.isa);
+    }
+}
+
 void __init riscv_fill_hwcap(void)
 {
     unsigned int i;
@@ -527,4 +610,5 @@ void __init riscv_fill_hwcap(void)
     if ( !all_extns_available )
         panic("Look why the extensions above are needed in "
               "https://xenbits.xenproject.org/docs/unstable/misc/riscv/booting.txt\n");
+
 }
diff --git a/xen/arch/riscv/domain.c b/xen/arch/riscv/domain.c
index 2819ff4e7c92..c9933147595e 100644
--- a/xen/arch/riscv/domain.c
+++ b/xen/arch/riscv/domain.c
@@ -308,6 +308,8 @@ int arch_domain_create(struct domain *d,
     if ( is_idle_domain(d) )
         return 0;
 
+    init_guest_isa(d);
+
     if ( (rc = p2m_init(d, config)) != 0)
         goto fail;
 
diff --git a/xen/arch/riscv/include/asm/cpufeature.h b/xen/arch/riscv/include/asm/cpufeature.h
index 0c48d57a03bb..e26f5f0b66fb 100644
--- a/xen/arch/riscv/include/asm/cpufeature.h
+++ b/xen/arch/riscv/include/asm/cpufeature.h
@@ -5,6 +5,7 @@
 #ifndef __ASSEMBLER__
 
 #include <xen/stdbool.h>
+#include <xen/types.h>
 
 /*
  * These macros represent the logical IDs of each multi-letter RISC-V ISA
@@ -44,7 +45,12 @@ enum riscv_isa_ext_id {
     RISCV_ISA_EXT_MAX
 };
 
+struct domain;
+
 void riscv_fill_hwcap(void);
+void init_guest_isa(struct domain *d);
+int build_guest_isa_str(char *buf, size_t size,
+                        const unsigned long *isa_bitmap);
 
 bool riscv_isa_extension_available(const unsigned long *isa_bitmap,
                                    enum riscv_isa_ext_id id);
diff --git a/xen/arch/riscv/include/asm/domain.h b/xen/arch/riscv/include/asm/domain.h
index 6044ce0feee0..235b20f8a6ba 100644
--- a/xen/arch/riscv/include/asm/domain.h
+++ b/xen/arch/riscv/include/asm/domain.h
@@ -7,6 +7,7 @@
 #include <xen/xmalloc.h>
 #include <public/hvm/params.h>
 
+#include <asm/cpufeature.h>
 #include <asm/guest-layout.h>
 #include <asm/p2m.h>
 #include <asm/vtimer.h>
@@ -94,6 +95,8 @@ struct arch_domain {
     struct p2m_domain p2m;
 
     struct paging_domain paging;
+
+    DECLARE_BITMAP(isa, RISCV_ISA_EXT_MAX);
 };
 
 #include <xen/sched.h>
-- 
2.54.0

Re: [PATCH v5 09/26] xen/riscv: introduce guest riscv,isa string

[Jan Beulich]

On 06.07.2026 17:57, Oleksii Kurochko wrote:
> --- a/xen/arch/riscv/cpufeature.c
> +++ b/xen/arch/riscv/cpufeature.c
> @@ -14,6 +14,7 @@
>  #include <xen/errno.h>
>  #include <xen/init.h>
>  #include <xen/lib.h>
> +#include <xen/sched.h>
>  #include <xen/sections.h>
>  
>  #include <asm/cpufeature.h>
> @@ -34,6 +35,19 @@ struct riscv_isa_ext_data {
>      .name = #ext_name,                          \
>  }
>  
> +struct riscv_isa_ext_entry {
> +    unsigned int id;
> +    const char *name;
> +    bool guest_supported;
> +};
> +
> +#define RISCV_ISA_EXT_ENTRY(ext_name, guest_supp)       \
> +{                                                       \
> +    .id              = RISCV_ISA_EXT_ ## ext_name,      \
> +    .name            = #ext_name,                       \
> +    .guest_supported = guest_supp,                      \
> +}
> +
>  /* Host ISA bitmap */
>  static __ro_after_init DECLARE_BITMAP(riscv_isa, RISCV_ISA_EXT_MAX);
>  
> @@ -120,29 +134,30 @@ static int __init dt_get_cpuid_from_node(const struct dt_device_node *cpu,
>   * and strncmp() is used in match_isa_ext() to compare extension names instead
>   * of strncasecmp().
>   */
> -const struct riscv_isa_ext_data __initconst riscv_isa_ext[] = {

I realize it has been this way before, but ...

> -    RISCV_ISA_EXT_DATA(i),
> -    RISCV_ISA_EXT_DATA(m),
> -    RISCV_ISA_EXT_DATA(a),
> -    RISCV_ISA_EXT_DATA(f),
> -    RISCV_ISA_EXT_DATA(d),
> -    RISCV_ISA_EXT_DATA(q),
> -    RISCV_ISA_EXT_DATA(c),
> -    RISCV_ISA_EXT_DATA(h),
> -    RISCV_ISA_EXT_DATA(zicntr),
> -    RISCV_ISA_EXT_DATA(zicsr),
> -    RISCV_ISA_EXT_DATA(zifencei),
> -    RISCV_ISA_EXT_DATA(zihintpause),
> -    RISCV_ISA_EXT_DATA(zihpm),
> -    RISCV_ISA_EXT_DATA(zba),
> -    RISCV_ISA_EXT_DATA(zbb),
> -    RISCV_ISA_EXT_DATA(zbs),
> -    RISCV_ISA_EXT_DATA(smaia),
> -    RISCV_ISA_EXT_DATA(smstateen),
> -    RISCV_ISA_EXT_DATA(ssaia),
> -    RISCV_ISA_EXT_DATA(sstc),
> -    RISCV_ISA_EXT_DATA(svade),
> -    RISCV_ISA_EXT_DATA(svpbmt),
> +const struct riscv_isa_ext_entry riscv_isa_ext[] = {

... is there a reason for this to be non-static? Its type (struct
riscv_isa_ext_entry) is local to this file, and I also can't spot any
declaration elsewhere.

> @@ -480,6 +495,74 @@ bool riscv_isa_extension_available(const unsigned long *isa_bitmap,
>      return test_bit(id, isa_bitmap);
>  }
>  
> +int build_guest_isa_str(char *buf, size_t size,
> +                        const unsigned long *isa_bitmap)
> +{
> +    char *p = buf;
> +    size_t left = size;
> +    int total;
> +
> +#if defined(CONFIG_RISCV_32)
> +    total = snprintf(p, left, "rv32");
> +#elif defined(CONFIG_RISCV_64)
> +    total = snprintf(p, left, "rv64");
> +#else
> +# error "Unsupported RISC-V bitness"
> +#endif

For the longer-term future of this, passing in const struct domain * may
help.

> +    if ( total < 0 )
> +        return total;
> +
> +    if ( buf )
> +    {
> +        if ( (size_t)total >= left )
> +            return -ENOSPC;
> +
> +        p += total;
> +        left -= total;
> +    }
> +
> +    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
> +    {
> +        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
> +        int ret;
> +
> +        if ( !riscv_isa_extension_available(isa_bitmap, ext->id) )
> +            continue;
> +
> +        ret = snprintf(p, left, "%s%s",
> +                       ext->id >= RISCV_ISA_EXT_BASE ? "_" : "",
> +                       ext->name);
> +        if ( ret < 0 )
> +            return ret;
> +
> +        total += ret;
> +
> +        if ( buf )
> +        {
> +            if ( (size_t)ret >= left )
> +                return -ENOSPC;
> +
> +            p += ret;
> +            left -= ret;
> +        }
> +    }
> +
> +    return total;
> +}
> +
> +void init_guest_isa(struct domain *d)
> +{
> +    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
> +    {
> +        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
> +
> +        if ( ext->guest_supported &&
> +             riscv_isa_extension_available(NULL, ext->id) )
> +            __set_bit(ext->id, d->arch.isa);
> +    }
> +}

Right now what this function does is dependent on only global variables.
IOW each guest gets the same bitmap. Is this going to change soon? Else
why not calculate that bitmap once, taking the same shortcut as you take
elsewhere for the time being? Then allowing riscv_isa_ext[] to remain
__initconst (should really have been __initconstrel).

> @@ -527,4 +610,5 @@ void __init riscv_fill_hwcap(void)
>      if ( !all_extns_available )
>          panic("Look why the extensions above are needed in "
>                "https://xenbits.xenproject.org/docs/unstable/misc/riscv/booting.txt\n");
> +
>  }

Stray change once again?

Jan

Re: [PATCH v5 09/26] xen/riscv: introduce guest riscv,isa string

[Oleksii Kurochko]

On 7/9/26 3:05 PM, Jan Beulich wrote:
> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>> --- a/xen/arch/riscv/cpufeature.c
>> +++ b/xen/arch/riscv/cpufeature.c
>> @@ -14,6 +14,7 @@
>>   #include <xen/errno.h>
>>   #include <xen/init.h>
>>   #include <xen/lib.h>
>> +#include <xen/sched.h>
>>   #include <xen/sections.h>
>>   
>>   #include <asm/cpufeature.h>
>> @@ -34,6 +35,19 @@ struct riscv_isa_ext_data {
>>       .name = #ext_name,                          \
>>   }
>>   
>> +struct riscv_isa_ext_entry {
>> +    unsigned int id;
>> +    const char *name;
>> +    bool guest_supported;
>> +};
>> +
>> +#define RISCV_ISA_EXT_ENTRY(ext_name, guest_supp)       \
>> +{                                                       \
>> +    .id              = RISCV_ISA_EXT_ ## ext_name,      \
>> +    .name            = #ext_name,                       \
>> +    .guest_supported = guest_supp,                      \
>> +}
>> +
>>   /* Host ISA bitmap */
>>   static __ro_after_init DECLARE_BITMAP(riscv_isa, RISCV_ISA_EXT_MAX);
>>   
>> @@ -120,29 +134,30 @@ static int __init dt_get_cpuid_from_node(const struct dt_device_node *cpu,
>>    * and strncmp() is used in match_isa_ext() to compare extension names instead
>>    * of strncasecmp().
>>    */
>> -const struct riscv_isa_ext_data __initconst riscv_isa_ext[] = {
> 
> I realize it has been this way before, but ...
> 
>> -    RISCV_ISA_EXT_DATA(i),
>> -    RISCV_ISA_EXT_DATA(m),
>> -    RISCV_ISA_EXT_DATA(a),
>> -    RISCV_ISA_EXT_DATA(f),
>> -    RISCV_ISA_EXT_DATA(d),
>> -    RISCV_ISA_EXT_DATA(q),
>> -    RISCV_ISA_EXT_DATA(c),
>> -    RISCV_ISA_EXT_DATA(h),
>> -    RISCV_ISA_EXT_DATA(zicntr),
>> -    RISCV_ISA_EXT_DATA(zicsr),
>> -    RISCV_ISA_EXT_DATA(zifencei),
>> -    RISCV_ISA_EXT_DATA(zihintpause),
>> -    RISCV_ISA_EXT_DATA(zihpm),
>> -    RISCV_ISA_EXT_DATA(zba),
>> -    RISCV_ISA_EXT_DATA(zbb),
>> -    RISCV_ISA_EXT_DATA(zbs),
>> -    RISCV_ISA_EXT_DATA(smaia),
>> -    RISCV_ISA_EXT_DATA(smstateen),
>> -    RISCV_ISA_EXT_DATA(ssaia),
>> -    RISCV_ISA_EXT_DATA(sstc),
>> -    RISCV_ISA_EXT_DATA(svade),
>> -    RISCV_ISA_EXT_DATA(svpbmt),
>> +const struct riscv_isa_ext_entry riscv_isa_ext[] = {
> 
> ... is there a reason for this to be non-static? Its type (struct
> riscv_isa_ext_entry) is local to this file, and I also can't spot any
> declaration elsewhere.

I checked downstream changes and it also local to cpufeature.c file so 
it should be static.

> 
>> @@ -480,6 +495,74 @@ bool riscv_isa_extension_available(const unsigned long *isa_bitmap,
>>       return test_bit(id, isa_bitmap);
>>   }
>>   
>> +int build_guest_isa_str(char *buf, size_t size,
>> +                        const unsigned long *isa_bitmap)
>> +{
>> +    char *p = buf;
>> +    size_t left = size;
>> +    int total;
>> +
>> +#if defined(CONFIG_RISCV_32)
>> +    total = snprintf(p, left, "rv32");
>> +#elif defined(CONFIG_RISCV_64)
>> +    total = snprintf(p, left, "rv64");
>> +#else
>> +# error "Unsupported RISC-V bitness"
>> +#endif
> 
> For the longer-term future of this, passing in const struct domain * may
> help.

pointer to const struct domain looks really better I chnage prototype of 
build_guest_isa_str().

> 
>> +    if ( total < 0 )
>> +        return total;
>> +
>> +    if ( buf )
>> +    {
>> +        if ( (size_t)total >= left )
>> +            return -ENOSPC;
>> +
>> +        p += total;
>> +        left -= total;
>> +    }
>> +
>> +    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
>> +    {
>> +        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
>> +        int ret;
>> +
>> +        if ( !riscv_isa_extension_available(isa_bitmap, ext->id) )
>> +            continue;
>> +
>> +        ret = snprintf(p, left, "%s%s",
>> +                       ext->id >= RISCV_ISA_EXT_BASE ? "_" : "",
>> +                       ext->name);
>> +        if ( ret < 0 )
>> +            return ret;
>> +
>> +        total += ret;
>> +
>> +        if ( buf )
>> +        {
>> +            if ( (size_t)ret >= left )
>> +                return -ENOSPC;
>> +
>> +            p += ret;
>> +            left -= ret;
>> +        }
>> +    }
>> +
>> +    return total;
>> +}
>> +
>> +void init_guest_isa(struct domain *d)
>> +{
>> +    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
>> +    {
>> +        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
>> +
>> +        if ( ext->guest_supported &&
>> +             riscv_isa_extension_available(NULL, ext->id) )
>> +            __set_bit(ext->id, d->arch.isa);
>> +    }
>> +}
> 
> Right now what this function does is dependent on only global variables.
> IOW each guest gets the same bitmap. Is this going to change soon?

At the moment, we don't have a use case where domain has unique bitmap. 
But IIRC correctly we agreed that generally it is good idea to have isa 
bitmap per domain and let the use to chose.

  Else
> why not calculate that bitmap once, taking the same shortcut as you take
> elsewhere for the time being?

static __ro_after_init DECLARE_BITMAP(guest_isa, RISCV_ISA_EXT_MAX);

/* called once from riscv_fill_hwcap() or similar */
void __init init_guest_isa_mask(void)
{
     for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
         if ( riscv_isa_ext[i].guest_supported &&
              riscv_isa_extension_available(NULL, riscv_isa_ext[i].id) )
             __set_bit(riscv_isa_ext[i].id, guest_isa);
}

void init_guest_isa(struct domain *d)   /* called per-domain */
{
     bitmap_copy(d->arch.isa, guest_isa, RISCV_ISA_EXT_MAX);
}

Do you mean something like that?

  Then allowing riscv_isa_ext[] to remain
> __initconst (should really have been __initconstrel).

I think you explained me already why but I forgot. Could you please 
remind me again why __initconstrel should be here? Is it because of 
pointers used inside struct riscv_isa_ext_entry?

Thanks.

~ Oleksii

Re: [PATCH v5 09/26] xen/riscv: introduce guest riscv,isa string

[Jan Beulich]

On 10.07.2026 17:00, Oleksii Kurochko wrote:
> On 7/9/26 3:05 PM, Jan Beulich wrote:
>> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>>> +void init_guest_isa(struct domain *d)
>>> +{
>>> +    for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
>>> +    {
>>> +        const struct riscv_isa_ext_entry *ext = &riscv_isa_ext[i];
>>> +
>>> +        if ( ext->guest_supported &&
>>> +             riscv_isa_extension_available(NULL, ext->id) )
>>> +            __set_bit(ext->id, d->arch.isa);
>>> +    }
>>> +}
>>
>> Right now what this function does is dependent on only global variables.
>> IOW each guest gets the same bitmap. Is this going to change soon?
> 
> At the moment, we don't have a use case where domain has unique bitmap. 
> But IIRC correctly we agreed that generally it is good idea to have isa 
> bitmap per domain and let the use to chose.

Indeed. But what you're doing (in this series alone) is a mix of things:
Some properties are per-domain, some are global. Such a mix might be okay
if it's justified by something. Otherwise I think consistency it to be
valued higher.

>   Else
>> why not calculate that bitmap once, taking the same shortcut as you take
>> elsewhere for the time being?
> 
> static __ro_after_init DECLARE_BITMAP(guest_isa, RISCV_ISA_EXT_MAX);
> 
> /* called once from riscv_fill_hwcap() or similar */
> void __init init_guest_isa_mask(void)
> {
>      for ( unsigned int i = 0; i < ARRAY_SIZE(riscv_isa_ext); i++ )
>          if ( riscv_isa_ext[i].guest_supported &&
>               riscv_isa_extension_available(NULL, riscv_isa_ext[i].id) )
>              __set_bit(riscv_isa_ext[i].id, guest_isa);
> }
> 
> void init_guest_isa(struct domain *d)   /* called per-domain */
> {
>      bitmap_copy(d->arch.isa, guest_isa, RISCV_ISA_EXT_MAX);
> }
> 
> Do you mean something like that?

Yes. Not necessarily with bitmap_copy() though; perhaps with a pointer in
struct domain.

>   Then allowing riscv_isa_ext[] to remain
>> __initconst (should really have been __initconstrel).
> 
> I think you explained me already why but I forgot. Could you please 
> remind me again why __initconstrel should be here? Is it because of 
> pointers used inside struct riscv_isa_ext_entry?

Yes, pointers incur relocations, and the need for relocations requires
that the compiler emit the data to a writable section. As opposed to
relocation-free data, which (when declared const) can go into a r/o
section.

Jan

[PATCH v5 10/26] xen/riscv: implement make_cpus_node()

[Oleksii Kurochko]

Implement make_cpus_node() to create cpus node for a guest domain.

This function is going to be use by common dom0less code during
construction domain.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
- Drop Acked-by: Jan Beulich <jbeulich@suse.com> as extra changes were done
  because of the changed in prev. patch.
- Move isa_str allocation and construction out of arch_domain_create() and
  into make_cpus_node() as a local variable, since the string is only
  needed during FDT generation. Use a two-call build_guest_isa_str()
  pattern (size probe, then fill) with xvmalloc_array, and convert all
  post-allocation error returns to goto out so xvfree() runs on every path.
---
Changes in v4:
 - Update the comment in make_cpus_node() to match code style.
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v3:
 - Add blank line above make_cpus_node() function definition.
 - Move 'unsigned int cpu' from function-level declarations into the for loop.
 - Drop 'uint32_t reg = cpu_to_fdt32(cpu)'; use fdt_property_cell(fdt, "reg", cpu)
   instead of fdt_property(fdt, "reg", &reg, sizeof(reg)) so byte-order adjustment
   is handled internally.
 - Add matching /* interrupt-controller */ start comment; fix end comment to
   /* end interrupt-controller */.
 - Update d->arch.guest_isa_str to ->isa_str in make_cpus_node() function.
---
Changes in v2:
 - s/u32/uint32_t for timebase_frequency local variable.
 - Drop +1 from BUILD_BUG_ON().
 - return fdt_end_node(fdt); instead of res at the end of the function.
---
---
 build/tools/fixdep            | Bin 0 -> 13632 bytes
 xen/arch/riscv/domain-build.c | 125 ++++++++++++++++++++++++++++++++++
 2 files changed, 125 insertions(+)
 create mode 100755 build/tools/fixdep

diff --git a/build/tools/fixdep b/build/tools/fixdep
new file mode 100755
index 0000000000000000000000000000000000000000..42233e2669e9cdaf1c31723ad22c00f6c9291f7c
GIT binary patch
literal 13632
zcmeG@ZE#!Fl}ECj2q)1~fCPuHyoG0K(?piyBsfk0$&uq{R{0=tLY4+zWa-(_t}Gep
z32b1fQ`;#IVH&#7Vf(QYI$M@*mnpNQ8OYLDkguk+I{{|9p>!KhH*_TuNVcINU*ztb
z`|got#iBd?vC|(pndrQ8?m73Ickai#_uT6*w+2_(Z8jjV!ySOs$!Z^GS-$|j`6L10
zgC>{(K9FH9OaXvO&a=QLGzcHITYSO}Ay*;vz$F+iVM*ZY1)DH=h`36WSy1qhllRTA
zxP+;G)I&dsCOd>TUSa7GCOOo@cRX{0Reol^Wry&S;{9^fRypY*8}%GFT6~Aw(j$CG
zybxiE3;KxvYcN0@TY5DDD;B$e`8x?6d_GfS37n}BehO?+*mf3_+H0C)@tfvY5`<+T
zPnhhj`@o3&DfZR~J>NA}#lCASdxSfLJ;G$~?hlLz#`FIQ)UDQ%pJm$5A=;0yXclhw
zY5?9(+g7cIAH2A(XVCkty6*R0I`HGJpY{(z&;6&Q8_%hO#~o^>>e+b!>TuSuvqS3O
zUdNt-n{3e&^8i@wlk)(ixjtaENN>UN{1{`5)qVwOG@C!f>4%X<uku+=Cy~b9kbjxe
ze~mPTCBK8yok-)5$ZzNLy+~uI@&lY+i}X~adpUg<(%Ag@&75vQ8hd|!4X2xt#@?Lw
zae4vL(~$OX`c|Z;BQ10KCZuuH<z1Y<7HKEa!09WImXJPqk+DKx1dP5o%LlnG#@Hyv
zAonOfy^p-L_=IuDZNaCXBkzs^uLGaB?ydO5b<y9^&e=Z5%`WifF~+*w(%d0#Z~Tck
z{(Jlz{OkQ4>({A+$2ShLN@@73RRC({ewUhwJ4SP}eBjNhnGH3n`I~n0i1+>6_oo1;
z=84?hQvnVHlpxlun)}+#ebQWzcDBMYS$gKpWt*gD-f;X(8vZ96z_My-=({$6p{z8t
zv=YU0$EHbh0|5Sk3)RN;?dJY~v~#mf9n9MNr}rL_hJIeb%QmHdGtkGHrJ=v%T5qcL
z9}b?o?y-B-*P`)oEFIAs{N^Ebv|Eqs$&jJnHDXj9RU4gZ<6{o>inG$tjg<g{=dL&E
z)m@};*GRDHztr8NqBhP{8y|3}SNvWYa#sTE2N-@|8j>mjG95~A_#J7;&uyQ`ZRRf?
zP#mgxfa16N?=aq{KVwWa_o>5KY3QyBfLzr@#)2d3r>YrG(EJZ|NlbC1T&lEtJv&{w
z!I3^Va85J!B0ZJURRia=^eaL0T^^IJ@n-s?kE;2eD(zlwQwR6hRP#+~XXT1)u3~V^
zHgHapo_W)8DE*(Rc{o^qXz<LG$7Y&Y)t1}Zq^(>XkcLb<HpF}FOMaG|qnbzZUdGsV
zb#R|8f7?aIq`3pwu)+GbhYw0aH~>fPW<m3i|FwPJxqhoUV$5>jc$Rj%c%ymWZjB!N
zTN~KaB`4D#`lX$3sAfR%shP@sV;&zM(Zs{^JOH$tSvCAd;PHr3qneu(d8N5GV7?VJ
zV@lmh^WRl7rg&8I7pUVpc8xT*I0`E>in4O}sBx!%$tGob`lNqpOmU?1YNkVRwU0ci
zxPs=#xdZ1J8_uTR4M;oDL}rsB2Qx9HE<X!L1COz4=Kbb-E6oo}Wz-B>55FBWJCr(g
z<Y8C93@Wl}2GQ3J#g+T!dB*sgJbi&NZdc71DB9=Z9_OOx84G3tic8G|m73kXvwfgu
z0!mXL6IA5UFVFUY-&7s#Cg=KEO?7(Ew4&tAq8(SRtpZ12P;m_(l%DzlwnC;usT=V#
z44KRSdIKMEo0J-LBv$3XxXD5D-D4hUF616L&se*(`xj~k0-1S_`v*U3ke<!@2QM_F
z8;7##2HsJY95dQl&Eo-S=NJ70pK0lX-mL#8SS!jIhl_fhnpxEU1%QBgBDeJ%V}oay
zG&F<}!2Y)6So$>{KNrTh24gIbetkC17`Z_^K>mB5QM~ym9&WzC*uUaj)jD+4Skyie
zx98tFk9`f)!Tgl1eHDTA!B%Ow>odmk5!BtTW*$`>-uH8R&ob6JbTs`|CZGgym`$+(
z1kH0n^Wy09mc^NN<XrS-M}LH4($2{fxhKw|w|h5wvtPQ;zsY}}|9-!=hdYsfgfXVR
zh7(7mA(U1dS4~$(jYK#R?{aTZ8y~wGr;y>FoM$W_L`n1G(Y2PT7i<9eJcePHP&U-Y
zyJx7o6MvKH?@6Kd1G8{S8GZ@1om~4v^mTz%fzG|ZI2y3X4K@IClM>87d!8|Cgymno
zz}RSRwhwlF5dd~$)YQz3>9+vny3f*-zY?EnuJOUHTZ)AKyA~kVQV^;;iy^kY0Qk-J
ze$;NheZOk{RvkQga!p68H|ss99ykD1K47!<C;*>~Pe3TYXPn&r>f<<?Z^vKbs#p2c
zKb$qL7)1sf>)O5tCxxQ^vzyCr{g@;3r259kcdBoksZeeE)weGiGYd6L6*ZLVqy2%~
zZ>R-;^i}Is^Ml;OjIsSy(`o^1_wBjF9?BnkV%%YM>+!>UwBQgmJ8)tNDosJ0n}TLg
zQHQd|ZBl(eStHd4mCaIphtez6e_O%1Ppbb1Wjn|JtnA?U73F1)UstkN=g5#U#_PVQ
zW^P}nAg2RA4mk8j0*ZVfpg3@$aUh^f_i(|0Qj>e)Q=FWn$L(hrQ@8F#?}`HK@9>`X
zX4k9cXY16h$I*Ol30LU5Up0Sc9x(Uh`YrmAU?!q?aL%*krhGd7{dwn8#)9T=Rdc_2
zB=^#3#?++&#Ul;B@F`>a162U#k=!<9Z{3U4t7Z<z#hzWb)8M^q^oO%>#+vc`%>cOz
zC~2O^?LAGakzbu=Y!|NTE#WMm-ewp#0~~uBc>MXAaKb9^GF*l~PiTlmI~Ol(h(+ed
zqVaU!{Jy5e^A|64rxNZ3++kdRUj<Ou2lEG;%Z@zUAJyOR<n>E_pP_B~C4d`)D=*;!
z1j_LH%J6XloUEP)%JA`XF`4|Y0SbHBV)$wq`P<9zo67KU<29Mx$I9?gb~5>=%J82p
z!@so*|GqMO+<s4H*9!nMVGiu@So?Cy6KoLtYzZHF(?%G2^<*-Ugs!BngWeZ4K-0oT
zf3L1}YOzEZl6oitDI=LOl8`bYiL?QUUOf&yp%@lxS}fWb)>1|&X=pv6XdH#~WU^3;
zk%%Q8(v!Td9=#{r(+lBPBBjHFUA@U@-00%m-hSwMC>b?$=t>zO1F%x;$cv#Z*xs^S
zTi|XSe;R-EE*$5MKQ3@D0!{1gNyLR;8uk`DRDfOl!yExUBd!8FOo1u<8HY&~e5)wk
zbX7Du12aP36TBZi{f#M@$@-z7pW$>R>=N`VoUVX<f=*u>y#nnY5}o#NgVjFR-$V+7
z!&ng?H~j?Eo|q`Wu}eVhiF_Q-1rY6wb>LVca1`-Hii(4)h)+2igqk9Lao$cY;uq(2
z>WcW(_Ygcqe37c-&{V{y6dZ!Dh>yt&0=0;bNeqHDMSPJ$<gl@bk4X)J%|(1nZV+rK
z;!_R^p|^-XlY{}FuZUkf9&Hm^6`(8H7twnKYL@wUlW`D5<K1#sG^RJpg+ei`ER|-N
zkG^nEM5|57&9}?7sp@K=WB_FWaQ#m!|1yPQWe=%DIvLiBD~ss8DM4?l23f96A;wMi
z`d}-$A)F$^xXFligDlIkQuk0a772%v5xF+i0PZdIsJ?vlsuk^R8dTS&nq{R<*r>0r
zhH;{~nrasT;RF8*MIkA``c$Y}Z<ei?$jc&nF9z)nd6^MPcI(C+^0IJGBo>Y9cUZlM
zg4Y{LrgW?JrE)wWTjD9XE0K;zssU`*RV>9^CH6`AIAhOY-}{I${LXZI#F%0Oc=RL2
zw%Y)*A2H^$0la*Qv0eZeJH;68N_Kq07%r&S{DHBP!ebhXwuje(t<Pn<Zu(RQ)`5Kr
zKekP$7{e_O1g5%>hwJN(Q;g9V!#pv5V+W2g=E4E&bggjK+$BwW$T0wSUc2<xM&%|{
z$8>QF01lsG>;+`BImc}Fzjxx;!+IYFfKA64<Ni3uY-s1(0I=~B#&)B8i_`U_z13N>
zts>x*2P@m0FWc-|wNnl_Yy3`Ei__tshBk2CsyohD9qKq=whdNptH9hjX3vh}I5^H&
z4xMjty1r&_an?Ll(c+XxDqEa&PgePzo^4b7&Zfbs0q1sG#jh)?olVP~9>24$#VNNq
zYg&XM5u0T;fTPFA)^^+A)NNCqtQx6&s^V*fsS@WXd>1r{`Ca<}WRXX6oegZ9rn$y0
zXevipj1SVNkAU-G!N6s>442_D{F%a`Y1aC2hrl$i;hGhJ)<(<3xg)KK*37W<#BpKa
z9P~P&M{Blg1r6fdlQxJ{{)dY!fg-Xv@1^gS@5=FYErKe_X>E5*)JtnRaoh>B1fPJ`
zra7@5rg?clyeNHNX^kw7BcbMM%Rcd6y~?7=@6EyheHY07MP|LvMj_7xO>sRb=y{_2
z{~PGsxfC80?Ym9jZwUN?z&i!rFYqq~{++<51)frA#c8&{w+Osg;1vRI5V%WVgtq0&
zo8`K;RqN|z?_#&t?UfgJ7A*EG@_6OCwR%KWLxw1r@2xK@?Ok+<^n!ZuZ)jfF>uvNj
z!P*VY$#k5rm%GE^QcKXXp*a+fCpx3?NsHU=Y4-Hp7Fq0Bw0ME+b~mK@Q@A8;=xbWs
z5bBK1k0%V>9foylnj2x=@@6kAU(ww3If5&K&7RLGZu2*LVNHAULRi<@?1AXIX3s<y
zqVcHV4qH~lGp|xSPjDA^!_n~kq#jFzEgwClJnn6Y9Ivm0$HxJ#d$41-`4wAZ$XmE8
zGF!|gw010(sTE~}CzGMMX07N`lgZHhvr)`LlgW65tzUkQKdXd3;mPWuGQyL|kgxZA
zj?d)leZuDF0nQhd@IRNFlcQ}LTzSd84BRtLCXe&69V%f=#DK5u0pMoA9}we@=0RKw
zqx|;i);Q*CdjMz_{AYwbU%%rKCiiC!;Nd0*bPxdU7V@u`$bYGfpIt(p+Kd2iNT5HP
zh5rPP2tIwc2%Z-H{8acu^X_*z|LVebh+wa%hrWXZxKFXcRY3Q92u_so{|uLR!AWt?
zrWht`7d*DJ!K_Q>V~IN~74E?h+{ERtDSXEWnrxHj@7l}oyKIx^_3#iwh8h^4b`;Rh
z_nI{@RKmya=au%V!Z;+@R>tmgW%%DO!+%}aE%oPM8Tnsv|1X6+zOUU0J7$UgDd2RO
zdhq_wOmM<;LY{J1*VreI^R0H=|ILB1rit}8puD{jWYKSFUGpZlTUnSZ`Q9DBeWD)9
z&k?NSb}Io7B@y`E828;}{E3#~KU#+WbQ%74%kY1U@v+wco?{ln8)f9*LB8Eyn9~XH
z9$;~vi{Mxp{uLFI%l}1%)t@PUDW)HQaMJL)6QF6K&ZuUDx<w|(9fm%UD;C%tPQ)TS
zHLYPPX#B}4*b+)@F+!by`Dlw1P8ywhcQo!!KtxaK-O-exCpDu-3&#?1Jq4N;Nod`%
zL}w_bMT|r;rG?Uc5Ki>;#&koExIL3gXkF2GR0}1Op?*z|8_9m?N``uLEt2l(=?6_K
zqBQ)vPY?|!4Lu&=@4I5He`TxIx+<V)pauSFm49XXa?rH4RqM4@Rg|iMwV<^HSGV|s
z+UgZ6*0pwM9sZVJtHx9JKFX6@$?uY+e4(^)p-AEvI9y(jgp3gIx3RMG6N)hjIe}s2
z@h7k}4Xd#7?fhJ!q;x_yUeh9}gtjFVkHmD5{x67o7lPKlT1y#`Xk1ID^oTfVC<s^%
z$0MLcVj5o;g$x}H8_}@V8`VM6I#Vg(2|tm*RO<wF>&RmQi%ugZF!4BK0>e6^n84Ds
zj+M(r)A1B$p|r6Pc%zHclLFsrA?u8#=yaq|-dH$0;U_RfeCueXz`%;Yo$BwwzV1#L
zNegeGC%&%jj;Gz7>1Zr6KN<lyc0zC)dY=Jq?7PS@^kgq^IUG0Oj`YV<{XG^ol2*xs
zdNLJF#3vA165L5W7D5H_)EhIvolNlF<kq){{=X%X9H(I1t=?p!S5F%Kg5_^%pO1r{
zJ86v+%Sn2U^v6Rz(J;8X69)gW>{-@2Qz>wV6Foh8+yJ-O4scs3%WED4cgQf3(ayA?
zr)c*2(*f6MxYwlpDc$p>`@eMGmw>)Y1a7|mu<jZo&>DJ~*Z|YMoS;;Hq(pzSSjTP_
z`aE}B1bpo;a-RqbOY~`7IUo%ETVZ0hVB*)qT3_PQht7a#eZNK|94PNVQ0hO{hx!yh
zy3b9HQr>}p)`bKr0GwtlLHd-Bkj0DAdY4{<Fu_^?o{J!T%2%jD|BNt*`2u_-eaai$
zTaq`X{D)6`Bq`rPQ0jjt0M9j$eabJ)6Nh|wE{s5SNscfkVK8?=H03Wg3jN}IN3s6|
zc&?3YLi&_1d9_5J>=UN<$MXf$ZxIzz{-s82OekN2dYGdr)&F`)`_uaEIgt?h$C7}N
zKEXFj^ywZt-A|``=me$x@5K`R=fr*X=R`tj(;u<_FD2uj?(5S%{?hSM>OY<j7tbGb
zZ=de-)4hFyQvct@;~3Eg5oq5-_vK6N5l#3AUI;7Fr+gpK-#w6F0YnqV{*7aw@^zG_
zqQ9G<zmK4N8|l$J^ofW+>C?IR;klMUk|Q8}!e>kLDPNcq`gopK45UZc&i7~I{?oo?
zKm@)t-X+}u95$;@lmE027!vwEG9;k1J!c5}xPLDO(%)3f6z^J$XP40*6NXloI7}qr
zTAS7X2*x&AJ=Vid7Xbn!C}6U9(A-fBeVC}g{f^i`VRynggTg`c2lfk!T`?RI6ZgWB
X!V-7*S$v5Ihst>tURt71Lc;$7AAVAt

literal 0
HcmV?d00001

diff --git a/xen/arch/riscv/domain-build.c b/xen/arch/riscv/domain-build.c
index 5f6f4b6248a5..33cd1ea80f39 100644
--- a/xen/arch/riscv/domain-build.c
+++ b/xen/arch/riscv/domain-build.c
@@ -3,8 +3,11 @@
 #include <xen/fdt-domain-build.h>
 #include <xen/fdt-kernel.h>
 #include <xen/init.h>
+#include <xen/libfdt/libfdt.h>
 #include <xen/sched.h>
+#include <xen/xvmalloc.h>
 
+#include <asm/cpufeature.h>
 #include <asm/current.h>
 #include <asm/guest_access.h>
 
@@ -48,3 +51,125 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo)
 
     return 0;
 }
+
+int __init make_cpus_node(const struct domain *d, struct kernel_info *kinfo)
+{
+    int res;
+    const struct dt_device_node *cpus = dt_find_node_by_path("/cpus");
+    uint32_t timebase_frequency;
+    bool frequency_valid;
+    void *fdt = kinfo->fdt;
+    char *isa_str;
+    int len;
+
+    dt_dprintk("Create cpus node\n");
+
+    if ( !cpus )
+    {
+        dprintk(XENLOG_ERR, "Missing /cpus node in the device tree?\n");
+        return -ENOENT;
+    }
+
+    frequency_valid = dt_property_read_u32(cpus, "timebase-frequency",
+                                           &timebase_frequency);
+
+    if ( (len = build_guest_isa_str(NULL, 0, d->arch.isa)) < 0 )
+        return len;
+
+    if ( !(isa_str = xvmalloc_array(char, len + 1)) )
+        return -ENOMEM;
+
+    if ( build_guest_isa_str(isa_str, len + 1, d->arch.isa) != len )
+    {
+        res = -EINVAL;
+        goto out;
+    }
+
+    res = fdt_begin_node(fdt, "cpus");
+    if ( res )
+        goto out;
+
+    res = fdt_property_cell(fdt, "#address-cells", 1);
+    if ( res )
+        goto out;
+
+    res = fdt_property_cell(fdt, "#size-cells", 0);
+    if ( res )
+        goto out;
+
+    if ( frequency_valid )
+        res = fdt_property_cell(fdt, "timebase-frequency", timebase_frequency);
+
+    for ( unsigned int cpu = 0; cpu < d->max_vcpus; cpu++ )
+    {
+        char buf[64];
+
+        snprintf(buf, sizeof(buf), "cpu@%u", cpu);
+        res = fdt_begin_node(fdt, buf);
+        if ( res )
+            goto out;
+
+        res = fdt_property_cell(fdt, "reg", cpu);
+        if ( res )
+            goto out;
+
+        res = fdt_property_string(fdt, "status", "okay");
+        if ( res )
+            goto out;
+
+        res = fdt_property_string(fdt, "compatible", "riscv");
+        if ( res )
+            goto out;
+
+        BUILD_BUG_ON((sizeof("riscv,") +
+                      sizeof_field(struct gstage_mode_desc, name)) >= sizeof(buf));
+        snprintf(buf, sizeof(buf), "riscv,%s", max_gstage_mode->name);
+        res = fdt_property_string(fdt, "mmu-type", buf);
+        if ( res )
+            goto out;
+
+        res = fdt_property_string(fdt, "riscv,isa", isa_str);
+        if ( res )
+            goto out;
+
+        res = fdt_property_string(fdt, "device_type", "cpu");
+        if ( res )
+            goto out;
+
+        /* Start of interrupt-controller */
+        res = fdt_begin_node(fdt, "interrupt-controller");
+        if ( res )
+            goto out;
+
+        res = fdt_property_string(fdt, "compatible", "riscv,cpu-intc");
+        if ( res )
+            goto out;
+
+        res = fdt_property_cell(fdt, "#interrupt-cells", 1);
+        if ( res )
+            goto out;
+
+        res = fdt_property(fdt, "interrupt-controller", NULL, 0);
+        if ( res )
+            goto out;
+
+        res = fdt_property_u32(fdt, "phandle", alloc_phandle(kinfo));
+        if ( res )
+            goto out;
+
+        /* End of interrupt-controller */
+        res = fdt_end_node(fdt);
+        if ( res )
+            goto out;
+
+        res = fdt_end_node(fdt);
+        if ( res )
+            goto out;
+    }
+
+    res = fdt_end_node(fdt);
+
+ out:
+    xvfree(isa_str);
+    return res;
+}
-- 
2.54.0

Re: [PATCH v5 10/26] xen/riscv: implement make_cpus_node()

[Jan Beulich]

On 06.07.2026 17:57, Oleksii Kurochko wrote:
> Implement make_cpus_node() to create cpus node for a guest domain.
> 
> This function is going to be use by common dom0less code during
> construction domain.
> 
> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
> ---
> Changes in v5:
> - Drop Acked-by: Jan Beulich <jbeulich@suse.com> as extra changes were done
>   because of the changed in prev. patch.
> - Move isa_str allocation and construction out of arch_domain_create() and
>   into make_cpus_node() as a local variable, since the string is only
>   needed during FDT generation. Use a two-call build_guest_isa_str()
>   pattern (size probe, then fill) with xvmalloc_array, and convert all
>   post-allocation error returns to goto out so xvfree() runs on every path.
> ---
> Changes in v4:
>  - Update the comment in make_cpus_node() to match code style.
>  - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
> ---
> Changes in v3:
>  - Add blank line above make_cpus_node() function definition.
>  - Move 'unsigned int cpu' from function-level declarations into the for loop.
>  - Drop 'uint32_t reg = cpu_to_fdt32(cpu)'; use fdt_property_cell(fdt, "reg", cpu)
>    instead of fdt_property(fdt, "reg", &reg, sizeof(reg)) so byte-order adjustment
>    is handled internally.
>  - Add matching /* interrupt-controller */ start comment; fix end comment to
>    /* end interrupt-controller */.
>  - Update d->arch.guest_isa_str to ->isa_str in make_cpus_node() function.
> ---
> Changes in v2:
>  - s/u32/uint32_t for timebase_frequency local variable.
>  - Drop +1 from BUILD_BUG_ON().
>  - return fdt_end_node(fdt); instead of res at the end of the function.
> ---
> ---
>  build/tools/fixdep            | Bin 0 -> 13632 bytes

There was a stray file in the v4 series iirc. Now there again is a stray file
in v5. Can you please make sure to take a look yourself before posting a
series? Are you doing out-of-tree hypervisor builds, but with a build directory
within the source repo? There is an entry in .gitignore after all, just for
xen/tools/fixdep.

With this properly dropped:
Acked-by: Jan Beulich <jbeulich@suse.com>

Jan

Re: [PATCH v5 10/26] xen/riscv: implement make_cpus_node()

[Oleksii Kurochko]

On 7/9/26 3:20 PM, Jan Beulich wrote:
> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>> Implement make_cpus_node() to create cpus node for a guest domain.
>>
>> This function is going to be use by common dom0less code during
>> construction domain.
>>
>> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
>> ---
>> Changes in v5:
>> - Drop Acked-by: Jan Beulich <jbeulich@suse.com> as extra changes were done
>>    because of the changed in prev. patch.
>> - Move isa_str allocation and construction out of arch_domain_create() and
>>    into make_cpus_node() as a local variable, since the string is only
>>    needed during FDT generation. Use a two-call build_guest_isa_str()
>>    pattern (size probe, then fill) with xvmalloc_array, and convert all
>>    post-allocation error returns to goto out so xvfree() runs on every path.
>> ---
>> Changes in v4:
>>   - Update the comment in make_cpus_node() to match code style.
>>   - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
>> ---
>> Changes in v3:
>>   - Add blank line above make_cpus_node() function definition.
>>   - Move 'unsigned int cpu' from function-level declarations into the for loop.
>>   - Drop 'uint32_t reg = cpu_to_fdt32(cpu)'; use fdt_property_cell(fdt, "reg", cpu)
>>     instead of fdt_property(fdt, "reg", &reg, sizeof(reg)) so byte-order adjustment
>>     is handled internally.
>>   - Add matching /* interrupt-controller */ start comment; fix end comment to
>>     /* end interrupt-controller */.
>>   - Update d->arch.guest_isa_str to ->isa_str in make_cpus_node() function.
>> ---
>> Changes in v2:
>>   - s/u32/uint32_t for timebase_frequency local variable.
>>   - Drop +1 from BUILD_BUG_ON().
>>   - return fdt_end_node(fdt); instead of res at the end of the function.
>> ---
>> ---
>>   build/tools/fixdep            | Bin 0 -> 13632 bytes
> 
> There was a stray file in the v4 series iirc. Now there again is a stray file
> in v5. Can you please make sure to take a look yourself before posting a
> series? 

Sorry about that, I will double-check next time.

> Are you doing out-of-tree hypervisor builds, but with a build directory
> within the source repo? There is an entry in .gitignore after all, just for
> xen/tools/fixdep.

No, it should in-tree:
CONTAINER=bookworm-riscv64 ./automation/scripts/containerize make V=1 
XEN_TARGET_ARCH=riscv64 -C xen

Sometime I am doing without CONTAINER when I want to check on my system 
with newer compile version but still I don't use O=, just make ... -C xen.

> 
> With this properly dropped:
> Acked-by: Jan Beulich <jbeulich@suse.com>

Thanks.

~ Oleksii

[PATCH v5 11/26] xen/riscv: implement make_timer_node()

[Oleksii Kurochko]

Generally, in DT for RISC-V there is a document which describes a timer
node (riscv,timer.yaml or sifive,clint.yaml), but the Linux timer driver
is declared with TIMER_OF_DECLARE(riscv_timer, "riscv", ...).
It matches the CPU node (compatible "riscv"), not the timer node itself.
It then calls of_find_compatible_node(NULL, NULL, "riscv,timer") only to
read the optional riscv,timer-cannot-wake-cpu property.

Since Xen does not care about that property for now, make_timer_node() is
implemented to return 0, as no timer node needs to be created for RISC-V
guests.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v3-5:
 - Nothing changed. Only rebase.
---
Changes in v2:
 - Acked-by: Jan Beulich <jbeulich@suse.com>
 - Update the commit message.
---
---
 xen/arch/riscv/domain-build.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/xen/arch/riscv/domain-build.c b/xen/arch/riscv/domain-build.c
index 33cd1ea80f39..089e5ce0e0a4 100644
--- a/xen/arch/riscv/domain-build.c
+++ b/xen/arch/riscv/domain-build.c
@@ -3,6 +3,7 @@
 #include <xen/fdt-domain-build.h>
 #include <xen/fdt-kernel.h>
 #include <xen/init.h>
+#include <xen/fdt-kernel.h>
 #include <xen/libfdt/libfdt.h>
 #include <xen/sched.h>
 #include <xen/xvmalloc.h>
@@ -173,3 +174,10 @@ int __init make_cpus_node(const struct domain *d, struct kernel_info *kinfo)
     xvfree(isa_str);
     return res;
 }
+
+int __init make_timer_node(const struct kernel_info *kinfo)
+{
+    /* There is no need for timer node for RISC-V. */
+
+    return 0;
+}
-- 
2.54.0

[PATCH v5 12/26] xen/riscv: implement make_arch_nodes()

[Oleksii Kurochko]

No RISC-V-specific nodes need to be created at the moment,
so make_arch_nodes() is implemented to simply return 0.

It is placed in dom0less-build.c as make_arch_nodes() is
only used in the dom0less code path. In the future, it will
be extended to create an emulated UART node.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Drop "Add" before Acked-by above the footer.
---
Change in v4:
 - Add lost Acked-by.
---
Changes in v3:
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v2:
 - Update the commit message.
---
---
 xen/arch/riscv/dom0less-build.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/xen/arch/riscv/dom0less-build.c b/xen/arch/riscv/dom0less-build.c
index a683972e9235..4cc00012aa8d 100644
--- a/xen/arch/riscv/dom0less-build.c
+++ b/xen/arch/riscv/dom0less-build.c
@@ -2,10 +2,18 @@
 
 #include <xen/bootfdt.h>
 #include <xen/device_tree.h>
+#include <xen/fdt-kernel.h>
 #include <xen/init.h>
 
 #include <asm/p2m.h>
 
+int __init make_arch_nodes(struct kernel_info *kinfo)
+{
+    /* No RISC-V specific nodes need to be made, at the moment. */
+
+    return 0;
+}
+
 int __init arch_parse_dom0less_node(struct dt_device_node *node,
                                     struct boot_domain *bd)
 {
-- 
2.54.0

[PATCH v5 13/26] xen/riscv: introduce init interrupt controller operations

[Oleksii Kurochko]

Introduce intc_hw_init_ops structure to avoid risky mix of init
function and non-init function.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Nothin changed. Only rebase.
---
Changes in v4:
 - Use __initconstrel instead of __initconst for aplic_init_ops as both
   initialized fields incur a relocation.
 - Add Acked-by: ... .
---
Changes in v3:
 - Use __initconst instead of __initdata for const intc_hw_init_ops.
 - Embed const struct intc_hw_operations *ops into intc_hw_init_ops so
   register_intc_ops() takes a single pointer argument.
---
Changes in v2:
 - New patch.
---
---
 xen/arch/riscv/aplic.c            |  8 ++++++--
 xen/arch/riscv/include/asm/intc.h | 10 +++++++---
 xen/arch/riscv/intc.c             | 11 ++++++++---
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c
index 6a1255c5f403..126d56fb7ea8 100644
--- a/xen/arch/riscv/aplic.c
+++ b/xen/arch/riscv/aplic.c
@@ -306,12 +306,16 @@ static const hw_irq_controller aplic_xen_irq_type = {
 
 static const struct intc_hw_operations aplic_ops = {
     .info                = &aplic_info,
-    .init                = aplic_init,
     .host_irq_type       = &aplic_xen_irq_type,
     .handle_interrupt    = aplic_handle_interrupt,
     .set_irq_type        = aplic_set_irq_type,
 };
 
+static const struct intc_hw_init_ops __initconstrel aplic_init_ops = {
+    .ops                 = &aplic_ops,
+    .init                = aplic_init,
+};
+
 static int cf_check aplic_irq_xlate(const uint32_t *intspec,
                                     unsigned int intsize,
                                     unsigned int *out_hwirq,
@@ -347,7 +351,7 @@ static int __init aplic_preinit(struct dt_device_node *node, const void *dat)
 
     dt_irq_xlate = aplic_irq_xlate;
 
-    register_intc_ops(&aplic_ops);
+    register_intc_ops(&aplic_init_ops);
 
     /* Enable supervisor external interrupt */
     csr_set(CSR_SIE, BIT(IRQ_S_EXT, UL));
diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h
index 675f703ec97f..d7b34fc15ad1 100644
--- a/xen/arch/riscv/include/asm/intc.h
+++ b/xen/arch/riscv/include/asm/intc.h
@@ -28,8 +28,6 @@ struct intc_info {
 struct intc_hw_operations {
     /* Hold intc hw information */
     const struct intc_info *info;
-    /* Initialize the intc and the boot CPU */
-    int (*init)(void);
 
     /* hw_irq_controller to enable/disable/eoi host irq */
     const struct hw_interrupt_type *host_irq_type;
@@ -43,9 +41,15 @@ struct intc_hw_operations {
     void (*handle_interrupt)(struct cpu_user_regs *regs);
 };
 
+struct intc_hw_init_ops {
+    const struct intc_hw_operations *ops;
+    /* Initialize the intc and the boot CPU */
+    int (*init)(void);
+};
+
 void intc_preinit(void);
 
-void register_intc_ops(const struct intc_hw_operations *ops);
+void register_intc_ops(const struct intc_hw_init_ops *init_ops);
 
 void intc_init(void);
 
diff --git a/xen/arch/riscv/intc.c b/xen/arch/riscv/intc.c
index ea317aea5ad8..3600d23bdb5b 100644
--- a/xen/arch/riscv/intc.c
+++ b/xen/arch/riscv/intc.c
@@ -12,9 +12,12 @@
 
 static const struct intc_hw_operations *__ro_after_init intc_hw_ops;
 
-void __init register_intc_ops(const struct intc_hw_operations *ops)
+static const struct intc_hw_init_ops *__initdata intc_hw_init_ops;
+
+void __init register_intc_ops(const struct intc_hw_init_ops *init_ops)
 {
-    intc_hw_ops = ops;
+    intc_hw_ops = init_ops->ops;
+    intc_hw_init_ops = init_ops;
 }
 
 void __init intc_preinit(void)
@@ -27,7 +30,9 @@ void __init intc_preinit(void)
 
 void __init intc_init(void)
 {
-    if ( intc_hw_ops->init() )
+    ASSERT(intc_hw_init_ops && intc_hw_init_ops->init);
+
+    if ( intc_hw_init_ops->init() )
         panic("Failed to initialize the interrupt controller drivers\n");
 }
 
-- 
2.54.0

[PATCH v5 14/26] xen/riscv: implement make_intc_domU_node()

[Oleksii Kurochko]

Introduce a RISC-V specific function to create an interrupt controller
Device Tree node for DomU domains during dom0less build.

Add make_intc_domU_node() to the dom0less build path and wire it to
a new generic helper, intc_make_domu_dt_node(), which delegates DT
node creation to the active interrupt controller implementation via
vintc_init_ops.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Nothing changed. Onlye rebase.
---
Change in v4:
 - Made local variable vintc pointer-to-const.
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v3:
 - Use const struct vintc_init_ops *init_ops in struct vintc.
 - Drop redundant intc_hw_ops check in make_intc_domU_node().
 - Drop NULL pointer checks in make_intc_domU_node() as we can't start domU
   without properly created interrupt contoller node.
---
Changes in v2:
 - s/intc_make_domu_dt_node/make_intc_domU_node.
 - introduce separate intc_hw_init_ops structure for init operations.
 - Return -EOPNOTSUPP instead of -ENOSYS.
 - Drop const for kinfo argument as it could be changed by interrupt
   controller node creation code.
 - Refactor make_domu_dt_node().
 - Make make_domu_dt_node part of vintc structure as it looks more logical to be
   there.
---
---
 xen/arch/riscv/include/asm/domain.h |  2 ++
 xen/arch/riscv/include/asm/intc.h   | 10 ++++++++++
 xen/arch/riscv/intc.c               |  8 ++++++++
 3 files changed, 20 insertions(+)

diff --git a/xen/arch/riscv/include/asm/domain.h b/xen/arch/riscv/include/asm/domain.h
index 235b20f8a6ba..bdc6086a1752 100644
--- a/xen/arch/riscv/include/asm/domain.h
+++ b/xen/arch/riscv/include/asm/domain.h
@@ -97,6 +97,8 @@ struct arch_domain {
     struct paging_domain paging;
 
     DECLARE_BITMAP(isa, RISCV_ISA_EXT_MAX);
+
+    struct vintc *vintc;
 };
 
 #include <xen/sched.h>
diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h
index d7b34fc15ad1..a4e678fad90b 100644
--- a/xen/arch/riscv/include/asm/intc.h
+++ b/xen/arch/riscv/include/asm/intc.h
@@ -16,6 +16,7 @@ enum intc_variant {
 
 struct cpu_user_regs;
 struct irq_desc;
+struct kernel_info;
 
 struct intc_info {
     enum intc_variant hw_variant;
@@ -47,6 +48,15 @@ struct intc_hw_init_ops {
     int (*init)(void);
 };
 
+struct vintc_init_ops {
+    /* Create interrupt controller node for domain */
+    int (*make_domu_dt_node)(struct kernel_info *kinfo);
+};
+
+struct vintc {
+    const struct vintc_init_ops *init_ops;
+};
+
 void intc_preinit(void);
 
 void register_intc_ops(const struct intc_hw_init_ops *init_ops);
diff --git a/xen/arch/riscv/intc.c b/xen/arch/riscv/intc.c
index 3600d23bdb5b..e63da5e22efc 100644
--- a/xen/arch/riscv/intc.c
+++ b/xen/arch/riscv/intc.c
@@ -3,6 +3,7 @@
 #include <xen/acpi.h>
 #include <xen/bug.h>
 #include <xen/device_tree.h>
+#include <xen/fdt-kernel.h>
 #include <xen/init.h>
 #include <xen/irq.h>
 #include <xen/lib.h>
@@ -72,3 +73,10 @@ void intc_route_irq_to_xen(struct irq_desc *desc, unsigned int priority)
     intc_set_irq_type(desc, desc->arch.type);
     intc_set_irq_priority(desc, priority);
 }
+
+int __init make_intc_domU_node(struct kernel_info *kinfo)
+{
+    const struct vintc *vintc = kinfo->bd.d->arch.vintc;
+
+    return vintc->init_ops->make_domu_dt_node(kinfo);
+}
-- 
2.54.0

[PATCH v5 15/26] xen/riscv: introduce aia_init() and aia_usable()

[Oleksii Kurochko]

aia_init() is going to contain all the logic related to AIA initialization.

At the moment, it only checks whether the SSAIA extension is available,
and if so, sets is_aia_usable (which  indicates more than just the
availability of the extension) to true; it also signifies that the necessary
components (to be introduced in follow-up patches) have been initialized.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Update the guards in asm/aia.h according to CODING_STYLE:
   s/ASM__RISCV__AIA_H/RISCV_AIA_H.
---
Changes in v4:
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v3:
 - s/is_aia_usable/_aia_usable to drop the is_ prefix while avoiding
   conflict with the aia_usable() function name.
---
Changes in v2:
 - s/is_aia_available/is_aia_usable.
 - Drop return value for aia_init().
 - s/aia_available()/aia_usable().
---
---
 xen/arch/riscv/Makefile          |  1 +
 xen/arch/riscv/aia.c             | 23 +++++++++++++++++++++++
 xen/arch/riscv/include/asm/aia.h | 10 ++++++++++
 xen/arch/riscv/intc.c            |  3 +++
 4 files changed, 37 insertions(+)
 create mode 100644 xen/arch/riscv/aia.c
 create mode 100644 xen/arch/riscv/include/asm/aia.h

diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile
index fd5e499eb4b9..9df8b72b5494 100644
--- a/xen/arch/riscv/Makefile
+++ b/xen/arch/riscv/Makefile
@@ -1,3 +1,4 @@
+obj-y += aia.o
 obj-y += aplic.o
 obj-y += cpufeature.o
 obj-y += domain.o
diff --git a/xen/arch/riscv/aia.c b/xen/arch/riscv/aia.c
new file mode 100644
index 000000000000..e31c9c2d24b6
--- /dev/null
+++ b/xen/arch/riscv/aia.c
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <xen/errno.h>
+#include <xen/init.h>
+#include <xen/sections.h>
+#include <xen/types.h>
+
+#include <asm/cpufeature.h>
+
+static bool __ro_after_init _aia_usable;
+
+bool aia_usable(void)
+{
+    return _aia_usable;
+}
+
+void __init aia_init(void)
+{
+    if ( !riscv_isa_extension_available(NULL, RISCV_ISA_EXT_ssaia) )
+        return;
+
+    _aia_usable = true;
+}
diff --git a/xen/arch/riscv/include/asm/aia.h b/xen/arch/riscv/include/asm/aia.h
new file mode 100644
index 000000000000..aaa4bf91fc75
--- /dev/null
+++ b/xen/arch/riscv/include/asm/aia.h
@@ -0,0 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef RISCV_AIA_H
+#define RISCV_AIA_H
+
+bool aia_usable(void);
+
+void aia_init(void);
+
+#endif /* RISCV_AIA_H */
diff --git a/xen/arch/riscv/intc.c b/xen/arch/riscv/intc.c
index e63da5e22efc..2864a896b677 100644
--- a/xen/arch/riscv/intc.c
+++ b/xen/arch/riscv/intc.c
@@ -9,6 +9,7 @@
 #include <xen/lib.h>
 #include <xen/spinlock.h>
 
+#include <asm/aia.h>
 #include <asm/intc.h>
 
 static const struct intc_hw_operations *__ro_after_init intc_hw_ops;
@@ -33,6 +34,8 @@ void __init intc_init(void)
 {
     ASSERT(intc_hw_init_ops && intc_hw_init_ops->init);
 
+    aia_init();
+
     if ( intc_hw_init_ops->init() )
         panic("Failed to initialize the interrupt controller drivers\n");
 }
-- 
2.54.0

[PATCH v5 16/26] xen/riscv: introduce per-vCPU IMSIC state

[Oleksii Kurochko]

Each vCPU interacting with the IMSIC requires state to track the
associated guest interrupt file and its backing context.

Introduce a per-vCPU structure to hold IMSIC-related state, including
the guest interrupt file identifier and the CPU providing the backing
VS-file. Access to the guest file identifier is protected by a lock.

Initialize this structure during vCPU setup and store it in arch_vcpu.
The initial state marks the VS-file as software-backed until it becomes
associated with a physical CPU.

Add helper to retrieve the guest interrupt file identifier:
- vcpu_guest_file_id() is going to be used during update of APLIC's
  target register with the pair of information <guest_file_id, cpu_id>
  (to have MSI delivery mode work properly) when guest is trying to
  access vAPLIC's target register.
It will be used in the follow up patches.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - Move v->arch.vimsic_state = imsic_state; after full initialization of
   the struct, so the pointer only becomes globally visible once all
   fields are set up.
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v4:
-  s/w vs h/w IMSIC VS-file commentary for struct vimsic_state:
   - fix the vsfile_pcpu h/w condition:
     "vsfile_pcpu >= 0" -> "vsfile_pcpu < NR_CPUS"
     (the old wording conflicted with the s/w "== NR_CPUS" case).
   - reorder both comment blocks to the "s/w ... / h/w ..." form for readability.
 - drop IMPOSSIBLE_GUEST_FILE_ID: the s/w IMSIC VS-file is always available
   and corresponds to guest_file_id == 0, which xvzalloc() already provides,
   so the explicit initializer in vcpu_imsic_init() and the macro itself
   are unneeded.
---
Changes in v3:
 - Drop const from imsic_set_guest_file_id() and vcpu_imsic_deinit() as
   it only works due to vimsic_state being a pointer member.
 - Use XVFREE() in vcpu_imsic_deinit() to make it idempotent.
 - Fix SW-file typo in struct vimsic_state comments; should be VS-file.
 - Drop imsic_set_guest_file_id() here, it will be added later when it
   will be nessary to initialise guest file id as the correspondendt code
   in this patch series was reworked and there is no need to use this
   function in arch_vcpu_create().
 - Introduce IMPOSSIBLE_GUEST_FILE_ID and init with it ->guest_file_id.
---
Changes in v2:
 - Rename imsic_state to vimsic_state.
 - Use 'unsigned int' for vsfile_pcpu.
 - Drop initialzation of ->guest_file_id as it will be by default zero.
 - Add the comment about ->guest_file_id field.
 - Drop __init for vcpu_imsic_init() as it could be used during post-boot
   vCPU creation.
 - Update the commit message.
 - Drop locks around ->guest_file_id() in  vcpu_guest_file_id() and imsic_set_guest_file_id().
---
---
 xen/arch/riscv/imsic.c              | 35 +++++++++++++++++++++++++++++
 xen/arch/riscv/include/asm/domain.h |  2 ++
 xen/arch/riscv/include/asm/imsic.h  | 22 ++++++++++++++++++
 3 files changed, 59 insertions(+)

diff --git a/xen/arch/riscv/imsic.c b/xen/arch/riscv/imsic.c
index f7b70a8da09e..5a5758e45dc2 100644
--- a/xen/arch/riscv/imsic.c
+++ b/xen/arch/riscv/imsic.c
@@ -16,6 +16,7 @@
 #include <xen/errno.h>
 #include <xen/init.h>
 #include <xen/macros.h>
+#include <xen/sched.h>
 #include <xen/smp.h>
 #include <xen/spinlock.h>
 #include <xen/xvmalloc.h>
@@ -56,6 +57,11 @@ do {                            \
     csr_clear(CSR_SIREG, v);    \
 } while (0)
 
+unsigned int vcpu_guest_file_id(const struct vcpu *v)
+{
+    return ACCESS_ONCE(v->arch.vimsic_state->guest_file_id);
+}
+
 void __init imsic_ids_local_delivery(bool enable)
 {
     if ( enable )
@@ -312,6 +318,35 @@ static int imsic_parse_node(const struct dt_device_node *node,
     return 0;
 }
 
+int vcpu_imsic_init(struct vcpu *v)
+{
+    struct vimsic_state *imsic_state;
+
+    /* Allocate IMSIC context */
+    imsic_state = xvzalloc(struct vimsic_state);
+    if ( !imsic_state )
+        return -ENOMEM;
+
+    /* Setup IMSIC context  */
+    rwlock_init(&imsic_state->vsfile_lock);
+
+    /*
+     * xvzalloc() already cleared the context, so guest_file_id == 0, i.e. the
+     * always-available s/w IMSIC VS-file. Only vsfile_pcpu needs an explicit
+     * initializer as its s/w VS-file value is NR_CPUS rather than 0.
+     */
+    imsic_state->vsfile_pcpu = NR_CPUS;
+
+    v->arch.vimsic_state = imsic_state;
+
+    return 0;
+}
+
+void vcpu_imsic_deinit(struct vcpu *v)
+{
+    XVFREE(v->arch.vimsic_state);
+}
+
 /*
  * Initialize the imsic_cfg structure based on the IMSIC DT node.
  *
diff --git a/xen/arch/riscv/include/asm/domain.h b/xen/arch/riscv/include/asm/domain.h
index bdc6086a1752..a0f681e25c33 100644
--- a/xen/arch/riscv/include/asm/domain.h
+++ b/xen/arch/riscv/include/asm/domain.h
@@ -54,6 +54,8 @@ struct arch_vcpu {
 
     struct vtimer vtimer;
 
+    struct vimsic_state *vimsic_state;
+
     register_t hcounteren;
     register_t hedeleg;
     register_t hideleg;
diff --git a/xen/arch/riscv/include/asm/imsic.h b/xen/arch/riscv/include/asm/imsic.h
index c6c59215df20..e2c413487d24 100644
--- a/xen/arch/riscv/include/asm/imsic.h
+++ b/xen/arch/riscv/include/asm/imsic.h
@@ -11,6 +11,7 @@
 #ifndef ASM_RISCV_IMSIC_H
 #define ASM_RISCV_IMSIC_H
 
+#include <xen/rwlock.h>
 #include <xen/spinlock.h>
 #include <xen/stdbool.h>
 #include <xen/types.h>
@@ -61,7 +62,24 @@ struct imsic_config {
     spinlock_t lock;
 };
 
+struct vimsic_state {
+    /* IMSIC VS-file */
+    rwlock_t vsfile_lock;
+    /*
+     * s/w IMSIC VS-file -> guest_file_id == 0
+     * h/w IMSIC VS-file -> guest_file_id > 0
+     */
+    unsigned int guest_file_id;
+    /*
+     * s/w IMSIC VS-file -> vsfile_pcpu == NR_CPUS
+     * h/w IMSIC VS-file -> vsfile_pcpu < NR_CPUS
+     */
+    unsigned int vsfile_pcpu;
+};
+
 struct dt_device_node;
+struct vcpu;
+
 int imsic_init(const struct dt_device_node *node);
 
 const struct imsic_config *imsic_get_config(void);
@@ -71,4 +89,8 @@ void imsic_irq_disable(unsigned int hwirq);
 
 void imsic_ids_local_delivery(bool enable);
 
+int vcpu_imsic_init(struct vcpu *v);
+void vcpu_imsic_deinit(struct vcpu *v);
+unsigned int vcpu_guest_file_id(const struct vcpu *v);
+
 #endif /* ASM_RISCV_IMSIC_H */
-- 
2.54.0

[PATCH v5 17/26] xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure

[Oleksii Kurochko]

At the current development stage, only domain vINTC init and deinit
operations are required, so implement those first.

Initialize vAPLIC's domaincfg to with the interrupt-enable bit set and
MSI delivery mode selected as the current solution is exepcted to have
always IMSIC, and initialize vintc->ops.

Other operations such as emulate_load(), emulate_store(), and is_access()
will be needed once guests are running and MMIO accesses to APLIC MMIO
range must be handled. These will be introduced separately later.

Introduce a structure to describe a virtual interrupt controller (vINTC)
and a vintc_ops structure, which provides operations to emulate load and
store accesses to interrupt controller MMIOs and to check whether a given
address falls within the MMIO range of a specific virtual interrupt
controller.
Note that already existed init_ops field in struct vintc will be init-ed
for APLIC in the follow up patch.

The vAPLIC implementation of these operations will be provided later
once guests can be run and these operations are actually needed.

Introduce these structures here as they are required for the implementation
of domain_vaplic_init() and domain_vaplic_alloc(). Also, introduce
vaplic_init() and init vintc_ops->vcpu_init() with it.

Co-developed-by: Romain Caritey <Romain.Caritey@microchip.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
 - Add explanational comments for fields in struct vintc.
 - Drop unnessary empty line in asm/aplic.h.
 - Update the commit message to tell that init_ops will be init-ed later
   in follow up patch.
---
Changes in v4:
 - Change subject of the commit.
 - s/APLIC_DOMAINCFG_RO80/APLIC_DOMAINCFG_RO + added a comment above definition.
 - Drop unnessary blank lines.
---
Changes in v3:
 - Drop ASSERT() before vintc->ops->vcpu_init() in arch_vcpu_create(); a
   NULL deref already produces a sufficient backtrace.
 - Parenthesize macro argument in to_vaplic().
 - Drop __init from domain_vaplic_init() and domain_vaplic_deinit() since
   the caller domain_vintc_init() (follow-up patch) is not __init.
 - Remove pointless zero-initializer for rc in vcpu_vaplic_init().
 - Fix domain_vaplic_deinit() to null d->arch.vintc before freeing, making
   the function idempotent.
 - Drop intc_irq_nums(), (*nr_irqs)(void) hook from intc_hw_operations,
   aplic_nr_irqs(), and vintc->nr_irqs field entirely.
 - Rename vcpu_vaplic_init() to vaplic_init() and drop vgein_assign() and
   imsic_set_guest_file_id() calls; those will be introduced/called later,
   where for sure we will know on which pCPU vCPU as it is required for
   proper h/w IMSIC interrupt file calculation, to have this initialization
   in one place.
 - Introduce vaplic_deinit().
---
Changes in v2:
 - s/vcpu/v for function arguments in struct vintc_ops().
 - Update the comment above is_access() and drop const for addr argument.
 - Update to_vaplic() to work with 'struct domain *'.
 - Drop smsiaddrcfg{h} from vaplic_regs struct as they aren't used for now.
 - Drop inclusion of xen/schec.h from intc.c.
 - use result of xvzalloc() as initializer in vpalic_alloc().
 - Drop goto in domain_vaplic_init().
 - s/XVFREE/xvfree.
 - s/aplic/vintc.
 - Drop __init for vcpu_vaplic_init() as it could be called for secondary CPU bring up.
 - Drop vaplic_alloc().
 - Drop vintc_ops struct, embed callbacks iniside struct vintc.
 - Introduce and init vintc irqs for vAPLIC.
 - Introduce intc_irq_nums() to properly initialize number of vAPLIC's irqs.
---
---
 xen/arch/riscv/Makefile             |  1 +
 xen/arch/riscv/domain.c             | 11 ++---
 xen/arch/riscv/include/asm/aplic.h  |  2 +
 xen/arch/riscv/include/asm/intc.h   | 12 ++++++
 xen/arch/riscv/include/asm/vaplic.h | 34 ++++++++++++++++
 xen/arch/riscv/vaplic.c             | 63 +++++++++++++++++++++++++++++
 6 files changed, 115 insertions(+), 8 deletions(-)
 create mode 100644 xen/arch/riscv/include/asm/vaplic.h
 create mode 100644 xen/arch/riscv/vaplic.c

diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile
index 9df8b72b5494..9d8d21b65188 100644
--- a/xen/arch/riscv/Makefile
+++ b/xen/arch/riscv/Makefile
@@ -25,6 +25,7 @@ obj-y += smpboot.o
 obj-y += stubs.o
 obj-y += time.o
 obj-y += traps.o
+obj-y += vaplic.o
 obj-y += vmid.o
 obj-y += vm_event.o
 obj-y += vsbi/
diff --git a/xen/arch/riscv/domain.c b/xen/arch/riscv/domain.c
index c9933147595e..45712d305975 100644
--- a/xen/arch/riscv/domain.c
+++ b/xen/arch/riscv/domain.c
@@ -11,6 +11,7 @@
 #include <asm/bitops.h>
 #include <asm/cpufeature.h>
 #include <asm/csr.h>
+#include <asm/intc.h>
 #include <asm/riscv_encoding.h>
 #include <asm/vtimer.h>
 
@@ -155,14 +156,8 @@ int arch_vcpu_create(struct vcpu *v)
     if ( (rc = vcpu_vtimer_init(v)) )
         goto fail;
 
-    /*
-     * As interrupt controller (IC) is not yet implemented,
-     * return an error.
-     *
-     * TODO: Drop this once IC is implemented.
-     */
-    rc = -EOPNOTSUPP;
-    goto fail;
+    if ( (rc = v->domain->arch.vintc->ops->vcpu_init(v)) )
+        goto fail;
 
     return rc;
 
diff --git a/xen/arch/riscv/include/asm/aplic.h b/xen/arch/riscv/include/asm/aplic.h
index b0724fe6f360..31264e2e683a 100644
--- a/xen/arch/riscv/include/asm/aplic.h
+++ b/xen/arch/riscv/include/asm/aplic.h
@@ -15,6 +15,8 @@
 
 #include <asm/imsic.h>
 
+/* domaincfg bits 31:24 are read-only 0x80 */
+#define APLIC_DOMAINCFG_RO      (0x80U << 24)
 #define APLIC_DOMAINCFG_IE      BIT(8, U)
 #define APLIC_DOMAINCFG_DM      BIT(2, U)
 
diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h
index a4e678fad90b..5330666e139e 100644
--- a/xen/arch/riscv/include/asm/intc.h
+++ b/xen/arch/riscv/include/asm/intc.h
@@ -17,6 +17,7 @@ enum intc_variant {
 struct cpu_user_regs;
 struct irq_desc;
 struct kernel_info;
+struct vcpu;
 
 struct intc_info {
     enum intc_variant hw_variant;
@@ -53,8 +54,19 @@ struct vintc_init_ops {
     int (*make_domu_dt_node)(struct kernel_info *kinfo);
 };
 
+struct vintc_ops {
+    /* Initialize some vINTC-related stuff for a vCPU */
+    int (*vcpu_init)(struct vcpu *v);
+
+    /* Deinitialize some vINTC-related stuff for a vCPU */
+    void (*vcpu_deinit)(struct vcpu *v);
+};
+
 struct vintc {
+    /* Used during domain build only; dropped afterwards. */
     const struct vintc_init_ops *init_ops;
+    /* Runtime callbacks used for the lifetime of the guest. */
+    const struct vintc_ops *ops;
 };
 
 void intc_preinit(void);
diff --git a/xen/arch/riscv/include/asm/vaplic.h b/xen/arch/riscv/include/asm/vaplic.h
new file mode 100644
index 000000000000..96080bfbc23b
--- /dev/null
+++ b/xen/arch/riscv/include/asm/vaplic.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * xen/arch/riscv/vaplic.c
+ *
+ * Virtual RISC-V Advanced Platform-Level Interrupt Controller support
+ *
+ * Copyright (c) Microchip.
+ */
+
+#ifndef ASM__RISCV__VAPLIC_H
+#define ASM__RISCV__VAPLIC_H
+
+#include <xen/kernel.h>
+#include <xen/types.h>
+
+#include <asm/intc.h>
+
+struct domain;
+
+#define to_vaplic(d) container_of((d)->arch.vintc, struct vaplic, vintc)
+
+struct vaplic_regs {
+    uint32_t domaincfg;
+};
+
+struct vaplic {
+    struct vintc vintc;
+    struct vaplic_regs regs;
+};
+
+int domain_vaplic_init(struct domain *d);
+void domain_vaplic_deinit(struct domain *d);
+
+#endif /* ASM__RISCV__VAPLIC_H */
diff --git a/xen/arch/riscv/vaplic.c b/xen/arch/riscv/vaplic.c
new file mode 100644
index 000000000000..6562b25f0abb
--- /dev/null
+++ b/xen/arch/riscv/vaplic.c
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * xen/arch/riscv/vaplic.c
+ *
+ * Virtual RISC-V Advanced Platform-Level Interrupt Controller support
+ *
+ * Copyright (c) Microchip.
+ * Copyright (c) Vates
+ */
+
+#include <xen/errno.h>
+#include <xen/sched.h>
+#include <xen/xvmalloc.h>
+
+#include <asm/aia.h>
+#include <asm/imsic.h>
+#include <asm/intc.h>
+#include <asm/vaplic.h>
+
+#include "aplic-priv.h"
+
+static int cf_check vaplic_init(struct vcpu *v)
+{
+    return vcpu_imsic_init(v);
+}
+
+static void cf_check vaplic_deinit(struct vcpu *v)
+{
+    return vcpu_imsic_deinit(v);
+}
+
+static const struct vintc_ops vintc_ops = {
+    .vcpu_init = vaplic_init,
+    .vcpu_deinit = vaplic_deinit,
+};
+
+int domain_vaplic_init(struct domain *d)
+{
+    struct vaplic *vaplic = xvzalloc(struct vaplic);
+
+    if ( !vaplic )
+        return -ENOMEM;
+
+    d->arch.vintc = &vaplic->vintc;
+    d->arch.vintc->ops = &vintc_ops;
+
+    vaplic->regs.domaincfg = APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM |
+                             APLIC_DOMAINCFG_RO;
+
+    return 0;
+}
+
+void domain_vaplic_deinit(struct domain *d)
+{
+    struct vaplic *vaplic;
+
+    if ( !d->arch.vintc )
+        return;
+
+    vaplic = to_vaplic(d);
+    d->arch.vintc = NULL;
+    xvfree(vaplic);
+}
-- 
2.54.0

Re: [PATCH v5 17/26] xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure

[Jan Beulich]

On 06.07.2026 17:57, Oleksii Kurochko wrote:
> At the current development stage, only domain vINTC init and deinit
> operations are required, so implement those first.
> 
> Initialize vAPLIC's domaincfg to with the interrupt-enable bit set and
> MSI delivery mode selected as the current solution is exepcted to have
> always IMSIC, and initialize vintc->ops.

How would domaincfg be initialized on real hardware? I can see that maybe
firmware would have to set DM suitably (and you may mean to take firmware's
role here). But isn't setting at least IE entirely the OSes responsibility?

> --- a/xen/arch/riscv/include/asm/aplic.h
> +++ b/xen/arch/riscv/include/asm/aplic.h
> @@ -15,6 +15,8 @@
>  
>  #include <asm/imsic.h>
>  
> +/* domaincfg bits 31:24 are read-only 0x80 */
> +#define APLIC_DOMAINCFG_RO      (0x80U << 24)

Bit 7 is also documented as read-only 0. Wouldn't the comment better reflect
that as well?

>  #define APLIC_DOMAINCFG_IE      BIT(8, U)
>  #define APLIC_DOMAINCFG_DM      BIT(2, U)

Wouldn't you better spell out BE as well?

Jan

Re: [PATCH v5 17/26] xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure

[Oleksii Kurochko]

On 7/9/26 5:39 PM, Jan Beulich wrote:
> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>> At the current development stage, only domain vINTC init and deinit
>> operations are required, so implement those first.
>>
>> Initialize vAPLIC's domaincfg to with the interrupt-enable bit set and
>> MSI delivery mode selected as the current solution is exepcted to have
>> always IMSIC, and initialize vintc->ops.
> 
> How would domaincfg be initialized on real hardware? 

Xen will initialize that in aplic_init_hw_interrupts():
writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);

I can see that maybe
> firmware would have to set DM suitably (and you may mean to take firmware's
> role here). 

I don't think that firmware will do that (and OpenSBI for example 
doesn't do that). If firmware can do that we for sure want to control in 
Xen what is written to ->domaincfg.

> But isn't setting at least IE entirely the OSes responsibility?

At least, Linux setups ->domaincfg once at the boot time:

	/* Setup APLIC domaincfg register */
	val = readl(priv->regs + APLIC_DOMAINCFG);
	val |= APLIC_DOMAINCFG_IE;
	if (msi_mode)
		val |= APLIC_DOMAINCFG_DM;
	writel(val, priv->regs + APLIC_DOMAINCFG);
	if (readl(priv->regs + APLIC_DOMAINCFG) != val)
		dev_warn(priv->dev, "unable to write 0x%x in domaincfg\n", val);

And don't touch this register anymore, even for interrupt disablement it 
isn't used.

So Xen can just does once:
writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);

and then just properly handle access of a guest to domaincfg.

> 
>> --- a/xen/arch/riscv/include/asm/aplic.h
>> +++ b/xen/arch/riscv/include/asm/aplic.h
>> @@ -15,6 +15,8 @@
>>   
>>   #include <asm/imsic.h>
>>   
>> +/* domaincfg bits 31:24 are read-only 0x80 */
>> +#define APLIC_DOMAINCFG_RO      (0x80U << 24)
> 
> Bit 7 is also documented as read-only 0. Wouldn't the comment better reflect
> that as well?

Not sure, bits 31:24 are read-only *0x80* but bit 7 is read-only *0*.

> 
>>   #define APLIC_DOMAINCFG_IE      BIT(8, U)
>>   #define APLIC_DOMAINCFG_DM      BIT(2, U)
> 
> Wouldn't you better spell out BE as well?

I can add:
   #define APLIC_DOMAINCFG_BE       BIT(0, U)

But it isn't used at the moment (Linux also defines it but never 
actually using it). Do you want still to add that now?

Thanks.

~ Oleksii

Re: [PATCH v5 17/26] xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure

[Jan Beulich]

On 10.07.2026 17:52, Oleksii Kurochko wrote:
> On 7/9/26 5:39 PM, Jan Beulich wrote:
>> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>>> At the current development stage, only domain vINTC init and deinit
>>> operations are required, so implement those first.
>>>
>>> Initialize vAPLIC's domaincfg to with the interrupt-enable bit set and
>>> MSI delivery mode selected as the current solution is exepcted to have
>>> always IMSIC, and initialize vintc->ops.
>>
>> How would domaincfg be initialized on real hardware? 
> 
> Xen will initialize that in aplic_init_hw_interrupts():
> writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);

I.e. it is very much something the OS should do.

> I can see that maybe
>> firmware would have to set DM suitably (and you may mean to take firmware's
>> role here). 
> 
> I don't think that firmware will do that (and OpenSBI for example 
> doesn't do that). If firmware can do that we for sure want to control in 
> Xen what is written to ->domaincfg.
> 
>> But isn't setting at least IE entirely the OSes responsibility?
> 
> At least, Linux setups ->domaincfg once at the boot time:
> 
> 	/* Setup APLIC domaincfg register */
> 	val = readl(priv->regs + APLIC_DOMAINCFG);
> 	val |= APLIC_DOMAINCFG_IE;
> 	if (msi_mode)
> 		val |= APLIC_DOMAINCFG_DM;
> 	writel(val, priv->regs + APLIC_DOMAINCFG);
> 	if (readl(priv->regs + APLIC_DOMAINCFG) != val)
> 		dev_warn(priv->dev, "unable to write 0x%x in domaincfg\n", val);
> 
> And don't touch this register anymore, even for interrupt disablement it 
> isn't used.
> 
> So Xen can just does once:
> writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);
> 
> and then just properly handle access of a guest to domaincfg.

Xen can do this for itself, sure. But shouldn't domaincfg as seen by guests
start out 0 then?

>>> --- a/xen/arch/riscv/include/asm/aplic.h
>>> +++ b/xen/arch/riscv/include/asm/aplic.h
>>> @@ -15,6 +15,8 @@
>>>   
>>>   #include <asm/imsic.h>
>>>   
>>> +/* domaincfg bits 31:24 are read-only 0x80 */
>>> +#define APLIC_DOMAINCFG_RO      (0x80U << 24)
>>
>> Bit 7 is also documented as read-only 0. Wouldn't the comment better reflect
>> that as well?
> 
> Not sure, bits 31:24 are read-only *0x80* but bit 7 is read-only *0*.

And would it hurt if the comment said so, to avoid any ambiguity?

>>>   #define APLIC_DOMAINCFG_IE      BIT(8, U)
>>>   #define APLIC_DOMAINCFG_DM      BIT(2, U)
>>
>> Wouldn't you better spell out BE as well?
> 
> I can add:
>    #define APLIC_DOMAINCFG_BE       BIT(0, U)
> 
> But it isn't used at the moment (Linux also defines it but never 
> actually using it). Do you want still to add that now?

Imo it would be better to have a complete set of definitions. If you
don't allow guests to set this bit, perhaps to emit a sufficiently
informative debug log messages you may want to use the #define?

Jan

Re: [PATCH v5 17/26] xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure

[Oleksii Kurochko]

On 7/13/26 8:41 AM, Jan Beulich wrote:
> On 10.07.2026 17:52, Oleksii Kurochko wrote:
>> On 7/9/26 5:39 PM, Jan Beulich wrote:
>>> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>>>> At the current development stage, only domain vINTC init and deinit
>>>> operations are required, so implement those first.
>>>>
>>>> Initialize vAPLIC's domaincfg to with the interrupt-enable bit set and
>>>> MSI delivery mode selected as the current solution is exepcted to have
>>>> always IMSIC, and initialize vintc->ops.
>>>
>>> How would domaincfg be initialized on real hardware?
>>
>> Xen will initialize that in aplic_init_hw_interrupts():
>> writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);
> 
> I.e. it is very much something the OS should do.
> 
>> I can see that maybe
>>> firmware would have to set DM suitably (and you may mean to take firmware's
>>> role here).
>>
>> I don't think that firmware will do that (and OpenSBI for example
>> doesn't do that). If firmware can do that we for sure want to control in
>> Xen what is written to ->domaincfg.
>>
>>> But isn't setting at least IE entirely the OSes responsibility?
>>
>> At least, Linux setups ->domaincfg once at the boot time:
>>
>> 	/* Setup APLIC domaincfg register */
>> 	val = readl(priv->regs + APLIC_DOMAINCFG);
>> 	val |= APLIC_DOMAINCFG_IE;
>> 	if (msi_mode)
>> 		val |= APLIC_DOMAINCFG_DM;
>> 	writel(val, priv->regs + APLIC_DOMAINCFG);
>> 	if (readl(priv->regs + APLIC_DOMAINCFG) != val)
>> 		dev_warn(priv->dev, "unable to write 0x%x in domaincfg\n", val);
>>
>> And don't touch this register anymore, even for interrupt disablement it
>> isn't used.
>>
>> So Xen can just does once:
>> writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);
>>
>> and then just properly handle access of a guest to domaincfg.
> 
> Xen can do this for itself, sure. But shouldn't domaincfg as seen by guests
> start out 0 then?

Now I think I understand your point.

I agree that it should start from 0 (or from 0x80000000, since bits 
31:24 are read-only and fixed to 0x80). All other bits should be set or 
cleared by the guest and written to vaplic->regs.domaincfg when the 
guest accesses the vAPLIC domaincfg register.

In that case, domain_vaplic_init() should initialize ->domaincfg as:
   vaplic->regs.domaincfg = APLIC_DOMAINCFG_RO;

instead of:
   vaplic->regs.domaincfg = APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM |
                          APLIC_DOMAINCFG_RO;

> 
>>>> --- a/xen/arch/riscv/include/asm/aplic.h
>>>> +++ b/xen/arch/riscv/include/asm/aplic.h
>>>> @@ -15,6 +15,8 @@
>>>>    
>>>>    #include <asm/imsic.h>
>>>>    
>>>> +/* domaincfg bits 31:24 are read-only 0x80 */
>>>> +#define APLIC_DOMAINCFG_RO      (0x80U << 24)
>>>
>>> Bit 7 is also documented as read-only 0. Wouldn't the comment better reflect
>>> that as well?
>>
>> Not sure, bits 31:24 are read-only *0x80* but bit 7 is read-only *0*.
> 
> And would it hurt if the comment said so, to avoid any ambiguity?

Of course, it won't I will update the comment.

> 
>>>>    #define APLIC_DOMAINCFG_IE      BIT(8, U)
>>>>    #define APLIC_DOMAINCFG_DM      BIT(2, U)
>>>
>>> Wouldn't you better spell out BE as well?
>>
>> I can add:
>>     #define APLIC_DOMAINCFG_BE       BIT(0, U)
>>
>> But it isn't used at the moment (Linux also defines it but never
>> actually using it). Do you want still to add that now?
> 
> Imo it would be better to have a complete set of definitions. If you
> don't allow guests to set this bit, perhaps to emit a sufficiently
> informative debug log messages you may want to use the #define?

Agree, it make sense.

Thanks.

~ Oleksii

Re: [PATCH v5 17/26] xen/riscv: introduce minimal virtual APLIC (vAPLIC) infrastructure

[Jan Beulich]

On 13.07.2026 11:57, Oleksii Kurochko wrote:
> 
> 
> On 7/13/26 8:41 AM, Jan Beulich wrote:
>> On 10.07.2026 17:52, Oleksii Kurochko wrote:
>>> On 7/9/26 5:39 PM, Jan Beulich wrote:
>>>> On 06.07.2026 17:57, Oleksii Kurochko wrote:
>>>>> At the current development stage, only domain vINTC init and deinit
>>>>> operations are required, so implement those first.
>>>>>
>>>>> Initialize vAPLIC's domaincfg to with the interrupt-enable bit set and
>>>>> MSI delivery mode selected as the current solution is exepcted to have
>>>>> always IMSIC, and initialize vintc->ops.
>>>>
>>>> How would domaincfg be initialized on real hardware?
>>>
>>> Xen will initialize that in aplic_init_hw_interrupts():
>>> writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);
>>
>> I.e. it is very much something the OS should do.
>>
>>> I can see that maybe
>>>> firmware would have to set DM suitably (and you may mean to take firmware's
>>>> role here).
>>>
>>> I don't think that firmware will do that (and OpenSBI for example
>>> doesn't do that). If firmware can do that we for sure want to control in
>>> Xen what is written to ->domaincfg.
>>>
>>>> But isn't setting at least IE entirely the OSes responsibility?
>>>
>>> At least, Linux setups ->domaincfg once at the boot time:
>>>
>>> 	/* Setup APLIC domaincfg register */
>>> 	val = readl(priv->regs + APLIC_DOMAINCFG);
>>> 	val |= APLIC_DOMAINCFG_IE;
>>> 	if (msi_mode)
>>> 		val |= APLIC_DOMAINCFG_DM;
>>> 	writel(val, priv->regs + APLIC_DOMAINCFG);
>>> 	if (readl(priv->regs + APLIC_DOMAINCFG) != val)
>>> 		dev_warn(priv->dev, "unable to write 0x%x in domaincfg\n", val);
>>>
>>> And don't touch this register anymore, even for interrupt disablement it
>>> isn't used.
>>>
>>> So Xen can just does once:
>>> writel(APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM, &aplic.regs->domaincfg);
>>>
>>> and then just properly handle access of a guest to domaincfg.
>>
>> Xen can do this for itself, sure. But shouldn't domaincfg as seen by guests
>> start out 0 then?
> 
> Now I think I understand your point.
> 
> I agree that it should start from 0 (or from 0x80000000, since bits 
> 31:24 are read-only and fixed to 0x80). All other bits should be set or 
> cleared by the guest and written to vaplic->regs.domaincfg when the 
> guest accesses the vAPLIC domaincfg register.
> 
> In that case, domain_vaplic_init() should initialize ->domaincfg as:
>    vaplic->regs.domaincfg = APLIC_DOMAINCFG_RO;
> 
> instead of:
>    vaplic->regs.domaincfg = APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM |
>                           APLIC_DOMAINCFG_RO;

Yes.

Jan

[PATCH v5 18/26] xen/riscv: introduce (de)initialization helpers for vINTC

[Oleksii Kurochko]

Add common helpers domain_vintc_init() and domain_vintc_deinit() to
allocate and deallocate a virtual interrupt controller (vINTC)
structure and initialize basic virtual interrupt controller registers.

domain_vintc_deinit() isn't called at the moment as arch_domain_destroy()
is implemented as stub at the moment.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v5:
 - s/printk/printk_once().
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v4:
 - Drop the comment from domain_vintc_init() about guests receiving a
   virtual interrupt controller that mirrors the host hardware as there
   can (and eventually should) be alternatives.
 - Finish renaming intc_version to intc_variant in domain_vintc_(de)init()
   (enum intc_variant, info->hw_variant, local variable) started in the
   prev patch.
---
Changes in v3:
 - Drop redundant printk() from domain_vintc_deinit()'s default case to
   avoid duplicate messages when init fails.
 - Add a comment to domain_vintc_init() clarifying that guests currently
   receive a virtual interrupt controller that mirrors the host hardware.
---
Changes in v2:
 - Drop __init for domain_vintc_(de)init().
 - Update the commit message.
---
---
 xen/arch/riscv/domain.c           |  3 +++
 xen/arch/riscv/include/asm/intc.h |  3 +++
 xen/arch/riscv/intc.c             | 35 +++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/xen/arch/riscv/domain.c b/xen/arch/riscv/domain.c
index 45712d305975..4db9c28662c7 100644
--- a/xen/arch/riscv/domain.c
+++ b/xen/arch/riscv/domain.c
@@ -308,6 +308,9 @@ int arch_domain_create(struct domain *d,
     if ( (rc = p2m_init(d, config)) != 0)
         goto fail;
 
+    if ( (rc = domain_vintc_init(d)) )
+        goto fail;
+
     return rc;
 
  fail:
diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h
index 5330666e139e..dad4c5fab08b 100644
--- a/xen/arch/riscv/include/asm/intc.h
+++ b/xen/arch/riscv/include/asm/intc.h
@@ -79,4 +79,7 @@ void intc_route_irq_to_xen(struct irq_desc *desc, unsigned int priority);
 
 void intc_handle_external_irqs(struct cpu_user_regs *regs);
 
+int domain_vintc_init(struct domain *d);
+void domain_vintc_deinit(struct domain *d);
+
 #endif /* ASM__RISCV__INTERRUPT_CONTOLLER_H */
diff --git a/xen/arch/riscv/intc.c b/xen/arch/riscv/intc.c
index 2864a896b677..f5c8af6ddea4 100644
--- a/xen/arch/riscv/intc.c
+++ b/xen/arch/riscv/intc.c
@@ -11,6 +11,7 @@
 
 #include <asm/aia.h>
 #include <asm/intc.h>
+#include <asm/vaplic.h>
 
 static const struct intc_hw_operations *__ro_after_init intc_hw_ops;
 
@@ -83,3 +84,37 @@ int __init make_intc_domU_node(struct kernel_info *kinfo)
 
     return vintc->init_ops->make_domu_dt_node(kinfo);
 }
+
+int domain_vintc_init(struct domain *d)
+{
+    int ret = -EOPNOTSUPP;
+    const enum intc_variant variant = intc_hw_ops->info->hw_variant;
+
+    switch ( variant )
+    {
+    case INTC_APLIC:
+        ret = domain_vaplic_init(d);
+        break;
+
+    default:
+        printk_once("vintc (variant:%d) isn't implemented\n", variant);
+        break;
+    }
+
+    return ret;
+}
+
+void domain_vintc_deinit(struct domain *d)
+{
+    const enum intc_variant variant = intc_hw_ops->info->hw_variant;
+
+    switch ( variant )
+    {
+    case INTC_APLIC:
+        domain_vaplic_deinit(d);
+        break;
+
+    default:
+        break;
+    }
+}
-- 
2.54.0

[PATCH v5 19/26] xen/riscv: generate IMSIC DT node for guest domains

[Oleksii Kurochko]

Guests using the IMSIC interrupt controller require a corresponding
Device Tree description.

Add support for generating an IMSIC node when building the guest DT.
This allows guests to discover and use the IMSIC interrupt controller.

The value choosen for GUEST_IMSIC_S_BASE is an address which is typically
used for IMSIC and QEMU.

DT-building functions are marked __init because domain creation happens at
boot time, before the init sections are freed. In a typical deployment
libxl creates the interrupt controller node in userspace and hands the
complete FDT to Xen, so these functions are only called during early
domain construction.

Co-developed-by: Romain Caritey <Romain.Caritey@microchip.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
 - s/GUEST_IMSIC_NUM_MSIS/GUEST_IMSIC_MAX_MSIS throughout.
 - Changed __read_mostly → __ro_after_init on guest_num_msis, since the value
   is set once during __init and never again.
 - Made imsic_parse_node() __init.
 - Moved the min(GUEST_IMSIC_MAX_MSIS, ...) cap into imsic_parse_node() right
   after guest_num_msis is assigned, so the bound is applied once at init
   time rather than on every DT node construction call.
 - Removed the now-unnecessary num_msis local variable from
   vimsic_make_domu_dt_node(); guest_num_msis is used directly.
 - s/snprintf(buf, sizeof(buf), ...)/snprintf(buf, ARRAY_SIZE(buf), ...)
   in guest_imsic_set_interrupt_extended_prop().
 - Added decl. of vimsic_make_domu_dt_node() in this patch instead of next.
---
Changes in v4:
 - Add a comment for guest_num_msis explaining that it is host-dependent
   and therefore identical for every domain, which is why a single global
   is used instead of a per-domain value.
 - Reduce vimsic_name[] from 128 to 32 bytes, which is enough to hold
   "/soc/imsic@" plus a 64-bit hex address.
 - Add a comment before GUEST_IMSIC_S_BASE noting that the value is the
   address typically used for IMSIC by QEMU.
 - s/__ULL/_UL for defintion of GUEST_IMSIC_S_BASE.
---
Changes in v3:
 - s/__ro_after_init/__read_mostly for guest_num_msis.
 - Use IMSIC_MAX_ID as default for guest_num_msis instead of imsic_cfg.nr_ids.
 - Drop base_addr local variable in guest_imsic_make_reg_property(); use
   GUEST_IMSIC_S_BASE directly and introduce size to avoid spelling
   IMSIC_MMIO_PAGE_SZ * d->max_vcpus twice.
 - Change irq_ext type from uint32_t * to __be32 * in
   guest_imsic_set_interrupt_extended_prop().
 - Move phandle declaration into the loop body.
 - Extend commit message to explain why __init is used for DT-building
   functions: libxl creates the interrupt controller node before handing
   the FDT to Xen, so these functions are only invoked during boot-time
   domain construction.
 - Re-order patch before APLIC DT node creation patch.
 - Update commit message.
---
Changes in v2:
 - s/imsic_make_reg_property/guest_imsic_make_reg_property.
 - s/imsic_set_interrupt_extended_prop/guest_imsic_set_interrupt_extended_prop.
 - Use initalizer for regs[] array in imsic_make_reg_property().
 - Move buf[] insde the for() loop.
 - Correct check of returned phandle.
 - Drop local variable len.
 - /s/XVFREE/xvfree in imsic_set_interrupt_extended_prop().
 - Drop initializer for local variable data.
 - s/uint32_t/unsinged int for pos and cpu in imsic_set_interrupt_extended_prop().
 - Drop next_phandle as it is now in common code.
 - Introduce vcpu_imsic_deinit.
 - Refactor vimsic_make_domu_dt_node() to avoid usage of host IMSIC dt node.
---
---
 xen/arch/riscv/imsic.c                    | 144 +++++++++++++++++++++-
 xen/arch/riscv/include/asm/guest-layout.h |   6 +
 xen/arch/riscv/include/asm/imsic.h        |   3 +
 3 files changed, 152 insertions(+), 1 deletion(-)

diff --git a/xen/arch/riscv/imsic.c b/xen/arch/riscv/imsic.c
index 5a5758e45dc2..8966362fb149 100644
--- a/xen/arch/riscv/imsic.c
+++ b/xen/arch/riscv/imsic.c
@@ -13,8 +13,12 @@
 #include <xen/const.h>
 #include <xen/cpumask.h>
 #include <xen/device_tree.h>
+#include <xen/domain.h>
 #include <xen/errno.h>
+#include <xen/fdt-domain-build.h>
+#include <xen/fdt-kernel.h>
 #include <xen/init.h>
+#include <xen/libfdt/libfdt.h>
 #include <xen/macros.h>
 #include <xen/sched.h>
 #include <xen/smp.h>
@@ -34,6 +38,21 @@ static struct imsic_config imsic_cfg = {
     .lock = SPIN_LOCK_UNLOCKED,
 };
 
+/*
+ * Number of MSIs available to a guest. Determined by the host interrupt
+ * controller, so it is identical for every domain -- hence a single global
+ * rather than a per-domain value.
+ */
+static unsigned int __ro_after_init guest_num_msis;
+
+#define GUEST_IMSIC_COMPATIBLE "riscv,imsics"
+
+/*
+ * Value is inspired by what QEMU is using for riscv,num-ids property for IMSIC
+ * node.
+ */
+#define GUEST_IMSIC_MAX_MSIS 255
+
 #define IMSIC_DISABLE_EIDELIVERY    0
 #define IMSIC_ENABLE_EIDELIVERY     1
 #define IMSIC_DISABLE_EITHRESHOLD   1
@@ -182,7 +201,7 @@ static int __init imsic_get_parent_hartid(const struct dt_device_node *node,
  * or IRQ_M_EXT if the IMSIC node corresponds to a machine-mode IMSIC,
  * which should be ignored by the hypervisor.
  */
-static int imsic_parse_node(const struct dt_device_node *node,
+static int __init imsic_parse_node(const struct dt_device_node *node,
                             unsigned int *nr_parent_irqs,
                             unsigned int *nr_mmios)
 {
@@ -285,6 +304,13 @@ static int imsic_parse_node(const struct dt_device_node *node,
         return -ENOENT;
     }
 
+    if ( dt_property_read_u32(node, "riscv,num-guest-ids", &tmp) )
+        guest_num_msis = tmp;
+    else
+        guest_num_msis = IMSIC_MAX_ID;
+
+    guest_num_msis = min(GUEST_IMSIC_MAX_MSIS + 0U, guest_num_msis);
+
     if ( (imsic_cfg.nr_ids < IMSIC_MIN_ID) ||
          (imsic_cfg.nr_ids > IMSIC_MAX_ID) )
     {
@@ -522,3 +548,119 @@ int __init imsic_init(const struct dt_device_node *node)
 
     return rc;
 }
+
+static int __init guest_imsic_make_reg_property(struct domain *d, void *fdt)
+{
+    paddr_t size = IMSIC_MMIO_PAGE_SZ * d->max_vcpus;
+    __be32 regs[4] = {
+        cpu_to_be32(GUEST_IMSIC_S_BASE >> 32),
+        cpu_to_be32(GUEST_IMSIC_S_BASE),
+        cpu_to_be32(size >> 32),
+        cpu_to_be32(size),
+    };
+
+    return fdt_property(fdt, "reg", regs, sizeof(regs));
+}
+
+static int __init guest_imsic_set_interrupt_extended_prop(struct domain *d,
+                                                          void *fdt)
+{
+    unsigned int cpu, pos = 0;
+    __be32 *irq_ext;
+    int res;
+
+    irq_ext = xvzalloc_array(__be32, d->max_vcpus * 2);
+    if ( !irq_ext )
+        return -ENOMEM;
+
+    for ( cpu = 0; cpu < d->max_vcpus; cpu++ )
+    {
+        char buf[64];
+        uint32_t phandle;
+
+        snprintf(buf, ARRAY_SIZE(buf), "/cpus/cpu@%u/interrupt-controller", cpu);
+        phandle = fdt_get_phandle(fdt, fdt_path_offset(fdt, buf));
+
+        if ( !phandle )
+        {
+            res = -ENODEV;
+            goto out;
+        }
+
+        irq_ext[pos++] = cpu_to_be32(phandle);
+        irq_ext[pos++] = cpu_to_be32(IRQ_S_EXT);
+    }
+
+    res = fdt_property(fdt, "interrupts-extended", irq_ext,
+                       d->max_vcpus * 2 * sizeof(*irq_ext));
+
+ out:
+    xvfree(irq_ext);
+
+    return res;
+}
+
+int __init vimsic_make_domu_dt_node(struct kernel_info *kinfo,
+                                    unsigned int *phandle)
+{
+    int res;
+    void *fdt = kinfo->fdt;
+    char vimsic_name[32];
+    unsigned int vimsic_phandle;
+    res = snprintf(vimsic_name, sizeof(vimsic_name), "/soc/imsic@%lx",
+                   GUEST_IMSIC_S_BASE);
+    if ( res >= sizeof(vimsic_name) )
+    {
+        dprintk(XENLOG_DEBUG, "vimsic name is truncated\n");
+        return -ENOBUFS;
+    }
+
+    res = fdt_begin_node(fdt, vimsic_name);
+    if ( res )
+        return res;
+
+    res = fdt_property_string(fdt, "compatible", GUEST_IMSIC_COMPATIBLE);
+    if ( res )
+        return res;
+
+    res = guest_imsic_make_reg_property(kinfo->bd.d, fdt);
+    if ( res )
+        return res;
+
+    res = guest_imsic_set_interrupt_extended_prop(kinfo->bd.d, fdt);
+    if ( res )
+        return res;
+
+    res = fdt_property_u32(fdt, "riscv,num-ids", guest_num_msis);
+    if ( res )
+        return res;
+
+    res = fdt_property(fdt, "msi-controller", NULL, 0);
+    if ( res )
+        return res;
+
+    res = fdt_property_u32(fdt, "#msi-cells", 0);
+    if ( res )
+        return res;
+
+    res = fdt_property(fdt, "interrupt-controller", NULL, 0);
+    if ( res )
+        return res;
+
+    res = fdt_property_u32(fdt, "#interrupt-cells", 0);
+    if ( res )
+        return res;
+
+    vimsic_phandle = alloc_phandle(kinfo);
+    if ( !vimsic_phandle )
+        return -EOVERFLOW;
+
+    res = fdt_property_cell(fdt, "phandle", vimsic_phandle);
+    if ( res )
+        return res;
+
+    if ( phandle )
+        *phandle = vimsic_phandle;
+
+    return fdt_end_node(fdt);
+}
diff --git a/xen/arch/riscv/include/asm/guest-layout.h b/xen/arch/riscv/include/asm/guest-layout.h
index 68d95a09394c..5e566450bdfa 100644
--- a/xen/arch/riscv/include/asm/guest-layout.h
+++ b/xen/arch/riscv/include/asm/guest-layout.h
@@ -3,6 +3,12 @@
 
 #include <public/xen.h>
 
+/*
+ * Base address of the guest's supervisor-mode IMSIC. The value is the address
+ * typically used for IMSIC by QEMU.
+ */
+#define GUEST_IMSIC_S_BASE _UL(0x28000000)
+
 #define GUEST_RAM_BANKS   2
 
 /*
diff --git a/xen/arch/riscv/include/asm/imsic.h b/xen/arch/riscv/include/asm/imsic.h
index e2c413487d24..e1ec3d03c4e9 100644
--- a/xen/arch/riscv/include/asm/imsic.h
+++ b/xen/arch/riscv/include/asm/imsic.h
@@ -78,6 +78,7 @@ struct vimsic_state {
 };
 
 struct dt_device_node;
+struct kernel_info;
 struct vcpu;
 
 int imsic_init(const struct dt_device_node *node);
@@ -93,4 +94,6 @@ int vcpu_imsic_init(struct vcpu *v);
 void vcpu_imsic_deinit(struct vcpu *v);
 unsigned int vcpu_guest_file_id(const struct vcpu *v);
 
+int vimsic_make_domu_dt_node(struct kernel_info *kinfo, unsigned int *phandle);
+
 #endif /* ASM_RISCV_IMSIC_H */
-- 
2.54.0

Re: [PATCH v5 19/26] xen/riscv: generate IMSIC DT node for guest domains

[Jan Beulich]

On 06.07.2026 17:58, Oleksii Kurochko wrote:
> --- a/xen/arch/riscv/imsic.c
> +++ b/xen/arch/riscv/imsic.c
> @@ -13,8 +13,12 @@
>  #include <xen/const.h>
>  #include <xen/cpumask.h>
>  #include <xen/device_tree.h>
> +#include <xen/domain.h>
>  #include <xen/errno.h>
> +#include <xen/fdt-domain-build.h>
> +#include <xen/fdt-kernel.h>
>  #include <xen/init.h>
> +#include <xen/libfdt/libfdt.h>
>  #include <xen/macros.h>
>  #include <xen/sched.h>
>  #include <xen/smp.h>
> @@ -34,6 +38,21 @@ static struct imsic_config imsic_cfg = {
>      .lock = SPIN_LOCK_UNLOCKED,
>  };
>  
> +/*
> + * Number of MSIs available to a guest. Determined by the host interrupt
> + * controller, so it is identical for every domain -- hence a single global
> + * rather than a per-domain value.
> + */
> +static unsigned int __ro_after_init guest_num_msis;
> +
> +#define GUEST_IMSIC_COMPATIBLE "riscv,imsics"
> +
> +/*
> + * Value is inspired by what QEMU is using for riscv,num-ids property for IMSIC
> + * node.
> + */
> +#define GUEST_IMSIC_MAX_MSIS 255

#define GUEST_IMSIC_MAX_MSIS 255U

to avoid ...

> @@ -285,6 +304,13 @@ static int imsic_parse_node(const struct dt_device_node *node,
>          return -ENOENT;
>      }
>  
> +    if ( dt_property_read_u32(node, "riscv,num-guest-ids", &tmp) )
> +        guest_num_msis = tmp;
> +    else
> +        guest_num_msis = IMSIC_MAX_ID;
> +
> +    guest_num_msis = min(GUEST_IMSIC_MAX_MSIS + 0U, guest_num_msis);

... the "+ 0U" here?

As to the use of IMSIC_MAX_ID - why not use GUEST_IMSIC_MAX_MSIS right away?
Overall perhaps

    if ( dt_property_read_u32(node, "riscv,num-guest-ids", &tmp) )
        guest_num_msis = min(GUEST_IMSIC_MAX_MSIS, tmp);
    else
        guest_num_msis = GUEST_IMSIC_MAX_MSIS;

?

> @@ -522,3 +548,119 @@ int __init imsic_init(const struct dt_device_node *node)
>  
>      return rc;
>  }
> +
> +static int __init guest_imsic_make_reg_property(struct domain *d, void *fdt)
> +{
> +    paddr_t size = IMSIC_MMIO_PAGE_SZ * d->max_vcpus;
> +    __be32 regs[4] = {
> +        cpu_to_be32(GUEST_IMSIC_S_BASE >> 32),
> +        cpu_to_be32(GUEST_IMSIC_S_BASE),
> +        cpu_to_be32(size >> 32),
> +        cpu_to_be32(size),
> +    };
> +
> +    return fdt_property(fdt, "reg", regs, sizeof(regs));
> +}
> +
> +static int __init guest_imsic_set_interrupt_extended_prop(struct domain *d,
> +                                                          void *fdt)
> +{
> +    unsigned int cpu, pos = 0;
> +    __be32 *irq_ext;
> +    int res;
> +
> +    irq_ext = xvzalloc_array(__be32, d->max_vcpus * 2);
> +    if ( !irq_ext )
> +        return -ENOMEM;
> +
> +    for ( cpu = 0; cpu < d->max_vcpus; cpu++ )
> +    {
> +        char buf[64];
> +        uint32_t phandle;
> +
> +        snprintf(buf, ARRAY_SIZE(buf), "/cpus/cpu@%u/interrupt-controller", cpu);
> +        phandle = fdt_get_phandle(fdt, fdt_path_offset(fdt, buf));
> +
> +        if ( !phandle )
> +        {
> +            res = -ENODEV;
> +            goto out;
> +        }
> +
> +        irq_ext[pos++] = cpu_to_be32(phandle);
> +        irq_ext[pos++] = cpu_to_be32(IRQ_S_EXT);
> +    }
> +
> +    res = fdt_property(fdt, "interrupts-extended", irq_ext,
> +                       d->max_vcpus * 2 * sizeof(*irq_ext));
> +
> + out:
> +    xvfree(irq_ext);
> +
> +    return res;
> +}
> +
> +int __init vimsic_make_domu_dt_node(struct kernel_info *kinfo,
> +                                    unsigned int *phandle)
> +{
> +    int res;
> +    void *fdt = kinfo->fdt;
> +    char vimsic_name[32];
> +    unsigned int vimsic_phandle;
> +    res = snprintf(vimsic_name, sizeof(vimsic_name), "/soc/imsic@%lx",
> +                   GUEST_IMSIC_S_BASE);

Blank line please between declaration(s) and statement(s). Also the revlog
claims you switched to ARRAY_SIZE() everywhere, when really you didn't.

Jan

Re: [PATCH v5 19/26] xen/riscv: generate IMSIC DT node for guest domains

[Oleksii Kurochko]

On 7/9/26 5:49 PM, Jan Beulich wrote:
> On 06.07.2026 17:58, Oleksii Kurochko wrote:
>> --- a/xen/arch/riscv/imsic.c
>> +++ b/xen/arch/riscv/imsic.c
>> @@ -13,8 +13,12 @@
>>   #include <xen/const.h>
>>   #include <xen/cpumask.h>
>>   #include <xen/device_tree.h>
>> +#include <xen/domain.h>
>>   #include <xen/errno.h>
>> +#include <xen/fdt-domain-build.h>
>> +#include <xen/fdt-kernel.h>
>>   #include <xen/init.h>
>> +#include <xen/libfdt/libfdt.h>
>>   #include <xen/macros.h>
>>   #include <xen/sched.h>
>>   #include <xen/smp.h>
>> @@ -34,6 +38,21 @@ static struct imsic_config imsic_cfg = {
>>       .lock = SPIN_LOCK_UNLOCKED,
>>   };
>>   
>> +/*
>> + * Number of MSIs available to a guest. Determined by the host interrupt
>> + * controller, so it is identical for every domain -- hence a single global
>> + * rather than a per-domain value.
>> + */
>> +static unsigned int __ro_after_init guest_num_msis;
>> +
>> +#define GUEST_IMSIC_COMPATIBLE "riscv,imsics"
>> +
>> +/*
>> + * Value is inspired by what QEMU is using for riscv,num-ids property for IMSIC
>> + * node.
>> + */
>> +#define GUEST_IMSIC_MAX_MSIS 255
> 
> #define GUEST_IMSIC_MAX_MSIS 255U
> 
> to avoid ...
> 
>> @@ -285,6 +304,13 @@ static int imsic_parse_node(const struct dt_device_node *node,
>>           return -ENOENT;
>>       }
>>   
>> +    if ( dt_property_read_u32(node, "riscv,num-guest-ids", &tmp) )
>> +        guest_num_msis = tmp;
>> +    else
>> +        guest_num_msis = IMSIC_MAX_ID;
>> +
>> +    guest_num_msis = min(GUEST_IMSIC_MAX_MSIS + 0U, guest_num_msis);
> 
> ... the "+ 0U" here?

Good point. I'll apply.

> 
> As to the use of IMSIC_MAX_ID - why not use GUEST_IMSIC_MAX_MSIS right away?
> Overall perhaps
> 
>      if ( dt_property_read_u32(node, "riscv,num-guest-ids", &tmp) )
>          guest_num_msis = min(GUEST_IMSIC_MAX_MSIS, tmp);
>      else
>          guest_num_msis = GUEST_IMSIC_MAX_MSIS;
> 
> ?

Agree, it would be better.

> 
>> @@ -522,3 +548,119 @@ int __init imsic_init(const struct dt_device_node *node)
>>   
>>       return rc;
>>   }
>> +
>> +static int __init guest_imsic_make_reg_property(struct domain *d, void *fdt)
>> +{
>> +    paddr_t size = IMSIC_MMIO_PAGE_SZ * d->max_vcpus;
>> +    __be32 regs[4] = {
>> +        cpu_to_be32(GUEST_IMSIC_S_BASE >> 32),
>> +        cpu_to_be32(GUEST_IMSIC_S_BASE),
>> +        cpu_to_be32(size >> 32),
>> +        cpu_to_be32(size),
>> +    };
>> +
>> +    return fdt_property(fdt, "reg", regs, sizeof(regs));
>> +}
>> +
>> +static int __init guest_imsic_set_interrupt_extended_prop(struct domain *d,
>> +                                                          void *fdt)
>> +{
>> +    unsigned int cpu, pos = 0;
>> +    __be32 *irq_ext;
>> +    int res;
>> +
>> +    irq_ext = xvzalloc_array(__be32, d->max_vcpus * 2);
>> +    if ( !irq_ext )
>> +        return -ENOMEM;
>> +
>> +    for ( cpu = 0; cpu < d->max_vcpus; cpu++ )
>> +    {
>> +        char buf[64];
>> +        uint32_t phandle;
>> +
>> +        snprintf(buf, ARRAY_SIZE(buf), "/cpus/cpu@%u/interrupt-controller", cpu);
>> +        phandle = fdt_get_phandle(fdt, fdt_path_offset(fdt, buf));
>> +
>> +        if ( !phandle )
>> +        {
>> +            res = -ENODEV;
>> +            goto out;
>> +        }
>> +
>> +        irq_ext[pos++] = cpu_to_be32(phandle);
>> +        irq_ext[pos++] = cpu_to_be32(IRQ_S_EXT);
>> +    }
>> +
>> +    res = fdt_property(fdt, "interrupts-extended", irq_ext,
>> +                       d->max_vcpus * 2 * sizeof(*irq_ext));
>> +
>> + out:
>> +    xvfree(irq_ext);
>> +
>> +    return res;
>> +}
>> +
>> +int __init vimsic_make_domu_dt_node(struct kernel_info *kinfo,
>> +                                    unsigned int *phandle)
>> +{
>> +    int res;
>> +    void *fdt = kinfo->fdt;
>> +    char vimsic_name[32];
>> +    unsigned int vimsic_phandle;
>> +    res = snprintf(vimsic_name, sizeof(vimsic_name), "/soc/imsic@%lx",
>> +                   GUEST_IMSIC_S_BASE);
> 
> Blank line please between declaration(s) and statement(s). Also the revlog
> claims you switched to ARRAY_SIZE() everywhere, when really you didn't.

I will do that next patch series version.

Thanks.

~ Oleksii

[PATCH v5 20/26] xen/riscv: create APLIC DT node for guest domains

[Oleksii Kurochko]

Guests require a Device Tree description of the interrupt controller
topology. Add support for creating an APLIC node when building the
guest DT.

Provide stub for imsic_make_dt_node() it will be introduced properly
in follow-up patch.

The value chosen for GUEST_APLIC_S_BASE is based on QEMU one.

DT-building functions are marked __init because domain creation happens at
boot time, before the init sections are freed. In a typical deployment
libxl creates the interrupt controller node in userspace and hands the
complete FDT to Xen, so these functions are only called during early
domain construction.

Co-developed-by: Romain Caritey <Romain.Caritey@microchip.com>
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
 - Drop pointless initializer for local variable res in
   vaplic_make_domu_dt_node().
 - Limit guest_num_sources in the similar way to IMSIC.
 - Rename VAPLIC_NUM_SOURCES to GUEST_APLIC_MAX_SOURCES to be aligned with
   the similar place in vIMSIC related code.
---
Changes in v4:
 - Drop spurious <xen/fdt-kernel.h> and <xen/libfdt/libfdt.h> includes from
   aplic.c (mistakenly added, they belong to vaplic.c).
 - Reduce vaplic_name[] from 128 to 32 bytes in vaplic_make_domu_dt_node().
 - Use __initconstrel (with const) for init_ops instead of __initdata.
 - s/__ULL/_UL for defintion of GUEST_APLIC_S_BASE.
---
Changes in v3:
 - Fix rebase conflicts becuase of this patch is reordered after IMSIC DT
   node creation is intoduced.
 - Update the commit message.
 - Move initialization of domaincfg with APLIC_DOMAINCFG_RO80 from this
   patch to earlier.
 - Change paddr_t aplic_size to unsigned int in vaplic_make_domu_dt_node()
   and replace the UB (after it started to be uint) aplic_size >> 32 with
   an explicit 0 in the DT reg property.
 - Add BUILD_BUG_ON() to be sure that aplic size isn't bigger then
   UINT32_MAX.
---
Changes in v2:
 - Avoid as max as possible of host properties inheritance. Only number of
   APLIC's irqs are checked what leads to an introduction of
   get_aplic_irqs_num().
 - Move this patch earlier what leads to an introduction of
   vimsic_make_domu_dt_node() stub.
 - s/vimsic_make_domu_dt_node/imsic_make_domu_dt_node.
 - Refactor vimsic_make_domu_dt_node() to avoid re-usage of APLIC host
   properties.
 - Drop next_phandle as it is now in common code.
 - Drop const for kinfo argument of vimsic_make_domu_dt_node() is is
   going to be updated inside vimsic_make_domu_dt_node().
 - Use introduced before vintc->num_irqs.
---
---
 xen/arch/riscv/aplic-priv.h               | 14 +++++
 xen/arch/riscv/aplic.c                    |  2 +
 xen/arch/riscv/include/asm/aplic.h        |  8 +++
 xen/arch/riscv/include/asm/guest-layout.h |  6 ++
 xen/arch/riscv/vaplic.c                   | 77 +++++++++++++++++++++++
 5 files changed, 107 insertions(+)

diff --git a/xen/arch/riscv/aplic-priv.h b/xen/arch/riscv/aplic-priv.h
index 85e0d028d1ae..ac971f34add3 100644
--- a/xen/arch/riscv/aplic-priv.h
+++ b/xen/arch/riscv/aplic-priv.h
@@ -34,4 +34,18 @@ struct aplic_priv {
     const struct imsic_config *imsic_cfg;
 };
 
+/*
+ * Value is inspired by what QEMU is using for riscv,num-sources property for
+ * APLIC node.
+ */
+#define GUEST_APLIC_MAX_SOURCES 96
+
+/*
+ * Specifies the number of wired interrupt sources supported by guest APLIC
+ * domain.
+ * Could be limited by host interrupt controller and is identical for every
+ * domain.
+ */
+extern unsigned int guest_num_sources;
+
 #endif /* ASM_RISCV_APLIC_PRIV_H */
diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c
index 126d56fb7ea8..5f8ae4d97b87 100644
--- a/xen/arch/riscv/aplic.c
+++ b/xen/arch/riscv/aplic.c
@@ -92,6 +92,8 @@ static int __init cf_check aplic_init(void)
         panic("%s: failed to get number of interrupt sources\n",
               node->full_name);
 
+    guest_num_sources = min(GUEST_APLIC_MAX_SOURCES + 0U, aplic_info.num_irqs);
+
     if ( aplic_info.num_irqs > ARRAY_SIZE(aplic.regs->sourcecfg) )
         aplic_info.num_irqs = ARRAY_SIZE(aplic.regs->sourcecfg);
 
diff --git a/xen/arch/riscv/include/asm/aplic.h b/xen/arch/riscv/include/asm/aplic.h
index 31264e2e683a..5a1ab85353e1 100644
--- a/xen/arch/riscv/include/asm/aplic.h
+++ b/xen/arch/riscv/include/asm/aplic.h
@@ -29,6 +29,14 @@
 
 #define APLIC_TARGET_HART_IDX_SHIFT 18
 
+#define APLIC_IDC_SIZE          32
+
+#define APLIC_MIN_SIZE          0x4000
+#define APLIC_SIZE_ALIGN(x)     ROUNDUP(x, APLIC_MIN_SIZE)
+
+#define APLIC_SIZE(nr_cpus)     (APLIC_MIN_SIZE + \
+                                 APLIC_SIZE_ALIGN(APLIC_IDC_SIZE * (nr_cpus)))
+
 struct aplic_regs {
     uint32_t domaincfg;         /* 0x0000 */
     uint32_t sourcecfg[1023];   /* 0x0004 */
diff --git a/xen/arch/riscv/include/asm/guest-layout.h b/xen/arch/riscv/include/asm/guest-layout.h
index 5e566450bdfa..90603f06bb91 100644
--- a/xen/arch/riscv/include/asm/guest-layout.h
+++ b/xen/arch/riscv/include/asm/guest-layout.h
@@ -3,6 +3,12 @@
 
 #include <public/xen.h>
 
+/*
+ * Base address of the guest's supervisor-mode APLIC. The value is the address
+ * typically used for APLIC by QEMU.
+ */
+#define GUEST_APLIC_S_BASE _UL(0xd000000)
+
 /*
  * Base address of the guest's supervisor-mode IMSIC. The value is the address
  * typically used for IMSIC by QEMU.
diff --git a/xen/arch/riscv/vaplic.c b/xen/arch/riscv/vaplic.c
index 6562b25f0abb..719c439e48d9 100644
--- a/xen/arch/riscv/vaplic.c
+++ b/xen/arch/riscv/vaplic.c
@@ -9,6 +9,8 @@
  */
 
 #include <xen/errno.h>
+#include <xen/fdt-kernel.h>
+#include <xen/libfdt/libfdt.h>
 #include <xen/sched.h>
 #include <xen/xvmalloc.h>
 
@@ -19,6 +21,12 @@
 
 #include "aplic-priv.h"
 
+unsigned int __ro_after_init guest_num_sources;
+
+#define VAPLIC_COMPATIBLE "riscv,aplic"
+
+#define FDT_VAPLIC_INT_CELLS 2
+
 static int cf_check vaplic_init(struct vcpu *v)
 {
     return vcpu_imsic_init(v);
@@ -29,6 +37,74 @@ static void cf_check vaplic_deinit(struct vcpu *v)
     return vcpu_imsic_deinit(v);
 }
 
+static int __init cf_check vaplic_make_domu_dt_node(struct kernel_info *kinfo)
+{
+    struct domain *d = kinfo->bd.d;
+    int res;
+    void *fdt = kinfo->fdt;
+    unsigned int msi_parent_phandle;
+    char vaplic_name[32];
+    unsigned int aplic_size = APLIC_SIZE(d->max_vcpus);
+    const __be32 reg[] = {
+        cpu_to_be32(GUEST_APLIC_S_BASE >> 32),
+        cpu_to_be32(GUEST_APLIC_S_BASE),
+        cpu_to_be32(0),
+        cpu_to_be32(aplic_size),
+    };
+
+    BUILD_BUG_ON(APLIC_SIZE(MAX_VIRT_CPUS) > UINT_MAX);
+
+    res = snprintf(vaplic_name, sizeof(vaplic_name), "/soc/aplic@%lx",
+                   GUEST_APLIC_S_BASE);
+    if ( res >= sizeof(vaplic_name) )
+    {
+        dprintk(XENLOG_DEBUG, "vaplic name is truncated\n");
+        return -ENOBUFS;
+    }
+
+    res = vimsic_make_domu_dt_node(kinfo, &msi_parent_phandle);
+    if ( res )
+        return res;
+
+    res = fdt_begin_node(fdt, vaplic_name);
+    if ( res )
+        return res;
+
+    res = fdt_property_cell(fdt, "#interrupt-cells", FDT_VAPLIC_INT_CELLS);
+    if ( res )
+        return res;
+
+    res = fdt_property(fdt, "reg", reg, sizeof(reg));
+    if ( res )
+        return res;
+
+    res = fdt_property_cell(fdt, "riscv,num-sources", guest_num_sources);
+    if ( res )
+        return res;
+
+    res = fdt_property(fdt, "interrupt-controller", NULL, 0);
+    if ( res )
+        return res;
+
+    res = fdt_property_string(fdt, "compatible", VAPLIC_COMPATIBLE);
+    if ( res )
+        return res;
+
+    res = fdt_property_cell(fdt, "msi-parent", msi_parent_phandle);
+    if ( res )
+        return res;
+
+    res = fdt_property_cell(fdt, "phandle", kinfo->phandle_intc);
+    if ( res )
+        return res;
+
+    return fdt_end_node(fdt);
+}
+
+static const struct vintc_init_ops __initconstrel init_ops = {
+    .make_domu_dt_node = vaplic_make_domu_dt_node,
+};
+
 static const struct vintc_ops vintc_ops = {
     .vcpu_init = vaplic_init,
     .vcpu_deinit = vaplic_deinit,
@@ -43,6 +119,7 @@ int domain_vaplic_init(struct domain *d)
 
     d->arch.vintc = &vaplic->vintc;
     d->arch.vintc->ops = &vintc_ops;
+    d->arch.vintc->init_ops = &init_ops;
 
     vaplic->regs.domaincfg = APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM |
                              APLIC_DOMAINCFG_RO;
-- 
2.54.0

Re: [PATCH v5 20/26] xen/riscv: create APLIC DT node for guest domains

[Jan Beulich]

On 06.07.2026 17:58, Oleksii Kurochko wrote:
> --- a/xen/arch/riscv/aplic-priv.h
> +++ b/xen/arch/riscv/aplic-priv.h
> @@ -34,4 +34,18 @@ struct aplic_priv {
>      const struct imsic_config *imsic_cfg;
>  };
>  
> +/*
> + * Value is inspired by what QEMU is using for riscv,num-sources property for
> + * APLIC node.
> + */
> +#define GUEST_APLIC_MAX_SOURCES 96
> +
> +/*
> + * Specifies the number of wired interrupt sources supported by guest APLIC
> + * domain.
> + * Could be limited by host interrupt controller and is identical for every
> + * domain.
> + */
> +extern unsigned int guest_num_sources;

If I saw this identifier in use somewhere, I wouldn't know at all what kind of
sources this is about. Insert "aplic" or some other suitable infix?

Otherwise comments on the previous patch look to also apply here.

Jan

[PATCH v5 21/26] xen/riscv: implement IRQ routing for device passthrough

[Oleksii Kurochko]

dom0less device passthrough requires granting guest domains access to
device interrupts.  Introduce map_device_irqs_to_domain() to enumerate
a DT node's interrupt properties, skipping those not owned by
the primary interrupt controller (as at the moment I haven't seen usages
of it), and map_irq_to_domain() to grant domain access and configure
Xen's interrupt descriptor accordingly. Sharing IRQ between domains is
rejected.

Both map_irq_to_domain() and map_device_irqs_to_domain() are marked
__overlay_init, mirroring Arm: without CONFIG_OVERLAY_DTB this expands to
__init, so the functions are init-only and need no XSM check; with
CONFIG_OVERLAY_DTB they become runtime-callable, but the only runtime
entry point is dt_overlay_domctl(), which performs the XSM checks at the
domctl layer.  RISC-V does not wire up DT overlay yet, so today these are
strictly __init; if/when overlay support is added, the domctl-level XSM
gating must be added together with it, as on Arm.

route_irq_to_guest() and release_irq() manage irq_desc ownership for
guest-assigned interrupts.  Each assignment carries a small irq_guest
structure as irqaction::dev_id, recording the owning domain and virtual
IRQ number which is 1:1 mapped to physical IRQ number.  A per-domain
vIRQ allocation bitmap (used_irqs in struct vintc), managed by
vintc_reserve_virq(), prevents the same vIRQ being claimed twice.

Host and guest interrupts may differ in some operations (EOI timing in
particular, possibly others): a host IRQ is completed once Xen's handler
runs, whereas a passthrough IRQ must defer the physical completion until
the guest issues its own EOI, otherwise a still-asserted level line would
immediately retrigger and storm.  This affects only the .end callback;
the rest of hw_interrupt_type is shared, hence the separate host and
guest hw_interrupt_type instances.

With APLIC+IMSIC, guest interrupts are delivered directly by hardware
through the IMSIC, bypassing do_IRQ(). The _IRQ_GUEST branch in
do_IRQ() is therefore left as BUG() until a platform without direct
IMSIC delivery is encountered.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
 - add early -EINVAL return in route_irq_to_guest() if domain is dying
 - use __clear_bit() instead of clear_bit() in release_guest_irq()
   since desc->lock is already held
 - remove irq_get_domain() wrapper; inline irq_get_guest_info(desc)->d
    at its single call site
 - reword IRQ_GUEST comment in do_IRQ() for clarity
 - move XVFREE(used_irqs) before the switch so it is freed prior to
   variant-specific vintc teardown
 - fix missing space in dt_dprintk() format string split across lines
 - Drop 'inline' for irq_get_guest_info() and leave it only static.
 - Drop xfree(info) from release_guest_irq() to avoid a potential
   dangling-pointer issue with the ->dev_id field. Now that
   'struct irqaction action;' is embedded into 'struct irq_guest',
   'info' will be freed as part of release_irq() at the end.
---
Changes in v4:
 - Update the commit message.
 - Mark map_irq_to_domain() and map_device_irqs_to_domain() as
   __overlay_init (mirroring Arm) and include <xen/dt-overlay.h>.
 - Fix grammar in the controller-skip comment ("IRQ" -> "IRQs").
 - Drop the redundant 'base' local in guest_imsic_make_reg_property();
   use GUEST_IMSIC_S_BASE directly.
 - Rename vintc::irq_nums -> nr_virqs and update all users.
 - Guard domain_vintc_deinit() against a NULL d->arch.vintc.
 - Use smp_rmb() instead of smp_mb() in release_irq()'s wait loop and
   document how it pairs with the spin_unlock() in do_IRQ().
 - In release_guest_irq(), reject live unrouting from a non-dying domain
   (-EBUSY) and clear _IRQ_GUEST under desc->lock so a concurrent
   release for the same IRQ bails out instead of double-freeing 'info'.
 - Tidy spurious whitespace in release_irq()'s spin_lock/unlock calls.
---
Changes in v3:
 - Drop extraneous "to" from "Unable to permit to %pd" message.
 - Move res/irq/rirq to loop scope; use nirq as declaration initializer.
 - Hoist irq_ranges check before the loop (it is loop-invariant).
 - Remove spurious forward declarations (struct dt_device_node, struct
   rangeset) from intc.h; remove all three from setup.h.
 - Use __set_bit() instead of set_bit() in intc_route_irq_to_guest()
   since desc->lock is always held on every write path for desc->status.
 - Use XVFREE() instead of xvfree() in domain_vintc_deinit().
 - Rename allocated_irqs -> used_irqs in struct vintc.
 - Fix dangling desc->action in release_irq()'s !IRQ_HAS_MULTIPLE_ACTION
   path by nulling *action_ptr after saving the action pointer.
 - Use true (not 1) for free_on_release in route_irq_to_guest().
 - Use %pd for domain printing in route_irq_to_guest() error paths.
 - Introduce release_guest_irq() to pair with route_irq_to_guest() and
   plug the irq_guest info leak; call it from domain_vintc_deinit()
   for each vIRQ recorded in used_irqs.
---
Changes in v2:
 - Rework IRQ mapping in more common (similar approach to Arm).
---
---
 xen/arch/riscv/Makefile           |   1 +
 xen/arch/riscv/aplic.c            |   4 +
 xen/arch/riscv/device.c           |  94 ++++++++++++
 xen/arch/riscv/include/asm/intc.h |   9 ++
 xen/arch/riscv/include/asm/irq.h  |   5 +
 xen/arch/riscv/intc.c             |  45 ++++++
 xen/arch/riscv/irq.c              | 238 ++++++++++++++++++++++++++++++
 xen/arch/riscv/vaplic.c           |   2 +
 8 files changed, 398 insertions(+)
 create mode 100644 xen/arch/riscv/device.c

diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile
index 9d8d21b65188..fc6b34661111 100644
--- a/xen/arch/riscv/Makefile
+++ b/xen/arch/riscv/Makefile
@@ -1,6 +1,7 @@
 obj-y += aia.o
 obj-y += aplic.o
 obj-y += cpufeature.o
+obj-y += device.o
 obj-y += domain.o
 obj-y += domain-build.init.o
 obj-$(CONFIG_DOM0LESS_BOOT) += dom0less-build.init.o
diff --git a/xen/arch/riscv/aplic.c b/xen/arch/riscv/aplic.c
index 5f8ae4d97b87..9b9a0929a89b 100644
--- a/xen/arch/riscv/aplic.c
+++ b/xen/arch/riscv/aplic.c
@@ -306,9 +306,13 @@ static const hw_irq_controller aplic_xen_irq_type = {
     .set_affinity = aplic_set_irq_affinity,
 };
 
+/* At the moment there is no difference between guest and Xen ops */
+#define aplic_guest_irq_type aplic_xen_irq_type
+
 static const struct intc_hw_operations aplic_ops = {
     .info                = &aplic_info,
     .host_irq_type       = &aplic_xen_irq_type,
+    .guest_irq_type      = &aplic_guest_irq_type,
     .handle_interrupt    = aplic_handle_interrupt,
     .set_irq_type        = aplic_set_irq_type,
 };
diff --git a/xen/arch/riscv/device.c b/xen/arch/riscv/device.c
new file mode 100644
index 000000000000..f54d0fdaa7ab
--- /dev/null
+++ b/xen/arch/riscv/device.c
@@ -0,0 +1,94 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include <xen/device_tree.h>
+#include <xen/dt-overlay.h>
+#include <xen/errno.h>
+#include <xen/iocap.h>
+#include <xen/rangeset.h>
+#include <xen/sched.h>
+
+#include <asm/intc.h>
+
+int __overlay_init map_irq_to_domain(struct domain *d, unsigned int irq,
+                                     bool need_mapping, const char *devname)
+{
+    int res;
+
+    res = irq_permit_access(d, irq);
+    if ( res )
+    {
+        printk(XENLOG_ERR "Unable to permit %pd access to IRQ %u\n", d, irq);
+        return res;
+    }
+
+    if ( need_mapping )
+    {
+        /*
+         * Checking the return of vintc_reserve_virq is not
+         * necessary. It should not fail except when we try to map
+         * the IRQ twice. This can legitimately happen if the IRQ is shared.
+         */
+        vintc_reserve_virq(d, irq);
+
+        res = route_irq_to_guest(d, irq, irq, devname);
+        if ( res < 0 )
+        {
+            printk(XENLOG_ERR "Unable to map IRQ%u to %pd\n", irq, d);
+            return res;
+        }
+    }
+
+    dt_dprintk("  - IRQ: %u\n", irq);
+
+    return 0;
+}
+
+int __overlay_init map_device_irqs_to_domain(struct domain *d,
+                                             struct dt_device_node *dev,
+                                             bool need_mapping,
+                                             struct rangeset *irq_ranges)
+{
+    unsigned int i, nirq = dt_number_of_irq(dev);
+
+    if ( irq_ranges )
+        return -EOPNOTSUPP;
+
+    /* Give permission and map IRQs */
+    for ( i = 0; i < nirq; i++ )
+    {
+        int res, irq;
+        struct dt_raw_irq rirq;
+
+        res = dt_device_get_raw_irq(dev, i, &rirq);
+        if ( res )
+        {
+            printk(XENLOG_ERR "Unable to retrieve irq %u for %s\n",
+                   i, dt_node_full_name(dev));
+            return res;
+        }
+
+        /*
+         * Don't map IRQs that have no physical meaning
+         * ie: IRQs whose controller is not APLIC/IMSIC/PLIC.
+         */
+        if ( rirq.controller != dt_interrupt_controller )
+        {
+            dt_dprintk("irq %u not connected to primary controller. Connected to %s\n",
+                       i, dt_node_full_name(rirq.controller));
+            continue;
+        }
+
+        irq = platform_get_irq(dev, i);
+        if ( irq < 0 )
+        {
+            printk("Unable to get irq %u for %s\n", i, dt_node_full_name(dev));
+            return irq;
+        }
+
+        res = map_irq_to_domain(d, irq, need_mapping, dt_node_name(dev));
+        if ( res )
+            return res;
+    }
+
+    return 0;
+}
diff --git a/xen/arch/riscv/include/asm/intc.h b/xen/arch/riscv/include/asm/intc.h
index dad4c5fab08b..2ee5d1533c8e 100644
--- a/xen/arch/riscv/include/asm/intc.h
+++ b/xen/arch/riscv/include/asm/intc.h
@@ -15,6 +15,7 @@ enum intc_variant {
 };
 
 struct cpu_user_regs;
+struct domain;
 struct irq_desc;
 struct kernel_info;
 struct vcpu;
@@ -34,6 +35,9 @@ struct intc_hw_operations {
     /* hw_irq_controller to enable/disable/eoi host irq */
     const struct hw_interrupt_type *host_irq_type;
 
+    /* hw_irq_controller to enable/disable/eoi guest irq */
+    const struct hw_interrupt_type *guest_irq_type;
+
     /* Set IRQ type */
     void (*set_irq_type)(struct irq_desc *desc, unsigned int type);
     /* Set IRQ priority */
@@ -63,6 +67,8 @@ struct vintc_ops {
 };
 
 struct vintc {
+    unsigned int nr_virqs;
+    unsigned long *used_irqs;
     /* Used during domain build only; dropped afterwards. */
     const struct vintc_init_ops *init_ops;
     /* Runtime callbacks used for the lifetime of the guest. */
@@ -76,10 +82,13 @@ void register_intc_ops(const struct intc_hw_init_ops *init_ops);
 void intc_init(void);
 
 void intc_route_irq_to_xen(struct irq_desc *desc, unsigned int priority);
+int intc_route_irq_to_guest(struct irq_desc *desc, unsigned int priority);
 
 void intc_handle_external_irqs(struct cpu_user_regs *regs);
 
 int domain_vintc_init(struct domain *d);
 void domain_vintc_deinit(struct domain *d);
 
+bool vintc_reserve_virq(const struct domain *d, unsigned int virq);
+
 #endif /* ASM__RISCV__INTERRUPT_CONTOLLER_H */
diff --git a/xen/arch/riscv/include/asm/irq.h b/xen/arch/riscv/include/asm/irq.h
index f633636dc308..2b95f8226be2 100644
--- a/xen/arch/riscv/include/asm/irq.h
+++ b/xen/arch/riscv/include/asm/irq.h
@@ -49,6 +49,11 @@ void init_IRQ(void);
 
 void do_IRQ(struct cpu_user_regs *regs, unsigned int irq);
 
+int route_irq_to_guest(struct domain *d, unsigned int virq,
+                       unsigned int irq, const char *devname);
+
+int release_guest_irq(struct domain *d, unsigned int virq);
+
 #endif /* ASM__RISCV__IRQ_H */
 
 /*
diff --git a/xen/arch/riscv/intc.c b/xen/arch/riscv/intc.c
index f5c8af6ddea4..372c8d3a20f9 100644
--- a/xen/arch/riscv/intc.c
+++ b/xen/arch/riscv/intc.c
@@ -7,7 +7,9 @@
 #include <xen/init.h>
 #include <xen/irq.h>
 #include <xen/lib.h>
+#include <xen/sched.h>
 #include <xen/spinlock.h>
+#include <xen/xvmalloc.h>
 
 #include <asm/aia.h>
 #include <asm/intc.h>
@@ -78,6 +80,22 @@ void intc_route_irq_to_xen(struct irq_desc *desc, unsigned int priority)
     intc_set_irq_priority(desc, priority);
 }
 
+int intc_route_irq_to_guest(struct irq_desc *desc,
+                            unsigned int priority)
+{
+    ASSERT(spin_is_locked(&desc->lock));
+
+    ASSERT(intc_hw_ops->guest_irq_type);
+
+    desc->handler = intc_hw_ops->guest_irq_type;
+    __set_bit(_IRQ_GUEST, &desc->status);
+
+    intc_set_irq_type(desc, desc->arch.type);
+    intc_set_irq_priority(desc, priority);
+
+    return 0;
+}
+
 int __init make_intc_domU_node(struct kernel_info *kinfo)
 {
     const struct vintc *vintc = kinfo->bd.d->arch.vintc;
@@ -101,12 +119,31 @@ int domain_vintc_init(struct domain *d)
         break;
     }
 
+    if ( !ret )
+    {
+        d->arch.vintc->used_irqs =
+            xvzalloc_array(unsigned long,
+                           BITS_TO_LONGS(d->arch.vintc->nr_virqs));
+        if ( !d->arch.vintc->used_irqs )
+            ret = -ENOMEM;
+    }
+
     return ret;
 }
 
 void domain_vintc_deinit(struct domain *d)
 {
     const enum intc_variant variant = intc_hw_ops->info->hw_variant;
+    unsigned int virq;
+
+    if ( !d->arch.vintc )
+        return;
+
+    for ( virq = 0; virq < d->arch.vintc->nr_virqs; virq++ )
+        if ( test_bit(virq, d->arch.vintc->used_irqs) )
+            release_guest_irq(d, virq);
+
+    XVFREE(d->arch.vintc->used_irqs);
 
     switch ( variant )
     {
@@ -118,3 +155,11 @@ void domain_vintc_deinit(struct domain *d)
         break;
     }
 }
+
+bool vintc_reserve_virq(const struct domain *d, unsigned int virq)
+{
+    if ( virq >= d->arch.vintc->nr_virqs )
+        return false;
+
+    return !test_and_set_bit(virq, d->arch.vintc->used_irqs);
+}
diff --git a/xen/arch/riscv/irq.c b/xen/arch/riscv/irq.c
index 25d329500212..ee75e0e88d85 100644
--- a/xen/arch/riscv/irq.c
+++ b/xen/arch/riscv/irq.c
@@ -12,11 +12,29 @@
 #include <xen/errno.h>
 #include <xen/init.h>
 #include <xen/irq.h>
+#include <xen/sched.h>
 #include <xen/spinlock.h>
+#include <xen/xvmalloc.h>
 
 #include <asm/hardirq.h>
 #include <asm/intc.h>
 
+/*
+ * Describe an IRQ assigned to a guest.
+ *
+ * The irqaction is embedded here (rather than allocated separately with
+ * its dev_id pointing at a standalone struct irq_guest) so that freeing
+ * the action in release_irq() also frees this whole structure in one go.
+ * That avoids the alternative of release_irq()'s caller having to free
+ * dev_id itself (something like in Arm release_guest_irq()).
+ */
+struct irq_guest
+{
+    struct irqaction action;
+    struct domain *d;
+    unsigned int virq;
+};
+
 static irq_desc_t irq_desc[NR_IRQS];
 
 static bool irq_validate_new_type(unsigned int curr, unsigned int new)
@@ -192,6 +210,14 @@ void do_IRQ(struct cpu_user_regs *regs, unsigned int irq)
     if ( desc->handler->ack )
         desc->handler->ack(desc);
 
+    if ( desc->status & IRQ_GUEST )
+        /*
+         * With APLIC + IMSIC, guest interrupts bypass Xen and are delivered
+         * directly to the guest. Without IMSIC, interrupts would be trapped
+         * by Xen and would need injecting into the guest here.
+         */
+        panic("unimplemented");
+
     if ( desc->status & IRQ_DISABLED )
         goto out;
 
@@ -221,3 +247,215 @@ void do_IRQ(struct cpu_user_regs *regs, unsigned int irq)
     spin_unlock(&desc->lock);
     irq_exit();
 }
+
+static struct irq_guest *irq_get_guest_info(struct irq_desc *desc)
+{
+    ASSERT(spin_is_locked(&desc->lock));
+    ASSERT(test_bit(_IRQ_GUEST, &desc->status));
+    ASSERT(desc->action != NULL);
+
+    return desc->action->dev_id;
+}
+
+
+void release_irq(unsigned int irq, const void *dev_id)
+{
+    struct irq_desc *desc;
+    unsigned long flags;
+    struct irqaction *action, **action_ptr;
+
+    desc = irq_to_desc(irq);
+
+    spin_lock_irqsave(&desc->lock, flags);
+
+    action_ptr = &desc->action;
+#ifdef CONFIG_IRQ_HAS_MULTIPLE_ACTION
+    for ( ;; )
+    {
+        action = *action_ptr;
+        if ( !action )
+        {
+            printk(XENLOG_WARNING "Trying to free already-free IRQ %u\n", irq);
+            spin_unlock_irqrestore(&desc->lock, flags);
+            return;
+        }
+
+        if ( action->dev_id == dev_id )
+            break;
+
+        action_ptr = &action->next;
+    }
+
+    /* Found it - remove it from the action list */
+    *action_ptr = action->next;
+#else
+    action = *action_ptr;
+    *action_ptr = NULL;
+#endif
+
+    /* If this was the last action, shut down the IRQ */
+    if ( !desc->action )
+    {
+        desc->handler->shutdown(desc);
+        __clear_bit(_IRQ_GUEST, &desc->status);
+    }
+
+    spin_unlock_irqrestore(&desc->lock, flags);
+
+    /*
+     * Wait to make sure it's not being used on another CPU.
+     *
+     * The read barrier pairs with the spin_unlock() in do_IRQ(): once we
+     * observe _IRQ_INPROGRESS cleared, we are guaranteed to also see the
+     * writes do_IRQ() made to desc (e.g. desc->action) before releasing the
+     * lock, so it is safe to free the action below.
+     */
+    do { smp_rmb(); } while ( test_bit(_IRQ_INPROGRESS, &desc->status) );
+
+    if ( action->free_on_release )
+        xvfree(action);
+}
+
+int release_guest_irq(struct domain *d, unsigned int virq)
+{
+    struct irq_desc *desc = irq_to_desc(virq);
+    struct irq_guest *info;
+    unsigned long flags;
+    int ret = -EINVAL;
+
+    spin_lock_irqsave(&desc->lock, flags);
+
+    if ( !test_bit(_IRQ_GUEST, &desc->status) )
+        goto unlock_err;
+
+    info = irq_get_guest_info(desc);
+    if ( d != info->d )
+        goto unlock_err;
+
+    /*
+     * Live IRQ unrouting from a running domain is not supported: the tear-down
+     * drops desc->lock across release_irq()/xvfree() and relies on no
+     * concurrent route_irq_to_guest() being issued for this domain. Only permit
+     * it for a dying domain, where assignment is frozen and no new routes can
+     * appear.
+     */
+    if ( !d->is_dying )
+    {
+        ret = -EBUSY;
+        goto unlock_err;
+    }
+
+    /*
+     * Clear _IRQ_GUEST while still holding the lock so that a concurrent
+     * release_guest_irq() for the same IRQ observes it and bails out, rather
+     * than capturing the same 'info' and double-freeing it below.
+     */
+    __clear_bit(_IRQ_GUEST, &desc->status);
+
+    spin_unlock_irqrestore(&desc->lock, flags);
+
+    release_irq(desc->irq, info);
+
+    return 0;
+
+ unlock_err:
+    spin_unlock_irqrestore(&desc->lock, flags);
+    return ret;
+}
+
+/* Route an IRQ to a specific guest */
+int route_irq_to_guest(struct domain *d, unsigned int virq,
+                       unsigned int irq, const char *devname)
+{
+    struct irqaction *action;
+    struct irq_guest *info;
+    struct irq_desc *desc;
+    unsigned long flags;
+    int retval = 0;
+
+    if ( d->is_dying )
+        return -EINVAL;
+
+    desc = irq_to_desc(irq);
+
+    /*
+     * release_irq() frees this action via xvfree(), relying on action
+     * being the first member of struct irq_guest so that &info->action
+     * coincides with info itself. Guard the layout so a future field
+     * reorder can't silently turn that into a free() of a mid-allocation
+     * pointer.
+     */
+    BUILD_BUG_ON(offsetof(struct irq_guest, action) != 0);
+
+    info = xvmalloc(struct irq_guest);
+    if ( !info )
+        return -ENOMEM;
+
+    info->d = d;
+    info->virq = virq;
+
+    action = &info->action;
+    action->dev_id = info;
+    action->name = devname;
+    action->free_on_release = true;
+
+    spin_lock_irqsave(&desc->lock, flags);
+
+    /*
+     * If the IRQ is already used by someone
+     *  - If it's the same domain -> Xen doesn't need to update the IRQ desc.
+     *  For safety check if we are not trying to assign the IRQ to a
+     *  different vIRQ.
+     *  - Otherwise -> For now, don't allow the IRQ to be shared between
+     *  Xen and domains.
+     */
+    if ( desc->action != NULL )
+    {
+        if ( test_bit(_IRQ_GUEST, &desc->status) )
+        {
+            struct domain *ad = irq_get_guest_info(desc)->d;
+
+            if ( d != ad )
+            {
+                printk(XENLOG_G_ERR "IRQ %u is already used by %pd\n",
+                       irq, ad);
+                retval = -EBUSY;
+            }
+            else if ( irq_get_guest_info(desc)->virq != virq )
+            {
+                printk(XENLOG_G_ERR
+                       "%pd: IRQ %u is already assigned to vIRQ %u\n",
+                       d, irq, irq_get_guest_info(desc)->virq);
+                retval = -EBUSY;
+            }
+        }
+        else
+        {
+            printk(XENLOG_G_ERR "IRQ %u is already used by Xen\n", irq);
+            retval = -EBUSY;
+        }
+        goto out;
+    }
+
+    retval = _setup_irq(desc, 0, action);
+    if ( retval )
+        goto out;
+
+    retval = intc_route_irq_to_guest(desc, IRQ_NO_PRIORITY);
+
+    spin_unlock_irqrestore(&desc->lock, flags);
+
+    if ( retval )
+    {
+        release_irq(desc->irq, info);
+        return retval;
+    }
+
+    return 0;
+
+ out:
+    spin_unlock_irqrestore(&desc->lock, flags);
+    xvfree(info);
+
+    return retval;
+}
diff --git a/xen/arch/riscv/vaplic.c b/xen/arch/riscv/vaplic.c
index 719c439e48d9..2d0b31e08252 100644
--- a/xen/arch/riscv/vaplic.c
+++ b/xen/arch/riscv/vaplic.c
@@ -124,6 +124,8 @@ int domain_vaplic_init(struct domain *d)
     vaplic->regs.domaincfg = APLIC_DOMAINCFG_IE | APLIC_DOMAINCFG_DM |
                              APLIC_DOMAINCFG_RO;
 
+    d->arch.vintc->nr_virqs = guest_num_sources;
+
     return 0;
 }
 
-- 
2.54.0

[PATCH v5 22/26] xen/riscv: implement init_intc_phandle()

[Oleksii Kurochko]

Implement init_intc_phandle() to read phandle of interrupt controller
node and save it in kernel->phandle_intc for the future usage during
creation of guest interrupt controller node.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v4-5:
 - Nothing changed. Only rebase.
---
---
 xen/arch/riscv/dom0less-build.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/xen/arch/riscv/dom0less-build.c b/xen/arch/riscv/dom0less-build.c
index 4cc00012aa8d..a1fa51b996a7 100644
--- a/xen/arch/riscv/dom0less-build.c
+++ b/xen/arch/riscv/dom0less-build.c
@@ -4,9 +4,26 @@
 #include <xen/device_tree.h>
 #include <xen/fdt-kernel.h>
 #include <xen/init.h>
+#include <xen/libfdt/libfdt.h>
 
 #include <asm/p2m.h>
 
+int __init init_intc_phandle(struct kernel_info *kinfo, const char *name,
+                             const int node_next, const void *pfdt)
+{
+    if ( dt_node_cmp(name, "intc") == 0 )
+    {
+        uint32_t phandle_intc = fdt_get_phandle(pfdt, node_next);
+
+        if ( phandle_intc != 0 )
+            kinfo->phandle_intc = phandle_intc;
+
+        return 0;
+    }
+
+    return 1;
+}
+
 int __init make_arch_nodes(struct kernel_info *kinfo)
 {
     /* No RISC-V specific nodes need to be made, at the moment. */
-- 
2.54.0

[PATCH v5 23/26] xen/riscv: initialize RCU, scheduler, and system domains in start_xen()

[Oleksii Kurochko]

Wire up the missing early-boot initialization steps in start_xen().

The scheduler must be initialized prior to do_initcalls() because
cpupool_create_pool() is called during initcalls; without it,
BUG_ON(IS_ERR(pool)) is triggered inside cpupool_create_pool().

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v4-5:
 - Nothing changed. Only rebase.
---
Changes in v3:
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
Changes in v2:
 - New patch. Several patches were folded into one.
---
---
 xen/arch/riscv/setup.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/xen/arch/riscv/setup.c b/xen/arch/riscv/setup.c
index 56a0907a855f..c3e98733ebc3 100644
--- a/xen/arch/riscv/setup.c
+++ b/xen/arch/riscv/setup.c
@@ -6,9 +6,12 @@
 #include <xen/compile.h>
 #include <xen/console.h>
 #include <xen/device_tree.h>
+#include <xen/domain.h>
 #include <xen/init.h>
 #include <xen/irq.h>
 #include <xen/mm.h>
+#include <xen/rcupdate.h>
+#include <xen/sched.h>
 #include <xen/serial.h>
 #include <xen/shutdown.h>
 #include <xen/smp.h>
@@ -156,12 +159,21 @@ void __init noreturn start_xen(unsigned long bootcpu_id,
 
     timer_init();
 
+    rcu_init();
+
+    setup_system_domains();
+
     local_irq_enable();
 
     console_init_postirq();
 
     guest_mm_init();
 
+    scheduler_init();
+    set_current(idle_vcpu[0]);
+
+    do_initcalls();
+
     printk("All set up\n");
 
     machine_halt();
-- 
2.54.0

[PATCH v5 24/26] xen/riscv: provide init_vuart()

[Oleksii Kurochko]

For debug purpose is enough to have only print messages from guest what is
now implemented in vsbi_legacy_ecall_handler().

For full guesst console support it will better to have something similar to
[1], thereby there is nothing specific should be done, at least, for now
and init_vuart() is provided to make dom0less code buildable.

[1] https://lore.kernel.org/xen-devel/alpine.DEB.2.22.394.2602041533440.3175371@ubuntu-linux-20-04-desktop/

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes in v3-v5:
 - Nothing changed. Only rebase.
---
Changes in v2:
 - Add Acked-by: Jan Beulich <jbeulich@suse.com>.
---
---
 xen/arch/riscv/dom0less-build.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/xen/arch/riscv/dom0less-build.c b/xen/arch/riscv/dom0less-build.c
index a1fa51b996a7..d1a51b92936a 100644
--- a/xen/arch/riscv/dom0less-build.c
+++ b/xen/arch/riscv/dom0less-build.c
@@ -8,6 +8,14 @@
 
 #include <asm/p2m.h>
 
+int __init init_vuart(struct domain *d, struct kernel_info *kinfo,
+                      const struct dt_device_node *node)
+{
+    /* Nothing to do at the moment */
+
+    return 0;
+}
+
 int __init init_intc_phandle(struct kernel_info *kinfo, const char *name,
                              const int node_next, const void *pfdt)
 {
-- 
2.54.0

[PATCH v5 25/26] xen/riscv: add initial dom0less infrastructure support

[Oleksii Kurochko]

Enable dom0less support for RISC-V by selecting HAS_DOM0LESS and
providing the minimal architecture hooks required by the common
dom0less infrastructure.

Add stub implementations for architecture-specific helpers used when
building domains from the device tree. These allow the generic
dom0less code to build and let a basic DomU be constructed on RISC-V.
construct_hwdom() and make_hypervisor_node() are still stubs returning
an error: Dom0/hwdom construction isn't supported yet, and the
hypervisor node generation (needed by domains with
DOM0LESS_ENHANCED_NO_XS set) is not implemented. Both are marked with
a TODO and are not reached by the currently supported configurations.

Provide missing helpers and definitions required by the domain
construction code, including domain bitness helpers and the
p2m_set_allocation() prototype.

Additionally define the guest magic memory region (GUEST_MAGIC_BASE /
GUEST_MAGIC_SIZE) in asm/guest-layout.h. The base is arbitrary; the
only constraint is that the region must not overlap guest RAM or the
emulated device regions. It is placed in the unused gap below
GUEST_RAM0_BASE (0x80000000); the constraints are documented next to
the #define-s.

A separate region for grant tables will be introduced at the same time as
the introduction of the grant table for RISC-V.

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
Changes in v5:
 - Reword the comment above defintion of GUEST_MAGIC_BASE.
 - Shrunk the size of GUEST_MAGIC_SIZE to 2Mb as looking on the Arm
   only 4 pages are used and there is no technical reason to have 16Mb for
   that region. (Maybe in case of Arm it is connected that Arm has these
   definitions in public header so more space is reserved to not "break"
   public API in future)
 - Update the commit message with a remark about grant table region
   in guest-layout.h.
---
Changes in v4:
  - Reword the description: the stubs do not let dom0less fully "run"
    since construct_hwdom() and make_hypervisor_node() return an error;
    spell out these limitations instead.
  - Add a TODO comment to construct_hwdom() explaining that Dom0/hwdom
    construction isn't supported yet.
  - Add a TODO comment to make_hypervisor_node() explaining that
    returning an error breaks building of domains with
    DOM0LESS_ENHANCED_NO_XS set, and why that is harmless for now.
  - Document the constraints on GUEST_MAGIC_BASE/GUEST_MAGIC_SIZE next
    to the #define-s and drop the QEMU-based justification (QEMU is not
    involved); the base is simply an arbitrary non-overlapping address.
Changes in v3:
  - Add /* Nothing specific to do for now */ comment to
    arch_handle_passthrough_prop().
  - Use _ULL() instead of xen_mk_ullong() for GUEST_MAGIC_BASE and
    GUEST_MAGIC_SIZE (xen_mk_ullong() is intended for public headers only).
  - Fix GUEST_MAGIC_BASE from 0x39000000 to 0x79000000 to avoid the
    QEMU RISC-V virt machine PCIE_ECAM range.
  - Drop CONFIG_STATIC_MEMORY=n from the CI randconfig; now redundant
    since STATIC_MEMORY depends on HAS_STATIC_MEMORY which RISC-V does
    not select.
Changes in v2:
  - Move declaration of p2m_set_allocation() to p2m-common.h.
  - Add __initdata for max_init_domid and drop initalizer for it.
  - Add CONFIG_STATIC_MEMORY=n to CI's randconfig to avoid
    compilation error because of guest_physmap_add_pages()
    isn't provided.
---
 xen/arch/riscv/Kconfig                    |  2 ++
 xen/arch/riscv/dom0less-build.c           |  7 ++++++
 xen/arch/riscv/domain-build.c             | 28 +++++++++++++++++++++++
 xen/arch/riscv/include/asm/guest-layout.h | 12 ++++++++++
 4 files changed, 49 insertions(+)

diff --git a/xen/arch/riscv/Kconfig b/xen/arch/riscv/Kconfig
index 48520588fe40..d8a348c0cf07 100644
--- a/xen/arch/riscv/Kconfig
+++ b/xen/arch/riscv/Kconfig
@@ -6,6 +6,8 @@ config RISCV
 	select GENERIC_BUG_FRAME
 	select GENERIC_UART_INIT
 	select HAS_DEVICE_TREE_DISCOVERY
+	select HAS_DOM0LESS
+	select HAS_DOMAIN_TYPE
 	select HAS_EX_TABLE
 	select HAS_PMAP
 	select HAS_UBSAN
diff --git a/xen/arch/riscv/dom0less-build.c b/xen/arch/riscv/dom0less-build.c
index d1a51b92936a..0801d7e25059 100644
--- a/xen/arch/riscv/dom0less-build.c
+++ b/xen/arch/riscv/dom0less-build.c
@@ -102,3 +102,10 @@ int __init arch_parse_dom0less_node(struct dt_device_node *node,
 
     return 0;
 }
+
+int __init arch_handle_passthrough_prop(struct kernel_info *kinfo,
+                                        struct dt_device_node *node)
+{
+    /* Nothing specific to do for now */
+    return 0;
+}
diff --git a/xen/arch/riscv/domain-build.c b/xen/arch/riscv/domain-build.c
index 089e5ce0e0a4..7f24bd1023bb 100644
--- a/xen/arch/riscv/domain-build.c
+++ b/xen/arch/riscv/domain-build.c
@@ -175,9 +175,37 @@ int __init make_cpus_node(const struct domain *d, struct kernel_info *kinfo)
     return res;
 }
 
+int __init construct_hwdom(struct kernel_info *kinfo,
+                           const struct dt_device_node *node)
+{
+    /*
+     * TODO: Dom0/hwdom construction isn't supported on RISC-V yet, so this
+     * is a stub returning an error. It must be implemented before a hardware
+     * domain can be built from the device tree.
+     */
+
+    return -EOPNOTSUPP;
+}
+
 int __init make_timer_node(const struct kernel_info *kinfo)
 {
     /* There is no need for timer node for RISC-V. */
 
     return 0;
 }
+
+int __init make_hypervisor_node(struct domain *d,
+                                const struct kernel_info *kinfo,
+                                int addrcells, int sizecells)
+{
+    /*
+     * TODO: Generating the hypervisor node isn't implemented yet. Returning
+     * an error here breaks building of any domain (DomU included) whose
+     * dom0less_feature has DOM0LESS_ENHANCED_NO_XS set. This is harmless for
+     * now because Dom0/hwdom construction isn't supported on RISC-V yet
+     * either, and no RISC-V DomU sets that flag, so this path is never taken.
+     * It must be implemented before DOM0LESS_ENHANCED_NO_XS is used.
+     */
+
+    return -EOPNOTSUPP;
+}
diff --git a/xen/arch/riscv/include/asm/guest-layout.h b/xen/arch/riscv/include/asm/guest-layout.h
index 90603f06bb91..ceed9125e7e2 100644
--- a/xen/arch/riscv/include/asm/guest-layout.h
+++ b/xen/arch/riscv/include/asm/guest-layout.h
@@ -32,4 +32,16 @@
 #define GUEST_RAM_BANK_BASES   { GUEST_RAM0_BASE, GUEST_RAM1_BASE }
 #define GUEST_RAM_BANK_SIZES   { GUEST_RAM0_SIZE, GUEST_RAM1_SIZE }
 
+/*
+ * The guest magic region holds the Xen-reserved pages mapped into the
+ * guest's physical address space. The only real constraint on
+ * GUEST_MAGIC_BASE/SIZE is that the region must not overlap guest RAM
+ * (the GUEST_RAMx banks) or the emulated device regions defined above;
+ * the exact base is otherwise arbitrary. Here it is placed in the unused gap
+ * below GUEST_RAM0_BASE (0x80000000), but a hole after a RAM bank would work
+ * equally well.
+ */
+#define GUEST_MAGIC_BASE  _UL(0x79000000)
+#define GUEST_MAGIC_SIZE  _UL(0x00200000)
+
 #endif /* ASM_RISCV_GUEST_LAYOUT_H */
-- 
2.54.0

[PATCH v5 26/26] xen/riscv: do a 4th linking pass if necessary

[Oleksii Kurochko]

Embedding the symbol table can shift sections and flip relaxation
decisions, changing code size and thus the set of emitted symbols
(e.g. gap end markers).  Re-link with a regenerated table when its
size differs from the previous pass.

This mirrors commit 35de7285d508 ("Arm: do a 4th linking pass if
necessary"), which riscv didn't receive when the underlying
pass-2-vs-pass-3 check was extended to it in commit aa786d6e3467
("non-x86/symbols: check table sizes don't change between linking
passes 2 and 3").

Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
I faced this issue again in downstream:
  https://gitlab.com/xen-project/people/olkur/xen/-/jobs/15171254706

It was found that the difference between .xen-syms.0 and .xen-syms.1 is in
alignment(?) gap between turn_on_mmu() and the end of simple_strtoull.
Specifically 0xffffffffc00c05b0 is present in pass 1 but not present in
pass 2 (where end of simple_strtoull() is just equal to ffffffffc00c05c0)
because code was shifted:

```
.xen-syms.0:     file format elf64-littleriscv

...

ffffffffc00c0534:       f2e794e3                bne     a5,a4,ffffffffc00c045c <simple_strtoull+0x18>
ffffffffc00c0538:       00280813                addi    a6,a6,2
ffffffffc00c053c:       f21ff06f                j       ffffffffc00c045c <simple_strtoull+0x18>
ffffffffc00c0540:       00068813                mv      a6,a3
ffffffffc00c0544:       00800613                li      a2,8
ffffffffc00c0548:       f15ff06f                j       ffffffffc00c045c <simple_strtoull+0x18>
ffffffffc00c054c:       00277713                andi    a4,a4,2
ffffffffc00c0550:       04070463                beqz    a4,ffffffffc00c0598 <simple_strtoull+0x154>
ffffffffc00c0554:       fe06869b                addiw   a3,a3,-32
ffffffffc00c0558:       0ff6f693                zext.b  a3,a3
ffffffffc00c055c:       fc96879b                addiw   a5,a3,-55
ffffffffc00c0560:       04c7f263                bgeu    a5,a2,ffffffffc00c05a4 <simple_strtoull+0x160>
ffffffffc00c0564:       02a60533                mul     a0,a2,a0
ffffffffc00c0568:       00f50533                add     a0,a0,a5
ffffffffc00c056c:       00180813                addi    a6,a6,1
ffffffffc00c0570:       00084683                lbu     a3,0(a6)
ffffffffc00c0574:       0006879b                sext.w  a5,a3
ffffffffc00c0578:       00d30733                add     a4,t1,a3
ffffffffc00c057c:       00074703                lbu     a4,0(a4)
ffffffffc00c0580:       04477893                andi    a7,a4,68
ffffffffc00c0584:       02088063                beqz    a7,ffffffffc00c05a4 <simple_strtoull+0x160>
ffffffffc00c0588:       00477893                andi    a7,a4,4
ffffffffc00c058c:       fc0880e3                beqz    a7,ffffffffc00c054c <simple_strtoull+0x108>
ffffffffc00c0590:       fd07879b                addiw   a5,a5,-48
ffffffffc00c0594:       fcdff06f                j       ffffffffc00c0560 <simple_strtoull+0x11c>
ffffffffc00c0598:       fc97879b                addiw   a5,a5,-55
ffffffffc00c059c:       fc5ff06f                j       ffffffffc00c0560 <simple_strtoull+0x11c>
ffffffffc00c05a0:       00000513                li      a0,0
ffffffffc00c05a4:       00058463                beqz    a1,ffffffffc00c05ac <simple_strtoull+0x168>
ffffffffc00c05a8:       0105b023                sd      a6,0(a1)
ffffffffc00c05ac:       00008067                ret
        ...

ffffffffc00c05c0 <turn_on_mmu>:
ffffffffc00c05c0:       12000073                sfence.vma
ffffffffc00c05c4:       00800293                li      t0,8
ffffffffc00c05c8:       03c29293                slli    t0,t0,0x3c
ffffffffc00c05cc:       000fc317                auipc   t1,0xfc
ffffffffc00c05d0:       a3430313                addi    t1,t1,-1484 # ffffffffc01bc000 <stage1_pgtbl_root>
ffffffffc00c05d4:       00c35313                srli    t1,t1,0xc
ffffffffc00c05d8:       00536333                or      t1,t1,t0
ffffffffc00c05dc:       18031073                csrw    satp,t1
ffffffffc00c05e0:       00050067                jr      a0

ffffffffc00c05e4 <_ident_end>:
ffffffffc00c05e4:       0000                    .insn   2, 0x0000
        ...
```

So the tool (symbols.c) emits an entry at start+size only when a gap
follows; the gap closed in pass 2.  (look at the code of want_symbol_end()
in symbols.c) what leads to difference in one entry in symbols table between
passes.
---
 xen/arch/riscv/Makefile | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/xen/arch/riscv/Makefile b/xen/arch/riscv/Makefile
index fc6b34661111..046f73f4d87c 100644
--- a/xen/arch/riscv/Makefile
+++ b/xen/arch/riscv/Makefile
@@ -50,9 +50,21 @@ $(TARGET)-syms: $(objtree)/prelink.o $(obj)/xen.lds
 		| $(objtree)/tools/symbols $(all_symbols) --sysv --sort \
 		> $(dot-target).2.S
 	$(MAKE) $(build)=$(@D) $(dot-target).2.o
-	$(call compare-symbol-tables, $(dot-target).1.o, $(dot-target).2.o)
+	if ! { $(call compare-symbol-tables, $(dot-target).1.o, $(dot-target).2.o) >/dev/null; }; \
+	then \
+		set -e; \
+		$(LD) $(XEN_LDFLAGS) -T $(obj)/xen.lds $< $(build_id_linker) \
+		    $(dot-target).2.o -o $(dot-target).2; \
+		$(NM) -pa --format=sysv $(dot-target).2 \
+			| $(objtree)/tools/symbols $(all_symbols) --sysv --sort \
+			> $(dot-target).3.S; \
+		$(MAKE) $(build)=$(@D) $(dot-target).3.o; \
+		$(call compare-symbol-tables, $(dot-target).2.o, $(dot-target).3.o); \
+	else \
+		ln -sf $(dot-target).2.o $(dot-target).3.o; \
+	fi
 	$(LD) $(XEN_LDFLAGS) -T $(obj)/xen.lds $< $(build_id_linker) \
-	    $(dot-target).2.o -o $@
+	    $(dot-target).3.o -o $@
 	$(NM) -pa --format=sysv $@ \
 		| $(objtree)/tools/symbols --all-symbols --xensyms --sysv --sort \
 		> $@.map
-- 
2.54.0

Re: [PATCH v5 26/26] xen/riscv: do a 4th linking pass if necessary

[Jan Beulich]

On 06.07.2026 17:58, Oleksii Kurochko wrote:
> Embedding the symbol table can shift sections and flip relaxation
> decisions, changing code size and thus the set of emitted symbols
> (e.g. gap end markers).

What difference in symbols is there? (And: Do you mean the ELF symbol
table or what tools/symbols emits?) On ...

>  Re-link with a regenerated table when its
> size differs from the previous pass.
> 
> This mirrors commit 35de7285d508 ("Arm: do a 4th linking pass if
> necessary"), which riscv didn't receive when the underlying
> pass-2-vs-pass-3 check was extended to it in commit aa786d6e3467
> ("non-x86/symbols: check table sizes don't change between linking
> passes 2 and 3").

... Arm the problem was with a symbol (dis)appearing from/in the ELF
symbol table. The situation looks to be different here. Sadly ...

> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
> ---
> I faced this issue again in downstream:
>   https://gitlab.com/xen-project/people/olkur/xen/-/jobs/15171254706
> 
> It was found that the difference between .xen-syms.0 and .xen-syms.1 is in
> alignment(?) gap between turn_on_mmu() and the end of simple_strtoull.
> Specifically 0xffffffffc00c05b0 is present in pass 1 but not present in
> pass 2 (where end of simple_strtoull() is just equal to ffffffffc00c05c0)
> because code was shifted:
> 
> ```
> .xen-syms.0:     file format elf64-littleriscv
> 
> ...
> 
> ffffffffc00c0534:       f2e794e3                bne     a5,a4,ffffffffc00c045c <simple_strtoull+0x18>
> ffffffffc00c0538:       00280813                addi    a6,a6,2
> ffffffffc00c053c:       f21ff06f                j       ffffffffc00c045c <simple_strtoull+0x18>
> ffffffffc00c0540:       00068813                mv      a6,a3
> ffffffffc00c0544:       00800613                li      a2,8
> ffffffffc00c0548:       f15ff06f                j       ffffffffc00c045c <simple_strtoull+0x18>
> ffffffffc00c054c:       00277713                andi    a4,a4,2
> ffffffffc00c0550:       04070463                beqz    a4,ffffffffc00c0598 <simple_strtoull+0x154>
> ffffffffc00c0554:       fe06869b                addiw   a3,a3,-32
> ffffffffc00c0558:       0ff6f693                zext.b  a3,a3
> ffffffffc00c055c:       fc96879b                addiw   a5,a3,-55
> ffffffffc00c0560:       04c7f263                bgeu    a5,a2,ffffffffc00c05a4 <simple_strtoull+0x160>
> ffffffffc00c0564:       02a60533                mul     a0,a2,a0
> ffffffffc00c0568:       00f50533                add     a0,a0,a5
> ffffffffc00c056c:       00180813                addi    a6,a6,1
> ffffffffc00c0570:       00084683                lbu     a3,0(a6)
> ffffffffc00c0574:       0006879b                sext.w  a5,a3
> ffffffffc00c0578:       00d30733                add     a4,t1,a3
> ffffffffc00c057c:       00074703                lbu     a4,0(a4)
> ffffffffc00c0580:       04477893                andi    a7,a4,68
> ffffffffc00c0584:       02088063                beqz    a7,ffffffffc00c05a4 <simple_strtoull+0x160>
> ffffffffc00c0588:       00477893                andi    a7,a4,4
> ffffffffc00c058c:       fc0880e3                beqz    a7,ffffffffc00c054c <simple_strtoull+0x108>
> ffffffffc00c0590:       fd07879b                addiw   a5,a5,-48
> ffffffffc00c0594:       fcdff06f                j       ffffffffc00c0560 <simple_strtoull+0x11c>
> ffffffffc00c0598:       fc97879b                addiw   a5,a5,-55
> ffffffffc00c059c:       fc5ff06f                j       ffffffffc00c0560 <simple_strtoull+0x11c>
> ffffffffc00c05a0:       00000513                li      a0,0
> ffffffffc00c05a4:       00058463                beqz    a1,ffffffffc00c05ac <simple_strtoull+0x168>
> ffffffffc00c05a8:       0105b023                sd      a6,0(a1)
> ffffffffc00c05ac:       00008067                ret
>         ...
> 
> ffffffffc00c05c0 <turn_on_mmu>:
> ffffffffc00c05c0:       12000073                sfence.vma
> ffffffffc00c05c4:       00800293                li      t0,8
> ffffffffc00c05c8:       03c29293                slli    t0,t0,0x3c
> ffffffffc00c05cc:       000fc317                auipc   t1,0xfc
> ffffffffc00c05d0:       a3430313                addi    t1,t1,-1484 # ffffffffc01bc000 <stage1_pgtbl_root>
> ffffffffc00c05d4:       00c35313                srli    t1,t1,0xc
> ffffffffc00c05d8:       00536333                or      t1,t1,t0
> ffffffffc00c05dc:       18031073                csrw    satp,t1
> ffffffffc00c05e0:       00050067                jr      a0
> 
> ffffffffc00c05e4 <_ident_end>:
> ffffffffc00c05e4:       0000                    .insn   2, 0x0000
>         ...
> ```

... with all of this disassembly provided it still doesn't become clear what
changed from .xen-syms.0 to .xen-syms.1.

Jan

Re: [PATCH v5 26/26] xen/riscv: do a 4th linking pass if necessary

[Oleksii Kurochko]

On 7/6/26 6:13 PM, Jan Beulich wrote:
> On 06.07.2026 17:58, Oleksii Kurochko wrote:
>> Embedding the symbol table can shift sections and flip relaxation
>> decisions, changing code size and thus the set of emitted symbols
>> (e.g. gap end markers).
> 
> What difference in symbols is there? (And: Do you mean the ELF symbol
> table or what tools/symbols emits?) On ...

The ELF symbol tables of .xen-syms.0 and .xen-syms.1 are identical
(same names, types, and count; only addresses past a certain point
differ). The difference is in what tools/symbols emits: the
address-only "end of symbol" entry produced when want_symbol_end()
is true, i.e. when a sized text symbol's end doesn't reach the next
symbol's address:

     static bool want_symbol_end(unsigned int idx)
     {
         return table[idx].size &&
                (idx + 1 == table_cnt ||
                 table[idx].addr + table[idx].size < table[idx + 1].addr);
     }

In pass 1 (generated from .xen-syms.0): simple_strtoull is at
0xffffffffc00c0444 with size 0x16c, ending at 0xffffffffc00c05b0,
while turn_on_mmu (alignment-pinned) starts at 0xffffffffc00c05c0.
16-byte gap -> the end marker at ...c05b0 is emitted.

In pass 2 (generated from .xen-syms.1): simple_strtoull moved to
0xffffffffc00c0454 (same size), ending at exactly 0xffffffffc00c05c0
== turn_on_mmu. No gap -> no end marker. Hence symbols_addresses
shrinks by 8 and symbols_names by 1 (the marker's empty name).

> 
>>   Re-link with a regenerated table when its
>> size differs from the previous pass.
>>
>> This mirrors commit 35de7285d508 ("Arm: do a 4th linking pass if
>> necessary"), which riscv didn't receive when the underlying
>> pass-2-vs-pass-3 check was extended to it in commit aa786d6e3467
>> ("non-x86/symbols: check table sizes don't change between linking
>> passes 2 and 3").
> 
> ... Arm the problem was with a symbol (dis)appearing from/in the ELF
> symbol table. The situation looks to be different here. Sadly ...

I will rephrase then this paragraph to:

This takes the same remedy as commit 35de7285d508 ("Arm: do a 4th
linking pass if necessary"), though the underlying cause differs:
here no symbol (dis)appears from the ELF symbol table; instead the
set of end markers emitted by tools/symbols legitimately changes,
because want_symbol_end() depends on code layout, and layout differs
between passes due to linker relaxation.

Or it could be just dropped.

> 
>> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
>> ---
>> I faced this issue again in downstream:
>>    https://gitlab.com/xen-project/people/olkur/xen/-/jobs/15171254706
>>
>> It was found that the difference between .xen-syms.0 and .xen-syms.1 is in
>> alignment(?) gap between turn_on_mmu() and the end of simple_strtoull.
>> Specifically 0xffffffffc00c05b0 is present in pass 1 but not present in
>> pass 2 (where end of simple_strtoull() is just equal to ffffffffc00c05c0)
>> because code was shifted:
>>
>> ```
>> .xen-syms.0:     file format elf64-littleriscv
>>
>> ...
>>
>> ffffffffc00c0534:       f2e794e3                bne     a5,a4,ffffffffc00c045c <simple_strtoull+0x18>
>> ffffffffc00c0538:       00280813                addi    a6,a6,2
>> ffffffffc00c053c:       f21ff06f                j       ffffffffc00c045c <simple_strtoull+0x18>
>> ffffffffc00c0540:       00068813                mv      a6,a3
>> ffffffffc00c0544:       00800613                li      a2,8
>> ffffffffc00c0548:       f15ff06f                j       ffffffffc00c045c <simple_strtoull+0x18>
>> ffffffffc00c054c:       00277713                andi    a4,a4,2
>> ffffffffc00c0550:       04070463                beqz    a4,ffffffffc00c0598 <simple_strtoull+0x154>
>> ffffffffc00c0554:       fe06869b                addiw   a3,a3,-32
>> ffffffffc00c0558:       0ff6f693                zext.b  a3,a3
>> ffffffffc00c055c:       fc96879b                addiw   a5,a3,-55
>> ffffffffc00c0560:       04c7f263                bgeu    a5,a2,ffffffffc00c05a4 <simple_strtoull+0x160>
>> ffffffffc00c0564:       02a60533                mul     a0,a2,a0
>> ffffffffc00c0568:       00f50533                add     a0,a0,a5
>> ffffffffc00c056c:       00180813                addi    a6,a6,1
>> ffffffffc00c0570:       00084683                lbu     a3,0(a6)
>> ffffffffc00c0574:       0006879b                sext.w  a5,a3
>> ffffffffc00c0578:       00d30733                add     a4,t1,a3
>> ffffffffc00c057c:       00074703                lbu     a4,0(a4)
>> ffffffffc00c0580:       04477893                andi    a7,a4,68
>> ffffffffc00c0584:       02088063                beqz    a7,ffffffffc00c05a4 <simple_strtoull+0x160>
>> ffffffffc00c0588:       00477893                andi    a7,a4,4
>> ffffffffc00c058c:       fc0880e3                beqz    a7,ffffffffc00c054c <simple_strtoull+0x108>
>> ffffffffc00c0590:       fd07879b                addiw   a5,a5,-48
>> ffffffffc00c0594:       fcdff06f                j       ffffffffc00c0560 <simple_strtoull+0x11c>
>> ffffffffc00c0598:       fc97879b                addiw   a5,a5,-55
>> ffffffffc00c059c:       fc5ff06f                j       ffffffffc00c0560 <simple_strtoull+0x11c>
>> ffffffffc00c05a0:       00000513                li      a0,0
>> ffffffffc00c05a4:       00058463                beqz    a1,ffffffffc00c05ac <simple_strtoull+0x168>
>> ffffffffc00c05a8:       0105b023                sd      a6,0(a1)
>> ffffffffc00c05ac:       00008067                ret
>>          ...
>>
>> ffffffffc00c05c0 <turn_on_mmu>:
>> ffffffffc00c05c0:       12000073                sfence.vma
>> ffffffffc00c05c4:       00800293                li      t0,8
>> ffffffffc00c05c8:       03c29293                slli    t0,t0,0x3c
>> ffffffffc00c05cc:       000fc317                auipc   t1,0xfc
>> ffffffffc00c05d0:       a3430313                addi    t1,t1,-1484 # ffffffffc01bc000 <stage1_pgtbl_root>
>> ffffffffc00c05d4:       00c35313                srli    t1,t1,0xc
>> ffffffffc00c05d8:       00536333                or      t1,t1,t0
>> ffffffffc00c05dc:       18031073                csrw    satp,t1
>> ffffffffc00c05e0:       00050067                jr      a0
>>
>> ffffffffc00c05e4 <_ident_end>:
>> ffffffffc00c05e4:       0000                    .insn   2, 0x0000
>>          ...
>> ```
> 
> ... with all of this disassembly provided it still doesn't become clear what
> changed from .xen-syms.0 to .xen-syms.1.

The disassembly was meant to show the 16-byte padding gap between the
end of simple_strtoull() and (aligned) turn_on_mmu() in .xen-syms.0.
In .xen-syms.1 that gap is gone, which is what removes the end marker
and shrinks symbols_addresses by 8 and symbols_names by 1, as
explained above.

The actual code change is earlier in .text. Inserting the symbol
table (~24k of .rodata) pushes .init.text from 0xffffffffc0148000
to 0xffffffffc014e000. Several calls from .text into .init.text
(e.g. to alloc_boot_pages()/init_boot_pages()) thereby cross JAL's
±1MB reach, so the linker can no longer relax them:

.xen-syms.0:
     <caller>: jal   ffffffffc0152000 <alloc_boot_pages>

.xen-syms.1:
     <caller>: auipc ra,0xfc
               jalr  1044(ra) # ffffffffc015800c <alloc_boot_pages>

Four such call sites grow .text by 16 bytes in total, which is what
shifts simple_strtoull by +0x10 and closes the padding gap before
the (aligned) turn_on_mmu.

~ Oleksii

Re: [PATCH v5 26/26] xen/riscv: do a 4th linking pass if necessary

[Jan Beulich]

On 07.07.2026 10:19, Oleksii Kurochko wrote:
> On 7/6/26 6:13 PM, Jan Beulich wrote:
>> On 06.07.2026 17:58, Oleksii Kurochko wrote:
>>> Embedding the symbol table can shift sections and flip relaxation
>>> decisions, changing code size and thus the set of emitted symbols
>>> (e.g. gap end markers).
>>
>> What difference in symbols is there? (And: Do you mean the ELF symbol
>> table or what tools/symbols emits?) On ...
> 
> The ELF symbol tables of .xen-syms.0 and .xen-syms.1 are identical
> (same names, types, and count; only addresses past a certain point
> differ). The difference is in what tools/symbols emits: the
> address-only "end of symbol" entry produced when want_symbol_end()
> is true, i.e. when a sized text symbol's end doesn't reach the next
> symbol's address:
> 
>      static bool want_symbol_end(unsigned int idx)
>      {
>          return table[idx].size &&
>                 (idx + 1 == table_cnt ||
>                  table[idx].addr + table[idx].size < table[idx + 1].addr);
>      }
> 
> In pass 1 (generated from .xen-syms.0): simple_strtoull is at
> 0xffffffffc00c0444 with size 0x16c, ending at 0xffffffffc00c05b0,
> while turn_on_mmu (alignment-pinned) starts at 0xffffffffc00c05c0.
> 16-byte gap -> the end marker at ...c05b0 is emitted.
> 
> In pass 2 (generated from .xen-syms.1): simple_strtoull moved to
> 0xffffffffc00c0454 (same size), ending at exactly 0xffffffffc00c05c0
> == turn_on_mmu. No gap -> no end marker. Hence symbols_addresses
> shrinks by 8 and symbols_names by 1 (the marker's empty name).
> 
>>
>>>   Re-link with a regenerated table when its
>>> size differs from the previous pass.
>>>
>>> This mirrors commit 35de7285d508 ("Arm: do a 4th linking pass if
>>> necessary"), which riscv didn't receive when the underlying
>>> pass-2-vs-pass-3 check was extended to it in commit aa786d6e3467
>>> ("non-x86/symbols: check table sizes don't change between linking
>>> passes 2 and 3").
>>
>> ... Arm the problem was with a symbol (dis)appearing from/in the ELF
>> symbol table. The situation looks to be different here. Sadly ...
> 
> I will rephrase then this paragraph to:
> 
> This takes the same remedy as commit 35de7285d508 ("Arm: do a 4th
> linking pass if necessary"), though the underlying cause differs:
> here no symbol (dis)appears from the ELF symbol table; instead the
> set of end markers emitted by tools/symbols legitimately changes,
> because want_symbol_end() depends on code layout, and layout differs
> between passes due to linker relaxation.
> 
> Or it could be just dropped.

Please don't drop it.

Jan