[PULL 00/56] riscv-to-apply queue

From: Alistair Francis The following changes since commit 757a34115e7491744a63dfc3d291fd1de5297ee2: Merge tag 'pull-nvme-20250515' of https://gitlab.com/birkelund/qemu into staging (2025-05-15 13:42:27 -0400) are available in the Git repository at: https://github.com/alistair2

[PULL 27/56] target/riscv: rvv: Apply vext_check_input_eew to vector narrow/widen instructions

From: Max Chou Handle the overlap of source registers with different EEWs. The vd of vector widening mul-add instructions is one of the input operands. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-9-max.c...@s

[PULL 22/56] target/riscv: rvv: Apply vext_check_input_eew to vrgather instructions to check mismatched input EEWs encoding constraint

From: Max Chou According to the v spec, a vector register cannot be used to provide source operands with more than one EEW for a single instruction. The vs1 EEW of vrgatherei16.vv is 16. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <

[PULL 50/56] hw/riscv/virt.c: use s->memmap in virt_machine_done()

From: Daniel Henrique Barboza Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-4-dbarb...@ventanamicro.com> Signed-off-by: Alistair Francis --- hw/riscv/virt.c | 15 +++ 1 file changed, 7 insertions(+), 8 deletions(-) diff --

[PULL 05/56] target/riscv: pmp: fix checks on writes to pmpcfg in Smepmp MML mode

From: Loïc Lefort With Machine Mode Lockdown (mseccfg.MML) set and RLB not set, checks on pmpcfg writes would match the wrong cases of Smepmp truth table. The existing code allows writes for the following cases: - L=1, X=0: cases 8, 10, 12, 14 - L=0, RWX!=WX: cases 0-2, 4-6 This leaves cases 3,

[PULL 48/56] hw/riscv/virt.c: enforce s->memmap use in machine_init()

From: Daniel Henrique Barboza Throughout the code we're accessing the board memmap, most of the time, by accessing it statically via 'virt_memmap'. This static map is also assigned in the machine state in s->memmap. We're also passing it as a variable to some fdt functions, which is unorthodox s

[PULL 23/56] target/riscv: rvv: Apply vext_check_input_eew to OPIVI/OPIVX/OPFVF(vext_check_ss) instructions

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-5-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 32/56] target/riscv: Pass ra to riscv_csr_write_fn

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-2-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/cpu.h | 3 +-

[PULL 16/56] Expand the probe_pages helper function to handle probe flags.

From: Paolo Savini This commit expands the probe_pages helper function in target/riscv/vector_helper.c to handle also the cases in which we need access to the flags raised while probing the memory and the host address. This is done in order to provide a unified interface to probe_access and probe

[PULL 55/56] hw/riscv/virt.c: use s->memmap in finalize_fdt() functions

From: Daniel Henrique Barboza Change create_fdt_pcie(), create_fdt_reset(), create_fdt_uart() and create_fdt_rtc() to use s->memmap in their logic. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-9-dbarb...@ventanamicro.com> Signed-off-by

[PULL 54/56] hw/riscv/virt.c: use s->memmap in create_fdt_virtio()

From: Daniel Henrique Barboza create_fdt_virtio() can use s->memmap instead of having an extra argument for it. While we're at it rewrite it a little bit to avoid the clunky line in 'name' and code repetition: - declare 'virtio_base' out of the loop since it never changes; - declare a 'size' va

[PULL 20/56] target/riscv: rvv: Source vector registers cannot overlap mask register

From: Anton Blanchard Add the relevant ISA paragraphs explaining why source (and destination) registers cannot overlap the mask register. Signed-off-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Reviewed-by: Max Chou Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-2-ma

[PULL 40/56] target/riscv/kvm: fix leak in kvm_riscv_init_multiext_cfg()

From: Daniel Henrique Barboza 'reglist' is being g-malloc'ed but never freed. Reported-by: Andrew Jones Signed-off-by: Daniel Henrique Barboza Reviewed-by: Andrew Jones Reviewed-by: Alistair Francis Message-ID: <20250429124421.223883-3-dbarb...@ventanamicro.com> Signed-off-by: Alistair Franc

[PULL 37/56] target/riscv: Move insn_len to internals.h

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-7-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/internals.h | 5

[PULL 42/56] target/riscv/kvm: turn kvm_riscv_reg_id_ulong() into a macro

From: Daniel Henrique Barboza We need the reg_id_ulong() helper to be a macro to be able to create a static array of KVMCPUConfig that will hold CSR information. Despite the amount of changes all of them are tedious/trivial: - replace instances of "kvm_riscv_reg_id_ulong" with "KVM_RISCV_REG_

[PULL 31/56] MAINTAINERS: Add common-user/host/riscv to RISC-V section

From: Alistair Francis Signed-off-by: Alistair Francis Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250422024752.2060289-1-alistair.fran...@wdc.com> Signed-off-by: Alistair Francis --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 57dddc

[PULL 35/56] target/riscv: Pass ra to riscv_csrrw

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-5-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/cpu.h | 8

[PULL 41/56] target/riscv/kvm: turn u32/u64 reg functions into macros

From: Daniel Henrique Barboza This change is motivated by a future change w.r.t CSRs management. We want to handle them the same way as KVM extensions, i.e. a static array with KVMCPUConfig objs that will be read/write during init and so on. But to do that properly we must be able to declare a st

[PULL 24/56] target/riscv: rvv: Apply vext_check_input_eew to OPIVV/OPFVV(vext_check_sss) instructions

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-6-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 38/56] target/riscv: Fix write_misa vs aligned next_pc

From: Richard Henderson Do not examine a random host return address, but properly compute the next pc for the guest cpu. Fixes: f18637cd611 ("RISC-V: Add misa runtime write support") Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-b

[PULL 09/56] hw/misc: Add MPFS system reset support

From: Sebastian Huber Signed-off-by: Sebastian Huber Acked-by: Alistair Francis Message-ID: <20250319061342.26435-2-sebastian.hu...@embedded-brains.de> Signed-off-by: Alistair Francis --- hw/misc/mchp_pfsoc_sysreg.c | 7 +++ 1 file changed, 7 insertions(+) diff --git a/hw/misc/mchp_pfsoc

[PULL 51/56] hw/riscv/virt.c: add 'base' arg in create_fw_cfg()

From: Daniel Henrique Barboza The function can receive the value via s->memmap[VIRT_FW_CFG].base from the caller, avoiding the use of virt_memmap. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-5-dbar

[PULL 47/56] target/riscv/kvm: add scounteren CSR

From: Daniel Henrique Barboza Add support for the scounteren KVM CSR. Note that env->scounteren is a 32 bit and all KVM CSRs are target_ulong, so scounteren will be capped to 32 bits read/writes. Reported-by: Andrew Jones Signed-off-by: Daniel Henrique Barboza Reviewed-by: Andrew Jones Review

[PULL 46/56] target/riscv/kvm: read/write KVM regs via env size

From: Daniel Henrique Barboza We're going to add support for scounteren in the next patch. KVM defines as a target_ulong CSR, while QEMU defines env->scounteren as a 32 bit field. This will cause the current code to read/write a 64 bit CSR in a 32 bit field when running in a 64 bit CPU. To preve

[PULL 49/56] hw/riscv/virt.c: remove trivial virt_memmap references

From: Daniel Henrique Barboza We should use s->memmap instead of virt_memmap to be able to use an updated memmap when we start versioning the board. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-3-dbarb...@ventanamicro.com> Signed-off-b

[PULL 43/56] target/riscv/kvm: add kvm_csr_cfgs[]

From: Daniel Henrique Barboza At this moment we're not checking if the host has support for any specific CSR before doing get/put regs. This will cause problems if the host KVM doesn't support it (see [1] as an example). We'll use the same approach done with the CPU extensions: read all known KV

[PULL 53/56] hw/riscv/virt.c: use s->memmap in create_fdt_sockets() path

From: Daniel Henrique Barboza create_fdt_sockets() and all its fdt helpers (create_fdt_socket_aplic(), create_fdt_imsic(), create_fdt_socket_plic(), create_fdt_socket_aclint() and create_fdt_socket_memory()) can use s->memmap from their RISCVVirtState pointer instead of having an extra memmap arg

[PULL 15/56] target/riscv: use tcg ops generation to emulate whole reg rvv loads/stores.

From: Paolo Savini This patch replaces the use of a helper function with direct tcg ops generation in order to emulate whole register loads and stores. This is done in order to improve the performance of QEMU. We still use the helper function when vstart is not 0 at the beginning of the emulation

[PULL 44/56] target/riscv/kvm: do not read unavailable CSRs

From: Daniel Henrique Barboza [1] reports that commit 4db19d5b21 broke a KVM guest running kernel 6.6. This happens because the kernel does not know 'senvcfg', making it unable to boot because QEMU is reading/wriiting it without any checks. After converting the CSRs to do "automated" get/put reg

[PULL 45/56] target/riscv/kvm: add senvcfg CSR

From: Daniel Henrique Barboza We're missing the senvcfg CSRs which is already present in the KVM UAPI. Reported-by: Andrew Jones Signed-off-by: Daniel Henrique Barboza Reviewed-by: Andrew Jones Acked-by: Alistair Francis Message-ID: <20250429124421.223883-8-dbarb...@ventanamicro.com> Signed-

[PULL 17/56] hw/riscv: Fix type conflict of GLib function pointers

From: Paolo Bonzini qtest_set_command_cb passed to g_once should match GThreadFunc, which it does not. But using g_once is actually unnecessary, because the function is called by riscv_harts_realize() under the Big QEMU Lock. Reported-by: Kohei Tokunaga Signed-off-by: Paolo Bonzini Reviewed-b

[PULL 30/56] target/riscv: Fix vslidedown with rvv_ta_all_1s

From: Anton Blanchard vslidedown always zeroes elements past vl, where it should use the tail policy. Signed-off-by: Anton Blanchard Reviewed-by: Alistair Francis Message-ID: <20250414213006.3509058-1-ant...@tenstorrent.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- targ

[PULL 56/56] hw/riscv/virt.c: remove 'long' casts in fmt strings

From: Daniel Henrique Barboza We can avoid the 'long' casts by using PRIx64 and HWADDR_PRIx on the fmt strings for uint64_t and hwaddr types. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-10-dbarb...

[PULL 08/56] Generate strided vector loads/stores with tcg nodes.

From: Paolo Savini This commit improves the performance of QEMU when emulating strided vector loads and stores by substituting the call for the helper function with the generation of equivalent TCG operations. Signed-off-by: Paolo Savini Reviewed-by: Daniel Henrique Barboza Message-ID: <202503

[PULL 34/56] target/riscv: Pass ra to riscv_csrrw_do128

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-4-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/csr.c | 9 +

[PULL 21/56] target/riscv: rvv: Add CHECK arg to GEN_OPFVF_WIDEN_TRANS

From: Anton Blanchard Signed-off-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Reviewed-by: Max Chou Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-3-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- target/riscv/insn_trans/trans_rvv

[PULL 36/56] target/riscv: Pass ra to riscv_csrrw_i128

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-6-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/cpu.h | 4

[PULL 11/56] hw/riscv: Make FDT optional for MPFS

From: Sebastian Huber Real-time kernels such as RTEMS or Zephyr may use a static device tree built into the kernel image. Do not require to use the -dtb option if -kernel is used for the microchip-icicle-kit machine. Issue a warning if no device tree is provided by the user since the machine do

[PULL 03/56] target/riscv: pmp: don't allow RLB to bypass rule privileges

From: Loïc Lefort When Smepmp is supported, mseccfg.RLB allows bypassing locks when writing CSRs but should not affect interpretation of actual PMP rules. This is not the case with the current implementation where pmp_hart_has_privs calls pmp_is_locked which implements mseccfg.RLB bypass. This

[PULL 06/56] target/riscv: pmp: exit csr writes early if value was not changed

From: Loïc Lefort Signed-off-by: Loïc Lefort Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Reviewed-by: LIU Zhiwei Message-ID: <20250313193011.720075-5-l...@rivosinc.com> Signed-off-by: Alistair Francis --- target/riscv/pmp.c | 22 +++--- 1 file changed,

[PULL 33/56] target/riscv: Pass ra to riscv_csrrw_do64

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-3-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/csr.c | 15

[PULL 29/56] target/riscv: Fix the rvv reserved encoding of unmasked instructions

From: Max Chou According to the v spec, the encodings of vcomoress.vm and vector mask-register logical instructions with vm=0 are reserved. Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-11-max.c...@sifive.com> Signed-off-by: Alistair Francis

[PULL 25/56] target/riscv: rvv: Apply vext_check_input_eew to vector slide instructions(OPIVI/OPIVX)

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-7-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 39/56] target/riscv/kvm: minor fixes/tweaks

From: Daniel Henrique Barboza Remove an unused 'KVMScratchCPU' pointer argument in kvm_riscv_check_sbi_dbcn_support(). Put kvm_riscv_reset_regs_csr() after kvm_riscv_put_regs_csr(). This will make a future patch diff easier to read, when changes in kvm_riscv_reset_regs_csr() and kvm_riscv_get_re

[PULL 52/56] hw/riscv/virt.c: use s->memmap in create_fdt() path

From: Daniel Henrique Barboza create_fdt(), create_fdt_flash() and create_fdt_fw_cfg() can access the memmap via their RISCVVirtState pointers. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-6-dbarb...@ventanamicro.com> Signed-off-by: Al

[PULL 01/56] hw/riscv/virt: Add the BDF of IOMMU to RISCVVirtState structure

From: Sunil V L When the IOMMU is implemented as a PCI device, its BDF is created locally in virt.c. However, the same BDF is also required in virt-acpi-build.c to support ACPI. Therefore, make this information part of the global RISCVVirtState structure so that it can be accessed outside of virt

[PULL 04/56] target/riscv: pmp: move Smepmp operation conversion into a function

From: Loïc Lefort Signed-off-by: Loïc Lefort Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Reviewed-by: LIU Zhiwei Message-ID: <20250313193011.720075-3-l...@rivosinc.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- target/riscv/pmp.c | 22

[PULL 13/56] hw/riscv: Configurable MPFS CLINT timebase freq

From: Sebastian Huber This property enables the setting of the CLINT timebase frequency through the command line, for example: -machine microchip-icicle-kit,clint-timebase-frequency=1000 Signed-off-by: Sebastian Huber Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Me

[PULL 28/56] target/riscv: rvv: Apply vext_check_input_eew to vector indexed load/store instructions

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-10-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org ---

[PULL 26/56] target/riscv: rvv: Apply vext_check_input_eew to vector integer extension instructions(OPMVV)

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-8-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 19/56] common-user/host/riscv: use tail pseudoinstruction for calling tail

From: Icenowy Zheng The j pseudoinstruction maps to a JAL instruction, which can only handle a jump to somewhere with a signed 20-bit destination. In case of static linking and LTO'ing this easily leads to "relocation truncated to fit" error. Switch to use tail pseudoinstruction, which is the st

[PULL 18/56] target/riscv: fix endless translation loop on big endian systems

From: Ziqiao Kong On big endian systems, pte and updated_pte hold big endian host data while pte_pa points to little endian target data. This means the branch at cpu_helper.c:1669 will be always satisfied and restart translation, causing an endless translation loop. The correctness of this patch

[PULL 14/56] hw/riscv: microchip_pfsoc: Rework documentation

From: Sebastian Huber Mention that running the HSS no longer works. Document the changed boot options. Reorder documentation blocks. Update URLs. Signed-off-by: Sebastian Huber Reviewed-by: Alistair Francis Message-ID: <20250319061342.26435-7-sebastian.hu...@embedded-brains.de> Signed-off-b

[PULL 12/56] hw/riscv: Allow direct start of kernel for MPFS

From: Sebastian Huber Further customize the -bios and -kernel options behaviour for the microchip-icicle-kit machine. If "-bios none -kernel filename" is specified, then do not load a firmware and instead only load and start the kernel image. For test runs, use an approach similar to riscv_find

[PULL 10/56] hw/riscv: More flexible FDT placement for MPFS

From: Sebastian Huber If the kernel entry is in the high DRAM area, place the FDT into this area. Signed-off-by: Sebastian Huber Reviewed-by: Alistair Francis Message-ID: <20250319061342.26435-3-sebastian.hu...@embedded-brains.de> Signed-off-by: Alistair Francis --- hw/riscv/microchip_pfsoc.

[PULL 02/56] hw/riscv/virt-acpi-build: Add support for RIMT

From: Sunil V L RISC-V IO Mapping Table (RIMT) is a new static ACPI table used to communicate IOMMU information to the OS. Add support for creating this table when the IOMMU is present. The specification is frozen and available at [1]. [1] - https://github.com/riscv-non-isa/riscv-acpi-rimt/rele

[PULL 07/56] target/riscv: pmp: remove redundant check in pmp_is_locked

From: Loïc Lefort Remove useless check in pmp_is_locked, the function will return 0 in either case. Signed-off-by: Loïc Lefort Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Reviewed-by: LIU Zhiwei Message-ID: <20250313193011.720075-6-l...@rivosinc.com> Signed-off-by: Ali