* [PULL 01/40] hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 02/40] hw/riscv/riscv-iommu.c: check for reserved PTE bits alistair23
` (40 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Under certain circunstances, like the one described in [1] and [2],
a read operation that faults will be logged as a write fault instead,
and vice-versa, if they happen after the translation phase in
riscv_iommu_spa_fetch().
The first problem is that we're overwriting iotlb->perm with PTE flags,
so an IOMMU_RO access flag can be overwritten by whatever flags
the PTE has. This will cause the wrong fault type to be thrown at
the end of the function in case a fault happens.
To solve the iotlb->perm overwrite we'll bit_and the original
iotlb->perm access flags with the PTE access flags, preserving the
original access type. So a IOMMU_RO access in a R+W PTE will result in
a IOMMU_RO perm.
Second, the resulting fault is received by riscv_iommu_translate(), which
will then report the fault. To do that we require a transaction type
(ttype). We're prioritizing checking "perm & IOMMU_RW" to set a
UADDR_WR ttype, and then checking "perm & IOMMU_RO" to set UADDR_RD
ttype. The issue with that is IOMMU_RO=1 and IOMMU_RW=3, thus checking
"perm & IOMMU_RW" for a write then "perm & IOMMU_RO" for a read will
cause the read fault to always be diagnosed as write.
Make the iotlb->perm matches more strict: "perm & IOMMU_RW" must be
exactly IOMMU_RW, ensuring that 'perm' has both flags. Then we can
check perm & IOMMU_WO and perm & IOMMU_RO without worrying about
overlapping with the RW flag.
[1] https://gitlab.com/qemu-project/qemu/-/work_items/3557
[2] https://gitlab.com/qemu-project/qemu/-/work_items/3577
Fixes: 69a9ae4836 ("hw/riscv/riscv-iommu: add ATS support")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3557
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3577
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260701124034.552271-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 974042d017..7f94ce152e 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -282,6 +282,7 @@ static hwaddr riscv_iommu_napot_page_mask(hwaddr ppn, hwaddr addr, hwaddr *out)
static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
IOMMUTLBEntry *iotlb)
{
+ IOMMUAccessFlags pte_perm;
dma_addr_t addr, base;
uint64_t satp, gatp, pte;
bool en_s, en_g;
@@ -509,8 +510,16 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
}
/* Translation phase completed (GPA or SPA) */
iotlb->translated_addr = base;
- iotlb->perm = (pte & PTE_W) ? ((pte & PTE_R) ? IOMMU_RW : IOMMU_WO)
- : IOMMU_RO;
+
+ /*
+ * Do a bit_and between the PTE bits and the original
+ * request flags to determine the exact permission we
+ * need, i.e. if the original request is RO and the
+ * PTE has RW flags the actual perm is RO.
+ */
+ pte_perm = (pte & PTE_W) ? ((pte & PTE_R) ? IOMMU_RW : IOMMU_WO)
+ : IOMMU_RO;
+ iotlb->perm &= pte_perm;
/* Check MSI GPA address match */
if (pass == S_STAGE && (iotlb->perm & IOMMU_WO) &&
@@ -1727,7 +1736,8 @@ done:
if (fault) {
unsigned ttype = RISCV_IOMMU_FQ_TTYPE_PCIE_ATS_REQ;
- if (iotlb->perm & IOMMU_RW) {
+ if ((iotlb->perm & IOMMU_RW) == IOMMU_RW
+ || iotlb->perm & IOMMU_WO) {
ttype = RISCV_IOMMU_FQ_TTYPE_UADDR_WR;
} else if (iotlb->perm & IOMMU_RO) {
ttype = RISCV_IOMMU_FQ_TTYPE_UADDR_RD;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 02/40] hw/riscv/riscv-iommu.c: check for reserved PTE bits
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
2026-07-10 2:54 ` [PULL 01/40] hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 03/40] hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access alistair23
` (39 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Nutty Liu, Chao Liu, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We need to fault if reserved PTE bits (60:54) are set.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3554
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260701121111.537654-2-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 7f94ce152e..6665ad9f7c 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -469,6 +469,8 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
if (!(pte & PTE_V)) {
break; /* Invalid PTE */
+ } else if (pte & PTE_RESERVED(false)) {
+ break; /* Reserved PTE bits set */
} else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
base = PPN_PHYS(ppn); /* Inner PTE, continue walking */
} else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 03/40] hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
2026-07-10 2:54 ` [PULL 01/40] hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults alistair23
2026-07-10 2:54 ` [PULL 02/40] hw/riscv/riscv-iommu.c: check for reserved PTE bits alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 04/40] hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE alistair23
` (38 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Nutty Liu, Chao Liu, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
All IOMMU accesses are assumed to be user mode unless told otherwise,
i.e. we have a process_id. In case we have a non-user mode leaf PTE
(PTE_U isn't set) and we are running in user mode, we need to throw a
fault.
This also reflects on qos-riscv-iommu tests: the tests always run in
user mode so our PTEs must have PTE_U (bit 0x10) set.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3553
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260701121111.537654-3-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
tests/qtest/libqos/qos-riscv-iommu.h | 4 ++--
hw/riscv/riscv-iommu.c | 8 ++++++++
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/tests/qtest/libqos/qos-riscv-iommu.h b/tests/qtest/libqos/qos-riscv-iommu.h
index 90e69a5d73..c218e9d66d 100644
--- a/tests/qtest/libqos/qos-riscv-iommu.h
+++ b/tests/qtest/libqos/qos-riscv-iommu.h
@@ -54,8 +54,8 @@
* PTE masks for RISC-V IOMMU page tables.
* Values match PTE_V, PTE_R, PTE_W, PTE_A, PTE_D in target/riscv/cpu_bits.h
*/
-#define QRIOMMU_NON_LEAF_PTE_MASK 0x001 /* PTE_V */
-#define QRIOMMU_LEAF_PTE_RW_MASK 0x0c7 /* V|R|W|A|D */
+#define QRIOMMU_NON_LEAF_PTE_MASK 0x011 /* PTE_V | PTE_U */
+#define QRIOMMU_LEAF_PTE_RW_MASK 0x0d7 /* V | R | W | A | D | PTE_U */
#define QRIOMMU_PTE_PPN_MASK 0x003ffffffffffc00ull
/* Address-space base offset for test tables */
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 6665ad9f7c..c35e9f0119 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -298,6 +298,7 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
G_STAGE = 1,
} pass;
MemTxResult ret;
+ bool pv = !!ctx->process_id;
satp = get_field(ctx->satp, RISCV_IOMMU_ATP_MODE_FIELD);
gatp = get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD);
@@ -471,6 +472,13 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
break; /* Invalid PTE */
} else if (pte & PTE_RESERVED(false)) {
break; /* Reserved PTE bits set */
+ } else if (!(pte & PTE_U) && !pv) {
+ /*
+ * All accesses are assumed to be User mode unless
+ * process_id is valid (pv). In case we have a
+ * non-user mode PTE and !pv we need to fault.
+ */
+ break;
} else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
base = PPN_PHYS(ppn); /* Inner PTE, continue walking */
} else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 04/40] hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (2 preceding siblings ...)
2026-07-10 2:54 ` [PULL 03/40] hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 05/40] hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits alistair23
` (37 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv-iommu spec 1.0 says:
"When checking the U bit in a second-stage PTE, the transaction
is treated as not requesting supervisor privilege."
We need to *always* fault in case we're on G_STAGE and PTE_U is cleared
since we can't be on supervisor mode at this point.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3555
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20260701121111.537654-4-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index c35e9f0119..6b20940b89 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -495,6 +495,16 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
break; /* Access bit not set */
} else if ((iotlb->perm & IOMMU_WO) && !ade && !(pte & PTE_D)) {
break; /* Dirty bit not set */
+ } else if (pass == G_STAGE && !(pte & PTE_U)) {
+ /*
+ * riscv-iommu spec 1.0: "When checking the U bit in a
+ * second-stage PTE, the transaction is treated as
+ * not requesting supervisor privilege."
+ *
+ * I.e. we need to fault if this is a non-user PTE since
+ * we are always in user mode at this point.
+ */
+ break;
} else {
/* Leaf PTE, translation completed. */
sc[pass].step = sc[pass].levels;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 05/40] hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (3 preceding siblings ...)
2026-07-10 2:54 ` [PULL 04/40] hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 06/40] hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write alistair23
` (36 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Nutty Liu, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We need to throw an MSI_MISCONFIGURED error when any of the reserved PTE
bits (first doubleword only) are set.
Fixes: Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3563
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Message-ID: <20260629125719.679626-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 6b20940b89..c3f9f052ae 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -677,6 +677,27 @@ static MemTxResult riscv_iommu_msi_write(RISCVIOMMUState *s,
switch (get_field(pte[0], RISCV_IOMMU_MSI_PTE_M)) {
case RISCV_IOMMU_MSI_PTE_M_BASIC:
+ /*
+ * riscv-iommu spec MSI PTE basic translate mode:
+ * "When an MSI PTE has fields V = 1, C = 0, and M = 3
+ * (basic translate mode), the PTE's complete format is:
+ * First doubleword: bit 63 C, = 0
+ * bits 53:10 PPN
+ * bits 2:1 M, = 3
+ * bit 0 V, = 1
+ * All other bits of the first doubleword are reserved
+ * and must be set to zeros by software. The second
+ * doubleword is ignored by an IOMMU so is free for
+ * software to use."
+ *
+ * In other words, bits 62:54 and 9:3 of pte[0] are reserved.
+ */
+ if (pte[0] & (GENMASK_ULL(62, 54) | GENMASK_ULL(9, 3))) {
+ res = MEMTX_DECODE_ERROR;
+ cause = RISCV_IOMMU_FQ_CAUSE_MSI_MISCONFIGURED;
+ goto err;
+ }
+
/* MSI Pass-through mode */
addr = PPN_PHYS(get_field(pte[0], RISCV_IOMMU_MSI_PTE_PPN));
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 06/40] hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (4 preceding siblings ...)
2026-07-10 2:54 ` [PULL 05/40] hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 07/40] target/riscv: Remove unused tcg/tcg.h include alistair23
` (35 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Nutty Liu, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
The riscv-iommu spec requires that the IOMMU records its own generated
MSI write faults.
Fixes: 01c1caa9d1 ("hw/riscv/virt.c, riscv-iommu-sys.c: add MSIx support")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3572
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Message-ID: <20260629165954.1018123-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.h | 1 +
hw/riscv/riscv-iommu-sys.c | 16 +++++++++++++++-
hw/riscv/riscv-iommu.c | 3 +--
3 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index a778e86fb7..da70e8bfa8 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -103,6 +103,7 @@ void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
void riscv_iommu_reset(RISCVIOMMUState *s);
void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type);
+void riscv_iommu_fault(RISCVIOMMUState *s, struct riscv_iommu_fq_record *ev);
typedef struct RISCVIOMMUContext RISCVIOMMUContext;
/* Device translation context state. */
diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
index bf87b0b4ea..3314adeed2 100644
--- a/hw/riscv/riscv-iommu-sys.c
+++ b/hw/riscv/riscv-iommu-sys.c
@@ -26,6 +26,7 @@
#include "qemu/host-utils.h"
#include "qemu/module.h"
#include "qom/object.h"
+#include "target/riscv/cpu_bits.h"
#include "trace.h"
#include "riscv-iommu.h"
@@ -143,7 +144,20 @@ static void riscv_iommu_sysdev_send_MSI(RISCVIOMMUStateSys *s,
address_space_stl_le(&address_space_memory, msi_addr,
msi_data, MEMTXATTRS_UNSPECIFIED, &result);
- trace_riscv_iommu_sys_msi_sent(vector, msi_addr, msi_data, result);
+
+ if (result == MEMTX_OK) {
+ trace_riscv_iommu_sys_msi_sent(vector, msi_addr, msi_data, result);
+ } else {
+ /* Record an access fault error in the fault queue */
+ struct riscv_iommu_fq_record ev = { 0 };
+ RISCVIOMMUState *iommu = &s->iommu;
+
+ ev.hdr = set_field(ev.hdr, RISCV_IOMMU_FQ_HDR_CAUSE,
+ RISCV_IOMMU_FQ_CAUSE_MSI_WR_FAULT);
+ ev.hdr = set_field(ev.hdr, RISCV_IOMMU_FQ_HDR_TTYPE,
+ RISCV_IOMMU_FQ_TTYPE_UADDR_WR);
+ riscv_iommu_fault(iommu, &ev);
+ }
}
static void riscv_iommu_sysdev_notify(RISCVIOMMUState *iommu,
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index c3f9f052ae..12f20fa4bd 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -118,8 +118,7 @@ void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type)
}
}
-static void riscv_iommu_fault(RISCVIOMMUState *s,
- struct riscv_iommu_fq_record *ev)
+void riscv_iommu_fault(RISCVIOMMUState *s, struct riscv_iommu_fq_record *ev)
{
uint32_t ctrl = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_FQCSR);
uint32_t head = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_FQH) & s->fq_mask;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 07/40] target/riscv: Remove unused tcg/tcg.h include
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (5 preceding siblings ...)
2026-07-10 2:54 ` [PULL 06/40] hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 08/40] target/riscv: move valid_vm_* satp arrays to cpu.c alistair23
` (34 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Zephyr Li, Philippe Mathieu-Daudé, Alistair Francis,
Daniel Henrique Barboza, Chao Liu
From: Zephyr Li <fritchleybohrer@gmail.com>
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260703180538.3346781-2-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 4d2eb281bf..7664e686fa 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -38,7 +38,6 @@
#include "system/tcg.h"
#include "kvm/kvm_riscv.h"
#include "tcg/tcg-cpu.h"
-#include "tcg/tcg.h"
#if !defined(CONFIG_USER_ONLY)
#include "target/riscv/debug.h"
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 08/40] target/riscv: move valid_vm_* satp arrays to cpu.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (6 preceding siblings ...)
2026-07-10 2:54 ` [PULL 07/40] target/riscv: Remove unused tcg/tcg.h include alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 09/40] hw/riscv, target/riscv: move pmu fdt function to fdt-common.c alistair23
` (33 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Alistair Francis,
Philippe Mathieu-Daudé
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
These satp arrays are used internally in both csr.c and in cpu.c. csr.c
is going to be moved to the TCG subdir in the next patch, and we want
the satp logic to be available for KVM with --disable-tcg builds.
Move these arrays to cpu.c to keep them available for KVM with
--disable-tcg.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-3-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 2 --
target/riscv/csr.h | 3 +++
target/riscv/cpu.c | 13 +++++++++++++
target/riscv/csr.c | 12 ------------
4 files changed, 16 insertions(+), 14 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index bdd28d329b..82362ef8d8 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -968,8 +968,6 @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
void riscv_add_satp_mode_properties(Object *obj);
bool riscv_cpu_accelerator_compatible(RISCVCPU *cpu);
-extern const bool valid_vm_1_10_32[], valid_vm_1_10_64[];
-
void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
diff --git a/target/riscv/csr.h b/target/riscv/csr.h
index c791260f83..66ec9546ed 100644
--- a/target/riscv/csr.h
+++ b/target/riscv/csr.h
@@ -72,6 +72,9 @@ enum {
CSR_TABLE_SIZE = 0x1000
};
+/* valid_vm_* arrays are shared with KVM via cpu.c */
+extern const bool valid_vm_1_10_32[], valid_vm_1_10_64[];
+
/* CSR function table */
extern riscv_csr_operations csr_ops[CSR_TABLE_SIZE];
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 7664e686fa..cae4e96232 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -65,6 +65,19 @@ const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
#define BYTE(x) (x)
#endif
+/* SATP bits that are shared between TCG and KVM */
+const bool valid_vm_1_10_32[16] = {
+ [VM_1_10_MBARE] = true,
+ [VM_1_10_SV32] = true
+};
+
+const bool valid_vm_1_10_64[16] = {
+ [VM_1_10_MBARE] = true,
+ [VM_1_10_SV39] = true,
+ [VM_1_10_SV48] = true,
+ [VM_1_10_SV57] = true
+};
+
bool riscv_cpu_is_32bit(RISCVCPU *cpu)
{
return riscv_cpu_mxl(&cpu->env) == MXL_RV32;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 7168a4dc12..7818d81fb0 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1875,18 +1875,6 @@ static const uint64_t hvien_writable_mask = LOCAL_INTERRUPTS;
static const uint64_t vsip_writable_mask = MIP_VSSIP | LOCAL_INTERRUPTS;
-const bool valid_vm_1_10_32[16] = {
- [VM_1_10_MBARE] = true,
- [VM_1_10_SV32] = true
-};
-
-const bool valid_vm_1_10_64[16] = {
- [VM_1_10_MBARE] = true,
- [VM_1_10_SV39] = true,
- [VM_1_10_SV48] = true,
- [VM_1_10_SV57] = true
-};
-
/* Machine Information Registers */
static RISCVException read_zero(CPURISCVState *env, int csrno,
target_ulong *val)
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 09/40] hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (7 preceding siblings ...)
2026-07-10 2:54 ` [PULL 08/40] target/riscv: move valid_vm_* satp arrays to cpu.c alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 10/40] target/riscv: move TCG only files to tcg subdir alistair23
` (32 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Alistair Francis,
Philippe Mathieu-Daudé
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_pmu_generate_fdt_node() can be moved to fdt_common.c since it has
no PMU TCG internals.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-4-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
include/hw/riscv/fdt-common.h | 1 +
hw/riscv/fdt-common.c | 52 +++++++++++++++++++++++++++++++++++
hw/riscv/tt_atlantis.c | 1 -
hw/riscv/virt.c | 1 -
target/riscv/pmu.c | 52 -----------------------------------
5 files changed, 53 insertions(+), 54 deletions(-)
diff --git a/include/hw/riscv/fdt-common.h b/include/hw/riscv/fdt-common.h
index 017278b611..1729a6abc6 100644
--- a/include/hw/riscv/fdt-common.h
+++ b/include/hw/riscv/fdt-common.h
@@ -35,4 +35,5 @@ void create_fdt_plic(void *fdt, hwaddr addr, uint64_t size,
uint32_t addr_cells, uint32_t *plic_cells,
uint32_t cells_size, uint32_t ndev_sources,
bool numa_enabled, int socket);
+void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name);
#endif
diff --git a/hw/riscv/fdt-common.c b/hw/riscv/fdt-common.c
index e0e31af09b..aa143a618b 100644
--- a/hw/riscv/fdt-common.c
+++ b/hw/riscv/fdt-common.c
@@ -230,3 +230,55 @@ void create_fdt_plic(void *fdt, hwaddr addr, uint64_t size,
}
qemu_fdt_setprop_cell(fdt, nodename, "phandle", plic_phandle);
}
+
+/*
+ * To keep it simple, any event can be mapped to any programmable counters in
+ * QEMU. The generic cycle & instruction count events can also be monitored
+ * using programmable counters. In that case, mcycle & minstret must continue
+ * to provide the correct value as well. Heterogeneous PMU per hart is not
+ * supported yet. Thus, number of counters are same across all harts.
+ */
+void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name)
+{
+ uint32_t fdt_event_ctr_map[15] = {};
+
+ /*
+ * The event encoding is specified in the SBI specification
+ * Event idx is a 20bits wide number encoded as follows:
+ * event_idx[19:16] = type
+ * event_idx[15:0] = code
+ * The code field in cache events are encoded as follows:
+ * event_idx.code[15:3] = cache_id
+ * event_idx.code[2:1] = op_id
+ * event_idx.code[0:0] = result_id
+ */
+
+ /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
+ fdt_event_ctr_map[0] = cpu_to_be32(0x00000001);
+ fdt_event_ctr_map[1] = cpu_to_be32(0x00000001);
+ fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
+
+ /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
+ fdt_event_ctr_map[3] = cpu_to_be32(0x00000002);
+ fdt_event_ctr_map[4] = cpu_to_be32(0x00000002);
+ fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
+
+ /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
+ fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
+ fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
+ fdt_event_ctr_map[8] = cpu_to_be32(cmask);
+
+ /* SBI_PMU_HW_CACHE_DTLB : 0x03 WRITE : 0x01 MISS : 0x00 type(0x01) */
+ fdt_event_ctr_map[9] = cpu_to_be32(0x0001001B);
+ fdt_event_ctr_map[10] = cpu_to_be32(0x0001001B);
+ fdt_event_ctr_map[11] = cpu_to_be32(cmask);
+
+ /* SBI_PMU_HW_CACHE_ITLB : 0x04 READ : 0x00 MISS : 0x00 type(0x01) */
+ fdt_event_ctr_map[12] = cpu_to_be32(0x00010021);
+ fdt_event_ctr_map[13] = cpu_to_be32(0x00010021);
+ fdt_event_ctr_map[14] = cpu_to_be32(cmask);
+
+ /* This a OpenSBI specific DT property documented in OpenSBI docs */
+ qemu_fdt_setprop(fdt, pmu_name, "riscv,event-to-mhpmcounters",
+ fdt_event_ctr_map, sizeof(fdt_event_ctr_map));
+}
diff --git a/hw/riscv/tt_atlantis.c b/hw/riscv/tt_atlantis.c
index beaf64e0c1..d808bcc11c 100644
--- a/hw/riscv/tt_atlantis.c
+++ b/hw/riscv/tt_atlantis.c
@@ -17,7 +17,6 @@
#include "hw/core/sysbus.h"
#include "target/riscv/cpu.h"
-#include "target/riscv/pmu.h"
#include "hw/riscv/boot.h"
#include "hw/riscv/fdt-common.h"
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index bd9f77aad3..51bac47a91 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -30,7 +30,6 @@
#include "hw/char/serial-mm.h"
#include "target/riscv/cpu.h"
#include "hw/core/sysbus-fdt.h"
-#include "target/riscv/pmu.h"
#include "hw/riscv/riscv_hart.h"
#include "hw/riscv/iommu.h"
#include "hw/riscv/riscv-iommu-bits.h"
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index 3444400bd2..38ad2737e1 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -27,58 +27,6 @@
#define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
-/*
- * To keep it simple, any event can be mapped to any programmable counters in
- * QEMU. The generic cycle & instruction count events can also be monitored
- * using programmable counters. In that case, mcycle & minstret must continue
- * to provide the correct value as well. Heterogeneous PMU per hart is not
- * supported yet. Thus, number of counters are same across all harts.
- */
-void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name)
-{
- uint32_t fdt_event_ctr_map[15] = {};
-
- /*
- * The event encoding is specified in the SBI specification
- * Event idx is a 20bits wide number encoded as follows:
- * event_idx[19:16] = type
- * event_idx[15:0] = code
- * The code field in cache events are encoded as follows:
- * event_idx.code[15:3] = cache_id
- * event_idx.code[2:1] = op_id
- * event_idx.code[0:0] = result_id
- */
-
- /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
- fdt_event_ctr_map[0] = cpu_to_be32(0x00000001);
- fdt_event_ctr_map[1] = cpu_to_be32(0x00000001);
- fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
-
- /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
- fdt_event_ctr_map[3] = cpu_to_be32(0x00000002);
- fdt_event_ctr_map[4] = cpu_to_be32(0x00000002);
- fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
-
- /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
- fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
- fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
- fdt_event_ctr_map[8] = cpu_to_be32(cmask);
-
- /* SBI_PMU_HW_CACHE_DTLB : 0x03 WRITE : 0x01 MISS : 0x00 type(0x01) */
- fdt_event_ctr_map[9] = cpu_to_be32(0x0001001B);
- fdt_event_ctr_map[10] = cpu_to_be32(0x0001001B);
- fdt_event_ctr_map[11] = cpu_to_be32(cmask);
-
- /* SBI_PMU_HW_CACHE_ITLB : 0x04 READ : 0x00 MISS : 0x00 type(0x01) */
- fdt_event_ctr_map[12] = cpu_to_be32(0x00010021);
- fdt_event_ctr_map[13] = cpu_to_be32(0x00010021);
- fdt_event_ctr_map[14] = cpu_to_be32(cmask);
-
- /* This a OpenSBI specific DT property documented in OpenSBI docs */
- qemu_fdt_setprop(fdt, pmu_name, "riscv,event-to-mhpmcounters",
- fdt_event_ctr_map, sizeof(fdt_event_ctr_map));
-}
-
static bool riscv_pmu_counter_valid(RISCVCPU *cpu, uint32_t ctr_idx)
{
if (ctr_idx < 3 || ctr_idx >= RV_MAX_MHPMCOUNTERS ||
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 10/40] target/riscv: move TCG only files to tcg subdir
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (8 preceding siblings ...)
2026-07-10 2:54 ` [PULL 09/40] hw/riscv, target/riscv: move pmu fdt function to fdt-common.c alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 11/40] target/riscv/machine.c: do not migrate pmp state with kvm alistair23
` (31 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis, Chao Liu
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We have *way* too much TCG-only code hanging around in target/riscv,
where ideally we would have things that are shared between accelerators.
We'll follow the example of other targets like i386 and loongarch and
move everything to the tcg subir. This will not only cleanup target/riscv
but it will also expose what is common code but it's buried inside a TCG
helper.
We're leaving some stuff behind because these require a little more
case to not end up breaking KVM. We'll take care of them next.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260703180538.3346781-5-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/{ => tcg}/pmu.h | 0
target/riscv/{ => tcg}/vector_internals.h | 0
target/riscv/{ => tcg}/bitmanip_helper.c | 0
target/riscv/{ => tcg}/cpu_helper.c | 0
target/riscv/{ => tcg}/crypto_helper.c | 0
target/riscv/{ => tcg}/csr.c | 0
target/riscv/{ => tcg}/debug.c | 0
target/riscv/{ => tcg}/fpu_helper.c | 0
target/riscv/{ => tcg}/m128_helper.c | 0
target/riscv/{ => tcg}/mips_csr.c | 0
target/riscv/{ => tcg}/op_helper.c | 0
target/riscv/{ => tcg}/pmu.c | 0
target/riscv/{ => tcg}/th_csr.c | 0
target/riscv/{ => tcg}/translate.c | 0
target/riscv/{ => tcg}/vcrypto_helper.c | 0
target/riscv/{ => tcg}/vector_helper.c | 0
target/riscv/{ => tcg}/vector_internals.c | 0
target/riscv/{ => tcg}/zce_helper.c | 0
.../insn_trans/trans_privileged.c.inc | 0
.../{ => tcg}/insn_trans/trans_rva.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvb.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvbf16.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvd.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvf.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvh.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvi.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvk.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvm.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvv.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvvk.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzabha.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzacas.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzalasr.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzawrs.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzce.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzcmop.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzfa.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzfh.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzicbo.c.inc | 0
.../insn_trans/trans_rvzicfiss.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzicond.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzimop.c.inc | 0
.../{ => tcg}/insn_trans/trans_svinval.c.inc | 0
.../{ => tcg}/insn_trans/trans_xlrbr.c.inc | 0
.../{ => tcg}/insn_trans/trans_xmips.c.inc | 0
.../{ => tcg}/insn_trans/trans_xthead.c.inc | 0
.../insn_trans/trans_xventanacondops.c.inc | 0
.../{ => tcg}/insn_trans/trans_zilsd.c.inc | 0
target/riscv/meson.build | 16 ----------
target/riscv/tcg/meson.build | 30 +++++++++++++++++--
50 files changed, 28 insertions(+), 18 deletions(-)
rename target/riscv/{ => tcg}/pmu.h (100%)
rename target/riscv/{ => tcg}/vector_internals.h (100%)
rename target/riscv/{ => tcg}/bitmanip_helper.c (100%)
rename target/riscv/{ => tcg}/cpu_helper.c (100%)
rename target/riscv/{ => tcg}/crypto_helper.c (100%)
rename target/riscv/{ => tcg}/csr.c (100%)
rename target/riscv/{ => tcg}/debug.c (100%)
rename target/riscv/{ => tcg}/fpu_helper.c (100%)
rename target/riscv/{ => tcg}/m128_helper.c (100%)
rename target/riscv/{ => tcg}/mips_csr.c (100%)
rename target/riscv/{ => tcg}/op_helper.c (100%)
rename target/riscv/{ => tcg}/pmu.c (100%)
rename target/riscv/{ => tcg}/th_csr.c (100%)
rename target/riscv/{ => tcg}/translate.c (100%)
rename target/riscv/{ => tcg}/vcrypto_helper.c (100%)
rename target/riscv/{ => tcg}/vector_helper.c (100%)
rename target/riscv/{ => tcg}/vector_internals.c (100%)
rename target/riscv/{ => tcg}/zce_helper.c (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_privileged.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rva.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvb.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvbf16.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvd.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvf.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvh.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvi.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvk.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvm.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvv.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvvk.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzabha.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzacas.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzalasr.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzawrs.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzce.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzcmop.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzfa.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzfh.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicbo.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicfiss.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicond.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzimop.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_svinval.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xlrbr.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xmips.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xthead.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xventanacondops.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_zilsd.c.inc (100%)
diff --git a/target/riscv/pmu.h b/target/riscv/tcg/pmu.h
similarity index 100%
rename from target/riscv/pmu.h
rename to target/riscv/tcg/pmu.h
diff --git a/target/riscv/vector_internals.h b/target/riscv/tcg/vector_internals.h
similarity index 100%
rename from target/riscv/vector_internals.h
rename to target/riscv/tcg/vector_internals.h
diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/tcg/bitmanip_helper.c
similarity index 100%
rename from target/riscv/bitmanip_helper.c
rename to target/riscv/tcg/bitmanip_helper.c
diff --git a/target/riscv/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
similarity index 100%
rename from target/riscv/cpu_helper.c
rename to target/riscv/tcg/cpu_helper.c
diff --git a/target/riscv/crypto_helper.c b/target/riscv/tcg/crypto_helper.c
similarity index 100%
rename from target/riscv/crypto_helper.c
rename to target/riscv/tcg/crypto_helper.c
diff --git a/target/riscv/csr.c b/target/riscv/tcg/csr.c
similarity index 100%
rename from target/riscv/csr.c
rename to target/riscv/tcg/csr.c
diff --git a/target/riscv/debug.c b/target/riscv/tcg/debug.c
similarity index 100%
rename from target/riscv/debug.c
rename to target/riscv/tcg/debug.c
diff --git a/target/riscv/fpu_helper.c b/target/riscv/tcg/fpu_helper.c
similarity index 100%
rename from target/riscv/fpu_helper.c
rename to target/riscv/tcg/fpu_helper.c
diff --git a/target/riscv/m128_helper.c b/target/riscv/tcg/m128_helper.c
similarity index 100%
rename from target/riscv/m128_helper.c
rename to target/riscv/tcg/m128_helper.c
diff --git a/target/riscv/mips_csr.c b/target/riscv/tcg/mips_csr.c
similarity index 100%
rename from target/riscv/mips_csr.c
rename to target/riscv/tcg/mips_csr.c
diff --git a/target/riscv/op_helper.c b/target/riscv/tcg/op_helper.c
similarity index 100%
rename from target/riscv/op_helper.c
rename to target/riscv/tcg/op_helper.c
diff --git a/target/riscv/pmu.c b/target/riscv/tcg/pmu.c
similarity index 100%
rename from target/riscv/pmu.c
rename to target/riscv/tcg/pmu.c
diff --git a/target/riscv/th_csr.c b/target/riscv/tcg/th_csr.c
similarity index 100%
rename from target/riscv/th_csr.c
rename to target/riscv/tcg/th_csr.c
diff --git a/target/riscv/translate.c b/target/riscv/tcg/translate.c
similarity index 100%
rename from target/riscv/translate.c
rename to target/riscv/tcg/translate.c
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/tcg/vcrypto_helper.c
similarity index 100%
rename from target/riscv/vcrypto_helper.c
rename to target/riscv/tcg/vcrypto_helper.c
diff --git a/target/riscv/vector_helper.c b/target/riscv/tcg/vector_helper.c
similarity index 100%
rename from target/riscv/vector_helper.c
rename to target/riscv/tcg/vector_helper.c
diff --git a/target/riscv/vector_internals.c b/target/riscv/tcg/vector_internals.c
similarity index 100%
rename from target/riscv/vector_internals.c
rename to target/riscv/tcg/vector_internals.c
diff --git a/target/riscv/zce_helper.c b/target/riscv/tcg/zce_helper.c
similarity index 100%
rename from target/riscv/zce_helper.c
rename to target/riscv/tcg/zce_helper.c
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/tcg/insn_trans/trans_privileged.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_privileged.c.inc
rename to target/riscv/tcg/insn_trans/trans_privileged.c.inc
diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/tcg/insn_trans/trans_rva.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rva.c.inc
rename to target/riscv/tcg/insn_trans/trans_rva.c.inc
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/tcg/insn_trans/trans_rvb.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvb.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvb.c.inc
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/tcg/insn_trans/trans_rvbf16.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvbf16.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvbf16.c.inc
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/tcg/insn_trans/trans_rvd.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvd.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvd.c.inc
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/tcg/insn_trans/trans_rvf.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvf.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvf.c.inc
diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/tcg/insn_trans/trans_rvh.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvh.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvh.c.inc
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/tcg/insn_trans/trans_rvi.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvi.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvi.c.inc
diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/tcg/insn_trans/trans_rvk.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvk.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvk.c.inc
diff --git a/target/riscv/insn_trans/trans_rvm.c.inc b/target/riscv/tcg/insn_trans/trans_rvm.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvm.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvm.c.inc
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/tcg/insn_trans/trans_rvv.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvv.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvv.c.inc
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/tcg/insn_trans/trans_rvvk.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvvk.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvvk.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzabha.c.inc b/target/riscv/tcg/insn_trans/trans_rvzabha.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzabha.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzabha.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/tcg/insn_trans/trans_rvzacas.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzacas.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzacas.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzalasr.c.inc b/target/riscv/tcg/insn_trans/trans_rvzalasr.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzalasr.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzalasr.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzawrs.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/tcg/insn_trans/trans_rvzce.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzce.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzce.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzcmop.c.inc b/target/riscv/tcg/insn_trans/trans_rvzcmop.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzcmop.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzcmop.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/tcg/insn_trans/trans_rvzfa.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzfa.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzfa.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/tcg/insn_trans/trans_rvzfh.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzfh.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzfh.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicbo.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzicbo.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzicbo.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzicfiss.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzicond.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicond.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzicond.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzicond.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzimop.c.inc b/target/riscv/tcg/insn_trans/trans_rvzimop.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzimop.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzimop.c.inc
diff --git a/target/riscv/insn_trans/trans_svinval.c.inc b/target/riscv/tcg/insn_trans/trans_svinval.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_svinval.c.inc
rename to target/riscv/tcg/insn_trans/trans_svinval.c.inc
diff --git a/target/riscv/insn_trans/trans_xlrbr.c.inc b/target/riscv/tcg/insn_trans/trans_xlrbr.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xlrbr.c.inc
rename to target/riscv/tcg/insn_trans/trans_xlrbr.c.inc
diff --git a/target/riscv/insn_trans/trans_xmips.c.inc b/target/riscv/tcg/insn_trans/trans_xmips.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xmips.c.inc
rename to target/riscv/tcg/insn_trans/trans_xmips.c.inc
diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xthead.c.inc
rename to target/riscv/tcg/insn_trans/trans_xthead.c.inc
diff --git a/target/riscv/insn_trans/trans_xventanacondops.c.inc b/target/riscv/tcg/insn_trans/trans_xventanacondops.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xventanacondops.c.inc
rename to target/riscv/tcg/insn_trans/trans_xventanacondops.c.inc
diff --git a/target/riscv/insn_trans/trans_zilsd.c.inc b/target/riscv/tcg/insn_trans/trans_zilsd.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_zilsd.c.inc
rename to target/riscv/tcg/insn_trans/trans_zilsd.c.inc
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 79f36abd63..61874ed0af 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -16,31 +16,15 @@ riscv_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
riscv_ss.add(files(
'cpu.c',
- 'cpu_helper.c',
- 'csr.c',
- 'fpu_helper.c',
'gdbstub.c',
- 'op_helper.c',
- 'vector_helper.c',
- 'vector_internals.c',
- 'bitmanip_helper.c',
- 'translate.c',
- 'm128_helper.c',
- 'crypto_helper.c',
- 'zce_helper.c',
- 'vcrypto_helper.c'
))
riscv_system_ss = ss.source_set()
riscv_system_ss.add(files(
'arch_dump.c',
'pmp.c',
- 'debug.c',
'monitor.c',
'machine.c',
- 'mips_csr.c',
- 'pmu.c',
- 'th_csr.c',
'time_helper.c',
'riscv-qmp-cmds.c',
))
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 061df3d74a..5684fcf985 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -1,2 +1,28 @@
-riscv_ss.add(when: 'CONFIG_TCG', if_true: files(
- 'tcg-cpu.c'))
+if 'CONFIG_TCG' not in config_all_accel
+ subdir_done()
+endif
+
+riscv_ss.add(files(
+ 'bitmanip_helper.c',
+ 'cpu_helper.c',
+ 'csr.c',
+ 'crypto_helper.c',
+ 'fpu_helper.c',
+ 'm128_helper.c',
+ 'op_helper.c',
+ 'translate.c',
+ 'tcg-cpu.c',
+ 'vcrypto_helper.c',
+ 'vector_helper.c',
+ 'vector_internals.c',
+ 'zce_helper.c'))
+
+
+riscv_system_ss.add(files(
+ 'debug.c',
+ 'mips_csr.c',
+ 'pmu.c',
+ 'th_csr.c',
+))
+
+
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 11/40] target/riscv/machine.c: do not migrate pmp state with kvm
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (9 preceding siblings ...)
2026-07-10 2:54 ` [PULL 10/40] target/riscv: move TCG only files to tcg subdir alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 12/40] target/riscv: move pmp files to tcg subdir alistair23
` (30 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
The PMP emulation isn't present in the KVM driver.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-6-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/machine.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index ba96ceceef..ef0a8eae24 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -20,6 +20,7 @@
#include "cpu.h"
#include "qemu/error-report.h"
#include "system/kvm.h"
+#include "system/tcg.h"
#include "migration/cpu.h"
#include "exec/icount.h"
#include "target/riscv/debug.h"
@@ -29,21 +30,25 @@ static bool pmp_needed(void *opaque)
{
RISCVCPU *cpu = opaque;
- return cpu->cfg.pmp;
+ if (kvm_enabled()) {
+ return false;
+ }
+
+ return tcg_enabled() && cpu->cfg.pmp;
}
static int pmp_post_load(void *opaque, int version_id)
{
+#ifdef CONFIG_TCG
RISCVCPU *cpu = opaque;
CPURISCVState *env = &cpu->env;
- int i;
uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
- for (i = 0; i < pmp_regions; i++) {
+ for (int i = 0; i < pmp_regions; i++) {
pmp_update_rule_addr(env, i);
}
pmp_update_rule_nums(env);
-
+#endif
return 0;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 12/40] target/riscv: move pmp files to tcg subdir
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (10 preceding siblings ...)
2026-07-10 2:54 ` [PULL 11/40] target/riscv/machine.c: do not migrate pmp state with kvm alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 13/40] target/riscv: tidy up riscv_sysemu_ops alistair23
` (29 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis, Chao Liu
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
A trivial header change is required too.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260703180538.3346781-7-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 2 +-
target/riscv/{ => tcg}/pmp.h | 0
target/riscv/{ => tcg}/pmp.c | 0
target/riscv/meson.build | 1 -
target/riscv/tcg/meson.build | 1 +
5 files changed, 2 insertions(+), 2 deletions(-)
rename target/riscv/{ => tcg}/pmp.h (100%)
rename target/riscv/{ => tcg}/pmp.c (100%)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 82362ef8d8..ecf2913d42 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -183,7 +183,7 @@ extern RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[];
#define MMU_USER_IDX 3
#if !defined(CONFIG_USER_ONLY)
-#include "pmp.h"
+#include "tcg/pmp.h"
#endif
#define RV_VLEN_MAX 1024
diff --git a/target/riscv/pmp.h b/target/riscv/tcg/pmp.h
similarity index 100%
rename from target/riscv/pmp.h
rename to target/riscv/tcg/pmp.h
diff --git a/target/riscv/pmp.c b/target/riscv/tcg/pmp.c
similarity index 100%
rename from target/riscv/pmp.c
rename to target/riscv/tcg/pmp.c
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 61874ed0af..42d0f6d538 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -22,7 +22,6 @@ riscv_ss.add(files(
riscv_system_ss = ss.source_set()
riscv_system_ss.add(files(
'arch_dump.c',
- 'pmp.c',
'monitor.c',
'machine.c',
'time_helper.c',
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 5684fcf985..a05ab642f4 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -21,6 +21,7 @@ riscv_ss.add(files(
riscv_system_ss.add(files(
'debug.c',
'mips_csr.c',
+ 'pmp.c',
'pmu.c',
'th_csr.c',
))
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 13/40] target/riscv: tidy up riscv_sysemu_ops
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (11 preceding siblings ...)
2026-07-10 2:54 ` [PULL 12/40] target/riscv: move pmp files to tcg subdir alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:54 ` [PULL 14/40] target/riscv: move debug.h to tcg subdir alistair23
` (28 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
monitor_get_register at this moment has a TCG exclusive implementation
for RISC-V, even though the callback is supposed to be arch independent.
Until we address how KVM is going to implement it we need to filter it out
in cpu.c.
Same goes for get_phys_addr_debug - it has a TCG only implementation and
KVM can't use it for now. It would also need to be filtered out, but
since we're at it, let's convert it to the newer 'translate_for_debug'
API too. Same restrictions apply.
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-8-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 3 ++-
target/riscv/cpu.c | 6 ++++--
target/riscv/monitor.c | 2 ++
target/riscv/tcg/cpu_helper.c | 14 ++++++++++----
4 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ecf2913d42..18fbd4edb6 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -665,7 +665,8 @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
MMUAccessType access_type,
int mmu_idx, MemTxAttrs attrs,
MemTxResult response, uintptr_t retaddr);
-hwaddr riscv_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
+bool riscv_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+ TranslateForDebugResult *result);
bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index cae4e96232..d17ba0474a 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -2693,11 +2693,13 @@ static int64_t riscv_get_arch_id(CPUState *cs)
static const struct SysemuCPUOps riscv_sysemu_ops = {
.has_work = riscv_cpu_has_work,
- .get_phys_addr_debug = riscv_cpu_get_phys_addr_debug,
.write_elf64_note = riscv_cpu_write_elf64_note,
.write_elf32_note = riscv_cpu_write_elf32_note,
- .monitor_get_register = riscv_monitor_get_register_legacy,
.legacy_vmsd = &vmstate_riscv_cpu,
+#ifdef CONFIG_TCG
+ .translate_for_debug = riscv_cpu_translate_for_debug,
+ .monitor_get_register = riscv_monitor_get_register_legacy,
+#endif
};
#endif
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 3e89dcaf7c..7aacd1d89c 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -245,6 +245,7 @@ void hmp_info_mem(Monitor *mon, const QDict *qdict)
mem_info_svxx(mon, env);
}
+#ifdef CONFIG_TCG
static bool reg_is_ulong_integer(CPURISCVState *env, const char *name,
target_ulong *val, bool is_gprh)
{
@@ -379,3 +380,4 @@ int riscv_monitor_get_register_legacy(CPUState *cs, const char *name,
return -EINVAL;
}
+#endif
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 2db07f5dfb..885b4172c0 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -1779,7 +1779,8 @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
env->two_stage_indirect_lookup = two_stage_indirect;
}
-hwaddr riscv_cpu_get_phys_addr_debug(CPUState *cs, vaddr addr)
+bool riscv_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+ TranslateForDebugResult *result)
{
RISCVCPU *cpu = RISCV_CPU(cs);
CPURISCVState *env = &cpu->env;
@@ -1789,17 +1790,22 @@ hwaddr riscv_cpu_get_phys_addr_debug(CPUState *cs, vaddr addr)
if (get_physical_address(env, &phys_addr, &prot, addr, NULL, 0, mmu_idx,
true, env->virt_enabled, true, false)) {
- return -1;
+ return false;
}
if (env->virt_enabled) {
if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
0, MMUIdx_U, false, true, true, false)) {
- return -1;
+ return false;
}
}
- return phys_addr;
+ *result = (TranslateForDebugResult) {
+ .physaddr = phys_addr,
+ .lg_page_size = TARGET_PAGE_BITS,
+ .attrs.debug = 1,
+ };
+ return true;
}
void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 14/40] target/riscv: move debug.h to tcg subdir
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (12 preceding siblings ...)
2026-07-10 2:54 ` [PULL 13/40] target/riscv: tidy up riscv_sysemu_ops alistair23
@ 2026-07-10 2:54 ` alistair23
2026-07-10 2:55 ` [PULL 15/40] target/riscv: remove csr.h from kvm-cpu.c alistair23
` (27 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:54 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_trigger_* APIs are TCG only. Wrap the usages we have of them
in cpu.c with CONFIG_TCG.
After that we can move the header to the tcg subdir. This will be
enough to get this out of the way for the --disable-tcg build.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-9-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/{ => tcg}/debug.h | 0
target/riscv/cpu.c | 8 +++++---
target/riscv/machine.c | 2 +-
target/riscv/tcg/cpu_helper.c | 2 +-
target/riscv/tcg/csr.c | 2 +-
target/riscv/tcg/debug.c | 2 +-
target/riscv/tcg/tcg-cpu.c | 2 +-
7 files changed, 10 insertions(+), 8 deletions(-)
rename target/riscv/{ => tcg}/debug.h (100%)
diff --git a/target/riscv/debug.h b/target/riscv/tcg/debug.h
similarity index 100%
rename from target/riscv/debug.h
rename to target/riscv/tcg/debug.h
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index d17ba0474a..a2887adf16 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -39,7 +39,7 @@
#include "kvm/kvm_riscv.h"
#include "tcg/tcg-cpu.h"
#if !defined(CONFIG_USER_ONLY)
-#include "target/riscv/debug.h"
+#include "target/riscv/tcg/debug.h"
#endif
/* RISC-V CPU definitions */
@@ -856,9 +856,11 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
env->vill = true;
#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_TCG
if (cpu->cfg.debug) {
riscv_trigger_reset_hold(env);
}
+#endif
if (cpu->cfg.ext_smrnmi) {
env->rnmip = 0;
@@ -1016,7 +1018,7 @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
riscv_cpu_register_gdb_regs_for_features(cs);
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
if (cpu->cfg.debug) {
riscv_trigger_realize(&cpu->env);
}
@@ -1031,7 +1033,7 @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
static void riscv_cpu_unrealize(DeviceState *dev)
{
RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
RISCVCPU *cpu = RISCV_CPU(dev);
if (cpu->cfg.debug) {
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index ef0a8eae24..0ab613a298 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -23,7 +23,7 @@
#include "system/tcg.h"
#include "migration/cpu.h"
#include "exec/icount.h"
-#include "target/riscv/debug.h"
+#include "target/riscv/tcg/debug.h"
#include "hw/riscv/machines-qom.h"
static bool pmp_needed(void *opaque)
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 885b4172c0..310c18db46 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -35,7 +35,7 @@
#include "semihosting/common-semi.h"
#include "exec/icount.h"
#include "cpu_bits.h"
-#include "target/riscv/debug.h"
+#include "target/riscv/tcg/debug.h"
#include "pmp.h"
#include "qemu/plugin.h"
diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index 7818d81fb0..36d12b6a51 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -34,7 +34,7 @@
#include "tcg/insn-start-words.h"
#include "internals.h"
#if !defined(CONFIG_USER_ONLY)
-#include "target/riscv/debug.h"
+#include "target/riscv/tcg/debug.h"
#endif
/* CSR function table public API */
diff --git a/target/riscv/tcg/debug.c b/target/riscv/tcg/debug.c
index ba5bc6ae13..3c0fe70101 100644
--- a/target/riscv/tcg/debug.c
+++ b/target/riscv/tcg/debug.c
@@ -28,7 +28,7 @@
#include "qapi/error.h"
#include "qemu/error-report.h"
#include "cpu.h"
-#include "target/riscv/debug.h"
+#include "target/riscv/tcg/debug.h"
#include "trace.h"
#include "exec/helper-proto.h"
#include "exec/watchpoint.h"
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index b73e3e9dd4..fe6350f497 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -37,7 +37,7 @@
#include "hw/core/boards.h"
#include "system/tcg.h"
#include "exec/icount.h"
-#include "target/riscv/debug.h"
+#include "target/riscv/tcg/debug.h"
#endif
/* Hash that stores user set extensions */
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 15/40] target/riscv: remove csr.h from kvm-cpu.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (13 preceding siblings ...)
2026-07-10 2:54 ` [PULL 14/40] target/riscv: move debug.h to tcg subdir alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 16/40] target/riscv: move csr.h to tcg subdir alistair23
` (26 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Move riscv_new_csr_seed from csr.c to cpu.c since this function is
shared with KVM. With that we can remove the csr.h from kvm-cpu.c.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-10-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 3 ++-
target/riscv/csr.h | 3 ---
target/riscv/cpu.c | 30 ++++++++++++++++++++++++++++++
target/riscv/kvm/kvm-cpu.c | 1 -
target/riscv/tcg/csr.c | 29 -----------------------------
5 files changed, 32 insertions(+), 34 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 18fbd4edb6..a8c7e21bec 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -970,7 +970,8 @@ void riscv_add_satp_mode_properties(Object *obj);
bool riscv_cpu_accelerator_compatible(RISCVCPU *cpu);
void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
-
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+ target_ulong write_mask);
const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
const char *priv_spec_to_str(int priv_version);
diff --git a/target/riscv/csr.h b/target/riscv/csr.h
index 66ec9546ed..53ba3b4a4d 100644
--- a/target/riscv/csr.h
+++ b/target/riscv/csr.h
@@ -12,9 +12,6 @@
#include "exec/target_long.h"
#include "cpu_bits.h"
-target_ulong riscv_new_csr_seed(target_ulong new_value,
- target_ulong write_mask);
-
RISCVException riscv_csrr(CPURISCVState *env, int csrno,
target_ulong *ret_value);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index a2887adf16..ba75c0de39 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -21,6 +21,7 @@
#include "qemu/qemu-print.h"
#include "qemu/ctype.h"
#include "qemu/log.h"
+#include "qemu/guest-random.h"
#include "cpu.h"
#include "cpu_vendorid.h"
#include "target/riscv/csr.h"
@@ -556,6 +557,35 @@ static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
}
#endif
+/* Used by csr.c and the KVM driver */
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+ target_ulong write_mask)
+{
+ uint16_t random_v;
+ Error *random_e = NULL;
+ int random_r;
+ target_ulong rval;
+
+ random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
+ if (unlikely(random_r < 0)) {
+ /*
+ * Failed, for unknown reasons in the crypto subsystem.
+ * The best we can do is log the reason and return a
+ * failure indication to the guest. There is no reason
+ * we know to expect the failure to be transitory, so
+ * indicate DEAD to avoid having the guest spin on WAIT.
+ */
+ qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
+ __func__, error_get_pretty(random_e));
+ error_free(random_e);
+ rval = SEED_OPST_DEAD;
+ } else {
+ rval = random_v | SEED_OPST_ES16;
+ }
+
+ return rval;
+}
+
static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
{
ObjectClass *oc;
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 2a5440d584..dfcd6e3c77 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -31,7 +31,6 @@
#include "system/kvm.h"
#include "system/kvm_int.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
#include "trace.h"
#include "accel/accel-cpu-target.h"
#include "hw/pci/pci.h"
diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index 36d12b6a51..9c7e9d0e4b 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -29,7 +29,6 @@
#include "exec/icount.h"
#include "accel/tcg/cpu-loop.h"
#include "accel/tcg/getpc.h"
-#include "qemu/guest-random.h"
#include "qapi/error.h"
#include "tcg/insn-start-words.h"
#include "internals.h"
@@ -5572,34 +5571,6 @@ static RISCVException write_mnstatus(CPURISCVState *env, int csrno,
#endif
/* Crypto Extension */
-target_ulong riscv_new_csr_seed(target_ulong new_value,
- target_ulong write_mask)
-{
- uint16_t random_v;
- Error *random_e = NULL;
- int random_r;
- target_ulong rval;
-
- random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
- if (unlikely(random_r < 0)) {
- /*
- * Failed, for unknown reasons in the crypto subsystem.
- * The best we can do is log the reason and return a
- * failure indication to the guest. There is no reason
- * we know to expect the failure to be transitory, so
- * indicate DEAD to avoid having the guest spin on WAIT.
- */
- qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
- __func__, error_get_pretty(random_e));
- error_free(random_e);
- rval = SEED_OPST_DEAD;
- } else {
- rval = random_v | SEED_OPST_ES16;
- }
-
- return rval;
-}
-
static RISCVException rmw_seed(CPURISCVState *env, int csrno,
target_ulong *ret_value,
target_ulong new_value,
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 16/40] target/riscv: move csr.h to tcg subdir
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (14 preceding siblings ...)
2026-07-10 2:55 ` [PULL 15/40] target/riscv: remove csr.h from kvm-cpu.c alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 17/40] target/riscv: move custom_csrs logic to tcg-cpu.c alistair23
` (25 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
After KVM is no longer reliant on csr.h move it to the TGC only land.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-11-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/{ => tcg}/csr.h | 0
target/riscv/cpu.c | 2 +-
target/riscv/gdbstub.c | 2 +-
target/riscv/monitor.c | 2 +-
target/riscv/riscv-qmp-cmds.c | 2 +-
target/riscv/tcg/csr.c | 2 +-
target/riscv/tcg/mips_csr.c | 2 +-
target/riscv/tcg/op_helper.c | 2 +-
target/riscv/tcg/pmp.c | 2 +-
target/riscv/tcg/th_csr.c | 2 +-
10 files changed, 9 insertions(+), 9 deletions(-)
rename target/riscv/{ => tcg}/csr.h (100%)
diff --git a/target/riscv/csr.h b/target/riscv/tcg/csr.h
similarity index 100%
rename from target/riscv/csr.h
rename to target/riscv/tcg/csr.h
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index ba75c0de39..c5b03847bf 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -24,7 +24,7 @@
#include "qemu/guest-random.h"
#include "cpu.h"
#include "cpu_vendorid.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "internals.h"
#include "qapi/error.h"
#include "qapi/visitor.h"
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index a2bbaf7f07..f0a5e0d86f 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -21,7 +21,7 @@
#include "gdbstub/helpers.h"
#include "cpu.h"
#include "internals.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
struct TypeSize {
const char *gdb_type;
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 7aacd1d89c..f8042db9cd 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -22,7 +22,7 @@
#include "qemu/ctype.h"
#include "qemu/qemu-print.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "cpu_bits.h"
#include "monitor/monitor.h"
#include "monitor/hmp.h"
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index b94e8391ed..2647deef91 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -35,7 +35,7 @@
#include "system/tcg.h"
#include "cpu-qom.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
static void riscv_cpu_add_definition(gpointer data, gpointer user_data)
{
diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index 9c7e9d0e4b..36f2004bc5 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -21,7 +21,7 @@
#include "qemu/log.h"
#include "qemu/timer.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "tcg/tcg-cpu.h"
#include "pmu.h"
#include "time_helper.h"
diff --git a/target/riscv/tcg/mips_csr.c b/target/riscv/tcg/mips_csr.c
index 609718f288..884030e91d 100644
--- a/target/riscv/tcg/mips_csr.c
+++ b/target/riscv/tcg/mips_csr.c
@@ -10,7 +10,7 @@
#include "qemu/osdep.h"
#include "cpu.h"
#include "cpu_vendorid.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
/* Static MIPS CSR state storage */
static struct {
diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c
index 6d4849b135..ba3c7da375 100644
--- a/target/riscv/tcg/op_helper.c
+++ b/target/riscv/tcg/op_helper.c
@@ -20,7 +20,7 @@
#include "qemu/osdep.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "internals.h"
#include "exec/cputlb.h"
#include "accel/tcg/cpu-ldst.h"
diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c
index d93563c36b..41b55519a8 100644
--- a/target/riscv/tcg/pmp.c
+++ b/target/riscv/tcg/pmp.c
@@ -23,7 +23,7 @@
#include "qemu/log.h"
#include "qapi/error.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "trace.h"
#include "exec/cputlb.h"
#include "exec/page-protection.h"
diff --git a/target/riscv/tcg/th_csr.c b/target/riscv/tcg/th_csr.c
index 431f4cc286..e6f642991c 100644
--- a/target/riscv/tcg/th_csr.c
+++ b/target/riscv/tcg/th_csr.c
@@ -22,7 +22,7 @@
#include "qemu/osdep.h"
#include "cpu.h"
#include "cpu_vendorid.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
/* Extended M-mode control registers of T-Head */
#define CSR_TH_MXSTATUS 0x7c0
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 17/40] target/riscv: move custom_csrs logic to tcg-cpu.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (15 preceding siblings ...)
2026-07-10 2:55 ` [PULL 16/40] target/riscv: move csr.h to tcg subdir alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 18/40] target/riscv: move riscv_cpu_set_nmi() " alistair23
` (24 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We have a couple of CPUs that has a set of custom CSRs that uses TCG
specific APIs. Move the related code to tcg-cpu.c and do not set
.custom_csrs if we're not in a TCG build.
What we'll end up doing, sooner or later, is punting all these CPUs to
tcg-cpu.c since they're all TCG specific and KVM has nothing to do with
them. Another time.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-12-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 2 ++
target/riscv/cpu.c | 26 +++++---------------------
target/riscv/tcg/tcg-cpu.c | 21 +++++++++++++++++++++
3 files changed, 28 insertions(+), 21 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index a8c7e21bec..82430ecec6 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -591,7 +591,9 @@ typedef struct RISCVCPUDef {
int32_t vext_spec;
RISCVCPUConfig cfg;
bool bare;
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
const RISCVCSR *custom_csrs;
+#endif
/* This is just a setter for env->num_triggers. */
uint32_t num_triggers;
} RISCVCPUDef;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index c5b03847bf..bbce58ee58 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -544,19 +544,6 @@ static void set_satp_mode_default_map(RISCVCPU *cpu)
}
#endif
-#ifndef CONFIG_USER_ONLY
-static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
-{
- for (size_t i = 0; csr_list[i].csr_ops.name; i++) {
- int csrno = csr_list[i].csrno;
- const riscv_csr_operations *csr_ops = &csr_list[i].csr_ops;
- if (!csr_list[i].insertion_test || csr_list[i].insertion_test(cpu)) {
- riscv_set_csr_ops(csrno, csr_ops);
- }
- }
-}
-#endif
-
/* Used by csr.c and the KVM driver */
target_ulong riscv_new_csr_seed(target_ulong new_value,
target_ulong write_mask)
@@ -1268,11 +1255,6 @@ static void riscv_cpu_init(Object *obj)
if (mcc->def->vext_spec != RISCV_PROFILE_ATTR_UNUSED) {
cpu->env.vext_ver = mcc->def->vext_spec;
}
-#ifndef CONFIG_USER_ONLY
- if (mcc->def->custom_csrs) {
- riscv_register_custom_csrs(cpu, mcc->def->custom_csrs);
- }
-#endif
accel_cpu_instance_init(CPU(obj));
}
@@ -2846,10 +2828,12 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
riscv_cpu_cfg_merge(&mcc->def->cfg, &def->cfg);
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
if (def->custom_csrs) {
assert(!mcc->def->custom_csrs);
mcc->def->custom_csrs = def->custom_csrs;
}
+#endif
}
if (!object_class_is_abstract(c)) {
@@ -3202,7 +3186,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
.cfg.mvendorid = THEAD_VENDOR_ID,
.cfg.max_satp_mode = VM_1_10_SV39,
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
.custom_csrs = th_csr_list,
#endif
),
@@ -3248,7 +3232,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
.cfg.marchid = 0x8d143000,
.cfg.mvendorid = THEAD_VENDOR_ID,
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
.custom_csrs = th_csr_list,
#endif
),
@@ -3454,7 +3438,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
.cfg.ext_xmipscmov = true,
.cfg.marchid = 0x8000000000000201,
.cfg.mvendorid = MIPS_VENDOR_ID,
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
.custom_csrs = mips_csr_list,
#endif
),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index fe6350f497..fef66557c2 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -38,6 +38,7 @@
#include "system/tcg.h"
#include "exec/icount.h"
#include "target/riscv/tcg/debug.h"
+#include "target/riscv/tcg/csr.h"
#endif
/* Hash that stores user set extensions */
@@ -1650,10 +1651,30 @@ static bool riscv_cpu_has_max_extensions(Object *cpu_obj)
return object_dynamic_cast(cpu_obj, TYPE_RISCV_CPU_MAX) != NULL;
}
+#ifndef CONFIG_USER_ONLY
+static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
+{
+ for (size_t i = 0; csr_list[i].csr_ops.name; i++) {
+ int csrno = csr_list[i].csrno;
+ const riscv_csr_operations *csr_ops = &csr_list[i].csr_ops;
+ if (!csr_list[i].insertion_test || csr_list[i].insertion_test(cpu)) {
+ riscv_set_csr_ops(csrno, csr_ops);
+ }
+ }
+}
+#endif
+
static void riscv_tcg_cpu_instance_init(CPUState *cs)
{
RISCVCPU *cpu = RISCV_CPU(cs);
Object *obj = OBJECT(cpu);
+#ifndef CONFIG_USER_ONLY
+ RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(obj);
+
+ if (mcc->def->custom_csrs) {
+ riscv_register_custom_csrs(cpu, mcc->def->custom_csrs);
+ }
+#endif
misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
multi_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 18/40] target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (16 preceding siblings ...)
2026-07-10 2:55 ` [PULL 17/40] target/riscv: move custom_csrs logic to tcg-cpu.c alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 19/40] target/riscv: move some irq helpers to cpu.c alistair23
` (23 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
This function is related to Smrnmi and non-masked interrupts, firing up
interrupts via env->rnmip from riscv_cpu_local_irq_pending().
This is all TCG only code.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-13-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.c | 8 --------
target/riscv/tcg/tcg-cpu.c | 7 +++++++
2 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index bbce58ee58..508e8dc03e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1180,11 +1180,6 @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
g_assert_not_reached();
}
}
-
-static void riscv_cpu_set_nmi(void *opaque, int irq, int level)
-{
- riscv_cpu_set_rnmi(RISCV_CPU(opaque), irq, level);
-}
#endif /* CONFIG_USER_ONLY */
static bool riscv_cpu_is_dynamic(Object *cpu_obj)
@@ -1203,9 +1198,6 @@ static void riscv_cpu_init(Object *obj)
#ifndef CONFIG_USER_ONLY
qdev_init_gpio_in(DEVICE(obj), riscv_cpu_set_irq,
IRQ_LOCAL_MAX + IRQ_LOCAL_GUEST_MAX);
- qdev_init_gpio_in_named(DEVICE(cpu), riscv_cpu_set_nmi,
- "riscv.cpu.rnmi", RNMI_MAX);
-
if (mcc->def->num_triggers) {
env->num_triggers = mcc->def->num_triggers;
}
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index fef66557c2..4af5cd9c73 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1662,6 +1662,11 @@ static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
}
}
}
+
+static inline void riscv_cpu_set_nmi(void *opaque, int irq, int level)
+{
+ riscv_cpu_set_rnmi(RISCV_CPU(opaque), irq, level);
+}
#endif
static void riscv_tcg_cpu_instance_init(CPUState *cs)
@@ -1674,6 +1679,8 @@ static void riscv_tcg_cpu_instance_init(CPUState *cs)
if (mcc->def->custom_csrs) {
riscv_register_custom_csrs(cpu, mcc->def->custom_csrs);
}
+ qdev_init_gpio_in_named(DEVICE(cpu), riscv_cpu_set_nmi,
+ "riscv.cpu.rnmi", RNMI_MAX);
#endif
misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 19/40] target/riscv: move some irq helpers to cpu.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (17 preceding siblings ...)
2026-07-10 2:55 ` [PULL 18/40] target/riscv: move riscv_cpu_set_nmi() " alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 20/40] target/riscv: move riscv_cpu_claim_interrupts " alistair23
` (22 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_cpu_has_work() uses a handful of irq pending functions from
cpu_helper.c. There is a very high possibility that KVM doesn't need
the current implermentation of has_work(), but the common accel code
needs an implementation of this callback (see cpu_exec_class_post_init)
otherwise the KVM driver won't initialize.
Move the relevant irq helpers to cpu.c to allow KVM to keep using the
current has_work implementation, allowing --disable-tcg to work. We'll
circle it back to evaluate a proper KVM implementation for it in a later
date.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-14-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 5 +
target/riscv/cpu.c | 187 ++++++++++++++++++++++++++++++++++
target/riscv/tcg/cpu_helper.c | 187 ----------------------------------
3 files changed, 192 insertions(+), 187 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 82430ecec6..396d9253e6 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -640,6 +640,11 @@ uint64_t riscv_cpu_all_pending(CPURISCVState *env);
int riscv_cpu_mirq_pending(CPURISCVState *env);
int riscv_cpu_sirq_pending(CPURISCVState *env);
int riscv_cpu_vsirq_pending(CPURISCVState *env);
+int riscv_cpu_pending_to_irq(CPURISCVState *env,
+ int extirq, unsigned int extirq_def_prio,
+ uint64_t pending, uint8_t *iprio);
+
+
bool riscv_cpu_fp_enabled(CPURISCVState *env);
uint8_t riscv_cpu_get_geilen(CPURISCVState *env);
void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 508e8dc03e..fe24751379 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -745,6 +745,193 @@ static vaddr riscv_cpu_get_pc(CPUState *cs)
}
#ifndef CONFIG_USER_ONLY
+/*
+ * Default priorities of local interrupts are defined in the
+ * RISC-V Advanced Interrupt Architecture specification.
+ *
+ * ----------------------------------------------------------------
+ * Default |
+ * Priority | Major Interrupt Numbers
+ * ----------------------------------------------------------------
+ * Highest | 47, 23, 46, 45, 22, 44,
+ * | 43, 21, 42, 41, 20, 40
+ * |
+ * | 11 (0b), 3 (03), 7 (07)
+ * | 9 (09), 1 (01), 5 (05)
+ * | 12 (0c)
+ * | 10 (0a), 2 (02), 6 (06)
+ * |
+ * | 39, 19, 38, 37, 18, 36,
+ * Lowest | 35, 17, 34, 33, 16, 32
+ * ----------------------------------------------------------------
+ */
+static const uint8_t default_iprio[64] = {
+ /* Custom interrupts 48 to 63 */
+ [63] = IPRIO_MMAXIPRIO,
+ [62] = IPRIO_MMAXIPRIO,
+ [61] = IPRIO_MMAXIPRIO,
+ [60] = IPRIO_MMAXIPRIO,
+ [59] = IPRIO_MMAXIPRIO,
+ [58] = IPRIO_MMAXIPRIO,
+ [57] = IPRIO_MMAXIPRIO,
+ [56] = IPRIO_MMAXIPRIO,
+ [55] = IPRIO_MMAXIPRIO,
+ [54] = IPRIO_MMAXIPRIO,
+ [53] = IPRIO_MMAXIPRIO,
+ [52] = IPRIO_MMAXIPRIO,
+ [51] = IPRIO_MMAXIPRIO,
+ [50] = IPRIO_MMAXIPRIO,
+ [49] = IPRIO_MMAXIPRIO,
+ [48] = IPRIO_MMAXIPRIO,
+
+ /* Custom interrupts 24 to 31 */
+ [31] = IPRIO_MMAXIPRIO,
+ [30] = IPRIO_MMAXIPRIO,
+ [29] = IPRIO_MMAXIPRIO,
+ [28] = IPRIO_MMAXIPRIO,
+ [27] = IPRIO_MMAXIPRIO,
+ [26] = IPRIO_MMAXIPRIO,
+ [25] = IPRIO_MMAXIPRIO,
+ [24] = IPRIO_MMAXIPRIO,
+
+ [47] = IPRIO_DEFAULT_UPPER,
+ [23] = IPRIO_DEFAULT_UPPER + 1,
+ [46] = IPRIO_DEFAULT_UPPER + 2,
+ [45] = IPRIO_DEFAULT_UPPER + 3,
+ [22] = IPRIO_DEFAULT_UPPER + 4,
+ [44] = IPRIO_DEFAULT_UPPER + 5,
+
+ [43] = IPRIO_DEFAULT_UPPER + 6,
+ [21] = IPRIO_DEFAULT_UPPER + 7,
+ [42] = IPRIO_DEFAULT_UPPER + 8,
+ [41] = IPRIO_DEFAULT_UPPER + 9,
+ [20] = IPRIO_DEFAULT_UPPER + 10,
+ [40] = IPRIO_DEFAULT_UPPER + 11,
+
+ [11] = IPRIO_DEFAULT_M,
+ [3] = IPRIO_DEFAULT_M + 1,
+ [7] = IPRIO_DEFAULT_M + 2,
+
+ [9] = IPRIO_DEFAULT_S,
+ [1] = IPRIO_DEFAULT_S + 1,
+ [5] = IPRIO_DEFAULT_S + 2,
+
+ [12] = IPRIO_DEFAULT_SGEXT,
+
+ [10] = IPRIO_DEFAULT_VS,
+ [2] = IPRIO_DEFAULT_VS + 1,
+ [6] = IPRIO_DEFAULT_VS + 2,
+
+ [39] = IPRIO_DEFAULT_LOWER,
+ [19] = IPRIO_DEFAULT_LOWER + 1,
+ [38] = IPRIO_DEFAULT_LOWER + 2,
+ [37] = IPRIO_DEFAULT_LOWER + 3,
+ [18] = IPRIO_DEFAULT_LOWER + 4,
+ [36] = IPRIO_DEFAULT_LOWER + 5,
+
+ [35] = IPRIO_DEFAULT_LOWER + 6,
+ [17] = IPRIO_DEFAULT_LOWER + 7,
+ [34] = IPRIO_DEFAULT_LOWER + 8,
+ [33] = IPRIO_DEFAULT_LOWER + 9,
+ [16] = IPRIO_DEFAULT_LOWER + 10,
+ [32] = IPRIO_DEFAULT_LOWER + 11,
+};
+
+uint8_t riscv_cpu_default_priority(int irq)
+{
+ if (irq < 0 || irq > 63) {
+ return IPRIO_MMAXIPRIO;
+ }
+
+ return default_iprio[irq] ? default_iprio[irq] : IPRIO_MMAXIPRIO;
+};
+
+int riscv_cpu_pending_to_irq(CPURISCVState *env,
+ int extirq, unsigned int extirq_def_prio,
+ uint64_t pending, uint8_t *iprio)
+{
+ int irq, best_irq = RISCV_EXCP_NONE;
+ unsigned int prio, best_prio = UINT_MAX;
+
+ if (!pending) {
+ return RISCV_EXCP_NONE;
+ }
+
+ irq = ctz64(pending);
+ if (!((extirq == IRQ_M_EXT) ? riscv_cpu_cfg(env)->ext_smaia :
+ riscv_cpu_cfg(env)->ext_ssaia)) {
+ return irq;
+ }
+
+ pending = pending >> irq;
+ while (pending) {
+ prio = iprio[irq];
+ if (!prio) {
+ if (irq == extirq) {
+ prio = extirq_def_prio;
+ } else {
+ prio = (riscv_cpu_default_priority(irq) < extirq_def_prio) ?
+ 1 : IPRIO_MMAXIPRIO;
+ }
+ }
+ if ((pending & 0x1) && (prio <= best_prio)) {
+ best_irq = irq;
+ best_prio = prio;
+ }
+ irq++;
+ pending = pending >> 1;
+ }
+
+ return best_irq;
+}
+
+/*
+ * Doesn't report interrupts inserted using mvip from M-mode firmware or
+ * using hvip bits 13:63 from HS-mode. Those are returned in
+ * riscv_cpu_sirq_pending() and riscv_cpu_vsirq_pending().
+ */
+uint64_t riscv_cpu_all_pending(CPURISCVState *env)
+{
+ uint32_t gein = get_field(env->hstatus, HSTATUS_VGEIN);
+ uint64_t vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
+ uint64_t vstip = (env->vstime_irq) ? MIP_VSTIP : 0;
+
+ return (env->mip | vsgein | vstip) & env->mie;
+}
+
+int riscv_cpu_mirq_pending(CPURISCVState *env)
+{
+ uint64_t irqs = riscv_cpu_all_pending(env) & ~env->mideleg &
+ ~(MIP_SGEIP | MIP_VSSIP | MIP_VSTIP | MIP_VSEIP);
+
+ return riscv_cpu_pending_to_irq(env, IRQ_M_EXT, IPRIO_DEFAULT_M,
+ irqs, env->miprio);
+}
+
+int riscv_cpu_sirq_pending(CPURISCVState *env)
+{
+ uint64_t irqs = riscv_cpu_all_pending(env) & env->mideleg & ~env->hideleg;
+ uint64_t irqs_f = env->mvip & env->mvien & ~env->mideleg & env->sie;
+
+ return riscv_cpu_pending_to_irq(env, IRQ_S_EXT, IPRIO_DEFAULT_S,
+ irqs | irqs_f, env->siprio);
+}
+
+int riscv_cpu_vsirq_pending(CPURISCVState *env)
+{
+ uint64_t irqs = riscv_cpu_all_pending(env) & env->mideleg & env->hideleg;
+ uint64_t irqs_f_vs = env->hvip & env->hvien & ~env->hideleg & env->vsie;
+ uint64_t vsbits;
+
+ /* Bring VS-level bits to correct position */
+ vsbits = irqs & VS_MODE_INTERRUPTS;
+ irqs &= ~VS_MODE_INTERRUPTS;
+ irqs |= vsbits >> 1;
+
+ return riscv_cpu_pending_to_irq(env, IRQ_S_EXT, IPRIO_DEFAULT_S,
+ (irqs | irqs_f_vs), env->hviprio);
+}
+
bool riscv_cpu_has_work(CPUState *cs)
{
RISCVCPU *cpu = RISCV_CPU(cs);
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 310c18db46..250bb20481 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -330,193 +330,6 @@ int riscv_cpu_hviprio_index2irq(int index, int *out_irq, int *out_rdzero)
return 0;
}
-/*
- * Default priorities of local interrupts are defined in the
- * RISC-V Advanced Interrupt Architecture specification.
- *
- * ----------------------------------------------------------------
- * Default |
- * Priority | Major Interrupt Numbers
- * ----------------------------------------------------------------
- * Highest | 47, 23, 46, 45, 22, 44,
- * | 43, 21, 42, 41, 20, 40
- * |
- * | 11 (0b), 3 (03), 7 (07)
- * | 9 (09), 1 (01), 5 (05)
- * | 12 (0c)
- * | 10 (0a), 2 (02), 6 (06)
- * |
- * | 39, 19, 38, 37, 18, 36,
- * Lowest | 35, 17, 34, 33, 16, 32
- * ----------------------------------------------------------------
- */
-static const uint8_t default_iprio[64] = {
- /* Custom interrupts 48 to 63 */
- [63] = IPRIO_MMAXIPRIO,
- [62] = IPRIO_MMAXIPRIO,
- [61] = IPRIO_MMAXIPRIO,
- [60] = IPRIO_MMAXIPRIO,
- [59] = IPRIO_MMAXIPRIO,
- [58] = IPRIO_MMAXIPRIO,
- [57] = IPRIO_MMAXIPRIO,
- [56] = IPRIO_MMAXIPRIO,
- [55] = IPRIO_MMAXIPRIO,
- [54] = IPRIO_MMAXIPRIO,
- [53] = IPRIO_MMAXIPRIO,
- [52] = IPRIO_MMAXIPRIO,
- [51] = IPRIO_MMAXIPRIO,
- [50] = IPRIO_MMAXIPRIO,
- [49] = IPRIO_MMAXIPRIO,
- [48] = IPRIO_MMAXIPRIO,
-
- /* Custom interrupts 24 to 31 */
- [31] = IPRIO_MMAXIPRIO,
- [30] = IPRIO_MMAXIPRIO,
- [29] = IPRIO_MMAXIPRIO,
- [28] = IPRIO_MMAXIPRIO,
- [27] = IPRIO_MMAXIPRIO,
- [26] = IPRIO_MMAXIPRIO,
- [25] = IPRIO_MMAXIPRIO,
- [24] = IPRIO_MMAXIPRIO,
-
- [47] = IPRIO_DEFAULT_UPPER,
- [23] = IPRIO_DEFAULT_UPPER + 1,
- [46] = IPRIO_DEFAULT_UPPER + 2,
- [45] = IPRIO_DEFAULT_UPPER + 3,
- [22] = IPRIO_DEFAULT_UPPER + 4,
- [44] = IPRIO_DEFAULT_UPPER + 5,
-
- [43] = IPRIO_DEFAULT_UPPER + 6,
- [21] = IPRIO_DEFAULT_UPPER + 7,
- [42] = IPRIO_DEFAULT_UPPER + 8,
- [41] = IPRIO_DEFAULT_UPPER + 9,
- [20] = IPRIO_DEFAULT_UPPER + 10,
- [40] = IPRIO_DEFAULT_UPPER + 11,
-
- [11] = IPRIO_DEFAULT_M,
- [3] = IPRIO_DEFAULT_M + 1,
- [7] = IPRIO_DEFAULT_M + 2,
-
- [9] = IPRIO_DEFAULT_S,
- [1] = IPRIO_DEFAULT_S + 1,
- [5] = IPRIO_DEFAULT_S + 2,
-
- [12] = IPRIO_DEFAULT_SGEXT,
-
- [10] = IPRIO_DEFAULT_VS,
- [2] = IPRIO_DEFAULT_VS + 1,
- [6] = IPRIO_DEFAULT_VS + 2,
-
- [39] = IPRIO_DEFAULT_LOWER,
- [19] = IPRIO_DEFAULT_LOWER + 1,
- [38] = IPRIO_DEFAULT_LOWER + 2,
- [37] = IPRIO_DEFAULT_LOWER + 3,
- [18] = IPRIO_DEFAULT_LOWER + 4,
- [36] = IPRIO_DEFAULT_LOWER + 5,
-
- [35] = IPRIO_DEFAULT_LOWER + 6,
- [17] = IPRIO_DEFAULT_LOWER + 7,
- [34] = IPRIO_DEFAULT_LOWER + 8,
- [33] = IPRIO_DEFAULT_LOWER + 9,
- [16] = IPRIO_DEFAULT_LOWER + 10,
- [32] = IPRIO_DEFAULT_LOWER + 11,
-};
-
-uint8_t riscv_cpu_default_priority(int irq)
-{
- if (irq < 0 || irq > 63) {
- return IPRIO_MMAXIPRIO;
- }
-
- return default_iprio[irq] ? default_iprio[irq] : IPRIO_MMAXIPRIO;
-};
-
-static int riscv_cpu_pending_to_irq(CPURISCVState *env,
- int extirq, unsigned int extirq_def_prio,
- uint64_t pending, uint8_t *iprio)
-{
- int irq, best_irq = RISCV_EXCP_NONE;
- unsigned int prio, best_prio = UINT_MAX;
-
- if (!pending) {
- return RISCV_EXCP_NONE;
- }
-
- irq = ctz64(pending);
- if (!((extirq == IRQ_M_EXT) ? riscv_cpu_cfg(env)->ext_smaia :
- riscv_cpu_cfg(env)->ext_ssaia)) {
- return irq;
- }
-
- pending = pending >> irq;
- while (pending) {
- prio = iprio[irq];
- if (!prio) {
- if (irq == extirq) {
- prio = extirq_def_prio;
- } else {
- prio = (riscv_cpu_default_priority(irq) < extirq_def_prio) ?
- 1 : IPRIO_MMAXIPRIO;
- }
- }
- if ((pending & 0x1) && (prio <= best_prio)) {
- best_irq = irq;
- best_prio = prio;
- }
- irq++;
- pending = pending >> 1;
- }
-
- return best_irq;
-}
-
-/*
- * Doesn't report interrupts inserted using mvip from M-mode firmware or
- * using hvip bits 13:63 from HS-mode. Those are returned in
- * riscv_cpu_sirq_pending() and riscv_cpu_vsirq_pending().
- */
-uint64_t riscv_cpu_all_pending(CPURISCVState *env)
-{
- uint32_t gein = get_field(env->hstatus, HSTATUS_VGEIN);
- uint64_t vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
- uint64_t vstip = (env->vstime_irq) ? MIP_VSTIP : 0;
-
- return (env->mip | vsgein | vstip) & env->mie;
-}
-
-int riscv_cpu_mirq_pending(CPURISCVState *env)
-{
- uint64_t irqs = riscv_cpu_all_pending(env) & ~env->mideleg &
- ~(MIP_SGEIP | MIP_VSSIP | MIP_VSTIP | MIP_VSEIP);
-
- return riscv_cpu_pending_to_irq(env, IRQ_M_EXT, IPRIO_DEFAULT_M,
- irqs, env->miprio);
-}
-
-int riscv_cpu_sirq_pending(CPURISCVState *env)
-{
- uint64_t irqs = riscv_cpu_all_pending(env) & env->mideleg & ~env->hideleg;
- uint64_t irqs_f = env->mvip & env->mvien & ~env->mideleg & env->sie;
-
- return riscv_cpu_pending_to_irq(env, IRQ_S_EXT, IPRIO_DEFAULT_S,
- irqs | irqs_f, env->siprio);
-}
-
-int riscv_cpu_vsirq_pending(CPURISCVState *env)
-{
- uint64_t irqs = riscv_cpu_all_pending(env) & env->mideleg & env->hideleg;
- uint64_t irqs_f_vs = env->hvip & env->hvien & ~env->hideleg & env->vsie;
- uint64_t vsbits;
-
- /* Bring VS-level bits to correct position */
- vsbits = irqs & VS_MODE_INTERRUPTS;
- irqs &= ~VS_MODE_INTERRUPTS;
- irqs |= vsbits >> 1;
-
- return riscv_cpu_pending_to_irq(env, IRQ_S_EXT, IPRIO_DEFAULT_S,
- (irqs | irqs_f_vs), env->hviprio);
-}
-
static int riscv_cpu_local_irq_pending(CPURISCVState *env)
{
uint64_t irqs, pending, mie, hsie, vsie, irqs_f, irqs_f_vs;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 20/40] target/riscv: move riscv_cpu_claim_interrupts to cpu.c
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (18 preceding siblings ...)
2026-07-10 2:55 ` [PULL 19/40] target/riscv: move some irq helpers to cpu.c alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 21/40] target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state alistair23
` (21 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
The function is used by hw/intc/ files that KVM cares about like
riscv_aplic.c. Move it to cpu.c to be accessible for --disable-tcg
builds.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-15-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.c | 14 ++++++++++++++
target/riscv/tcg/cpu_helper.c | 11 -----------
2 files changed, 14 insertions(+), 11 deletions(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index fe24751379..2741047769 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -573,6 +573,20 @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
return rval;
}
+#ifndef CONFIG_USER_ONLY
+/* Used by lots of folks in hw/intc */
+int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
+{
+ CPURISCVState *env = &cpu->env;
+ if (env->miclaim & interrupts) {
+ return -1;
+ } else {
+ env->miclaim |= interrupts;
+ return 0;
+ }
+}
+#endif
+
static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
{
ObjectClass *oc;
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 250bb20481..aded995a7f 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -572,17 +572,6 @@ void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level)
}
}
-int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
-{
- CPURISCVState *env = &cpu->env;
- if (env->miclaim & interrupts) {
- return -1;
- } else {
- env->miclaim |= interrupts;
- return 0;
- }
-}
-
void riscv_cpu_interrupt(CPURISCVState *env)
{
uint64_t gein, vsgein = 0, vstip = 0, irqf = 0;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 21/40] target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (19 preceding siblings ...)
2026-07-10 2:55 ` [PULL 20/40] target/riscv: move riscv_cpu_claim_interrupts " alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 22/40] target/riscv: gate riscv_cpu_update_mip with tcg_enabled() alistair23
` (20 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Alistair Francis,
Philippe Mathieu-Daudé
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_dump_csr() is a TCG only function but we'll have to implement it
at some capacity for KVM eventually, therefore put it under a CONFIG_TCG
ifdef while making a note that this function is unimplemented in KVM.
The csr_ops array is also TCG specific, thus the for loop inside
dump_state that iterates it is also TCG only business.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-16-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 2741047769..db18c52656 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -612,8 +612,10 @@ char *riscv_cpu_get_name(RISCVCPU *cpu)
return cpu_model_from_type(typename);
}
+/* Note: this function needs a KVM implementation. */
static void riscv_dump_csr(CPURISCVState *env, int csrno, FILE *f)
{
+#ifdef CONFIG_TCG
target_ulong val = 0;
RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
@@ -625,6 +627,7 @@ static void riscv_dump_csr(CPURISCVState *env, int csrno, FILE *f)
qemu_fprintf(f, " %-13s " TARGET_FMT_lx "\n",
csr_ops[csrno].name, val);
}
+#endif
}
#if !defined(CONFIG_USER_ONLY)
@@ -662,7 +665,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
}
#endif
qemu_fprintf(f, " %-13s %" PRIx64 "\n", "pc", env->pc);
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
for (i = 0; i < ARRAY_SIZE(csr_ops); i++) {
int csrno = i;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 22/40] target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (20 preceding siblings ...)
2026-07-10 2:55 ` [PULL 21/40] target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 23/40] target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold() alistair23
` (19 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_cpu_update_mip() is a TCG only call. Its KVM equivalent is
kvm_riscv_set_irq(). cpu.c gates the KVM only function with a
kvm_enabled() check, making it unavailable for TCG only builds. We need
to do the same for riscv_cpu_update_mip() otherwise a KVM only build
will fail because it doesn't know what this function is.
Use tcg_enabled() for the couple of riscv_cpu_update_mip() calls we have
unguarded in cpu.c.
We have way more calls to deal with in time_helper.c which isn't using
kvm_riscv_set_irq() at all, so create a riscv_accel_set_irq() local
helper that will choose whether to use the KVM or TCG API.
The reason we're going through all this hassle in time_helper.c is
because hw/int/riscv_aclint.c uses it, and if we don't do something
about we won't have riscv_aclint working for KVM. Whether this is a
real problem or not and we should remove aclint support for KVM is
question for another day.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-17-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.c | 19 ++++++++++++++-----
target/riscv/time_helper.c | 33 +++++++++++++++++++++++++--------
2 files changed, 39 insertions(+), 13 deletions(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index db18c52656..6b79dcc5ee 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1343,14 +1343,18 @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
case IRQ_M_EXT:
if (kvm_enabled()) {
kvm_riscv_set_irq(cpu, irq, level);
- } else {
+ }
+
+ if (tcg_enabled()) {
riscv_cpu_update_mip(env, 1 << irq, BOOL_TO_MASK(level));
}
break;
case IRQ_S_EXT:
if (kvm_enabled()) {
kvm_riscv_set_irq(cpu, irq, level);
- } else {
+ }
+
+ if (tcg_enabled()) {
env->external_seip = level;
riscv_cpu_update_mip(env, 1 << irq,
BOOL_TO_MASK(level | env->software_seip));
@@ -1377,9 +1381,14 @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
env->hgeip |= 1ULL << irq;
}
- /* Update mip.SGEIP bit */
- riscv_cpu_update_mip(env, MIP_SGEIP,
- BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
+ if (kvm_enabled()) {
+ kvm_riscv_set_irq(cpu, irq, level);
+ }
+ if (tcg_enabled()) {
+ /* Update mip.SGEIP bit */
+ riscv_cpu_update_mip(env, MIP_SGEIP,
+ BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
+ }
} else {
g_assert_not_reached();
}
diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
index 400e917354..ede1a4c2a3 100644
--- a/target/riscv/time_helper.c
+++ b/target/riscv/time_helper.c
@@ -21,19 +21,34 @@
#include "cpu_bits.h"
#include "time_helper.h"
#include "hw/intc/riscv_aclint.h"
+#include "kvm/kvm_riscv.h"
+#include "system/kvm.h"
+#include "system/tcg.h"
+
+static void riscv_accel_set_irq(RISCVCPU *cpu, int irq, int level)
+{
+ if (kvm_enabled()) {
+ kvm_riscv_set_irq(cpu, irq, level);
+ }
+
+ if (tcg_enabled()) {
+ riscv_cpu_update_mip(&cpu->env, irq, level);
+ }
+}
+
static void riscv_vstimer_cb(void *opaque)
{
RISCVCPU *cpu = opaque;
CPURISCVState *env = &cpu->env;
env->vstime_irq = 1;
- riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(1));
+ riscv_accel_set_irq(cpu, 0, BOOL_TO_MASK(1));
}
static void riscv_stimer_cb(void *opaque)
{
RISCVCPU *cpu = opaque;
- riscv_cpu_update_mip(&cpu->env, MIP_STIP, BOOL_TO_MASK(1));
+ riscv_accel_set_irq(cpu, MIP_STIP, BOOL_TO_MASK(1));
}
/*
@@ -48,6 +63,7 @@ void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
RISCVAclintMTimerState *mtimer = env->rdtime_fn_arg;
uint32_t timebase_freq;
uint64_t rtc_r;
+ RISCVCPU *cpu;
if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn ||
!env->rdtime_fn_arg || !get_field(env->menvcfg, MENVCFG_STCE)) {
@@ -63,6 +79,7 @@ void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
timebase_freq = mtimer->timebase_freq;
rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
+ cpu = env_archcpu(env);
if (timecmp <= rtc_r) {
/*
@@ -71,9 +88,9 @@ void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
*/
if (timer_irq == MIP_VSTIP) {
env->vstime_irq = 1;
- riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(1));
+ riscv_accel_set_irq(cpu, 0, BOOL_TO_MASK(1));
} else {
- riscv_cpu_update_mip(env, MIP_STIP, BOOL_TO_MASK(1));
+ riscv_accel_set_irq(cpu, MIP_STIP, BOOL_TO_MASK(1));
}
return;
}
@@ -81,9 +98,9 @@ void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
/* Clear the [VS|S]TIP bit in mip */
if (timer_irq == MIP_VSTIP) {
env->vstime_irq = 0;
- riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(0));
+ riscv_accel_set_irq(cpu, 0, BOOL_TO_MASK(0));
} else {
- riscv_cpu_update_mip(env, timer_irq, BOOL_TO_MASK(0));
+ riscv_accel_set_irq(cpu, timer_irq, BOOL_TO_MASK(0));
}
/*
@@ -151,7 +168,7 @@ static void riscv_timer_disable_timecmp(CPURISCVState *env, QEMUTimer *timer,
{
/* Disable S-mode Timer IRQ and HW-based STIP */
if ((timer_irq == MIP_STIP) && !get_field(env->menvcfg, MENVCFG_STCE)) {
- riscv_cpu_update_mip(env, timer_irq, BOOL_TO_MASK(0));
+ riscv_accel_set_irq(env_archcpu(env), timer_irq, BOOL_TO_MASK(0));
timer_del(timer);
return;
}
@@ -161,7 +178,7 @@ static void riscv_timer_disable_timecmp(CPURISCVState *env, QEMUTimer *timer,
(!get_field(env->menvcfg, MENVCFG_STCE) ||
!get_field(env->henvcfg, HENVCFG_STCE))) {
env->vstime_irq = 0;
- riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(0));
+ riscv_accel_set_irq(env_archcpu(env), 0, BOOL_TO_MASK(0));
timer_del(timer);
return;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 23/40] target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (21 preceding siblings ...)
2026-07-10 2:55 ` [PULL 22/40] target/riscv: gate riscv_cpu_update_mip with tcg_enabled() alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 24/40] hw/riscv/riscv_hart.c isolate tcg only bits alistair23
` (18 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We have a lot of TCG only initialization in the common cpu_reset_hold
callback that prevents --disable-tcg to work.
Put a CONFIG_TCG ifdef around those bits to make the build work.
Eventually we'll create a TCG specific reset function in tcg-cpu.c but
for now this suffices.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-18-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6b79dcc5ee..5a82e6563b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -965,10 +965,6 @@ bool riscv_cpu_has_work(CPUState *cs)
static void riscv_cpu_reset_hold(Object *obj, ResetType type)
{
-#ifndef CONFIG_USER_ONLY
- uint8_t iprio;
- int i, irq, rdzero;
-#endif
CPUState *cs = CPU(obj);
RISCVCPU *cpu = RISCV_CPU(cs);
RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(obj);
@@ -1020,6 +1016,10 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
MENVCFG_ADUE : 0);
env->henvcfg = 0;
+#ifdef CONFIG_TCG
+ uint8_t iprio;
+ int i, irq, rdzero;
+
/* Initialized default priorities of local interrupts. */
for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
iprio = riscv_cpu_default_priority(i);
@@ -1057,11 +1057,12 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
}
pmp_unlock_entries(env);
+#endif /* ifdef CONFIG_TCG */
#else
env->priv = PRV_U;
env->senvcfg = 0;
env->menvcfg = 0;
-#endif
+#endif /* !CONFIG_USER_ONLY */
/* on reset elp is clear */
env->elp = false;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 24/40] hw/riscv/riscv_hart.c isolate tcg only bits
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (22 preceding siblings ...)
2026-07-10 2:55 ` [PULL 23/40] target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold() alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 25/40] target/riscv/gdbstub.c: isolate TCG only checks alistair23
` (17 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Alistair Francis,
Philippe Mathieu-Daudé
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_cpu_register_csr_qtest_callback(), vcsr_call() and
csr_qtest_callback() are all TCG only and are not available in
--disable-tcg builds.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-19-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv_hart.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index d1c7188369..747754be61 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -61,7 +61,7 @@ static void riscv_harts_cpu_reset(void *opaque)
cpu_reset(CPU(cpu));
}
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
static void csr_call(char *cmd, uint64_t cpu_num, int csrno, uint64_t *val)
{
RISCVCPU *cpu = RISCV_CPU(cpu_by_arch_id(cpu_num));
@@ -151,8 +151,10 @@ static void riscv_harts_realize(DeviceState *dev, Error **errp)
s->harts = g_new0(RISCVCPU, s->num_harts);
-#ifndef CONFIG_USER_ONLY
- riscv_cpu_register_csr_qtest_callback();
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+ if (qtest_enabled()) {
+ riscv_cpu_register_csr_qtest_callback();
+ }
#endif
for (n = 0; n < s->num_harts; n++) {
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 25/40] target/riscv/gdbstub.c: isolate TCG only checks
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (23 preceding siblings ...)
2026-07-10 2:55 ` [PULL 24/40] hw/riscv/riscv_hart.c isolate tcg only bits alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 26/40] target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint alistair23
` (16 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Alistair Francis,
Philippe Mathieu-Daudé
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
The following functions are TCG only and are broken, if they were ever
usable in the first place, with KVM:
- riscv_gdb_(get|se)t_csr
- riscv_gdb_(get|set)_virtual
- riscv_gen_dynamic_csr_feature
Gate everything with TCG enabled to at least get them out of the way to
enable --disable-tcg.
As a note for the future: other archs have distincts gdbstub files for
each accelerator. There's a strong case for RISC-V to do the same.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-20-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/gdbstub.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index f0a5e0d86f..9abbf5bcdf 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -164,6 +164,7 @@ static int riscv_gdb_set_vector(CPUState *cs, uint8_t *mem_buf, int n)
return 0;
}
+#ifdef CONFIG_TCG
static int riscv_gdb_get_csr(CPUState *cs, GByteArray *buf, int n)
{
RISCVCPU *cpu = RISCV_CPU(cs);
@@ -294,6 +295,7 @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
return &cpu->dyn_csr_feature;
}
+#endif /* CONFIG_TCG */
static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
{
@@ -336,7 +338,6 @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
{
- RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cs);
RISCVCPU *cpu = RISCV_CPU(cs);
CPURISCVState *env = &cpu->env;
if (env->misa_ext & RVD) {
@@ -351,6 +352,10 @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
riscv_gdb_set_vector,
ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs));
}
+
+#ifdef CONFIG_TCG
+ RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cs);
+
switch (mcc->def->misa_mxl_max) {
case MXL_RV32:
gdb_register_coprocessor(cs, riscv_gdb_get_virtual,
@@ -371,4 +376,5 @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
gdb_register_coprocessor(cs, riscv_gdb_get_csr, riscv_gdb_set_csr,
riscv_gen_dynamic_csr_feature(cs, cs->gdb_num_regs));
}
+#endif
}
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 26/40] target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (24 preceding siblings ...)
2026-07-10 2:55 ` [PULL 25/40] target/riscv/gdbstub.c: isolate TCG only checks alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 27/40] target/riscv/tcg: remove unused riscv_cpu_get_geilen() alistair23
` (15 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
There's no need for it to be in cpu_helper since riscv_aclint is the
only caller.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-21-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 2 --
hw/intc/riscv_aclint.c | 8 ++++++++
target/riscv/tcg/cpu_helper.c | 7 -------
3 files changed, 8 insertions(+), 9 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 396d9253e6..d6c5d6c1db 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -682,8 +682,6 @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level);
void riscv_cpu_interrupt(CPURISCVState *env);
#define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
-void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
- void *arg);
void riscv_cpu_set_aia_ireg_rmw_cb(CPURISCVState *env, privilege_mode_t priv,
aia_ireg_rmw_fn rmw_fn,
void *rmw_fn_arg);
diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index e27e5fb394..361a8d1bcb 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -40,6 +40,14 @@ typedef struct riscv_aclint_mtimer_callback {
int num;
} riscv_aclint_mtimer_callback;
+static void riscv_cpu_set_rdtime_fn(CPURISCVState *env,
+ uint64_t (*fn)(void *),
+ void *arg)
+{
+ env->rdtime_fn = fn;
+ env->rdtime_fn_arg = arg;
+}
+
static uint64_t cpu_riscv_read_rtc_raw(uint32_t timebase_freq)
{
return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index aded995a7f..7a1ea53ae7 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -612,13 +612,6 @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask, uint64_t value)
return old;
}
-void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
- void *arg)
-{
- env->rdtime_fn = fn;
- env->rdtime_fn_arg = arg;
-}
-
void riscv_cpu_set_aia_ireg_rmw_cb(CPURISCVState *env, privilege_mode_t priv,
aia_ireg_rmw_fn rmw_fn,
void *rmw_fn_arg)
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 27/40] target/riscv/tcg: remove unused riscv_cpu_get_geilen()
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (25 preceding siblings ...)
2026-07-10 2:55 ` [PULL 26/40] target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 28/40] target/riscv: move riscv_cpu_set_geilen() to riscv-imsic alistair23
` (14 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Alistair Francis,
Philippe Mathieu-Daudé
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
No one uses it.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-22-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 1 -
target/riscv/tcg/cpu_helper.c | 9 ---------
2 files changed, 10 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index d6c5d6c1db..7618110412 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -646,7 +646,6 @@ int riscv_cpu_pending_to_irq(CPURISCVState *env,
bool riscv_cpu_fp_enabled(CPURISCVState *env);
-uint8_t riscv_cpu_get_geilen(CPURISCVState *env);
void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen);
bool riscv_cpu_vector_enabled(CPURISCVState *env);
void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 7a1ea53ae7..6b39152ee2 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -526,15 +526,6 @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
}
}
-uint8_t riscv_cpu_get_geilen(CPURISCVState *env)
-{
- if (!riscv_has_ext(env, RVH)) {
- return 0;
- }
-
- return env->geilen;
-}
-
void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen)
{
if (!riscv_has_ext(env, RVH)) {
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 28/40] target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (26 preceding siblings ...)
2026-07-10 2:55 ` [PULL 27/40] target/riscv/tcg: remove unused riscv_cpu_get_geilen() alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 29/40] target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic alistair23
` (13 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_imsic.c is the only caller. Having it sitting in the TCG only
cpu_helper.c gets in the way of --disable-tcg for no good reason.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-23-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 1 -
hw/intc/riscv_imsic.c | 13 +++++++++++++
target/riscv/tcg/cpu_helper.c | 13 -------------
3 files changed, 13 insertions(+), 14 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 7618110412..7a4d8abe07 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -646,7 +646,6 @@ int riscv_cpu_pending_to_irq(CPURISCVState *env,
bool riscv_cpu_fp_enabled(CPURISCVState *env);
-void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen);
bool riscv_cpu_vector_enabled(CPURISCVState *env);
void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
int riscv_env_mmu_index(CPURISCVState *env, bool ifetch);
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index 7e5b5349ba..ebb55191c7 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -46,6 +46,19 @@
#define IMSIC_EISTATE_ENPEND (IMSIC_EISTATE_ENABLED | \
IMSIC_EISTATE_PENDING)
+static void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen)
+{
+ if (!riscv_has_ext(env, RVH)) {
+ return;
+ }
+
+ if (geilen > (TARGET_LONG_BITS - 1)) {
+ return;
+ }
+
+ env->geilen = geilen;
+}
+
static uint32_t riscv_imsic_topei(RISCVIMSICState *imsic, uint32_t page)
{
uint32_t i, max_irq, base;
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 6b39152ee2..71a96a20ef 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -526,19 +526,6 @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
}
}
-void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen)
-{
- if (!riscv_has_ext(env, RVH)) {
- return;
- }
-
- if (geilen > (TARGET_LONG_BITS - 1)) {
- return;
- }
-
- env->geilen = geilen;
-}
-
void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level)
{
CPURISCVState *env = &cpu->env;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 29/40] target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (27 preceding siblings ...)
2026-07-10 2:55 ` [PULL 28/40] target/riscv: move riscv_cpu_set_geilen() to riscv-imsic alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 30/40] gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job alistair23
` (12 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel
Cc: Daniel Henrique Barboza, Philippe Mathieu-Daudé,
Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_imsic.c is the only caller. Having it sitting in the TCG only
cpu_helper.c gets in the way of --disable-tcg for no good reason.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-24-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu.h | 3 ---
hw/intc/riscv_imsic.c | 11 +++++++++++
target/riscv/tcg/cpu_helper.c | 10 ----------
3 files changed, 11 insertions(+), 13 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 7a4d8abe07..c9dfa7daff 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -680,9 +680,6 @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask,
void riscv_cpu_set_rnmi(RISCVCPU *cpu, uint32_t irq, bool level);
void riscv_cpu_interrupt(CPURISCVState *env);
#define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
-void riscv_cpu_set_aia_ireg_rmw_cb(CPURISCVState *env, privilege_mode_t priv,
- aia_ireg_rmw_fn rmw_fn,
- void *rmw_fn_arg);
RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
#endif /* !CONFIG_USER_ONLY */
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index ebb55191c7..d6b46cdca2 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -376,6 +376,17 @@ static void riscv_imsic_reset_enter(Object *obj, ResetType type)
}
}
+static void riscv_cpu_set_aia_ireg_rmw_cb(CPURISCVState *env,
+ privilege_mode_t priv,
+ aia_ireg_rmw_fn rmw_fn,
+ void *rmw_fn_arg)
+{
+ if (priv <= PRV_M) {
+ env->aia_ireg_rmw_cb[priv] = rmw_fn;
+ env->aia_ireg_rmw_cb_arg[priv] = rmw_fn_arg;
+ }
+}
+
static void riscv_imsic_realize(DeviceState *dev, Error **errp)
{
RISCVIMSICState *imsic = RISCV_IMSIC(dev);
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 71a96a20ef..07d9222652 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -590,16 +590,6 @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t mask, uint64_t value)
return old;
}
-void riscv_cpu_set_aia_ireg_rmw_cb(CPURISCVState *env, privilege_mode_t priv,
- aia_ireg_rmw_fn rmw_fn,
- void *rmw_fn_arg)
-{
- if (priv <= PRV_M) {
- env->aia_ireg_rmw_cb[priv] = rmw_fn;
- env->aia_ireg_rmw_cb_arg[priv] = rmw_fn_arg;
- }
-}
-
static void riscv_ctr_freeze(CPURISCVState *env, uint64_t freeze_mask,
bool virt)
{
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 30/40] gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (28 preceding siblings ...)
2026-07-10 2:55 ` [PULL 29/40] target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 31/40] hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN alistair23
` (11 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Zephyr Li, Daniel Henrique Barboza, Alistair Francis
From: Zephyr Li <fritchleybohrer@gmail.com>
Add CI coverage for a riscv64 --disable-tcg cross build. This ensures that
RISC-V no-TCG/KVM-only builds keep working and prevents TCG-only code from
being accidentally pulled into common RISC-V sources again.
The cross_accel_build_job template enables KVM by default via
--enable-${ACCEL:-kvm}, so the extra options only need to disable TCG.
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-25-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
.gitlab-ci.d/crossbuilds.yml | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index eaeeb533ce..a823aaaa21 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -59,6 +59,14 @@ cross-riscv64-user:
variables:
IMAGE: debian-riscv64-cross
+cross-riscv64-kvm-only:
+ extends: .cross_accel_build_job
+ needs:
+ - job: riscv64-debian-cross-container
+ variables:
+ IMAGE: debian-riscv64-cross
+ EXTRA_CONFIGURE_OPTS: --disable-tcg --without-default-features
+
cross-s390x-system:
extends: .cross_system_build_job
needs:
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 31/40] hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (29 preceding siblings ...)
2026-07-10 2:55 ` [PULL 30/40] gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 32/40] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch() alistair23
` (10 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Chao Liu, Nutty Liu, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We must check if IOHGATP_PPN is 16kb aligned for non-bare GATP modes.
Fixes: 69a9ae4836 ("hw/riscv/riscv-iommu: add ATS support")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3550
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Message-ID: <20260702203616.1795588-2-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 12f20fa4bd..d3710aa3a2 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -862,6 +862,21 @@ static bool riscv_iommu_validate_device_ctx(RISCVIOMMUState *s,
return false;
}
+ if (gatp != RISCV_IOMMU_DC_IOHGATP_MODE_BARE) {
+ uint64_t iohgatp_ppn = get_field(ctx->gatp,
+ RISCV_IOMMU_DC_IOHGATP_PPN);
+
+ /*
+ * One of the conditions for a misconfigured DDT entry
+ * according to the riscv-spec: "DC.iohgatp.MODE is not
+ * Bare and the root page table (address) determined by
+ * DC.iohgatp.PPN is not aligned to a 16-KiB boundary."
+ */
+ if (PPN_PHYS(iohgatp_ppn) & ((1ULL << 14) - 1)) {
+ return false;
+ }
+ }
+
fsc_mode = get_field(ctx->satp, RISCV_IOMMU_DC_FSC_MODE);
if (ctx->tc & RISCV_IOMMU_DC_TC_PDTV) {
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 32/40] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (30 preceding siblings ...)
2026-07-10 2:55 ` [PULL 31/40] hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 33/40] hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero alistair23
` (9 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(),
will use riscv_iommu_report_fault() for all faults it detects. And it
will use iotlb->translated_addr as 'iotval2' every time.
At this moment we're updating iotlb->translated_addr only after a
translation step is completed, meaning any fault that occur before that
will have a zeroed iotlb->translated_addr, and as a result iotval2 will
also be zero later on.
Keep iotlb->translated_addr updated with the latest translated addr we
have.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260702171202.1322493-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index d3710aa3a2..bdc409adc9 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -574,6 +574,14 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
}
} while (1);
+ /*
+ * riscv_iommu_translate() will receive a fault and then call
+ * riscv_iommu_report_fault() using iotlb->translated_addr
+ * as iotval2. Update translated_addr it with the latest
+ * translated addr we have.
+ */
+ iotlb->translated_addr = addr;
+
return (iotlb->perm & IOMMU_WO) ?
(pass ? RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS :
RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S) :
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 33/40] hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (31 preceding siblings ...)
2026-07-10 2:55 ` [PULL 32/40] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch() alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 34/40] hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx() alistair23
` (8 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Nutty Liu, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
When capabilities.AMO_HWADD isn't set, DC.tc.GADE and DC.tc.SADE are
reserved bits and setting them throws a DDT_MISCONFIGURED error.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3549
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Message-ID: <20260630172110.1866951-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu-bits.h | 1 +
hw/riscv/riscv-iommu.c | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index cc0b1c3ccd..924a1f8c21 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -86,6 +86,7 @@ struct riscv_iommu_pq_record {
#define RISCV_IOMMU_CAP_SV57X4 BIT_ULL(19)
#define RISCV_IOMMU_CAP_MSI_FLAT BIT_ULL(22)
#define RISCV_IOMMU_CAP_MSI_MRIF BIT_ULL(23)
+#define RISCV_IOMMU_CAP_AMO_HWAD BIT_ULL(24)
#define RISCV_IOMMU_CAP_ATS BIT_ULL(25)
#define RISCV_IOMMU_CAP_T2GPA BIT_ULL(26)
#define RISCV_IOMMU_CAP_IGS GENMASK_ULL(29, 28)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index bdc409adc9..877d24bc47 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -417,6 +417,11 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
const bool ade =
ctx->tc & (pass ? RISCV_IOMMU_DC_TC_GADE : RISCV_IOMMU_DC_TC_SADE);
+ if (ade && !(s->cap & RISCV_IOMMU_CAP_AMO_HWAD)) {
+ /* GADE/SADE are reserved bits if AMO_HWAD is cleared. */
+ return RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED;
+ }
+
/* Address range check before first level lookup */
if (!sc[pass].step) {
const uint64_t va_len = va_skip + va_bits;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 34/40] hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (32 preceding siblings ...)
2026-07-10 2:55 ` [PULL 33/40] hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 35/40] hw/pci/pcie_doe: Check mailbox length for overflows alistair23
` (7 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Daniel Henrique Barboza, Alistair Francis
From: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
We're hardcoding faulting type as READ, where it could very well be a
write access, and we're not recording the faulting addr/iova.
A note was added in the fault_type logic because I wasn't able to
trivially handle a probable code repeitition it in this same patch.
Something to do in a later date.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3564
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20260701092241.307801-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/riscv/riscv-iommu.c | 29 +++++++++++++++++++++++------
1 file changed, 23 insertions(+), 6 deletions(-)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 877d24bc47..f6865d1e16 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -1430,6 +1430,7 @@ static void riscv_iommu_ctx_inval(RISCVIOMMUState *s, GHFunc func,
/* Find or allocate translation context for a given {device_id, process_id} */
static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
unsigned devid, unsigned process_id,
+ IOMMUAccessFlags perm, uint64_t iova,
void **ref)
{
GHashTable *ctx_cache;
@@ -1439,6 +1440,7 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
.process_id = process_id,
};
unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);
+ uint32_t fault_type;
ctx_cache = g_hash_table_ref(s->ctx_cache);
@@ -1481,8 +1483,21 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
g_hash_table_unref(ctx_cache);
*ref = NULL;
- riscv_iommu_report_fault(s, ctx, RISCV_IOMMU_FQ_TTYPE_UADDR_RD,
- fault, !!process_id, 0, 0);
+ /*
+ * TODO: (1) do we need to distinguish other fault types
+ * for ctx fetching and (2) evaluate putting the 'fault_type'
+ * logic inside riscv_iommu_report_fault() - there's at
+ * least one other place (end of riscv_iommu_translate())
+ * that does something similar.
+ */
+ if (perm & IOMMU_RO) {
+ fault_type = RISCV_IOMMU_FQ_TTYPE_UADDR_RD;
+ } else {
+ fault_type = RISCV_IOMMU_FQ_TTYPE_UADDR_WR;
+ }
+
+ riscv_iommu_report_fault(s, ctx, fault_type, fault,
+ !!process_id, iova, 0);
g_free(ctx);
return NULL;
@@ -2233,6 +2248,8 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *s)
uint64_t ctrl = riscv_iommu_reg_get64(s, RISCV_IOMMU_REG_TR_REQ_CTL);
unsigned devid = get_field(ctrl, RISCV_IOMMU_TR_REQ_CTL_DID);
unsigned pid = get_field(ctrl, RISCV_IOMMU_TR_REQ_CTL_PID);
+ IOMMUAccessFlags perm = ctrl & RISCV_IOMMU_TR_REQ_CTL_NW
+ ? IOMMU_RO : IOMMU_RW;
RISCVIOMMUContext *ctx;
void *ref;
@@ -2240,7 +2257,7 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *s)
return;
}
- ctx = riscv_iommu_ctx(s, devid, pid, &ref);
+ ctx = riscv_iommu_ctx(s, devid, pid, perm, iova, &ref);
if (ctx == NULL) {
riscv_iommu_reg_set64(s, RISCV_IOMMU_REG_TR_RESPONSE,
RISCV_IOMMU_TR_RESPONSE_FAULT |
@@ -2248,7 +2265,7 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *s)
} else {
IOMMUTLBEntry iotlb = {
.iova = iova,
- .perm = ctrl & RISCV_IOMMU_TR_REQ_CTL_NW ? IOMMU_RO : IOMMU_RW,
+ .perm = perm,
.addr_mask = ~0,
.target_as = NULL,
};
@@ -2587,7 +2604,7 @@ static MemTxResult riscv_iommu_trap_write(void *opaque, hwaddr addr,
/* FIXME: PCIe bus remapping for attached endpoints. */
devid |= s->bus << 8;
- ctx = riscv_iommu_ctx(s, devid, 0, &ref);
+ ctx = riscv_iommu_ctx(s, devid, 0, IOMMU_RW, addr, &ref);
if (ctx == NULL) {
res = MEMTX_ACCESS_ERROR;
} else {
@@ -2889,7 +2906,7 @@ static IOMMUTLBEntry riscv_iommu_memory_region_translate(
};
uint32_t devid = riscv_iommu_space_devid(as);
- ctx = riscv_iommu_ctx(as->iommu, devid, iommu_idx, &ref);
+ ctx = riscv_iommu_ctx(as->iommu, devid, iommu_idx, flag, addr, &ref);
if (ctx == NULL) {
/* Translation disabled or invalid. */
iotlb.addr_mask = 0;
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 35/40] hw/pci/pcie_doe: Check mailbox length for overflows
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (33 preceding siblings ...)
2026-07-10 2:55 ` [PULL 34/40] hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx() alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 36/40] target/riscv/kvm: add extensions after v7.1-rc4 update alistair23
` (6 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Alistair Francis, Philippe Mathieu-Daudé, Tao Tang
From: Alistair Francis <alistair.francis@wdc.com>
It was possible that a guest could overflow the `doe_cap->write_mbox`
buffer by writing more then PCI_DOE_DW_SIZE_MAX dwords.
`doe_cap->write_mbox_len` would continue to increment and there were no
bounds checks on the length when offsetting into doe_cap->write_mbox.
This patch adds a check and reports a guest error if we would overflow.
On an overflow we also silenty discard the entire object as instructed
to do in the PCIe spec when the length specified in the header
(up to PCI_DOE_DW_SIZE_MAX dwords) doesn't match the length of the
object.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3679
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Tao Tang <tangtao1634@phytium.com.cn>
Message-ID: <20260707020750.788960-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/pci/pcie_doe.c | 27 +++++++++++++++++++++++----
1 file changed, 23 insertions(+), 4 deletions(-)
diff --git a/hw/pci/pcie_doe.c b/hw/pci/pcie_doe.c
index 2210f86968..1bc2b45781 100644
--- a/hw/pci/pcie_doe.c
+++ b/hw/pci/pcie_doe.c
@@ -78,14 +78,21 @@ static bool pcie_doe_discovery(DOECap *doe_cap)
return true;
}
+static void pcie_doe_reset_write_mbox(DOECap *st)
+{
+ st->write_mbox_len = 0;
+
+ memset(st->write_mbox, 0, PCI_DOE_DW_SIZE_MAX * DWORD_BYTE);
+}
+
static void pcie_doe_reset_mbox(DOECap *st)
{
st->read_mbox_idx = 0;
st->read_mbox_len = 0;
- st->write_mbox_len = 0;
memset(st->read_mbox, 0, PCI_DOE_DW_SIZE_MAX * DWORD_BYTE);
- memset(st->write_mbox, 0, PCI_DOE_DW_SIZE_MAX * DWORD_BYTE);
+
+ pcie_doe_reset_write_mbox(st);
}
void pcie_doe_init(PCIDevice *dev, DOECap *doe_cap, uint16_t offset,
@@ -356,8 +363,20 @@ void pcie_doe_write_config(DOECap *doe_cap,
if (size != DWORD_BYTE) {
return;
}
- doe_cap->write_mbox[doe_cap->write_mbox_len] = val;
- doe_cap->write_mbox_len++;
+ if (doe_cap->write_mbox_len < PCI_DOE_DW_SIZE_MAX) {
+ doe_cap->write_mbox[doe_cap->write_mbox_len] = val;
+ doe_cap->write_mbox_len++;
+ } else {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Mailbox write length (%d) overflow\n",
+ doe_cap->write_mbox_len);
+ /*
+ * Too much data has been written, it can't
+ * "match the Length indicated in DOE Data Object Header 2"
+ * so we drop the entire object.
+ */
+ pcie_doe_reset_write_mbox(doe_cap);
+ }
break;
case PCI_EXP_DOE_CAP:
/* fallthrough */
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 36/40] target/riscv/kvm: add extensions after v7.1-rc4 update
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (34 preceding siblings ...)
2026-07-10 2:55 ` [PULL 35/40] hw/pci/pcie_doe: Check mailbox length for overflows alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 37/40] gitlab-ci: Remove job building OpenSBI firmware binaries alistair23
` (5 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Wang Yechao, Alistair Francis
From: Wang Yechao <wang.yechao255@zte.com.cn>
Expose zilsd, zclsd and zalasr.
Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260707072610.403595-1-wang.yechao255@zte.com.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/kvm/kvm-cpu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index dfcd6e3c77..495cb42dc8 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -303,10 +303,13 @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
KVM_EXT_CFG("zihintntl", ext_zihintntl, KVM_RISCV_ISA_EXT_ZIHINTNTL),
KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
KVM_EXT_CFG("zihpm", ext_zihpm, KVM_RISCV_ISA_EXT_ZIHPM),
+ KVM_EXT_CFG("zilsd", ext_zilsd, KVM_RISCV_ISA_EXT_ZILSD),
KVM_EXT_CFG("zimop", ext_zimop, KVM_RISCV_ISA_EXT_ZIMOP),
KVM_EXT_CFG("zcmop", ext_zcmop, KVM_RISCV_ISA_EXT_ZCMOP),
+ KVM_EXT_CFG("zclsd", ext_zclsd, KVM_RISCV_ISA_EXT_ZCLSD),
KVM_EXT_CFG("zabha", ext_zabha, KVM_RISCV_ISA_EXT_ZABHA),
KVM_EXT_CFG("zacas", ext_zacas, KVM_RISCV_ISA_EXT_ZACAS),
+ KVM_EXT_CFG("zalasr", ext_zalasr, KVM_RISCV_ISA_EXT_ZALASR),
KVM_EXT_CFG("zawrs", ext_zawrs, KVM_RISCV_ISA_EXT_ZAWRS),
KVM_EXT_CFG("zfa", ext_zfa, KVM_RISCV_ISA_EXT_ZFA),
KVM_EXT_CFG("zfbfmin", ext_zfbfmin, KVM_RISCV_ISA_EXT_ZFBFMIN),
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 37/40] gitlab-ci: Remove job building OpenSBI firmware binaries
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (35 preceding siblings ...)
2026-07-10 2:55 ` [PULL 36/40] target/riscv/kvm: add extensions after v7.1-rc4 update alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 38/40] tests: allow differences in SPCR alistair23
` (4 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Bin Meng, Alistair Francis, Philippe Mathieu-Daudé
From: Bin Meng <bin.meng@processmission.com>
The OpenSBI firmware build job follows the same pattern as the EDK2 job
[1] that was removed earlier [2]: it exists to produce firmware binaries
from CI artifacts, but those outputs are not consumed by the tree.
Remove the job definition and its project include to avoid maintaining
bitrotting container and firmware build logic.
[1] 71920809ceab ("gitlab-ci.yml: Add jobs to build EDK2 firmware binaries")
[2] 690ceb71936f ("gitlab-ci: Remove job building EDK2 firmware binaries")
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260706161716.29488-1-bin.meng@processmission.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
MAINTAINERS | 2 -
.gitlab-ci.d/opensbi.yml | 88 ---------------------------------
.gitlab-ci.d/opensbi/Dockerfile | 34 -------------
.gitlab-ci.d/qemu-project.yml | 1 -
4 files changed, 125 deletions(-)
delete mode 100644 .gitlab-ci.d/opensbi.yml
delete mode 100644 .gitlab-ci.d/opensbi/Dockerfile
diff --git a/MAINTAINERS b/MAINTAINERS
index 6171cc7494..e25df9493c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4127,8 +4127,6 @@ R: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
L: qemu-riscv@nongnu.org
S: Supported
F: pc-bios/opensbi-*
-F: .gitlab-ci.d/opensbi.yml
-F: .gitlab-ci.d/opensbi/
Clock framework
M: Luc Michel <luc@lmichel.fr>
diff --git a/.gitlab-ci.d/opensbi.yml b/.gitlab-ci.d/opensbi.yml
deleted file mode 100644
index 42f137d624..0000000000
--- a/.gitlab-ci.d/opensbi.yml
+++ /dev/null
@@ -1,88 +0,0 @@
-# All jobs needing docker-opensbi must use the same rules it uses.
-.opensbi_job_rules:
- rules:
- # Forks don't get pipelines unless QEMU_CI=1 or QEMU_CI=2 is set
- - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != "qemu-project"'
- when: never
-
- # In forks, if QEMU_CI=1 is set, then create manual job
- # if any files affecting the build output are touched
- - if: '$QEMU_CI == "1" && $CI_PROJECT_NAMESPACE != "qemu-project"'
- changes:
- - .gitlab-ci.d/opensbi.yml
- - .gitlab-ci.d/opensbi/Dockerfile
- - roms/opensbi/*
- when: manual
-
- # In forks, if QEMU_CI=1 is set, then create manual job
- # if the branch/tag starts with 'opensbi'
- - if: '$QEMU_CI == "1" && $CI_PROJECT_NAMESPACE != "qemu-project" && $CI_COMMIT_REF_NAME =~ /^opensbi/'
- when: manual
-
- # In forks, if QEMU_CI=1 is set, then create manual job
- # if the last commit msg contains 'OpenSBI' (case insensitive)
- - if: '$QEMU_CI == "1" && $CI_PROJECT_NAMESPACE != "qemu-project" && $CI_COMMIT_MESSAGE =~ /opensbi/i'
- when: manual
-
- # Scheduled runs on mainline don't get pipelines except for the special Coverity job
- - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_PIPELINE_SOURCE == "schedule"'
- when: never
-
- # Run if any files affecting the build output are touched
- - changes:
- - .gitlab-ci.d/opensbi.yml
- - .gitlab-ci.d/opensbi/Dockerfile
- - roms/opensbi/*
- when: on_success
-
- # Run if the branch/tag starts with 'opensbi'
- - if: '$CI_COMMIT_REF_NAME =~ /^opensbi/'
- when: on_success
-
- # Run if the last commit msg contains 'OpenSBI' (case insensitive)
- - if: '$CI_COMMIT_MESSAGE =~ /opensbi/i'
- when: on_success
-
-docker-opensbi:
- extends: .opensbi_job_rules
- stage: containers
- image: docker:latest
- services:
- - docker:dind
- variables:
- GIT_DEPTH: 3
- IMAGE_TAG: $CI_REGISTRY_IMAGE:opensbi-cross-build
- before_script:
- - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- - until docker info; do sleep 1; done
- script:
- - docker pull $IMAGE_TAG || true
- - docker build --cache-from $IMAGE_TAG --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
- --tag $IMAGE_TAG .gitlab-ci.d/opensbi
- - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
- - docker push $IMAGE_TAG
-
-build-opensbi:
- extends: .opensbi_job_rules
- stage: build
- needs: ['docker-opensbi']
- artifacts:
- when: on_success
- paths: # 'artifacts.zip' will contains the following files:
- - pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
- - pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
- - opensbi32-generic-stdout.log
- - opensbi32-generic-stderr.log
- - opensbi64-generic-stdout.log
- - opensbi64-generic-stderr.log
- image: $CI_REGISTRY_IMAGE:opensbi-cross-build
- variables:
- GIT_DEPTH: 3
- script: # Clone the required submodules and build OpenSBI
- - git submodule update --init roms/opensbi
- - export JOBS=$(($(getconf _NPROCESSORS_ONLN) + 1))
- - echo "=== Using ${JOBS} simultaneous jobs ==="
- - make -j${JOBS} -C roms/opensbi clean
- - make -j${JOBS} -C roms opensbi32-generic 2>&1 1>opensbi32-generic-stdout.log | tee -a opensbi32-generic-stderr.log >&2
- - make -j${JOBS} -C roms/opensbi clean
- - make -j${JOBS} -C roms opensbi64-generic 2>&1 1>opensbi64-generic-stdout.log | tee -a opensbi64-generic-stderr.log >&2
diff --git a/.gitlab-ci.d/opensbi/Dockerfile b/.gitlab-ci.d/opensbi/Dockerfile
deleted file mode 100644
index 5ccf4151f4..0000000000
--- a/.gitlab-ci.d/opensbi/Dockerfile
+++ /dev/null
@@ -1,34 +0,0 @@
-#
-# Docker image to cross-compile OpenSBI firmware binaries
-#
-FROM ubuntu:18.04
-
-MAINTAINER Bin Meng <bmeng.cn@gmail.com>
-
-# Install packages required to build OpenSBI
-RUN apt update \
- && \
- \
- DEBIAN_FRONTEND=noninteractive \
- apt install --assume-yes --no-install-recommends \
- build-essential \
- ca-certificates \
- git \
- make \
- python3 \
- wget \
- && \
- \
- rm -rf /var/lib/apt/lists/*
-
-# Manually install the kernel.org "Crosstool" based toolchains for gcc-8.3
-RUN wget -O - \
- https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.3.0/x86_64-gcc-8.3.0-nolibc-riscv32-linux.tar.xz \
- | tar -C /opt -xJ
-RUN wget -O - \
- https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.3.0/x86_64-gcc-8.3.0-nolibc-riscv64-linux.tar.xz \
- | tar -C /opt -xJ
-
-# Export the toolchains to the system path
-ENV PATH="/opt/gcc-8.3.0-nolibc/riscv32-linux/bin:${PATH}"
-ENV PATH="/opt/gcc-8.3.0-nolibc/riscv64-linux/bin:${PATH}"
diff --git a/.gitlab-ci.d/qemu-project.yml b/.gitlab-ci.d/qemu-project.yml
index 104a147b2d..72d02bc65b 100644
--- a/.gitlab-ci.d/qemu-project.yml
+++ b/.gitlab-ci.d/qemu-project.yml
@@ -11,7 +11,6 @@ default:
include:
- local: '/.gitlab-ci.d/base.yml'
- local: '/.gitlab-ci.d/stages.yml'
- - local: '/.gitlab-ci.d/opensbi.yml'
- local: '/.gitlab-ci.d/containers.yml'
- local: '/.gitlab-ci.d/crossbuilds.yml'
- local: '/.gitlab-ci.d/buildtest.yml'
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 38/40] tests: allow differences in SPCR
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (36 preceding siblings ...)
2026-07-10 2:55 ` [PULL 37/40] gitlab-ci: Remove job building OpenSBI firmware binaries alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 39/40] hw/acpi: correct field sequence in SPCR table alistair23
` (3 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Heinrich Schuchardt, Alistair Francis
From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
For easier bisection add the SPCR table to bios-tables-test-allowed-diff.h.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260705063147.199732-2-heinrich.schuchardt@canonical.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
tests/qtest/bios-tables-test-allowed-diff.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..2c7086d9de 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,3 @@
/* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/loongarch64/virt/SPCR",
+"tests/data/acpi/riscv64/virt/SPCR",
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 39/40] hw/acpi: correct field sequence in SPCR table
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (37 preceding siblings ...)
2026-07-10 2:55 ` [PULL 38/40] tests: allow differences in SPCR alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-10 2:55 ` [PULL 40/40] tests: update SPCR loongarch64 and riscv64 test data alistair23
` (2 subsequent siblings)
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Heinrich Schuchardt, Alistair Francis
From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
On LoongArch and RISC-V invalid SPCR tables are created:
Terminal Type : 00
Language : 03
The correct values are:
Terminal Type : 03
Language : 00
This is due to commit 7dd0b070fa09 ("hw/arm/virt-acpi-build.c: Migrate
SPCR creation to common location") that swapped the fields.
See the specification of the table in
https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/serial-port-console-redirection-table
This page shows version 1.10. But the sequence of the fields was not changed
since version 1.0.
Our LoongArch and ARM code uses version 1.07 of the specification.
Our RISC-V code uses version 1.10 of the specification.
Fixes: 7dd0b070fa09 ("hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location")
Origin: https://lore.kernel.org/qemu-devel/20260326121947.51200-1-heinrich.schuchardt@canonical.com/T/#u
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2146419
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260705063147.199732-3-heinrich.schuchardt@canonical.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
hw/acpi/aml-build.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index 9b3cdd3781..990abc64cd 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -2144,10 +2144,10 @@ void build_spcr(GArray *table_data, BIOSLinker *linker,
build_append_int_noprefix(table_data, f->stop_bits, 1);
/* Flow Control */
build_append_int_noprefix(table_data, f->flow_control, 1);
- /* Language */
- build_append_int_noprefix(table_data, f->language, 1);
/* Terminal Type */
build_append_int_noprefix(table_data, f->terminal_type, 1);
+ /* Language */
+ build_append_int_noprefix(table_data, f->language, 1);
/* PCI Device ID */
build_append_int_noprefix(table_data, f->pci_device_id, 2);
/* PCI Vendor ID */
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* [PULL 40/40] tests: update SPCR loongarch64 and riscv64 test data
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (38 preceding siblings ...)
2026-07-10 2:55 ` [PULL 39/40] hw/acpi: correct field sequence in SPCR table alistair23
@ 2026-07-10 2:55 ` alistair23
2026-07-11 4:42 ` [PULL 00/40] riscv-to-apply queue Stefan Hajnoczi
2026-07-11 6:32 ` Michael Tokarev
41 siblings, 0 replies; 50+ messages in thread
From: alistair23 @ 2026-07-10 2:55 UTC (permalink / raw)
To: qemu-devel; +Cc: Heinrich Schuchardt, Alistair Francis
From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
On LoongArch and RISC-V the SPCR test data contained:
Terminal Type : 00
Language : 03
The corrected values are:
Terminal Type : 03
Language : 00
See the specification of the table in
https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/serial-port-console-redirection-table
The ACPI table data was rebuilt with
tests/data/acpi/rebuild-expected-aml.sh.
Remove SPCR expections from tests/qtest/bios-tables-test-allowed-diff.h.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260705063147.199732-4-heinrich.schuchardt@canonical.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
tests/qtest/bios-tables-test-allowed-diff.h | 2 --
tests/data/acpi/loongarch64/virt/SPCR | Bin 80 -> 80 bytes
tests/data/acpi/riscv64/virt/SPCR | Bin 90 -> 90 bytes
3 files changed, 2 deletions(-)
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 2c7086d9de..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,3 +1 @@
/* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/loongarch64/virt/SPCR",
-"tests/data/acpi/riscv64/virt/SPCR",
diff --git a/tests/data/acpi/loongarch64/virt/SPCR b/tests/data/acpi/loongarch64/virt/SPCR
index 3cc9bbcfb8..7bb819cd0d 100644
Binary files a/tests/data/acpi/loongarch64/virt/SPCR and b/tests/data/acpi/loongarch64/virt/SPCR differ
diff --git a/tests/data/acpi/riscv64/virt/SPCR b/tests/data/acpi/riscv64/virt/SPCR
index 09617f8793..59d2c8f7f2 100644
Binary files a/tests/data/acpi/riscv64/virt/SPCR and b/tests/data/acpi/riscv64/virt/SPCR differ
--
2.54.0
^ permalink raw reply related [flat|nested] 50+ messages in thread* Re: [PULL 00/40] riscv-to-apply queue
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (39 preceding siblings ...)
2026-07-10 2:55 ` [PULL 40/40] tests: update SPCR loongarch64 and riscv64 test data alistair23
@ 2026-07-11 4:42 ` Stefan Hajnoczi
2026-07-11 6:32 ` Michael Tokarev
41 siblings, 0 replies; 50+ messages in thread
From: Stefan Hajnoczi @ 2026-07-11 4:42 UTC (permalink / raw)
To: alistair23; +Cc: qemu-devel, Alistair Francis
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 50+ messages in thread* Re: [PULL 00/40] riscv-to-apply queue
2026-07-10 2:54 [PULL 00/40] riscv-to-apply queue alistair23
` (40 preceding siblings ...)
2026-07-11 4:42 ` [PULL 00/40] riscv-to-apply queue Stefan Hajnoczi
@ 2026-07-11 6:32 ` Michael Tokarev
2026-07-11 7:39 ` Daniel Henrique Barboza
41 siblings, 1 reply; 50+ messages in thread
From: Michael Tokarev @ 2026-07-11 6:32 UTC (permalink / raw)
To: alistair23, qemu-devel
Cc: Alistair Francis, Daniel Henrique Barboza, qemu-stable
On 7/10/26 05:54, alistair23@gmail.com wrote:
> From: Alistair Francis <alistair.francis@wdc.com>
> RISC-V PR for 11.1
>
> * Fix IOMMU fault type for spa_fetch() faults
> * Check IOMMU for reserved PTE bits
> * Fault when IOMMU !PTE_U and no priv access
> * Fault IOMMU for non-user PTE in G_STAGE
> * Check IOMMU reserved MSI PTE basic bits
> * Record fault on IOMMU-generated MSI write
> * Move RISC-V TCG files and fix --disable-tcg
> * Check for misaligned IOMMU IOHGATP_PPN
> * Update IOMMU ioval2 when faulting in spa_fetch()
> * Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
> * Set IOMMU ftype and iova in riscv_iommu_ctx()
> * Check PCIe DOE mailbox length for overflows
> * Add extensions after v7.1-rc4 update
> * Remove job building OpenSBI firmware binaries
> * Correct ACPI field sequence in SPCR table
Is it the same as usual for riscv pull requests, -- everything with
Fixes: or Resolves: tag should be picked up for the current qemu stable
releases?
(Cc'ing Daniel too since he has largest share of contributions here).
Thanks,
/mjt
> ----------------------------------------------------------------
> Alistair Francis (1):
> hw/pci/pcie_doe: Check mailbox length for overflows
>
> Bin Meng (1):
> gitlab-ci: Remove job building OpenSBI firmware binaries
>
> Daniel Henrique Barboza (32):
> hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
> hw/riscv/riscv-iommu.c: check for reserved PTE bits
> hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
> hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
> hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
> hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
> target/riscv: move valid_vm_* satp arrays to cpu.c
> hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
> target/riscv: move TCG only files to tcg subdir
> target/riscv/machine.c: do not migrate pmp state with kvm
> target/riscv: move pmp files to tcg subdir
> target/riscv: tidy up riscv_sysemu_ops
> target/riscv: move debug.h to tcg subdir
> target/riscv: remove csr.h from kvm-cpu.c
> target/riscv: move csr.h to tcg subdir
> target/riscv: move custom_csrs logic to tcg-cpu.c
> target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
> target/riscv: move some irq helpers to cpu.c
> target/riscv: move riscv_cpu_claim_interrupts to cpu.c
> target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
> target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
> target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
> hw/riscv/riscv_hart.c isolate tcg only bits
> target/riscv/gdbstub.c: isolate TCG only checks
> target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
> target/riscv/tcg: remove unused riscv_cpu_get_geilen()
> target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
> target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
> hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
> hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
> hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
> hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
>
> Heinrich Schuchardt (3):
> tests: allow differences in SPCR
> hw/acpi: correct field sequence in SPCR table
> tests: update SPCR loongarch64 and riscv64 test data
>
> Wang Yechao (1):
> target/riscv/kvm: add extensions after v7.1-rc4 update
>
> Zephyr Li (2):
> target/riscv: Remove unused tcg/tcg.h include
> gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
^ permalink raw reply [flat|nested] 50+ messages in thread* Re: [PULL 00/40] riscv-to-apply queue
2026-07-11 6:32 ` Michael Tokarev
@ 2026-07-11 7:39 ` Daniel Henrique Barboza
0 siblings, 0 replies; 50+ messages in thread
From: Daniel Henrique Barboza @ 2026-07-11 7:39 UTC (permalink / raw)
To: Michael Tokarev, alistair23, qemu-devel; +Cc: Alistair Francis, qemu-stable
On 7/11/2026 3:32 AM, Michael Tokarev wrote:
> On 7/10/26 05:54, alistair23@gmail.com wrote:
>> From: Alistair Francis <alistair.francis@wdc.com>
>
>> RISC-V PR for 11.1
>>
>> * Fix IOMMU fault type for spa_fetch() faults
>> * Check IOMMU for reserved PTE bits
>> * Fault when IOMMU !PTE_U and no priv access
>> * Fault IOMMU for non-user PTE in G_STAGE
>> * Check IOMMU reserved MSI PTE basic bits
>> * Record fault on IOMMU-generated MSI write
>> * Move RISC-V TCG files and fix --disable-tcg
>> * Check for misaligned IOMMU IOHGATP_PPN
>> * Update IOMMU ioval2 when faulting in spa_fetch()
>> * Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
>> * Set IOMMU ftype and iova in riscv_iommu_ctx()
>> * Check PCIe DOE mailbox length for overflows
>> * Add extensions after v7.1-rc4 update
>> * Remove job building OpenSBI firmware binaries
>> * Correct ACPI field sequence in SPCR table
>
> Is it the same as usual for riscv pull requests, -- everything with
> Fixes: or Resolves: tag should be picked up for the current qemu stable
> releases?
>
> (Cc'ing Daniel too since he has largest share of contributions here).
Yes sir. All "Fixes" and "Resolves" from this batch fixes bugs that
are also applicable for qemu-stable.
Cheers,
Daniel
>
> Thanks,
>
> /mjt
>
>> ----------------------------------------------------------------
>> Alistair Francis (1):
>> hw/pci/pcie_doe: Check mailbox length for overflows
>>
>> Bin Meng (1):
>> gitlab-ci: Remove job building OpenSBI firmware binaries
>>
>> Daniel Henrique Barboza (32):
>> hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
>> hw/riscv/riscv-iommu.c: check for reserved PTE bits
>> hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
>> hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
>> hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
>> hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
>> target/riscv: move valid_vm_* satp arrays to cpu.c
>> hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
>> target/riscv: move TCG only files to tcg subdir
>> target/riscv/machine.c: do not migrate pmp state with kvm
>> target/riscv: move pmp files to tcg subdir
>> target/riscv: tidy up riscv_sysemu_ops
>> target/riscv: move debug.h to tcg subdir
>> target/riscv: remove csr.h from kvm-cpu.c
>> target/riscv: move csr.h to tcg subdir
>> target/riscv: move custom_csrs logic to tcg-cpu.c
>> target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
>> target/riscv: move some irq helpers to cpu.c
>> target/riscv: move riscv_cpu_claim_interrupts to cpu.c
>> target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
>> target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
>> target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
>> hw/riscv/riscv_hart.c isolate tcg only bits
>> target/riscv/gdbstub.c: isolate TCG only checks
>> target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
>> target/riscv/tcg: remove unused riscv_cpu_get_geilen()
>> target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
>> target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
>> hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
>> hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
>> hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
>> hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
>>
>> Heinrich Schuchardt (3):
>> tests: allow differences in SPCR
>> hw/acpi: correct field sequence in SPCR table
>> tests: update SPCR loongarch64 and riscv64 test data
>>
>> Wang Yechao (1):
>> target/riscv/kvm: add extensions after v7.1-rc4 update
>>
>> Zephyr Li (2):
>> target/riscv: Remove unused tcg/tcg.h include
>> gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
>
^ permalink raw reply [flat|nested] 50+ messages in thread