* [PATCH v2 11/24] target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
This function is related to Smrnmi and non-masked interrupts, firing up
interrupts via env->rnmip from riscv_cpu_local_irq_pending().
This is all TCG only code.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
target/riscv/cpu.c | 8 --------
target/riscv/tcg/tcg-cpu.c | 7 +++++++
2 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 5e951ea19c..cba7d2502e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1160,11 +1160,6 @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
g_assert_not_reached();
}
}
-
-static void riscv_cpu_set_nmi(void *opaque, int irq, int level)
-{
- riscv_cpu_set_rnmi(RISCV_CPU(opaque), irq, level);
-}
#endif /* CONFIG_USER_ONLY */
static bool riscv_cpu_is_dynamic(Object *cpu_obj)
@@ -1183,9 +1178,6 @@ static void riscv_cpu_init(Object *obj)
#ifndef CONFIG_USER_ONLY
qdev_init_gpio_in(DEVICE(obj), riscv_cpu_set_irq,
IRQ_LOCAL_MAX + IRQ_LOCAL_GUEST_MAX);
- qdev_init_gpio_in_named(DEVICE(cpu), riscv_cpu_set_nmi,
- "riscv.cpu.rnmi", RNMI_MAX);
-
if (mcc->def->num_triggers) {
env->num_triggers = mcc->def->num_triggers;
}
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index fef66557c2..4af5cd9c73 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1662,6 +1662,11 @@ static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
}
}
}
+
+static inline void riscv_cpu_set_nmi(void *opaque, int irq, int level)
+{
+ riscv_cpu_set_rnmi(RISCV_CPU(opaque), irq, level);
+}
#endif
static void riscv_tcg_cpu_instance_init(CPUState *cs)
@@ -1674,6 +1679,8 @@ static void riscv_tcg_cpu_instance_init(CPUState *cs)
if (mcc->def->custom_csrs) {
riscv_register_custom_csrs(cpu, mcc->def->custom_csrs);
}
+ qdev_init_gpio_in_named(DEVICE(cpu), riscv_cpu_set_nmi,
+ "riscv.cpu.rnmi", RNMI_MAX);
#endif
misa_ext_user_opts = g_hash_table_new(NULL, g_direct_equal);
--
2.43.0
^ permalink raw reply related
* [PATCH v2 15/24] target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
riscv_dump_csr() is a TCG only function but we'll have to implement it
at some capacity for KVM eventually, therefore put it under a CONFIG_TCG
ifdef while making a note that this function is unimplemented in KVM.
The csr_ops array is also TCG specific, thus the for loop inside
dump_state that iterates it is also TCG only business.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
target/riscv/cpu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 4fc0ee2823..7bd5bc0fc1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -605,8 +605,10 @@ char *riscv_cpu_get_name(RISCVCPU *cpu)
return cpu_model_from_type(typename);
}
+/* Note: this function needs a KVM implementation. */
static void riscv_dump_csr(CPURISCVState *env, int csrno, FILE *f)
{
+#ifdef CONFIG_TCG
target_ulong val = 0;
RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
@@ -618,6 +620,7 @@ static void riscv_dump_csr(CPURISCVState *env, int csrno, FILE *f)
qemu_fprintf(f, " %-13s " TARGET_FMT_lx "\n",
csr_ops[csrno].name, val);
}
+#endif
}
#if !defined(CONFIG_USER_ONLY)
@@ -655,7 +658,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
}
#endif
qemu_fprintf(f, " %-13s %" PRIx64 "\n", "pc", env->pc);
-#ifndef CONFIG_USER_ONLY
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
for (i = 0; i < ARRAY_SIZE(csr_ops); i++) {
int csrno = i;
--
2.43.0
^ permalink raw reply related
* [PATCH v2 06/24] target/riscv: move pmu.h to tcg subdir
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
riscv_pmu_generate_fdt_node() can be moved to fdt_common.c since it has
no PMU TCG internals.
With this change we can remove pmu.h from 'virt.c', which is now
becoming a tcg header since we're moving it to the tcg subdir.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
hw/riscv/fdt-common.c | 52 +++++++++++++++++++++++++++++++++++
hw/riscv/virt.c | 1 -
include/hw/riscv/fdt-common.h | 1 +
target/riscv/tcg/pmu.c | 52 -----------------------------------
target/riscv/{ => tcg}/pmu.h | 1 -
5 files changed, 53 insertions(+), 54 deletions(-)
rename target/riscv/{ => tcg}/pmu.h (95%)
diff --git a/hw/riscv/fdt-common.c b/hw/riscv/fdt-common.c
index e0e31af09b..aa143a618b 100644
--- a/hw/riscv/fdt-common.c
+++ b/hw/riscv/fdt-common.c
@@ -230,3 +230,55 @@ void create_fdt_plic(void *fdt, hwaddr addr, uint64_t size,
}
qemu_fdt_setprop_cell(fdt, nodename, "phandle", plic_phandle);
}
+
+/*
+ * To keep it simple, any event can be mapped to any programmable counters in
+ * QEMU. The generic cycle & instruction count events can also be monitored
+ * using programmable counters. In that case, mcycle & minstret must continue
+ * to provide the correct value as well. Heterogeneous PMU per hart is not
+ * supported yet. Thus, number of counters are same across all harts.
+ */
+void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name)
+{
+ uint32_t fdt_event_ctr_map[15] = {};
+
+ /*
+ * The event encoding is specified in the SBI specification
+ * Event idx is a 20bits wide number encoded as follows:
+ * event_idx[19:16] = type
+ * event_idx[15:0] = code
+ * The code field in cache events are encoded as follows:
+ * event_idx.code[15:3] = cache_id
+ * event_idx.code[2:1] = op_id
+ * event_idx.code[0:0] = result_id
+ */
+
+ /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
+ fdt_event_ctr_map[0] = cpu_to_be32(0x00000001);
+ fdt_event_ctr_map[1] = cpu_to_be32(0x00000001);
+ fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
+
+ /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
+ fdt_event_ctr_map[3] = cpu_to_be32(0x00000002);
+ fdt_event_ctr_map[4] = cpu_to_be32(0x00000002);
+ fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
+
+ /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
+ fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
+ fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
+ fdt_event_ctr_map[8] = cpu_to_be32(cmask);
+
+ /* SBI_PMU_HW_CACHE_DTLB : 0x03 WRITE : 0x01 MISS : 0x00 type(0x01) */
+ fdt_event_ctr_map[9] = cpu_to_be32(0x0001001B);
+ fdt_event_ctr_map[10] = cpu_to_be32(0x0001001B);
+ fdt_event_ctr_map[11] = cpu_to_be32(cmask);
+
+ /* SBI_PMU_HW_CACHE_ITLB : 0x04 READ : 0x00 MISS : 0x00 type(0x01) */
+ fdt_event_ctr_map[12] = cpu_to_be32(0x00010021);
+ fdt_event_ctr_map[13] = cpu_to_be32(0x00010021);
+ fdt_event_ctr_map[14] = cpu_to_be32(cmask);
+
+ /* This a OpenSBI specific DT property documented in OpenSBI docs */
+ qemu_fdt_setprop(fdt, pmu_name, "riscv,event-to-mhpmcounters",
+ fdt_event_ctr_map, sizeof(fdt_event_ctr_map));
+}
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 92c30a6f4c..a1cf8210be 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -30,7 +30,6 @@
#include "hw/char/serial-mm.h"
#include "target/riscv/cpu.h"
#include "hw/core/sysbus-fdt.h"
-#include "target/riscv/pmu.h"
#include "hw/riscv/riscv_hart.h"
#include "hw/riscv/iommu.h"
#include "hw/riscv/riscv-iommu-bits.h"
diff --git a/include/hw/riscv/fdt-common.h b/include/hw/riscv/fdt-common.h
index 017278b611..1729a6abc6 100644
--- a/include/hw/riscv/fdt-common.h
+++ b/include/hw/riscv/fdt-common.h
@@ -35,4 +35,5 @@ void create_fdt_plic(void *fdt, hwaddr addr, uint64_t size,
uint32_t addr_cells, uint32_t *plic_cells,
uint32_t cells_size, uint32_t ndev_sources,
bool numa_enabled, int socket);
+void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name);
#endif
diff --git a/target/riscv/tcg/pmu.c b/target/riscv/tcg/pmu.c
index 3444400bd2..38ad2737e1 100644
--- a/target/riscv/tcg/pmu.c
+++ b/target/riscv/tcg/pmu.c
@@ -27,58 +27,6 @@
#define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
-/*
- * To keep it simple, any event can be mapped to any programmable counters in
- * QEMU. The generic cycle & instruction count events can also be monitored
- * using programmable counters. In that case, mcycle & minstret must continue
- * to provide the correct value as well. Heterogeneous PMU per hart is not
- * supported yet. Thus, number of counters are same across all harts.
- */
-void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name)
-{
- uint32_t fdt_event_ctr_map[15] = {};
-
- /*
- * The event encoding is specified in the SBI specification
- * Event idx is a 20bits wide number encoded as follows:
- * event_idx[19:16] = type
- * event_idx[15:0] = code
- * The code field in cache events are encoded as follows:
- * event_idx.code[15:3] = cache_id
- * event_idx.code[2:1] = op_id
- * event_idx.code[0:0] = result_id
- */
-
- /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
- fdt_event_ctr_map[0] = cpu_to_be32(0x00000001);
- fdt_event_ctr_map[1] = cpu_to_be32(0x00000001);
- fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
-
- /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
- fdt_event_ctr_map[3] = cpu_to_be32(0x00000002);
- fdt_event_ctr_map[4] = cpu_to_be32(0x00000002);
- fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
-
- /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
- fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
- fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
- fdt_event_ctr_map[8] = cpu_to_be32(cmask);
-
- /* SBI_PMU_HW_CACHE_DTLB : 0x03 WRITE : 0x01 MISS : 0x00 type(0x01) */
- fdt_event_ctr_map[9] = cpu_to_be32(0x0001001B);
- fdt_event_ctr_map[10] = cpu_to_be32(0x0001001B);
- fdt_event_ctr_map[11] = cpu_to_be32(cmask);
-
- /* SBI_PMU_HW_CACHE_ITLB : 0x04 READ : 0x00 MISS : 0x00 type(0x01) */
- fdt_event_ctr_map[12] = cpu_to_be32(0x00010021);
- fdt_event_ctr_map[13] = cpu_to_be32(0x00010021);
- fdt_event_ctr_map[14] = cpu_to_be32(cmask);
-
- /* This a OpenSBI specific DT property documented in OpenSBI docs */
- qemu_fdt_setprop(fdt, pmu_name, "riscv,event-to-mhpmcounters",
- fdt_event_ctr_map, sizeof(fdt_event_ctr_map));
-}
-
static bool riscv_pmu_counter_valid(RISCVCPU *cpu, uint32_t ctr_idx)
{
if (ctr_idx < 3 || ctr_idx >= RV_MAX_MHPMCOUNTERS ||
diff --git a/target/riscv/pmu.h b/target/riscv/tcg/pmu.h
similarity index 95%
rename from target/riscv/pmu.h
rename to target/riscv/tcg/pmu.h
index b4f1e469a2..de2fae1fb4 100644
--- a/target/riscv/pmu.h
+++ b/target/riscv/tcg/pmu.h
@@ -31,7 +31,6 @@ void riscv_pmu_init(RISCVCPU *cpu, Error **errp);
int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
uint32_t ctr_idx);
int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
-void riscv_pmu_generate_fdt_node(void *fdt, uint32_t cmask, char *pmu_name);
int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
uint32_t ctr_idx);
void riscv_pmu_update_fixed_ctrs(CPURISCVState *env, privilege_mode_t newpriv,
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] KVM: arm64: nv: Check RW permissions for insn abort due to S1PTW
From: Oliver Upton @ 2026-06-24 0:07 UTC (permalink / raw)
To: sashiko-reviews; +Cc: kvmarm, Marc Zyngier
In-Reply-To: <20260623213225.A89CF1F000E9@smtp.kernel.org>
On Tue, Jun 23, 2026 at 09:32:25PM +0000, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> > index 94df26de6990c..713fc44f362d9 100644
> > --- a/arch/arm64/kvm/nested.c
> > +++ b/arch/arm64/kvm/nested.c
> [ ... ]
> > @@ -918,7 +918,7 @@ int kvm_s2_handle_perm_fault(struct kvm_vcpu *vcpu, struct kvm_s2_trans *trans)
> > if (!kvm_vcpu_trap_is_permission_fault(vcpu))
> > return 0;
> >
> > - if (kvm_vcpu_trap_is_iabt(vcpu)) {
> > + if (kvm_vcpu_trap_is_iabt(vcpu) && !kvm_vcpu_abt_iss1tw(vcpu)) {
> > if (vcpu_mode_priv(vcpu))
> > forward_fault = !kvm_s2_trans_exec_el1(vcpu->kvm, trans);
> > else
>
> [Severity: High]
> This isn't a bug introduced by this patch, but does this change expose
> instruction aborts to an infinite loop if the L1 guest maps nested stage-2
> memory as Write-Only?
>
> By falling through to the else block in kvm_s2_handle_perm_fault(), S1PTW
> instruction aborts are now evaluated for read/write permissions.
>
> However, if the L1 guest mapped the nested stage-2 page table entry as
> Write-Only, the hardware will still fault on the missing read permission
> during the stage-1 translation table walk.
>
> Looking at kvm_is_write_fault() in arch/arm64/include/asm/kvm_emulate.h:
>
> static inline bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
> {
> if (kvm_vcpu_abt_iss1tw(vcpu)) {
> ...
> return kvm_vcpu_trap_is_permission_fault(vcpu);
> }
> ...
> }
>
> It unconditionally treats all permission faults on an S1PTW as write faults,
> assuming they are Access Flag or Dirty Bit updates.
>
> Back in the else block of kvm_s2_handle_perm_fault():
>
> bool write_fault = kvm_is_write_fault(vcpu);
>
> forward_fault = ((write_fault && !trans->writable) ||
> (!write_fault && !trans->readable));
>
> Because write_fault is true, it only evaluates !trans->writable. Since the
> mapping is Write-Only, this check passes and KVM doesn't forward the fault.
> Instead, KVM resumes the guest, which will immediately fault again on the
> read, causing an infinite loop.
Well this isn't exactly malice, just a guest choosing to shoot itself in
the foot. Having said that, it's pretty clear that the assumption around S1PTW
permission faults no longer holds in kvm_is_write_fault().
I think the best we can do is key write faults off of TCR_ELx.HA and
evaluate potentially both permissions for S1PTW. Needs to be split up
into a couple patches:
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 5bf3d7e1d92c..d5c61e0027c8 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -479,21 +479,12 @@ static __always_inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu)
static inline bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
{
- if (kvm_vcpu_abt_iss1tw(vcpu)) {
- /*
- * Only a permission fault on a S1PTW should be
- * considered as a write. Otherwise, page tables baked
- * in a read-only memslot will result in an exception
- * being delivered in the guest.
- *
- * The drawback is that we end-up faulting twice if the
- * guest is using any of HW AF/DB: a translation fault
- * to map the page containing the PT (read only at
- * first), then a permission fault to allow the flags
- * to be set.
- */
- return kvm_vcpu_trap_is_permission_fault(vcpu);
- }
+ /*
+ * The architecture sucks; assume that the S1PTW fetched for write if
+ * HA is enabled at stage-1.
+ */
+ if (kvm_vcpu_abt_iss1tw(vcpu))
+ return effective_tcr_ha(vcpu);
if (kvm_vcpu_trap_is_iabt(vcpu))
return false;
diff --git a/arch/arm64/include/asm/kvm_nested.h b/arch/arm64/include/asm/kvm_nested.h
index cbdaaa2a2903..26f1d72b1b07 100644
--- a/arch/arm64/include/asm/kvm_nested.h
+++ b/arch/arm64/include/asm/kvm_nested.h
@@ -417,4 +417,36 @@ u16 get_asid_by_regime(struct kvm_vcpu *vcpu, enum trans_regime regime);
int __kvm_at_swap_desc(struct kvm *kvm, gpa_t ipa, u64 old, u64 new);
+static inline bool __effective_tcr_ha(struct kvm_vcpu *vcpu, enum trans_regime regime)
+{
+ u64 tcr;
+
+ if (!kvm_has_feat(vcpu->kvm, ID_AA64MMFR1_EL1, HAFDBS, AF))
+ return false;
+
+ switch (regime) {
+ case TR_EL10:
+ return vcpu_read_sys_reg(vcpu, TCR_EL1) & TCR_HA;
+ case TR_EL20:
+ return vcpu_read_sys_reg(vcpu, TCR_EL2) & TCR_HA;
+ case TR_EL2:
+ return vcpu_read_sys_reg(vcpu, TCR_EL2) & TCR_EL2_HA;
+ default:
+ BUG();
+ }
+}
+
+static inline enum trans_regime vcpu_trans_regime(struct kvm_vcpu *vcpu)
+{
+ if (!is_hyp_ctxt(vcpu))
+ return TR_EL10;
+
+ return vcpu_el2_e2h_is_set(vcpu) ? TR_EL20 : TR_EL2;
+}
+
+static inline bool effective_tcr_ha(struct kvm_vcpu *vcpu)
+{
+ return __effective_tcr_ha(vcpu, vcpu_trans_regime(vcpu));
+}
+
#endif /* __ARM64_KVM_NESTED_H */
diff --git a/arch/arm64/kvm/at.c b/arch/arm64/kvm/at.c
index 8263c648207b..9d6d71ddc326 100644
--- a/arch/arm64/kvm/at.c
+++ b/arch/arm64/kvm/at.c
@@ -407,12 +407,7 @@ static int setup_s1_walk(struct kvm_vcpu *vcpu, struct s1_walk_info *wi,
goto addrsz;
wi->baddr &= GENMASK_ULL(wi->max_oa_bits - 1, x);
-
- wi->ha = kvm_has_feat(vcpu->kvm, ID_AA64MMFR1_EL1, HAFDBS, AF);
- wi->ha &= (wi->regime == TR_EL2 ?
- FIELD_GET(TCR_EL2_HA, tcr) :
- FIELD_GET(TCR_HA, tcr));
-
+ wi->ha = __effective_tcr_ha(vcpu, wi->regime);
return 0;
addrsz:
@@ -1723,10 +1718,7 @@ int __kvm_find_s1_desc_level(struct kvm_vcpu *vcpu, u64 va, u64 ipa, int *level)
struct s1_walk_result wr = {};
int ret;
- if (is_hyp_ctxt(vcpu))
- wi.regime = vcpu_el2_e2h_is_set(vcpu) ? TR_EL20 : TR_EL2;
- else
- wi.regime = TR_EL10;
+ wi.regime = vcpu_trans_regime(vcpu);
ret = setup_s1_walk(vcpu, &wi, &wr, va);
if (ret)
diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
index 94df26de6990..4c9123cb2e1c 100644
--- a/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -911,6 +911,7 @@ void kvm_vcpu_put_hw_mmu(struct kvm_vcpu *vcpu)
*/
int kvm_s2_handle_perm_fault(struct kvm_vcpu *vcpu, struct kvm_s2_trans *trans)
{
+ bool write_fault = kvm_is_write_fault(vcpu);
bool forward_fault = false;
trans->esr = 0;
@@ -918,14 +919,27 @@ int kvm_s2_handle_perm_fault(struct kvm_vcpu *vcpu, struct kvm_s2_trans *trans)
if (!kvm_vcpu_trap_is_permission_fault(vcpu))
return 0;
- if (kvm_vcpu_trap_is_iabt(vcpu)) {
+ /*
+ * S1PTW permission faults do not provide sufficient syndrome information
+ * to determine if the fault was for read or write permissions. Perform a
+ * read permission check and an optional write permission check, relying
+ * on the fact that:
+ *
+ * - The table walker at minimum requires read permission
+ *
+ * - The L1 hypervisor also needs to deal with the architecture and
+ * cannot directly infer the failing permission from the fault context
+ */
+ if (kvm_vcpu_abt_iss1tw(vcpu)) {
+ forward_fault = !trans->readable;
+ if (write_fault)
+ forward_fault |= !trans->writable;
+ } else if (kvm_vcpu_trap_is_iabt(vcpu)) {
if (vcpu_mode_priv(vcpu))
forward_fault = !kvm_s2_trans_exec_el1(vcpu->kvm, trans);
else
forward_fault = !kvm_s2_trans_exec_el0(vcpu->kvm, trans);
} else {
- bool write_fault = kvm_is_write_fault(vcpu);
-
forward_fault = ((write_fault && !trans->writable) ||
(!write_fault && !trans->readable));
}
^ permalink raw reply related
* [PATCH v2 09/24] target/riscv: move csr.h to tcg subdir
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
After KVM is no longer reliant on csr.h move it to the TGC only land.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
target/riscv/cpu.c | 2 +-
target/riscv/gdbstub.c | 2 +-
target/riscv/monitor.c | 2 +-
target/riscv/riscv-qmp-cmds.c | 2 +-
target/riscv/tcg/csr.c | 2 +-
target/riscv/{ => tcg}/csr.h | 0
target/riscv/tcg/mips_csr.c | 2 +-
target/riscv/tcg/op_helper.c | 2 +-
target/riscv/tcg/pmp.c | 2 +-
target/riscv/tcg/th_csr.c | 2 +-
10 files changed, 9 insertions(+), 9 deletions(-)
rename target/riscv/{ => tcg}/csr.h (100%)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 5d44f993e4..96c92de2ee 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -24,7 +24,7 @@
#include "qemu/guest-random.h"
#include "cpu.h"
#include "cpu_vendorid.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "internals.h"
#include "qapi/error.h"
#include "qapi/visitor.h"
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index a2bbaf7f07..f0a5e0d86f 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -21,7 +21,7 @@
#include "gdbstub/helpers.h"
#include "cpu.h"
#include "internals.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
struct TypeSize {
const char *gdb_type;
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 7aacd1d89c..f8042db9cd 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -22,7 +22,7 @@
#include "qemu/ctype.h"
#include "qemu/qemu-print.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "cpu_bits.h"
#include "monitor/monitor.h"
#include "monitor/hmp.h"
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index b94e8391ed..2647deef91 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -35,7 +35,7 @@
#include "system/tcg.h"
#include "cpu-qom.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
static void riscv_cpu_add_definition(gpointer data, gpointer user_data)
{
diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index d447204721..572a39d660 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -21,7 +21,7 @@
#include "qemu/log.h"
#include "qemu/timer.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "tcg/tcg-cpu.h"
#include "pmu.h"
#include "time_helper.h"
diff --git a/target/riscv/csr.h b/target/riscv/tcg/csr.h
similarity index 100%
rename from target/riscv/csr.h
rename to target/riscv/tcg/csr.h
diff --git a/target/riscv/tcg/mips_csr.c b/target/riscv/tcg/mips_csr.c
index 609718f288..884030e91d 100644
--- a/target/riscv/tcg/mips_csr.c
+++ b/target/riscv/tcg/mips_csr.c
@@ -10,7 +10,7 @@
#include "qemu/osdep.h"
#include "cpu.h"
#include "cpu_vendorid.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
/* Static MIPS CSR state storage */
static struct {
diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c
index 775fd431d6..003f6ebb31 100644
--- a/target/riscv/tcg/op_helper.c
+++ b/target/riscv/tcg/op_helper.c
@@ -20,7 +20,7 @@
#include "qemu/osdep.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "internals.h"
#include "exec/cputlb.h"
#include "accel/tcg/cpu-ldst.h"
diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c
index d93563c36b..41b55519a8 100644
--- a/target/riscv/tcg/pmp.c
+++ b/target/riscv/tcg/pmp.c
@@ -23,7 +23,7 @@
#include "qemu/log.h"
#include "qapi/error.h"
#include "cpu.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
#include "trace.h"
#include "exec/cputlb.h"
#include "exec/page-protection.h"
diff --git a/target/riscv/tcg/th_csr.c b/target/riscv/tcg/th_csr.c
index 431f4cc286..e6f642991c 100644
--- a/target/riscv/tcg/th_csr.c
+++ b/target/riscv/tcg/th_csr.c
@@ -22,7 +22,7 @@
#include "qemu/osdep.h"
#include "cpu.h"
#include "cpu_vendorid.h"
-#include "target/riscv/csr.h"
+#include "target/riscv/tcg/csr.h"
/* Extended M-mode control registers of T-Head */
#define CSR_TH_MXSTATUS 0x7c0
--
2.43.0
^ permalink raw reply related
* [PATCH v2 05/24] target/riscv: tidy up riscv_sysemu_ops
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
monitor_get_register at this moment has a TCG exclusive implementation
for RISC-V, even though the callback is supposed to be arch independent.
Until we address how KVM is going to implement it we need to filter it out
in cpu.c.v
Same goes for get_phys_addr_debug - it has a TCG only implementation and
KVM can't use it for now. It would also need to be filtered out, but
since we're at it, let's convert it to the newer 'translate_for_debug'
API too. Same restrictions apply.
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
target/riscv/cpu.c | 6 ++++--
target/riscv/cpu.h | 3 ++-
target/riscv/monitor.c | 2 ++
target/riscv/tcg/cpu_helper.c | 14 ++++++++++----
4 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 4e96bbeb60..319825882a 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -2669,11 +2669,13 @@ static int64_t riscv_get_arch_id(CPUState *cs)
static const struct SysemuCPUOps riscv_sysemu_ops = {
.has_work = riscv_cpu_has_work,
- .get_phys_addr_debug = riscv_cpu_get_phys_addr_debug,
.write_elf64_note = riscv_cpu_write_elf64_note,
.write_elf32_note = riscv_cpu_write_elf32_note,
- .monitor_get_register = riscv_monitor_get_register_legacy,
.legacy_vmsd = &vmstate_riscv_cpu,
+#ifdef CONFIG_TCG
+ .translate_for_debug = riscv_cpu_translate_for_debug,
+ .monitor_get_register = riscv_monitor_get_register_legacy,
+#endif
};
#endif
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f0c78c1474..70b8729bd7 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -665,7 +665,8 @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
MMUAccessType access_type,
int mmu_idx, MemTxAttrs attrs,
MemTxResult response, uintptr_t retaddr);
-hwaddr riscv_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
+bool riscv_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+ TranslateForDebugResult *result);
bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 3e89dcaf7c..7aacd1d89c 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -245,6 +245,7 @@ void hmp_info_mem(Monitor *mon, const QDict *qdict)
mem_info_svxx(mon, env);
}
+#ifdef CONFIG_TCG
static bool reg_is_ulong_integer(CPURISCVState *env, const char *name,
target_ulong *val, bool is_gprh)
{
@@ -379,3 +380,4 @@ int riscv_monitor_get_register_legacy(CPUState *cs, const char *name,
return -EINVAL;
}
+#endif
diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 59edcdd370..a893472c4e 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -1771,7 +1771,8 @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
env->two_stage_indirect_lookup = two_stage_indirect;
}
-hwaddr riscv_cpu_get_phys_addr_debug(CPUState *cs, vaddr addr)
+bool riscv_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+ TranslateForDebugResult *result)
{
RISCVCPU *cpu = RISCV_CPU(cs);
CPURISCVState *env = &cpu->env;
@@ -1781,17 +1782,22 @@ hwaddr riscv_cpu_get_phys_addr_debug(CPUState *cs, vaddr addr)
if (get_physical_address(env, &phys_addr, &prot, addr, NULL, 0, mmu_idx,
true, env->virt_enabled, true, false)) {
- return -1;
+ return false;
}
if (env->virt_enabled) {
if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
0, MMUIdx_U, false, true, true, false)) {
- return -1;
+ return false;
}
}
- return phys_addr;
+ *result = (TranslateForDebugResult) {
+ .physaddr = phys_addr,
+ .lg_page_size = TARGET_PAGE_BITS,
+ .attrs.debug = 1,
+ };
+ return true;
}
void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
--
2.43.0
^ permalink raw reply related
* [PATCH v2 01/24] target/riscv: Remove unused tcg/tcg.h include
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
From: Zephyr Li <fritchleybohrer@gmail.com>
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
target/riscv/cpu.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index bff3ed5de1..4e96bbeb60 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -38,7 +38,6 @@
#include "system/tcg.h"
#include "kvm/kvm_riscv.h"
#include "tcg/tcg-cpu.h"
-#include "tcg/tcg.h"
#if !defined(CONFIG_USER_ONLY)
#include "target/riscv/debug.h"
#endif
--
2.43.0
^ permalink raw reply related
* [PATCH v2 00/24] target/riscv: move TCG files and fix --disable-tcg
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza
Hello,
In this version we addressed the reviews from Phil and Richard from v1.
No other changes were made.
Patches are based on alistair riscv-to-apply.next tree.
It can also be fetched from this branch:
https://gitlab.com/danielhb/qemu/-/tree/riscv_disabletcg_v2
Changes from v1:
- patch 3:
- changed pmp_needed return to "tcg_enabled() && cpu->cfg.pmp"
- patch 5:
- reworded commit msg; implemented translate_for_debug
- patch 10:
- added ifdefs around custom_csrs in cpu.h
- patch 11:
- inlined riscv_cpu_set_rnmi()
- patch 16:
- renamed riscv_set_irq() to riscv_accel_set_irq()
- patch 18:
- gated csr_register_qtest_callback() with qtest_enabled()
- v1 link: https://lore.kernel.org/qemu-devel/20260622193141.1449724-1-daniel.barboza@oss.qualcomm.com/
Daniel Henrique Barboza (22):
target/riscv: move TCG only files to tcg subdir
target/riscv/machine.c: do not migrate pmp state with kvm
target/riscv: move pmp files to tcg subdir
target/riscv: tidy up riscv_sysemu_ops
target/riscv: move pmu.h to tcg subdir
target/riscv: move debug.h to tcg subdir
target/riscv: remove csr.h from kvm-cpu.c
target/riscv: move csr.h to tcg subdir
target/riscv: move custom_csrs logic to tcg-cpu.c
target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
target/riscv: move valid_vm_* satp arrays to cpu.c
target/riscv: move some irq helpers to cpu.c
target/riscv: move riscv_cpu_claim_interrupts to cpu.c
target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
hw/riscv/riscv_hart.c isolate tcg only bits
target/riscv/gdbstub.c: isolate TCG only checks
target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
target/riscv/tcg: remove unused riscv_cpu_get_geilen()
target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
Zephyr Li (2):
target/riscv: Remove unused tcg/tcg.h include
gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
.gitlab-ci.d/crossbuilds.yml | 8 +
hw/intc/riscv_aclint.c | 8 +
hw/intc/riscv_imsic.c | 24 ++
hw/riscv/fdt-common.c | 52 +++
hw/riscv/riscv_hart.c | 8 +-
hw/riscv/virt.c | 1 -
include/hw/riscv/fdt-common.h | 1 +
target/riscv/cpu.c | 318 +++++++++++++++---
target/riscv/cpu.h | 24 +-
target/riscv/gdbstub.c | 10 +-
target/riscv/kvm/kvm-cpu.c | 1 -
target/riscv/machine.c | 17 +-
target/riscv/meson.build | 17 -
target/riscv/monitor.c | 4 +-
target/riscv/riscv-qmp-cmds.c | 2 +-
target/riscv/{ => tcg}/bitmanip_helper.c | 0
target/riscv/{ => tcg}/cpu_helper.c | 253 +-------------
target/riscv/{ => tcg}/crypto_helper.c | 0
target/riscv/{ => tcg}/csr.c | 45 +--
target/riscv/{ => tcg}/csr.h | 6 +-
target/riscv/{ => tcg}/debug.c | 2 +-
target/riscv/{ => tcg}/debug.h | 0
target/riscv/{ => tcg}/fpu_helper.c | 0
.../insn_trans/trans_privileged.c.inc | 0
.../{ => tcg}/insn_trans/trans_rva.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvb.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvbf16.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvd.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvf.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvh.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvi.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvk.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvm.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvv.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvvk.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzabha.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzacas.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzalasr.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzawrs.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzce.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzcmop.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzfa.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzfh.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzicbo.c.inc | 0
.../insn_trans/trans_rvzicfiss.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzicond.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzimop.c.inc | 0
.../{ => tcg}/insn_trans/trans_svinval.c.inc | 0
.../{ => tcg}/insn_trans/trans_xlrbr.c.inc | 0
.../{ => tcg}/insn_trans/trans_xmips.c.inc | 0
.../{ => tcg}/insn_trans/trans_xthead.c.inc | 0
.../insn_trans/trans_xventanacondops.c.inc | 0
.../{ => tcg}/insn_trans/trans_zilsd.c.inc | 0
target/riscv/{ => tcg}/m128_helper.c | 0
target/riscv/tcg/meson.build | 31 +-
target/riscv/{ => tcg}/mips_csr.c | 2 +-
target/riscv/{ => tcg}/op_helper.c | 2 +-
target/riscv/{ => tcg}/pmp.c | 2 +-
target/riscv/{ => tcg}/pmp.h | 0
target/riscv/{ => tcg}/pmu.c | 52 ---
target/riscv/{ => tcg}/pmu.h | 1 -
target/riscv/tcg/tcg-cpu.c | 30 +-
target/riscv/{ => tcg}/th_csr.c | 2 +-
target/riscv/{ => tcg}/translate.c | 0
target/riscv/{ => tcg}/vcrypto_helper.c | 0
target/riscv/{ => tcg}/vector_helper.c | 0
target/riscv/{ => tcg}/vector_internals.c | 0
target/riscv/{ => tcg}/vector_internals.h | 0
target/riscv/{ => tcg}/zce_helper.c | 0
target/riscv/time_helper.c | 33 +-
70 files changed, 515 insertions(+), 441 deletions(-)
rename target/riscv/{ => tcg}/bitmanip_helper.c (100%)
rename target/riscv/{ => tcg}/cpu_helper.c (91%)
rename target/riscv/{ => tcg}/crypto_helper.c (100%)
rename target/riscv/{ => tcg}/csr.c (99%)
rename target/riscv/{ => tcg}/csr.h (96%)
rename target/riscv/{ => tcg}/debug.c (99%)
rename target/riscv/{ => tcg}/debug.h (100%)
rename target/riscv/{ => tcg}/fpu_helper.c (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_privileged.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rva.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvb.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvbf16.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvd.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvf.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvh.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvi.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvk.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvm.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvv.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvvk.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzabha.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzacas.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzalasr.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzawrs.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzce.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzcmop.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzfa.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzfh.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicbo.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicfiss.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicond.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzimop.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_svinval.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xlrbr.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xmips.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xthead.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xventanacondops.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_zilsd.c.inc (100%)
rename target/riscv/{ => tcg}/m128_helper.c (100%)
rename target/riscv/{ => tcg}/mips_csr.c (99%)
rename target/riscv/{ => tcg}/op_helper.c (99%)
rename target/riscv/{ => tcg}/pmp.c (99%)
rename target/riscv/{ => tcg}/pmp.h (100%)
rename target/riscv/{ => tcg}/pmu.c (86%)
rename target/riscv/{ => tcg}/pmu.h (95%)
rename target/riscv/{ => tcg}/th_csr.c (99%)
rename target/riscv/{ => tcg}/translate.c (100%)
rename target/riscv/{ => tcg}/vcrypto_helper.c (100%)
rename target/riscv/{ => tcg}/vector_helper.c (100%)
rename target/riscv/{ => tcg}/vector_internals.c (100%)
rename target/riscv/{ => tcg}/vector_internals.h (100%)
rename target/riscv/{ => tcg}/zce_helper.c (100%)
--
2.43.0
^ permalink raw reply
* [PATCH v2 02/24] target/riscv: move TCG only files to tcg subdir
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
We have *way* too much TCG-only code hanging around in target/riscv,
where ideally we would have things that are shared between accelerators.
We'll follow the example of other targets like i386 and loongarch and
move everything to the tcg subir. This will not only cleanup target/riscv
but it will also expose what is common code but it's buried inside a TCG
helper.
We're leaving some stuff behind because these require a little more
case to not end up breaking KVM. We'll take care of them next.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
target/riscv/meson.build | 16 ----------
target/riscv/{ => tcg}/bitmanip_helper.c | 0
target/riscv/{ => tcg}/cpu_helper.c | 0
target/riscv/{ => tcg}/crypto_helper.c | 0
target/riscv/{ => tcg}/csr.c | 0
target/riscv/{ => tcg}/debug.c | 0
target/riscv/{ => tcg}/fpu_helper.c | 0
.../insn_trans/trans_privileged.c.inc | 0
.../{ => tcg}/insn_trans/trans_rva.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvb.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvbf16.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvd.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvf.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvh.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvi.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvk.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvm.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvv.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvvk.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzabha.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzacas.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzalasr.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzawrs.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzce.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzcmop.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzfa.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzfh.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzicbo.c.inc | 0
.../insn_trans/trans_rvzicfiss.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzicond.c.inc | 0
.../{ => tcg}/insn_trans/trans_rvzimop.c.inc | 0
.../{ => tcg}/insn_trans/trans_svinval.c.inc | 0
.../{ => tcg}/insn_trans/trans_xlrbr.c.inc | 0
.../{ => tcg}/insn_trans/trans_xmips.c.inc | 0
.../{ => tcg}/insn_trans/trans_xthead.c.inc | 0
.../insn_trans/trans_xventanacondops.c.inc | 0
.../{ => tcg}/insn_trans/trans_zilsd.c.inc | 0
target/riscv/{ => tcg}/m128_helper.c | 0
target/riscv/tcg/meson.build | 30 +++++++++++++++++--
target/riscv/{ => tcg}/mips_csr.c | 0
target/riscv/{ => tcg}/op_helper.c | 0
target/riscv/{ => tcg}/pmu.c | 0
target/riscv/{ => tcg}/th_csr.c | 0
target/riscv/{ => tcg}/translate.c | 0
target/riscv/{ => tcg}/vcrypto_helper.c | 0
target/riscv/{ => tcg}/vector_helper.c | 0
target/riscv/{ => tcg}/vector_internals.c | 0
target/riscv/{ => tcg}/vector_internals.h | 0
target/riscv/{ => tcg}/zce_helper.c | 0
49 files changed, 28 insertions(+), 18 deletions(-)
rename target/riscv/{ => tcg}/bitmanip_helper.c (100%)
rename target/riscv/{ => tcg}/cpu_helper.c (100%)
rename target/riscv/{ => tcg}/crypto_helper.c (100%)
rename target/riscv/{ => tcg}/csr.c (100%)
rename target/riscv/{ => tcg}/debug.c (100%)
rename target/riscv/{ => tcg}/fpu_helper.c (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_privileged.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rva.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvb.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvbf16.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvd.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvf.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvh.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvi.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvk.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvm.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvv.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvvk.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzabha.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzacas.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzalasr.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzawrs.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzce.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzcmop.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzfa.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzfh.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicbo.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicfiss.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzicond.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_rvzimop.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_svinval.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xlrbr.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xmips.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xthead.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_xventanacondops.c.inc (100%)
rename target/riscv/{ => tcg}/insn_trans/trans_zilsd.c.inc (100%)
rename target/riscv/{ => tcg}/m128_helper.c (100%)
rename target/riscv/{ => tcg}/mips_csr.c (100%)
rename target/riscv/{ => tcg}/op_helper.c (100%)
rename target/riscv/{ => tcg}/pmu.c (100%)
rename target/riscv/{ => tcg}/th_csr.c (100%)
rename target/riscv/{ => tcg}/translate.c (100%)
rename target/riscv/{ => tcg}/vcrypto_helper.c (100%)
rename target/riscv/{ => tcg}/vector_helper.c (100%)
rename target/riscv/{ => tcg}/vector_internals.c (100%)
rename target/riscv/{ => tcg}/vector_internals.h (100%)
rename target/riscv/{ => tcg}/zce_helper.c (100%)
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 79f36abd63..61874ed0af 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -16,31 +16,15 @@ riscv_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
riscv_ss.add(files(
'cpu.c',
- 'cpu_helper.c',
- 'csr.c',
- 'fpu_helper.c',
'gdbstub.c',
- 'op_helper.c',
- 'vector_helper.c',
- 'vector_internals.c',
- 'bitmanip_helper.c',
- 'translate.c',
- 'm128_helper.c',
- 'crypto_helper.c',
- 'zce_helper.c',
- 'vcrypto_helper.c'
))
riscv_system_ss = ss.source_set()
riscv_system_ss.add(files(
'arch_dump.c',
'pmp.c',
- 'debug.c',
'monitor.c',
'machine.c',
- 'mips_csr.c',
- 'pmu.c',
- 'th_csr.c',
'time_helper.c',
'riscv-qmp-cmds.c',
))
diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/tcg/bitmanip_helper.c
similarity index 100%
rename from target/riscv/bitmanip_helper.c
rename to target/riscv/tcg/bitmanip_helper.c
diff --git a/target/riscv/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
similarity index 100%
rename from target/riscv/cpu_helper.c
rename to target/riscv/tcg/cpu_helper.c
diff --git a/target/riscv/crypto_helper.c b/target/riscv/tcg/crypto_helper.c
similarity index 100%
rename from target/riscv/crypto_helper.c
rename to target/riscv/tcg/crypto_helper.c
diff --git a/target/riscv/csr.c b/target/riscv/tcg/csr.c
similarity index 100%
rename from target/riscv/csr.c
rename to target/riscv/tcg/csr.c
diff --git a/target/riscv/debug.c b/target/riscv/tcg/debug.c
similarity index 100%
rename from target/riscv/debug.c
rename to target/riscv/tcg/debug.c
diff --git a/target/riscv/fpu_helper.c b/target/riscv/tcg/fpu_helper.c
similarity index 100%
rename from target/riscv/fpu_helper.c
rename to target/riscv/tcg/fpu_helper.c
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/tcg/insn_trans/trans_privileged.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_privileged.c.inc
rename to target/riscv/tcg/insn_trans/trans_privileged.c.inc
diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/tcg/insn_trans/trans_rva.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rva.c.inc
rename to target/riscv/tcg/insn_trans/trans_rva.c.inc
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/tcg/insn_trans/trans_rvb.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvb.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvb.c.inc
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/tcg/insn_trans/trans_rvbf16.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvbf16.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvbf16.c.inc
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/tcg/insn_trans/trans_rvd.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvd.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvd.c.inc
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/tcg/insn_trans/trans_rvf.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvf.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvf.c.inc
diff --git a/target/riscv/insn_trans/trans_rvh.c.inc b/target/riscv/tcg/insn_trans/trans_rvh.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvh.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvh.c.inc
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/tcg/insn_trans/trans_rvi.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvi.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvi.c.inc
diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/tcg/insn_trans/trans_rvk.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvk.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvk.c.inc
diff --git a/target/riscv/insn_trans/trans_rvm.c.inc b/target/riscv/tcg/insn_trans/trans_rvm.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvm.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvm.c.inc
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/tcg/insn_trans/trans_rvv.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvv.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvv.c.inc
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/tcg/insn_trans/trans_rvvk.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvvk.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvvk.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzabha.c.inc b/target/riscv/tcg/insn_trans/trans_rvzabha.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzabha.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzabha.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/tcg/insn_trans/trans_rvzacas.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzacas.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzacas.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzalasr.c.inc b/target/riscv/tcg/insn_trans/trans_rvzalasr.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzalasr.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzalasr.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzawrs.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/tcg/insn_trans/trans_rvzce.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzce.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzce.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzcmop.c.inc b/target/riscv/tcg/insn_trans/trans_rvzcmop.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzcmop.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzcmop.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/tcg/insn_trans/trans_rvzfa.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzfa.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzfa.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/tcg/insn_trans/trans_rvzfh.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzfh.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzfh.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicbo.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzicbo.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzicbo.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzicfiss.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzicond.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicond.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzicond.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzicond.c.inc
diff --git a/target/riscv/insn_trans/trans_rvzimop.c.inc b/target/riscv/tcg/insn_trans/trans_rvzimop.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_rvzimop.c.inc
rename to target/riscv/tcg/insn_trans/trans_rvzimop.c.inc
diff --git a/target/riscv/insn_trans/trans_svinval.c.inc b/target/riscv/tcg/insn_trans/trans_svinval.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_svinval.c.inc
rename to target/riscv/tcg/insn_trans/trans_svinval.c.inc
diff --git a/target/riscv/insn_trans/trans_xlrbr.c.inc b/target/riscv/tcg/insn_trans/trans_xlrbr.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xlrbr.c.inc
rename to target/riscv/tcg/insn_trans/trans_xlrbr.c.inc
diff --git a/target/riscv/insn_trans/trans_xmips.c.inc b/target/riscv/tcg/insn_trans/trans_xmips.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xmips.c.inc
rename to target/riscv/tcg/insn_trans/trans_xmips.c.inc
diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/tcg/insn_trans/trans_xthead.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xthead.c.inc
rename to target/riscv/tcg/insn_trans/trans_xthead.c.inc
diff --git a/target/riscv/insn_trans/trans_xventanacondops.c.inc b/target/riscv/tcg/insn_trans/trans_xventanacondops.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_xventanacondops.c.inc
rename to target/riscv/tcg/insn_trans/trans_xventanacondops.c.inc
diff --git a/target/riscv/insn_trans/trans_zilsd.c.inc b/target/riscv/tcg/insn_trans/trans_zilsd.c.inc
similarity index 100%
rename from target/riscv/insn_trans/trans_zilsd.c.inc
rename to target/riscv/tcg/insn_trans/trans_zilsd.c.inc
diff --git a/target/riscv/m128_helper.c b/target/riscv/tcg/m128_helper.c
similarity index 100%
rename from target/riscv/m128_helper.c
rename to target/riscv/tcg/m128_helper.c
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 061df3d74a..5684fcf985 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -1,2 +1,28 @@
-riscv_ss.add(when: 'CONFIG_TCG', if_true: files(
- 'tcg-cpu.c'))
+if 'CONFIG_TCG' not in config_all_accel
+ subdir_done()
+endif
+
+riscv_ss.add(files(
+ 'bitmanip_helper.c',
+ 'cpu_helper.c',
+ 'csr.c',
+ 'crypto_helper.c',
+ 'fpu_helper.c',
+ 'm128_helper.c',
+ 'op_helper.c',
+ 'translate.c',
+ 'tcg-cpu.c',
+ 'vcrypto_helper.c',
+ 'vector_helper.c',
+ 'vector_internals.c',
+ 'zce_helper.c'))
+
+
+riscv_system_ss.add(files(
+ 'debug.c',
+ 'mips_csr.c',
+ 'pmu.c',
+ 'th_csr.c',
+))
+
+
diff --git a/target/riscv/mips_csr.c b/target/riscv/tcg/mips_csr.c
similarity index 100%
rename from target/riscv/mips_csr.c
rename to target/riscv/tcg/mips_csr.c
diff --git a/target/riscv/op_helper.c b/target/riscv/tcg/op_helper.c
similarity index 100%
rename from target/riscv/op_helper.c
rename to target/riscv/tcg/op_helper.c
diff --git a/target/riscv/pmu.c b/target/riscv/tcg/pmu.c
similarity index 100%
rename from target/riscv/pmu.c
rename to target/riscv/tcg/pmu.c
diff --git a/target/riscv/th_csr.c b/target/riscv/tcg/th_csr.c
similarity index 100%
rename from target/riscv/th_csr.c
rename to target/riscv/tcg/th_csr.c
diff --git a/target/riscv/translate.c b/target/riscv/tcg/translate.c
similarity index 100%
rename from target/riscv/translate.c
rename to target/riscv/tcg/translate.c
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/tcg/vcrypto_helper.c
similarity index 100%
rename from target/riscv/vcrypto_helper.c
rename to target/riscv/tcg/vcrypto_helper.c
diff --git a/target/riscv/vector_helper.c b/target/riscv/tcg/vector_helper.c
similarity index 100%
rename from target/riscv/vector_helper.c
rename to target/riscv/tcg/vector_helper.c
diff --git a/target/riscv/vector_internals.c b/target/riscv/tcg/vector_internals.c
similarity index 100%
rename from target/riscv/vector_internals.c
rename to target/riscv/tcg/vector_internals.c
diff --git a/target/riscv/vector_internals.h b/target/riscv/tcg/vector_internals.h
similarity index 100%
rename from target/riscv/vector_internals.h
rename to target/riscv/tcg/vector_internals.h
diff --git a/target/riscv/zce_helper.c b/target/riscv/tcg/zce_helper.c
similarity index 100%
rename from target/riscv/zce_helper.c
rename to target/riscv/tcg/zce_helper.c
--
2.43.0
^ permalink raw reply related
* [PATCH v2 03/24] target/riscv/machine.c: do not migrate pmp state with kvm
From: Daniel Henrique Barboza @ 2026-06-24 0:06 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, alistair.francis, liwei1518, zhiwei_liu,
chao.liu.zevorn, pierrick.bouvier, philmd, fritchleybohrer,
Daniel Henrique Barboza, Palmer Dabbelt
In-Reply-To: <20260624000632.2149359-1-daniel.barboza@oss.qualcomm.com>
The PMP emulation isn't present in the KVM driver.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
target/riscv/machine.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index ba96ceceef..e1cbcaa349 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -20,6 +20,7 @@
#include "cpu.h"
#include "qemu/error-report.h"
#include "system/kvm.h"
+#include "system/tcg.h"
#include "migration/cpu.h"
#include "exec/icount.h"
#include "target/riscv/debug.h"
@@ -29,7 +30,11 @@ static bool pmp_needed(void *opaque)
{
RISCVCPU *cpu = opaque;
- return cpu->cfg.pmp;
+ if (kvm_enabled()) {
+ return false;
+ }
+
+ return tcg_enabled() && cpu->cfg.pmp;
}
static int pmp_post_load(void *opaque, int version_id)
@@ -39,10 +44,12 @@ static int pmp_post_load(void *opaque, int version_id)
int i;
uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
- for (i = 0; i < pmp_regions; i++) {
- pmp_update_rule_addr(env, i);
+ if (tcg_enabled()) {
+ for (i = 0; i < pmp_regions; i++) {
+ pmp_update_rule_addr(env, i);
+ }
+ pmp_update_rule_nums(env);
}
- pmp_update_rule_nums(env);
return 0;
}
--
2.43.0
^ permalink raw reply related
* RE: [EXTERNAL] Re: [PATCH 1/2] eal: return error on devargs truncation in hotplug MP messages
From: Long Li @ 2026-06-24 0:06 UTC (permalink / raw)
To: David Marchand
Cc: dev@dpdk.org, bruce.richardson@intel.com,
stephen@networkplumber.org, Burakov, Anatoly
In-Reply-To: <CAJFAV8ye5NG=-xkXjNX5+jBpJgV1S5oe02_+rAa9BYwNv_wmAA@mail.gmail.com>
> On Wed, 25 Mar 2026 at 02:45, Long Li <longli@microsoft.com> wrote:
> >
> > The EAL hotplug multi-process messaging uses a fixed-size buffer
> > (EAL_DEV_MP_DEV_ARGS_MAX_LEN, 128 bytes) for device arguments.
> > When devargs exceeds this limit, strlcpy silently truncates the
> > string. This causes secondary processes to receive incomplete devargs
> > during hotplug re-add, leading to failed port re-initialization.
> >
> > For example, a MANA PCI device with 6 mac= arguments:
> >
> > mac=AA:BB:CC:DD:EE:01,mac=AA:BB:CC:DD:EE:02,
> > mac=AA:BB:CC:DD:EE:03,mac=AA:BB:CC:DD:EE:04,
> > mac=AA:BB:CC:DD:EE:05,mac=AA:BB:CC:DD:EE:06
> >
> > produces a 131-byte devargs string that gets silently truncated to 127
> > bytes, losing the last MAC address.
> >
> > Return -E2BIG from rte_dev_probe() and rte_dev_remove() when devargs
> > would be truncated, instead of silently corrupting data.
> >
> > Signed-off-by: Long Li <longli@microsoft.com>
>
> Worth a Fixes: tag and Cc: stable.
>
> > ---
> > lib/eal/common/eal_common_dev.c | 11 +++++++++++
> > 1 file changed, 11 insertions(+)
> >
> > diff --git a/lib/eal/common/eal_common_dev.c
> > b/lib/eal/common/eal_common_dev.c index 7185de0cb9..de24d14d28
> 100644
> > --- a/lib/eal/common/eal_common_dev.c
> > +++ b/lib/eal/common/eal_common_dev.c
> > @@ -250,6 +250,11 @@ rte_dev_probe(const char *devargs)
> >
> > memset(&req, 0, sizeof(req));
> > req.t = EAL_DEV_REQ_TYPE_ATTACH;
> > + if (strlen(devargs) >= EAL_DEV_MP_DEV_ARGS_MAX_LEN) {
> > + EAL_LOG(ERR, "devargs truncated (len %zu, max %d)",
> > + strlen(devargs), EAL_DEV_MP_DEV_ARGS_MAX_LEN);
> > + return -E2BIG;
> > + }
> > strlcpy(req.devargs, devargs, EAL_DEV_MP_DEV_ARGS_MAX_LEN);
>
> Please move the check before the memset().
>
> >
> > if (rte_eal_process_type() != RTE_PROC_PRIMARY) { @@ -397,6
> > +402,12 @@ rte_dev_remove(struct rte_device *dev)
> >
> > memset(&req, 0, sizeof(req));
> > req.t = EAL_DEV_REQ_TYPE_DETACH;
> > + if (strlen(devargs) >= EAL_DEV_MP_DEV_ARGS_MAX_LEN) {
> > + EAL_LOG(ERR, "devargs truncated (len %zu, max %d)",
> > + strlen(devargs), EAL_DEV_MP_DEV_ARGS_MAX_LEN);
> > + free(devargs);
> > + return -E2BIG;
> > + }
> > strlcpy(req.devargs, devargs, EAL_DEV_MP_DEV_ARGS_MAX_LEN);
> > free(devargs);
> >
>
> Why do we need to validate devargs on cleanup?
> Its length should have been validated during probe.
>
>
> --
> David Marchand
I have sent v2 with all the comments addressed.
Thanks,
Long
^ permalink raw reply
* [PATCH v2] eal: return error on devargs truncation in hotplug MP messages
From: Long Li @ 2026-06-24 0:05 UTC (permalink / raw)
To: dev; +Cc: stable, david.marchand, Long Li
In-Reply-To: <20260325014506.1866374-1-longli@microsoft.com>
The EAL hotplug multi-process messaging uses a fixed-size buffer
(EAL_DEV_MP_DEV_ARGS_MAX_LEN, 128 bytes) for device arguments.
When devargs exceeds this limit, strlcpy silently truncates the
string. This causes secondary processes to receive incomplete
devargs during hotplug re-add, leading to failed port
re-initialization.
For example, a MANA PCI device with 6 mac= arguments:
mac=AA:BB:CC:DD:EE:01,mac=AA:BB:CC:DD:EE:02,
mac=AA:BB:CC:DD:EE:03,mac=AA:BB:CC:DD:EE:04,
mac=AA:BB:CC:DD:EE:05,mac=AA:BB:CC:DD:EE:06
produces a 131-byte devargs string that gets silently truncated
to 127 bytes, losing the last MAC address.
Return -E2BIG from rte_dev_probe() when devargs would be truncated,
instead of silently corrupting data. rte_dev_remove() does not need
the same check because the length was already validated at probe time.
Fixes: 244d5130719c ("eal: enable hotplug on multi-process")
Cc: stable@dpdk.org
Signed-off-by: Long Li <longli@microsoft.com>
---
v2:
- Added Fixes: tag and Cc: stable@dpdk.org.
- Moved the length check before memset() in rte_dev_probe().
- Removed the redundant length check from rte_dev_remove();
devargs length is already validated at probe time.
- Dropped the [2/2] meson-options patch from this series; it will
be sent separately.
lib/eal/common/eal_common_dev.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/lib/eal/common/eal_common_dev.c b/lib/eal/common/eal_common_dev.c
index 48b631532a..f3fc4d585e 100644
--- a/lib/eal/common/eal_common_dev.c
+++ b/lib/eal/common/eal_common_dev.c
@@ -271,6 +271,12 @@ rte_dev_probe(const char *devargs)
struct rte_device *dev;
int ret;
+ if (strlen(devargs) >= EAL_DEV_MP_DEV_ARGS_MAX_LEN) {
+ EAL_LOG(ERR, "devargs truncated (len %zu, max %d)",
+ strlen(devargs), EAL_DEV_MP_DEV_ARGS_MAX_LEN);
+ return -E2BIG;
+ }
+
memset(&req, 0, sizeof(req));
req.t = EAL_DEV_REQ_TYPE_ATTACH;
strlcpy(req.devargs, devargs, EAL_DEV_MP_DEV_ARGS_MAX_LEN);
--
2.43.0
^ permalink raw reply related
* [PATCH 1/1] perf bench bpf: Add missing .gitignore file
From: Arnaldo Carvalho de Melo @ 2026-06-24 0:05 UTC (permalink / raw)
To: Linus Torvalds
Cc: Adrian Hunter, Ian Rogers, James Clark, Jiri Olsa, Namhyung Kim,
Linux Kernel Mailing List, linux-perf-users
Hi Linus,
I'll have this in the next pull req if you prefer not to merge
now,
- Arnaldo
---
From: Arnaldo Carvalho de Melo <acme@redhat.com>
In 713eeb2279402758 ("perf build: Move BPF skeleton generation out of
Makefile.perf") the bpf_skel used with 'perf bench uprobe' was moved
from tools/perf/util/bpf_skel/ to tools/perf/bench/bpf_skel.
Copy tools/perf/util/bpf_skel/.gitignore to that new directory so that
files generated during build get ignored by git.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Fixes: 713eeb2279402758 ("perf build: Move BPF skeleton generation out of Makefile.perf")
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/bench/bpf_skel/.gitignore | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 tools/perf/bench/bpf_skel/.gitignore
diff --git a/tools/perf/bench/bpf_skel/.gitignore b/tools/perf/bench/bpf_skel/.gitignore
new file mode 100644
index 0000000000000000..cd01455e1b53c3d9
--- /dev/null
+++ b/tools/perf/bench/bpf_skel/.gitignore
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0-only
+.tmp
+*.skel.h
+vmlinux.h
--
2.54.0
^ permalink raw reply related
* [RFC PATCH] dma-coherent: use KiB in DMA allocation logs
From: Vova Sharaienko @ 2026-06-24 0:05 UTC (permalink / raw)
To: Marek Szyprowski, Robin Murphy
Cc: android-mm, Vova Sharaienko, kernel-team, iommu, linux-kernel
We are proposing to update DMA reserved memory pool allocation log
messages to display sizes in KiB instead of MiB. Using MiB caused
allocations less than 1 MiB to be logged as 0 MiB due to integer
truncation. KiB provides better precision for smaller memory regions
specified in the Device Tree.
This is currently marked as an RFC because we would like feedback on
a KiB unit change.
Signed-off-by: Vova Sharaienko <sharaienko@google.com>
---
kernel/dma/coherent.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
index 480dd1766ece..3ede8da395ce 100644
--- a/kernel/dma/coherent.c
+++ b/kernel/dma/coherent.c
@@ -69,8 +69,8 @@ static struct dma_coherent_mem *dma_init_coherent_memory(phys_addr_t phys_addr,
kfree(dma_mem);
out_unmap_membase:
memunmap(mem_base);
- pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %zd MiB\n",
- &phys_addr, size / SZ_1M);
+ pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %lu KiB\n",
+ &phys_addr, (unsigned long)(size / SZ_1K));
return ERR_PTR(-ENOMEM);
}
@@ -384,8 +384,8 @@ static int __init rmem_dma_setup(unsigned long node, struct reserved_mem *rmem)
}
#endif
- pr_info("Reserved memory: created DMA memory pool at %pa, size %ld MiB\n",
- &rmem->base, (unsigned long)rmem->size / SZ_1M);
+ pr_info("Reserved memory: created DMA memory pool at %pa, size %lu KiB\n",
+ &rmem->base, (unsigned long)(rmem->size / SZ_1K));
return 0;
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related
* Re: [PATCH] lib/iomem_copy: fix __iomem casts
From: Al Viro @ 2026-06-24 0:04 UTC (permalink / raw)
To: Ben Dooks; +Cc: Andrew Morton, linux-kernel
In-Reply-To: <20260623234720.GG2636677@ZenIV>
On Wed, Jun 24, 2026 at 12:47:20AM +0100, Al Viro wrote:
> On Mon, Jun 22, 2026 at 01:48:57PM +0100, Ben Dooks wrote:
> > The iomem_copy.c code discards __iomem address space when using
> > the IS_ALIGNED() macro. It would make more sense to fix this in
> > one place by aing a PTR_ALIGNED_LONG() macro and then doing the
> > necessary casts there before invoking IS_ALIGNED().
> >
> > As part of this, also force the pointer to an unsigned long as
> > pointers are generally not signed, although there is no warning
> > as yet on treating pointers as signed.
>
> > +#define PTR_ALIGNED_LONG(__ptr) IS_ALIGNED((__force unsigned long)__ptr, sizeof(long))
>
> Casting to unsigned long is fine (indeed, casting a pointer to long had
> been very odd in the first place), but... why __force? Casts to unsigned long
> (de facto uintptr_t) do *not* require __force - they are explicitly allowed,
> unless you pass -Wcast-from-as in sparse arguments. -Wall does not turn
> those on; -Wsparse-all would, but kbuild doesn't pass that.
FWIW, we have 170+ places where IS_ALIGNED((unsigned long)pointer, _)
or IS_ALIGNED((uintptr_t)pointer, _) is used in the tree...
^ permalink raw reply
* Re: [PATCH bpf-next v2 14/15] selftests/bpf: Test attaching struct_ops to a cgroup
From: sashiko-bot @ 2026-06-24 0:03 UTC (permalink / raw)
To: Amery Hung; +Cc: bpf
In-Reply-To: <20260623175006.3136053-15-ameryhung@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Test state pollution in the `inherit` subtest bypasses the intended `cgroup_bpf_inherit()` testing path because the child cgroup persists from the previous `hierarchy` subtest.
--
commit 9dd80df6f86c72623dac7d2f203da4036e4e8827
Author: Martin KaFai Lau <martin.lau@kernel.org>
Subject: selftests/bpf: Test bpf_tcp_ops cgroup generic link
This commit adds selftests for attaching bpf_tcp_ops struct_ops to cgroups via
the generic cgroup link infrastructure. The tests validate various behaviors
including execution order, query interfaces, updates, and inheritance.
> diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ops.c b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ops.c
> new file mode 100644
> index 000000000000..4d087bdc4613
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ops.c
[ ... ]
> +static void run_hierarchy_subtest(void)
> +{
> + struct bpf_tcp_ops *skel = NULL;
> + struct netns_obj *ns = NULL;
> + int parent_fd, child_fd = -1;
> +
> + parent_fd = test__join_cgroup(CGROUP_PATH);
> + if (!ASSERT_GE(parent_fd, 0, "join_parent_cgroup"))
> + return;
> +
> + child_fd = create_and_get_cgroup(CGROUP_PATH "/child");
> + if (!ASSERT_GE(child_fd, 0, "create_child_cgroup"))
> + goto done;
> +
> + if (!ASSERT_OK(join_cgroup(CGROUP_PATH "/child"), "join_child_cgroup"))
> + goto done;
> +
> + ns = netns_new(TEST_NETNS, true);
> + if (!ASSERT_OK_PTR(ns, "netns_new"))
> + goto done;
> +
> + skel = bpf_tcp_ops__open_and_load();
> + if (!ASSERT_OK_PTR(skel, "open_and_load"))
> + goto done;
> +
> + test_hierarchy(parent_fd, child_fd, skel);
> +
> +done:
> + bpf_tcp_ops__destroy(skel);
> + netns_free(ns);
> + if (child_fd >= 0)
> + close(child_fd);
> + close(parent_fd);
> +}
[Severity: Medium]
Does this code leak the child cgroup and pollute the state for the inherit
subtest?
Because the child cgroup is not explicitly removed here (e.g., via
remove_cgroup()), the directory persists in the filesystem after the file
descriptor is closed.
When test_inherit() runs immediately afterward, its call to
create_and_get_cgroup() will re-open this existing cgroup instead of creating a
new one. This causes test_inherit() to silently bypass the intended
cgroup_bpf_inherit() testing path, and instead exercise the
cgroup_bpf_update_effective() path during the parent attachment.
[ ... ]
> +static void test_inherit(int parent_fd, struct bpf_tcp_ops *skel)
> +{
> + struct bpf_link *plink = NULL;
> + int child_fd = -1;
> +
> + plink = bpf_map__attach_cgroup_opts(skel->maps.tcp_ops1, parent_fd, NULL);
> + if (!ASSERT_OK_PTR(plink, "attach_parent"))
> + goto done;
> +
> + child_fd = create_and_get_cgroup(CGROUP_PATH "/child");
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260623175006.3136053-1-ameryhung@gmail.com?part=14
^ permalink raw reply
* Re: [PATCH 2/2] iomap: submit read bio after each extent
From: Namjae Jeon @ 2026-06-23 23:58 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Christian Brauner, Darrick J. Wong, Kelu Ye, Yifan Zhao,
Ritesh Harjani, Joanne Koong, Sungjong Seo, Hyunchul Lee,
Konstantin Komarov, Miklos Szeredi, fuse-devel, ntfs3,
linux-erofs, linux-xfs, linux-fsdevel
In-Reply-To: <20260623135208.1812933-3-hch@lst.de>
On Tue, Jun 23, 2026 at 10:52 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Currently the iomap buffered read path tries to build up read context
> (i.e. bios for the typical block based case) over multiple iomaps as
> long as the sector matches. This does not take into account files
> that can map to multiple different devices. While this could be fixed
> by a bdev check in iomap_bio_read_folio_range, the building up of I/O
> over iomaps actually was a problem for the not yet merged ext2 iomap
> port, as that does want to send out I/O at the end of an indirect
> block mapped range.
>
> So instead of adding more checks move over to a model where a bio only
> spans a single iomap. Change ->submit_read to be called after each
> iteration, and pass a force argument to indicate that the bio must
> be submitted set on the last iteration. Switch the bio based users
> to always submit, while keeping the single submit for fuse.
>
> Fixes: dfeab2e95a75 ("erofs: add multiple device support")
> Reported-by: Kelu Ye <yekelu1@huawei.com>
> Reported-by: Yifan Zhao <zhaoyifan28@huawei.com>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
for ntfs, exfat part.
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks!
^ permalink raw reply
* Re: [PATCH 1/2] iomap: consolidate bio submission
From: Namjae Jeon @ 2026-06-23 23:57 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Christian Brauner, Darrick J. Wong, Kelu Ye, Yifan Zhao,
Ritesh Harjani, Joanne Koong, Sungjong Seo, Hyunchul Lee,
Konstantin Komarov, Miklos Szeredi, fuse-devel, ntfs3,
linux-erofs, linux-xfs, linux-fsdevel
In-Reply-To: <20260623135208.1812933-2-hch@lst.de>
On Tue, Jun 23, 2026 at 10:52 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Add a iomap_bio_submit_read_endio helper factored out of
> iomap_bio_submit_read to that all ->submit_read implementations for
> iomap_read_ops that use iomap_bio_read_folio_range can shared the
> logic.
>
> Right now that logic is mostly trivial, but already has a bug for XFS
> because the XFS version is too trivial: file system integrity validation
> needs a workqueue context and thus can't happen from the default iomap
> bi_end_io I/O handler. Unfortunately the iomap refactoring just before
> fs integrity landed moved code around here and the call go misplaced,
> meaning it never got called. The PI information still is verified by
> the block layer, but the offloading is less efficient (and the future
> userspace interface can't get at it).
>
> Fixes: 0b10a370529c ("iomap: support T10 protection information")
> Signed-off-by: Christoph Hellwig <hch@lst.de>
for ntfs, exfat part.
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks!
^ permalink raw reply
* lib/tests/string_kunit.c:866:9: sparse: sparse: not a function __func
From: kernel test robot @ 2026-06-23 23:54 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp
::::::
:::::: Manual check reason: "low confidence static check warning: lib/tests/string_kunit.c:866:9: sparse: sparse: not a function __func"
::::::
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Feng Jiang <jiangfeng@kylinos.cn>
CC: Paul Walmsley <pjw@kernel.org>
CC: Kees Cook <kees@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 558ef39aeb9a089a6be9dda8413b0b9d42e843ea
commit: 0020240a431187628e2636284023e63b9b7a2aa1 lib/string_kunit: add performance benchmark for strlen()
date: 3 months ago
:::::: branch date: 57 minutes ago
:::::: commit date: 3 months ago
config: s390-randconfig-r123-20260623 (https://download.01.org/0day-ci/archive/20260624/202606240752.RIfKz4Go-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 8.5.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260624/202606240752.RIfKz4Go-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 0020240a4311 ("lib/string_kunit: add performance benchmark for strlen()")
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202606240752.RIfKz4Go-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
lib/tests/string_kunit.c:866:9: sparse: sparse: undefined identifier 'strlen'
lib/tests/string_kunit.c:866:9: sparse: sparse: undefined identifier 'strlen'
>> lib/tests/string_kunit.c:866:9: sparse: sparse: not a function __func
>> lib/tests/string_kunit.c:866:9: sparse: sparse: not a function __func
vim +866 lib/tests/string_kunit.c
0020240a431187 Feng Jiang 2026-04-03 863
0020240a431187 Feng Jiang 2026-04-03 864 static void string_bench_strlen(struct kunit *test)
0020240a431187 Feng Jiang 2026-04-03 865 {
0020240a431187 Feng Jiang 2026-04-03 @866 STRING_BENCH_BUF(test, buf, len, strlen, buf);
0020240a431187 Feng Jiang 2026-04-03 867 }
0020240a431187 Feng Jiang 2026-04-03 868
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [stdexec] Long-Term Ownership and Maintenance of stdexec Dependency
From: Chinmoy Dey @ 2026-06-23 12:29 UTC (permalink / raw)
To: openbmc@lists.ozlabs.org; +Cc: Roger Liao
[-- Attachment #1: Type: text/plain, Size: 1942 bytes --]
Hi OpenBMC Community,
I would like to start a discussion around the long-term ownership and maintenance model for the stdexec dependency that is currently part of the OpenBMC dependency chain. As I understand it today:
*
bmcweb references sdbusplus through subprojects/sdbusplus.wrap:
*
https://github.com/openbmc/bmcweb
*
sdbusplus is maintained under the OpenBMC organization:
*
https://github.com/openbmc/sdbusplus
*
https://github.com/openbmc/sdbusplus/blob/master/subprojects/stdexec.wrap
*
sdbusplus in turn references stdexec through subprojects/stdexec.wrap :
*
https://github.com/NVIDIA/stdexec
First, I would like to acknowledge and appreciate the work that has gone into this implementation. The intent of this note is not to question the quality of the code or the contributions made by NVIDIA, but rather to discuss whether there may be an opportunity to align this dependency more closely with OpenBMC’s long-term governance and maintenance model. Since stdexec is now part of a commonly consumed dependency path within OpenBMC, it may be worth considering whether a community-maintained approach could provide additional benefits, such as:
*
Reduced risk from repository access, policy, or ownership changes outside the OpenBMC project
*
Broader review and maintainer participation and long-term support
*
Improved community ownership , transparency and reduce dependency risk
If there have already been discussions on this topic, or if there is a preferred roadmap for the dependency, I would greatly appreciate any references or guidance. My goal is simply to explore whether we can further strengthen the sustainability, transparency, and long-term maintainability of the OpenBMC dependency ecosystem as it continues to grow.
Thank you for your time and consideration. I look forward to hearing the community’s thoughts.
Best regards,
Chinmoy Dey
[-- Attachment #2: Type: text/html, Size: 7178 bytes --]
^ permalink raw reply
* [RFC] platform/x86: redmi-wmi/bitland-mifs-wmi: shared WMI GUID ownership
From: Nika Krasnova @ 2026-06-23 23:48 UTC (permalink / raw)
To: Ilpo Järvinen, Hans de Goede
Cc: Nika Krasnova, Gladyshev Ilya, Mingyou Chen, Armin Wolf,
platform-driver-x86, linux-kernel
Hello,
I am adding support for a mic-mute LED to redmi-wmi (a follow-up to the
keymap patch [1]) and ran into a GUID ownership problem with
bitland-mifs-wmi.
bitland-mifs-wmi claims two WMI GUIDs in its id_table:
46C93E13-EE9B-4262-8488-563BCA757FEF (event device)
B60BFB48-3E5B-49E4-A0E9-8CFFE1B3434B (control device)
redmi-wmi already claims the event GUID for its keymap, so the two
overlap there today, with nothing deciding which one wins. The mic-mute
LED needs the control device -- the EC mic-mute field sits behind its
WMAA method -- and bitland-mifs-wmi claims that one too, so my patch
would extend the overlap to the control GUID as well.
Both drivers set MODULE_DEVICE_TABLE(wmi, ...), so udev autoloads both
and the device goes to whichever probes first.
The outcome is load-order dependent. Loading bitland-mifs-wmi first, it
binds *both* devices, and a redmi-wmi loaded afterwards binds nothing:
$ for d in /sys/bus/wmi/devices/*; do \
printf '%s -> %s\n' "$(basename "$d")" \
"$(basename "$(readlink "$d/driver")")"; done | column -t
...
46C93E13-EE9B-4262-8488-563BCA757FEF-0 -> bitland-mifs-wmi
B60BFB48-3E5B-49E4-A0E9-8CFFE1B3434B-4 -> bitland-mifs-wmi
In this order redmi-wmi is shut out entirely, including the mic-mute key
(bitland's keymap has none).
This is a RedmiBook Pro 16 2024 (DMI_SYS_VENDOR "XIAOMI", board TM2309).
These machines appear to share a common ODM firmware base with
Bitland's: the same WMI GUIDs are exposed under a different DMI vendor.
Neither driver inspects DMI, so neither can tell whose machine it is on.
Two complications:
- The control device (B60BFB48) is one multiplexed method (WMAA):
mic-mute, keyboard backlight, platform profile and fan all sit behind
it as sub-functions. Its features cannot be split between drivers; one
driver has to handle all of them.
- The mic-mute LED needs one driver to own *both* devices. The EC
reflects an LED write as the very same WMI event as a physical
mic-mute key press, so suppressing the self-induced event requires the
LED-writing path and the key-event path to share state. A split
(control in one driver, event in the other) cannot coordinate it.
So per machine one driver needs to own both devices and provide all the
features that machine needs. The options I see:
1. The two are merged into one driver for this ODM platform that owns
both GUIDs and DMI-gates the per-brand pieces (keymap, mic-mute
LED).
2. bitland-mifs-wmi gains the Redmi mic-mute key + LED (DMI-gated to
XIAOMI), since it already owns both devices and provides the other
features here; redmi-wmi would then not bind on these machines.
3. redmi-wmi becomes the Redmi owner: it absorbs the control-device
features (backlight/profile/fan) plus the mic-mute LED, and
bitland-mifs-wmi DMI-gates itself out of Redmi hardware.
In cases 2 and 3 the split is enforced by a DMI check in probe,
returning -ENODEV on a vendor mismatch, so the declining driver yields
the device to some'ne else. Both sides must gate from the start: once
the wrong driver binds, the device is -EBUSY for the other and is not
re-offered.
Mingyou Chen (bitland-mifs-wmi author, CC'd) told me off-list that this
is a GUID overlap, that his Bitland hardware has no mic-mute key, and
that he is fine with the mic-mute support living in redmi-wmi.
The mic-mute LED is already implemented and tested on my RedmiBook Pro
16. I can send it, and the bitland-mifs-wmi changes, as a proper series
once we settle on a shape.
This follows up the mic-mute keymap patch [1] and an earlier question
about the overlap [2].
[1]: https://lore.kernel.org/all/20260620145928.2156909-1-nika@nikableh.moe/
[2]: https://lore.kernel.org/all/20260531123345.237521-1-nika@nikableh.moe/
--
Nika Krasnova
^ permalink raw reply
* Re: [PATCH bpf-next v2 13/15] libbpf: Support attaching struct_ops to a cgroup
From: sashiko-bot @ 2026-06-23 23:53 UTC (permalink / raw)
To: Amery Hung; +Cc: bpf
In-Reply-To: <20260623175006.3136053-14-ameryhung@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf_map__attach_cgroup_opts() does not verify that the map has BPF_F_LINK set before calling bpf_map_update_elem(), leading to unintended global registration of the struct_ops map.
--
commit 4549a23db01bbdf38f2f884251281fc0a75a8c97
Author: Martin KaFai Lau <martin.lau@kernel.org>
Subject: Add bpf_map__attach_cgroup_opts() to attach a struct_ops map to a cgroup
This commit introduces bpf_map__attach_cgroup_opts() to allow attaching a
struct_ops map to a cgroup via a BPF link. It also extends
bpf_prog_query_opts with a type_id field to select the struct_ops type
during a BPF_STRUCT_OPS query.
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 1368752aa13c..17f8466e33fa 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
[ ... ]
> @@ -14104,6 +14104,65 @@ struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map)
> return &link->link;
> }
>
> +struct bpf_link *bpf_map__attach_cgroup_opts(const struct bpf_map *map, int cgroup_fd,
> + const struct bpf_cgroup_opts *opts)
> +{
[ ... ]
> + link = calloc(1, sizeof(*link));
> + if (!link)
> + return libbpf_err_ptr(-ENOMEM);
> +
> + err = bpf_map_update_elem(map->fd, &zero, map->st_ops->kern_vdata, 0);
[Severity: High]
Does this function need to verify that the map has the BPF_F_LINK flag
set before calling bpf_map_update_elem()?
If a user passes a struct_ops map without the BPF_F_LINK flag to
bpf_map__attach_cgroup_opts(), bpf_map_update_elem() will globally
register the struct_ops.
The subsequent bpf_link_create() call will then fail because
BPF_STRUCT_OPS links require BPF_F_LINK. This results in the struct_ops
remaining globally active on the system despite the API returning an error.
> + if (err && err != -EBUSY) {
> + free(link);
> + return libbpf_err_ptr(err);
> + }
> +
> + link->link.detach = bpf_link__detach_struct_ops;
> +
> + fd = bpf_link_create(map->fd, cgroup_fd, BPF_STRUCT_OPS, &link_create_opts);
> + if (fd < 0) {
> + free(link);
> + return libbpf_err_ptr(fd);
> + }
> +
> + link->link.fd = fd;
> + link->map_fd = map->fd;
> +
> + return &link->link;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260623175006.3136053-1-ameryhung@gmail.com?part=13
^ permalink raw reply
* Re: [PATCH v3] dt-bindings: misc: convert lis302.txt to YAML
From: kernel test robot @ 2026-06-23 23:52 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp
::::::
:::::: Manual check reason: "dtcheck: binding changes may go via different trees"
::::::
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <20260619122446.867091-1-inasj268@gmail.com>
References: <20260619122446.867091-1-inasj268@gmail.com>
TO: Jad Keskes <inasj268@gmail.com>
TO: Eric Piel <eric.piel@tremplin-utc.net>
TO: Rob Herring <robh@kernel.org>
TO: Krzysztof Kozlowski <krzk@kernel.org>
TO: Conor Dooley <conor+dt@kernel.org>
CC: devicetree@vger.kernel.org
CC: linux-kernel@vger.kernel.org
CC: Jad Keskes <inasj268@gmail.com>
Hi Jad,
kernel test robot noticed the following build warnings:
[auto build test WARNING on robh/for-next]
[also build test WARNING on linus/master v7.1 next-20260623]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Jad-Keskes/dt-bindings-misc-convert-lis302-txt-to-YAML/20260622-134640
base: https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next
patch link: https://lore.kernel.org/r/20260619122446.867091-1-inasj268%40gmail.com
patch subject: [PATCH v3] dt-bindings: misc: convert lis302.txt to YAML
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: arm-randconfig-2051-20260622 (https://download.01.org/0day-ci/archive/20260624/202606240120.r4ppKtqB-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 8.5.0
dtschema: 2026.7.dev1+g2203c1720
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260624/202606240120.r4ppKtqB-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202606240120.r4ppKtqB-lkp@intel.com/
dtcheck warnings: (new ones prefixed by >>)
'st,lis331dlh' is not one of ['st,h3lis331dl-accel', 'st,lis2de12', 'st,lis2dw12', 'st,lis2hh12', 'st,lis2dh12-accel', 'st,lis2ds12', 'st,lis302dl', 'st,lis331dl-accel', 'st,lis331dlh-accel', 'st,lis3de', 'st,lis3dh-accel', 'st,lis3dhh', 'st,lis3l02dq', 'st,lis3lv02dl-accel', 'st,lng2dm-accel', 'st,lsm303agr-accel', 'st,lsm303c-accel', 'st,lsm303dl-accel', 'st,lsm303dlh-accel', 'st,lsm303dlhc-accel', 'st,lsm303dlm-accel', 'st,lsm330-accel', 'st,lsm330d-accel', 'st,lsm330dl-accel', 'st,lsm330dlc-accel']
'st,iis328dq' was expected
'st,lis331dlh' is not one of ['silan,sc7a20']
'st,lis331dlh' is not one of ['st,l3g4200d-gyro', 'st,l3g4is-gyro', 'st,l3gd20-gyro', 'st,l3gd20h-gyro', 'st,lsm330-gyro', 'st,lsm330d-gyro', 'st,lsm330dl-gyro', 'st,lsm330dlc-gyro', 'st,lsm9ds0-gyro']
'st,lis331dlh' is not one of ['st,iis2mdc', 'st,lis2mdl', 'st,lis3mdl-magn', 'st,lsm303agr-magn', 'st,lsm303c-magn', 'st,lsm303dlh-magn', 'st,lsm303dlhc-magn', 'st,lsm303dlm-magn', 'st,lsm9ds1-magn']
'st,lis331dlh' is not one of ['st,lps001wp-press', 'st,lps22df', 'st,lps22hb-press', 'st,lps22hh', 'st,lps25h-press', 'st,lps331ap-press', 'st,lps33hw', 'st,lps35hw']
'st,lis331dlh' is not one of ['st,lsm303d-imu', 'st,lsm9ds0-imu']
'st,lis331dlh' is not one of ['st,lis302dl-spi', 'st,lis3lv02d']
'st,h3lis331dl-accel' was expected
from schema $id: http://devicetree.org/schemas/iio/st,st-sensors.yaml
>> arch/arm/boot/dts/marvell/mmp2-olpc-xo-1-75.dtb: accelerometer@1d (st,lis331dlh): 'Vdd-supply' is a required property
from schema $id: http://devicetree.org/schemas/misc/st,lis3lv02d.yaml
>> arch/arm/boot/dts/marvell/mmp2-olpc-xo-1-75.dtb: accelerometer@1d (st,lis331dlh): 'Vdd_IO-supply' is a required property
from schema $id: http://devicetree.org/schemas/misc/st,lis3lv02d.yaml
arch/arm/boot/dts/marvell/mmp2-olpc-xo-1-75.dtb: gpio-keys (gpio-keys): 'lid', 'tablet_mode' do not match any of the regexes: '^(button|event|key|switch|(button|event|key|switch)-[a-z0-9-]+|[a-z0-9-]+-(button|event|key|switch))$', '^pinctrl-[0-9]+$'
from schema $id: http://devicetree.org/schemas/input/gpio-keys.yaml
arch/arm/boot/dts/marvell/mmp2-olpc-xo-1-75.dtb: /i2c/camera@21: failed to match any schema with compatible: ['ovti,ov7670']
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] nvdimm/btt: add endian conversion in dev_err in btt_log_read
From: Alison Schofield @ 2026-06-23 23:51 UTC (permalink / raw)
To: Ben Dooks
Cc: Dan Williams, Vishal Verma, Dave Jiang, Ira Weiny, nvdimm,
linux-kernel
In-Reply-To: <20260622142011.491522-1-ben.dooks@codethink.co.uk>
On Mon, Jun 22, 2026 at 03:20:11PM +0100, Ben Dooks wrote:
> The dev_err() call in btt_log_read() is passing a seq value
> into dev_err() which is a __le32 without any conversion.
>
> Fix the following (prototype) sparse warnings:
> drivers/nvdimm/btt.c:342:17: warning: incorrect type in argument 5 (different base types)
> drivers/nvdimm/btt.c:342:17: expected int
> drivers/nvdimm/btt.c:342:17: got restricted __le32 [usertype] seq
> drivers/nvdimm/btt.c:342:17: warning: incorrect type in argument 6 (different base types)
> drivers/nvdimm/btt.c:342:17: expected int
> drivers/nvdimm/btt.c:342:17: got restricted __le32 [usertype] seq
Hi Ben,
Please revise the commit log.
The commit log is a message to all future readers, not a place to
paste static analysis warnings and leave the user visible impact
assumed, or as an exercise for the reader.
Prefer something like this:
When BTT log corruption is detected, btt_log_read() reports the
sequence numbers of the two log entries. Those values are stored
little-endian, so printing them without conversion can report
byte-swapped sequence numbers on big-endian systems.
Convert the sequence numbers to CPU endianness before passing
them to dev_err().
Issue reported by sparse.
(There is no need for the sparse pastings.)
-- Alison
>
> Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
> ---
> drivers/nvdimm/btt.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
> index 7e1112960d7f..e9d548442884 100644
> --- a/drivers/nvdimm/btt.c
> +++ b/drivers/nvdimm/btt.c
> @@ -341,8 +341,9 @@ static int btt_log_read(struct arena_info *arena, u32 lane,
> if (old_ent < 0 || old_ent > 1) {
> dev_err(to_dev(arena),
> "log corruption (%d): lane %d seq [%d, %d]\n",
> - old_ent, lane, log.ent[arena->log_index[0]].seq,
> - log.ent[arena->log_index[1]].seq);
> + old_ent, lane,
> + le32_to_cpu(log.ent[arena->log_index[0]].seq),
> + le32_to_cpu(log.ent[arena->log_index[1]].seq));
> /* TODO set error state? */
> return -EIO;
> }
> --
> 2.37.2.352.g3c44437643
>
^ permalink raw reply
* Re: [PATCH v2 11/13] alloc_tag: Move to mm/
From: Suren Baghdasaryan @ 2026-06-23 23:48 UTC (permalink / raw)
To: Lorenzo Stoakes
Cc: Brendan Jackman, Andrew Morton, Vlastimil Babka, Michal Hocko,
Johannes Weiner, Zi Yan, Muchun Song, Oscar Salvador,
David Hildenbrand, Liam R. Howlett, Mike Rapoport, Matthew Brost,
Joshua Hahn, Rakie Kim, Byungchul Park, Ying Huang,
Alistair Popple, Hao Li, Christoph Lameter, David Rientjes,
Roman Gushchin, Sebastian Andrzej Siewior, Clark Williams,
Steven Rostedt, Harry Yoo (Oracle), Gregory Price,
Alexei Starovoitov, Matthew Wilcox, linux-mm, linux-kernel,
linux-rt-devel
In-Reply-To: <ajrA4wiAKTdiraEO@lucifer>
On Tue, Jun 23, 2026 at 10:29 AM Lorenzo Stoakes <ljs@kernel.org> wrote:
>
> On Mon, Jun 22, 2026 at 10:01:38AM +0000, Brendan Jackman wrote:
> > This is logically mm code. Moving to mm/ allows access to mm/internal.h
> >
> > Signed-off-by: Brendan Jackman <jackmanb@google.com>
>
> Sorry to be a pain, but I feel that this change should be dealt with separately
> perhaps as a pre-requisite to this series.
I know you have an idea for some cleanup. Let's wait for your patch
and then rebase this series over it. In the meantime I'll start
reviewing the rest.
>
> Thanks, Lorenzo
>
> > ---
> > MAINTAINERS | 2 +-
> > lib/Makefile | 1 -
> > mm/Makefile | 1 +
> > {lib => mm}/alloc_tag.c | 0
> > 4 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index 65bd4328fe056..5d426b79b8fe7 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -16713,7 +16713,7 @@ S: Maintained
> > F: Documentation/mm/allocation-profiling.rst
> > F: include/linux/alloc_tag.h
> > F: include/linux/pgalloc_tag.h
> > -F: lib/alloc_tag.c
> > +F: mm/alloc_tag.c
> >
> > MEMORY CONTROLLER DRIVERS
> > M: Krzysztof Kozlowski <krzk@kernel.org>
> > diff --git a/lib/Makefile b/lib/Makefile
> > index f33a24bf1c19a..44f6538533a97 100644
> > --- a/lib/Makefile
> > +++ b/lib/Makefile
> > @@ -197,7 +197,6 @@ obj-$(CONFIG_OF_RECONFIG_NOTIFIER_ERROR_INJECT) += \
> > obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o
> >
> > obj-$(CONFIG_CODE_TAGGING) += codetag.o
> > -obj-$(CONFIG_MEM_ALLOC_PROFILING) += alloc_tag.o
> >
> > lib-$(CONFIG_GENERIC_BUG) += bug.o
> >
> > diff --git a/mm/Makefile b/mm/Makefile
> > index eff9f9e7e061c..4fc713867b9bd 100644
> > --- a/mm/Makefile
> > +++ b/mm/Makefile
> > @@ -147,3 +147,4 @@ obj-$(CONFIG_SHRINKER_DEBUG) += shrinker_debug.o
> > obj-$(CONFIG_EXECMEM) += execmem.o
> > obj-$(CONFIG_TMPFS_QUOTA) += shmem_quota.o
> > obj-$(CONFIG_LAZY_MMU_MODE_KUNIT_TEST) += tests/lazy_mmu_mode_kunit.o
> > +obj-$(CONFIG_MEM_ALLOC_PROFILING) += alloc_tag.o
> > diff --git a/lib/alloc_tag.c b/mm/alloc_tag.c
> > similarity index 100%
> > rename from lib/alloc_tag.c
> > rename to mm/alloc_tag.c
> >
> > --
> > 2.54.0
> >
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.