[PULL 01/40] target/riscv: Add the checking into stimecmp write function.

From: Jim Shu Preparation commit to let aclint timer to use stimecmp write function. Aclint timer doesn't call sstc() predicate so we need to check inside the stimecmp write function. Signed-off-by: Jim Shu Acked-by: Alistair Francis Message-ID: <20250519143518.11086-2-jim@sifive.com> Sign

[PULL 38/40] tests/tcg/riscv64: Add test for MEPC bit masking

From: Charalampos Mitrodimas Add a regression test to verify that MEPC properly masks the lower bits when an address with mode bits is written to it, as required by the RISC-V Privileged Architecture specification. The test sets STVEC to an address with bit 0 set (vectored mode), triggers an ill

[PULL 40/40] target: riscv: Add Svrsw60t59b extension support

From: Alexandre Ghiti The Svrsw60t59b extension allows to free the PTE reserved bits 60 and 59 for software to use. Reviewed-by: Deepak Gupta Signed-off-by: Alexandre Ghiti Reviewed-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Message-ID: <20250702-dev-alex-svrsw60b59b_v2-v2-1-504ddf0f8

[PULL 14/40] target/riscv: support atomic instruction fetch (Ziccif)

From: Jim Shu Support 4-byte atomic instruction fetch when instruction is natural aligned. Current implementation is not atomic because it loads instruction twice for first and last 2 bytes. We load 4 bytes at once to keep the atomicity. This instruction preload method only applys when instructi

[PULL 13/40] target/riscv/cpu.c: do better with 'named features' doc

From: Daniel Henrique Barboza Most of the named features are added directly in isa_edata_arr[], some of them are also added in riscv_cpu_named_features(). There is a reason for that, and the existing docs can do better explaining it. Signed-off-by: Daniel Henrique Barboza Message-ID: <202505292

[PULL 37/40] target/riscv: Fix MEPC/SEPC bit masking for IALIGN

From: Charalampos Mitrodimas According to the RISC-V Privileged Architecture specification, the low bit of MEPC/SEPC must always be zero. When IALIGN=32, the two low bits must be zero. This commit fixes the behavior of MEPC/SEPC CSR reads and writes, and the implicit reads by MRET/SRET instructi

[PULL 35/40] target/riscv: rvv: Fix missing exit TB flow for ldff_trans

From: Max Chou According to the V spec, the vector fault-only-first load instructions may change the VL CSR. So the ldff_trans TCG translation function should generate the lookup_and_goto_ptr flow as the vsetvl/vsetvli translation function to make sure the vl_eq_vlmax TB flag is correct. Signed-

[PULL 20/40] hw/char: sifive_uart: Avoid infinite delay of async xmit function

From: Florian Lugou The current handler for TXFIFO writes schedules an async callback to pop characters from the queue. When software writes to TXFIFO faster than the async callback delay (100ns), the timer may be pushed back while the previous character has not be dequeued yet. This happens in p

[PULL 17/40] hw/riscv/riscv-iommu: Fix PPN field of Translation-reponse register

From: Nutty Liu The original implementation incorrectly performed a bitwise AND operation between the PPN of iova and PPN Mask, leading to an incorrect PPN field in Translation-reponse register. The PPN of iova should be set entirely in the PPN field of Translation-reponse register. Also remove

[PULL 25/40] hw/riscv/virt: Use setprop_sized_cells for aclint

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 32/40] hw/riscv/virt: Use setprop_sized_cells for pcie

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 36/40] migration: Fix migration failure when aia is configured as aplic-imsic

From: "liu.xuem...@zte.com.cn" Address an error in migration when aia is configured as 'aplic-imsic' in riscv kvm vm by adding riscv_aplic_state_needed() and riscv_imsic_state_needed() to determine whether the corresponding sates are needed. Previously, the fields in the vmsds of 'riscv_aplic' a

[PULL 19/40] target/riscv: Fix fcvt.s.bf16 NaN box checking

From: Anton Blanchard fcvt.s.bf16 uses the FP16 check_nanbox_h() which returns an FP16 quiet NaN. Add check_nanbox_bf16() which returns a BF16 quiet NaN. Signed-off-by: Anton Blanchard Acked-by: Alistair Francis Message-ID: <20250501114253.594887-1-ant...@tenstorrent.com> Signed-off-by: Alista

[PULL 28/40] hw/riscv/virt: Use setprop_sized_cells for reset

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 34/40] hw/riscv: Initial support for BOSC's Xiangshan Kunminghu FPGA prototype

From: Huang Borong <3543977...@qq.com> This implementation provides emulation for the Xiangshan Kunminghu FPGA prototype platform, including support for UART, CLINT, IMSIC, and APLIC devices. More details can be found at https://github.com/OpenXiangShan/XiangShan Signed-off-by: qinshaoqing Signe

[PULL 30/40] hw/riscv/virt: Use setprop_sized_cells for rtc

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 22/40] hw/riscv/virt: Use setprop_sized_cells for clint

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 26/40] hw/riscv/virt: Use setprop_sized_cells for plic

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 24/40] hw/riscv/virt: Use setprop_sized_cells for aplic

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 31/40] hw/riscv/virt: Use setprop_sized_cells for iommu

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 39/40] target/riscv: Add a property to set vill bit on reserved usage of vsetvli instruction

From: Vasilis Liaskovitis Usage of vsetvli instruction is reserved if VLMAX is changed when vsetvli rs1 and rd arguments are x0. In this case, if the new property is true, only the vill bit will be set. See https://github.com/riscv/riscv-isa-manual/blob/main/src/v-st-ext.adoc#avl-encoding Acco

[PULL 10/40] target/riscv: remove capital 'Z' CPU properties

From: Daniel Henrique Barboza These properties were deprecated in QEMU 8.2, commit 8043effd9b. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250530134608.1806922-1-dbarb...@ventanamicro.com> Signed-off-by: Alistair Francis --- target/riscv/cpu.h

[PULL 23/40] hw/riscv/virt: Use setprop_sized_cells for memory

From: Joel Stanley Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Signed-off-by: Joel Stanley Message-ID: <20250604025450.85327-4-j...@jms.id.au> Signed-off-by: Alistair F

[PULL 33/40] target/riscv: Add BOSC's Xiangshan Kunminghu CPU

From: Huang Borong <3543977...@qq.com> Add a CPU entry for the Xiangshan Kunminghu CPU, an open-source, high-performance RISC-V processor. More details can be found at: https://github.com/OpenXiangShan/XiangShan Note: The ISA extensions supported by the Xiangshan Kunminghu CPU are categorized bas

[PULL 18/40] target/riscv: use qemu_chr_fe_write_all() in DBCN_CONSOLE_WRITE_BYTE

From: Daniel Henrique Barboza The SBI spec states, for console write byte: "This is a blocking SBI call and it will only return after writing the specified byte to the debug console. It will also return, with SBI_ERR_FAILED, if there are I/O errors." Being a blocker call will either succeed wri

[PULL 29/40] hw/riscv/virt: Use setprop_sized_cells for uart

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 12/40] target/riscv/cpu.c: add 'ssstrict' to riscv, isa

From: Daniel Henrique Barboza 'ssstrict' is a RVA23 profile-defined extension defined as follows: "No non-conforming extensions are present. Attempts to execute unimplemented opcodes or access unimplemented CSRs in the standard or reserved encoding spaces raises an illegal instruction exception

[PULL 08/40] target/riscv: add profile->present flag

From: Daniel Henrique Barboza Björn reported in [1] a case where a rv64 CPU is going through the profile code path to enable satp mode. In this case,the amount of extensions on top of the rv64 CPU made it compliant with the RVA22S64 profile during the validation of CPU 0. When the subsequent CPUs

[PULL 21/40] hw/riscv/virt: Fix clint base address type

From: Joel Stanley The address is a hardware address, so use hwaddr for consistency with the rest of the machine. Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Signed-off-by: Joel Stanley Message-ID: <20250604025450.85327-2-j...@jms.id.au> Signed-off-by: Alistair Francis

[PULL 11/40] target/riscv/cpu.c: add 'sdtrig' in riscv,isa

From: Daniel Henrique Barboza We have support for sdtrig for awhile but we are not advertising it. It is enabled by default via the 'debug' flag. Use the same flag to also advertise sdtrig. Add an exception in disable_priv_spec_isa_exts() to avoid spamming warnings for 'sdtrig' for vendor CPUs l

[PULL 16/40] target/riscv: Make PMP region count configurable

From: Jay Chang Previously, the number of PMP regions was hardcoded to 16 in QEMU. This patch replaces the fixed value with a new `pmp_regions` field, allowing platforms to configure the number of PMP regions. If no specific value is provided, the default number of PMP regions remains 16 to pres

[PULL 07/40] target/riscv/tcg: decouple profile enablement from user prop

From: Daniel Henrique Barboza We have code in riscv_cpu_add_profiles() to enable a profile right away in case a CPU chose the profile during its cpu_init(). But we're using the user callback option to do so, setting profile->user_set. Create a new helper that does all the grunt work to enable/di

[PULL 04/40] target/riscv: Enable/Disable S/VS-mode Timer when STCE bit is changed

From: Jim Shu Updating STCE will enable/disable SSTC in S-mode or/and VS-mode, so we also need to update S/VS-mode Timer and S/VSTIP bits in $mip CSR. Signed-off-by: Jim Shu Acked-by: Alistair Francis Message-ID: <20250519143518.11086-5-jim@sifive.com> Signed-off-by: Alistair Francis ---

[PULL 27/40] hw/riscv/virt: Use setprop_sized_cells for virtio

From: Joel Stanley The current device tree property uses two cells for the address (and for the size), but assumes the they are less than 32 bits by hard coding the high cell to zero. Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper and lower 32 bits across cells. Reviewed-

[PULL 02/40] hw/intc: riscv_aclint: Fix mtime write for sstc extension

From: Jim Shu When changing the mtime value, the period of [s|vs]timecmp timers should also be updated, similar to the period of mtimecmp timer. The period of the stimecmp timer is the time until the next S-mode timer IRQ. The value is calculated as "stimecmp - time". [1] It is equal to "stimecm

[PULL 15/40] target/riscv/kvm: add max_satp_mode from host cpu

From: Meng Zhuo This patch adds max_satp_mode from host kvm cpu setting. Tested on: Milkv Megrez (Eswin 7700x) Reviewed-by: Andrew Jones Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2931 Signed-off-by: Meng Zhuo Message-ID: <20250606034250.181707-1-mengz...@iscas.ac.cn> Signed-off-

[PULL 00/40] riscv-to-apply queue

From: Alistair Francis The following changes since commit c77283dd5d79149f4e7e9edd00f65416c648ee59: Merge tag 'pull-request-2025-07-02' of https://gitlab.com/thuth/qemu into staging (2025-07-03 06:01:41 -0400) are available in the Git repository at: https://github.com/alistair2

[PULL 05/40] target/riscv/cpu.c: fix zama16b order in isa_edata_arr[]

From: Daniel Henrique Barboza Put it after zalrsc and before zawrs. Cc: qemu-triv...@nongnu.org Fixes: a60ce58fd9 ("target/riscv: Support Zama16b extension") Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250522113344.823294-1-dbarb...@ventanamicro.com> Sig

[PULL 06/40] target/riscv/tcg: restrict satp_mode changes in cpu_set_profile

From: Daniel Henrique Barboza We're changing 'mmu' to true regardless of whether the profile is being enabled or not, and at the same time we're changing satp_mode to profile->enabled. This will promote a situation where we'll set mmu=on without a virtual memory mode, which is a mistake. Only t

[PULL 09/40] target/riscv: Extend PMP region up to 64

From: Jay Chang According to the RISC-V Privileged Specification (version >1.12), RV32 supports 16 CSRs (pmpcfg0–pmpcfg15) to configure 64 PMP regions (pmpaddr0–pmpaddr63). Signed-off-by: Jay Chang Reviewed-by: Frank Chang Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Me

[PULL 03/40] target/riscv: Fix VSTIP bit in sstc extension.

From: Jim Shu VSTIP is only writable when both [mh]envcfg.STCE is enabled, or it will revert it's defined behavior as if sstc extension is not implemented. Signed-off-by: Jim Shu Acked-by: Alistair Francis Message-ID: <20250519143518.11086-4-jim@sifive.com> Signed-off-by: Alistair Francis

[PULL 00/56] riscv-to-apply queue

From: Alistair Francis The following changes since commit 757a34115e7491744a63dfc3d291fd1de5297ee2: Merge tag 'pull-nvme-20250515' of https://gitlab.com/birkelund/qemu into staging (2025-05-15 13:42:27 -0400) are available in the Git repository at: https://github.com/alistair2

[PULL 27/56] target/riscv: rvv: Apply vext_check_input_eew to vector narrow/widen instructions

From: Max Chou Handle the overlap of source registers with different EEWs. The vd of vector widening mul-add instructions is one of the input operands. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-9-max.c...@s

[PULL 22/56] target/riscv: rvv: Apply vext_check_input_eew to vrgather instructions to check mismatched input EEWs encoding constraint

From: Max Chou According to the v spec, a vector register cannot be used to provide source operands with more than one EEW for a single instruction. The vs1 EEW of vrgatherei16.vv is 16. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <

[PULL 50/56] hw/riscv/virt.c: use s->memmap in virt_machine_done()

From: Daniel Henrique Barboza Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-4-dbarb...@ventanamicro.com> Signed-off-by: Alistair Francis --- hw/riscv/virt.c | 15 +++ 1 file changed, 7 insertions(+), 8 deletions(-) diff --

[PULL 05/56] target/riscv: pmp: fix checks on writes to pmpcfg in Smepmp MML mode

From: Loïc Lefort With Machine Mode Lockdown (mseccfg.MML) set and RLB not set, checks on pmpcfg writes would match the wrong cases of Smepmp truth table. The existing code allows writes for the following cases: - L=1, X=0: cases 8, 10, 12, 14 - L=0, RWX!=WX: cases 0-2, 4-6 This leaves cases 3,

[PULL 48/56] hw/riscv/virt.c: enforce s->memmap use in machine_init()

From: Daniel Henrique Barboza Throughout the code we're accessing the board memmap, most of the time, by accessing it statically via 'virt_memmap'. This static map is also assigned in the machine state in s->memmap. We're also passing it as a variable to some fdt functions, which is unorthodox s

[PULL 23/56] target/riscv: rvv: Apply vext_check_input_eew to OPIVI/OPIVX/OPFVF(vext_check_ss) instructions

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-5-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 32/56] target/riscv: Pass ra to riscv_csr_write_fn

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-2-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/cpu.h | 3 +-

[PULL 16/56] Expand the probe_pages helper function to handle probe flags.

From: Paolo Savini This commit expands the probe_pages helper function in target/riscv/vector_helper.c to handle also the cases in which we need access to the flags raised while probing the memory and the host address. This is done in order to provide a unified interface to probe_access and probe

[PULL 55/56] hw/riscv/virt.c: use s->memmap in finalize_fdt() functions

From: Daniel Henrique Barboza Change create_fdt_pcie(), create_fdt_reset(), create_fdt_uart() and create_fdt_rtc() to use s->memmap in their logic. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-9-dbarb...@ventanamicro.com> Signed-off-by

[PULL 54/56] hw/riscv/virt.c: use s->memmap in create_fdt_virtio()

From: Daniel Henrique Barboza create_fdt_virtio() can use s->memmap instead of having an extra argument for it. While we're at it rewrite it a little bit to avoid the clunky line in 'name' and code repetition: - declare 'virtio_base' out of the loop since it never changes; - declare a 'size' va

[PULL 20/56] target/riscv: rvv: Source vector registers cannot overlap mask register

From: Anton Blanchard Add the relevant ISA paragraphs explaining why source (and destination) registers cannot overlap the mask register. Signed-off-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Reviewed-by: Max Chou Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-2-ma

[PULL 40/56] target/riscv/kvm: fix leak in kvm_riscv_init_multiext_cfg()

From: Daniel Henrique Barboza 'reglist' is being g-malloc'ed but never freed. Reported-by: Andrew Jones Signed-off-by: Daniel Henrique Barboza Reviewed-by: Andrew Jones Reviewed-by: Alistair Francis Message-ID: <20250429124421.223883-3-dbarb...@ventanamicro.com> Signed-off-by: Alistair Franc

[PULL 37/56] target/riscv: Move insn_len to internals.h

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-7-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/internals.h | 5

[PULL 42/56] target/riscv/kvm: turn kvm_riscv_reg_id_ulong() into a macro

From: Daniel Henrique Barboza We need the reg_id_ulong() helper to be a macro to be able to create a static array of KVMCPUConfig that will hold CSR information. Despite the amount of changes all of them are tedious/trivial: - replace instances of "kvm_riscv_reg_id_ulong" with "KVM_RISCV_REG_

[PULL 31/56] MAINTAINERS: Add common-user/host/riscv to RISC-V section

From: Alistair Francis Signed-off-by: Alistair Francis Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250422024752.2060289-1-alistair.fran...@wdc.com> Signed-off-by: Alistair Francis --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 57dddc

[PULL 35/56] target/riscv: Pass ra to riscv_csrrw

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-5-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/cpu.h | 8

[PULL 41/56] target/riscv/kvm: turn u32/u64 reg functions into macros

From: Daniel Henrique Barboza This change is motivated by a future change w.r.t CSRs management. We want to handle them the same way as KVM extensions, i.e. a static array with KVMCPUConfig objs that will be read/write during init and so on. But to do that properly we must be able to declare a st

[PULL 24/56] target/riscv: rvv: Apply vext_check_input_eew to OPIVV/OPFVV(vext_check_sss) instructions

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-6-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 38/56] target/riscv: Fix write_misa vs aligned next_pc

From: Richard Henderson Do not examine a random host return address, but properly compute the next pc for the guest cpu. Fixes: f18637cd611 ("RISC-V: Add misa runtime write support") Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-b

[PULL 09/56] hw/misc: Add MPFS system reset support

From: Sebastian Huber Signed-off-by: Sebastian Huber Acked-by: Alistair Francis Message-ID: <20250319061342.26435-2-sebastian.hu...@embedded-brains.de> Signed-off-by: Alistair Francis --- hw/misc/mchp_pfsoc_sysreg.c | 7 +++ 1 file changed, 7 insertions(+) diff --git a/hw/misc/mchp_pfsoc

[PULL 51/56] hw/riscv/virt.c: add 'base' arg in create_fw_cfg()

From: Daniel Henrique Barboza The function can receive the value via s->memmap[VIRT_FW_CFG].base from the caller, avoiding the use of virt_memmap. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-5-dbar

[PULL 47/56] target/riscv/kvm: add scounteren CSR

From: Daniel Henrique Barboza Add support for the scounteren KVM CSR. Note that env->scounteren is a 32 bit and all KVM CSRs are target_ulong, so scounteren will be capped to 32 bits read/writes. Reported-by: Andrew Jones Signed-off-by: Daniel Henrique Barboza Reviewed-by: Andrew Jones Review

[PULL 46/56] target/riscv/kvm: read/write KVM regs via env size

From: Daniel Henrique Barboza We're going to add support for scounteren in the next patch. KVM defines as a target_ulong CSR, while QEMU defines env->scounteren as a 32 bit field. This will cause the current code to read/write a 64 bit CSR in a 32 bit field when running in a 64 bit CPU. To preve

[PULL 49/56] hw/riscv/virt.c: remove trivial virt_memmap references

From: Daniel Henrique Barboza We should use s->memmap instead of virt_memmap to be able to use an updated memmap when we start versioning the board. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-3-dbarb...@ventanamicro.com> Signed-off-b

[PULL 43/56] target/riscv/kvm: add kvm_csr_cfgs[]

From: Daniel Henrique Barboza At this moment we're not checking if the host has support for any specific CSR before doing get/put regs. This will cause problems if the host KVM doesn't support it (see [1] as an example). We'll use the same approach done with the CPU extensions: read all known KV

[PULL 53/56] hw/riscv/virt.c: use s->memmap in create_fdt_sockets() path

From: Daniel Henrique Barboza create_fdt_sockets() and all its fdt helpers (create_fdt_socket_aplic(), create_fdt_imsic(), create_fdt_socket_plic(), create_fdt_socket_aclint() and create_fdt_socket_memory()) can use s->memmap from their RISCVVirtState pointer instead of having an extra memmap arg

[PULL 15/56] target/riscv: use tcg ops generation to emulate whole reg rvv loads/stores.

From: Paolo Savini This patch replaces the use of a helper function with direct tcg ops generation in order to emulate whole register loads and stores. This is done in order to improve the performance of QEMU. We still use the helper function when vstart is not 0 at the beginning of the emulation

[PULL 44/56] target/riscv/kvm: do not read unavailable CSRs

From: Daniel Henrique Barboza [1] reports that commit 4db19d5b21 broke a KVM guest running kernel 6.6. This happens because the kernel does not know 'senvcfg', making it unable to boot because QEMU is reading/wriiting it without any checks. After converting the CSRs to do "automated" get/put reg

[PULL 45/56] target/riscv/kvm: add senvcfg CSR

From: Daniel Henrique Barboza We're missing the senvcfg CSRs which is already present in the KVM UAPI. Reported-by: Andrew Jones Signed-off-by: Daniel Henrique Barboza Reviewed-by: Andrew Jones Acked-by: Alistair Francis Message-ID: <20250429124421.223883-8-dbarb...@ventanamicro.com> Signed-

[PULL 17/56] hw/riscv: Fix type conflict of GLib function pointers

From: Paolo Bonzini qtest_set_command_cb passed to g_once should match GThreadFunc, which it does not. But using g_once is actually unnecessary, because the function is called by riscv_harts_realize() under the Big QEMU Lock. Reported-by: Kohei Tokunaga Signed-off-by: Paolo Bonzini Reviewed-b

[PULL 30/56] target/riscv: Fix vslidedown with rvv_ta_all_1s

From: Anton Blanchard vslidedown always zeroes elements past vl, where it should use the tail policy. Signed-off-by: Anton Blanchard Reviewed-by: Alistair Francis Message-ID: <20250414213006.3509058-1-ant...@tenstorrent.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- targ

[PULL 56/56] hw/riscv/virt.c: remove 'long' casts in fmt strings

From: Daniel Henrique Barboza We can avoid the 'long' casts by using PRIx64 and HWADDR_PRIx on the fmt strings for uint64_t and hwaddr types. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-10-dbarb...

[PULL 08/56] Generate strided vector loads/stores with tcg nodes.

From: Paolo Savini This commit improves the performance of QEMU when emulating strided vector loads and stores by substituting the call for the helper function with the generation of equivalent TCG operations. Signed-off-by: Paolo Savini Reviewed-by: Daniel Henrique Barboza Message-ID: <202503

[PULL 34/56] target/riscv: Pass ra to riscv_csrrw_do128

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-4-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/csr.c | 9 +

[PULL 21/56] target/riscv: rvv: Add CHECK arg to GEN_OPFVF_WIDEN_TRANS

From: Anton Blanchard Signed-off-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Reviewed-by: Max Chou Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-3-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- target/riscv/insn_trans/trans_rvv

[PULL 36/56] target/riscv: Pass ra to riscv_csrrw_i128

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-6-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/cpu.h | 4

[PULL 11/56] hw/riscv: Make FDT optional for MPFS

From: Sebastian Huber Real-time kernels such as RTEMS or Zephyr may use a static device tree built into the kernel image. Do not require to use the -dtb option if -kernel is used for the microchip-icicle-kit machine. Issue a warning if no device tree is provided by the user since the machine do

[PULL 03/56] target/riscv: pmp: don't allow RLB to bypass rule privileges

From: Loïc Lefort When Smepmp is supported, mseccfg.RLB allows bypassing locks when writing CSRs but should not affect interpretation of actual PMP rules. This is not the case with the current implementation where pmp_hart_has_privs calls pmp_is_locked which implements mseccfg.RLB bypass. This

[PULL 06/56] target/riscv: pmp: exit csr writes early if value was not changed

From: Loïc Lefort Signed-off-by: Loïc Lefort Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Reviewed-by: LIU Zhiwei Message-ID: <20250313193011.720075-5-l...@rivosinc.com> Signed-off-by: Alistair Francis --- target/riscv/pmp.c | 22 +++--- 1 file changed,

[PULL 33/56] target/riscv: Pass ra to riscv_csrrw_do64

From: Richard Henderson Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250425152311.804338-3-richard.hender...@linaro.org> Signed-off-by: Alistair Francis --- target/riscv/csr.c | 15

[PULL 29/56] target/riscv: Fix the rvv reserved encoding of unmasked instructions

From: Max Chou According to the v spec, the encodings of vcomoress.vm and vector mask-register logical instructions with vm=0 are reserved. Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-11-max.c...@sifive.com> Signed-off-by: Alistair Francis

[PULL 25/56] target/riscv: rvv: Apply vext_check_input_eew to vector slide instructions(OPIVI/OPIVX)

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-7-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 39/56] target/riscv/kvm: minor fixes/tweaks

From: Daniel Henrique Barboza Remove an unused 'KVMScratchCPU' pointer argument in kvm_riscv_check_sbi_dbcn_support(). Put kvm_riscv_reset_regs_csr() after kvm_riscv_put_regs_csr(). This will make a future patch diff easier to read, when changes in kvm_riscv_reset_regs_csr() and kvm_riscv_get_re

[PULL 52/56] hw/riscv/virt.c: use s->memmap in create_fdt() path

From: Daniel Henrique Barboza create_fdt(), create_fdt_flash() and create_fdt_fw_cfg() can access the memmap via their RISCVVirtState pointers. Signed-off-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Message-ID: <20250429125811.224803-6-dbarb...@ventanamicro.com> Signed-off-by: Al

[PULL 01/56] hw/riscv/virt: Add the BDF of IOMMU to RISCVVirtState structure

From: Sunil V L When the IOMMU is implemented as a PCI device, its BDF is created locally in virt.c. However, the same BDF is also required in virt-acpi-build.c to support ACPI. Therefore, make this information part of the global RISCVVirtState structure so that it can be accessed outside of virt

[PULL 04/56] target/riscv: pmp: move Smepmp operation conversion into a function

From: Loïc Lefort Signed-off-by: Loïc Lefort Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Reviewed-by: LIU Zhiwei Message-ID: <20250313193011.720075-3-l...@rivosinc.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- target/riscv/pmp.c | 22

[PULL 13/56] hw/riscv: Configurable MPFS CLINT timebase freq

From: Sebastian Huber This property enables the setting of the CLINT timebase frequency through the command line, for example: -machine microchip-icicle-kit,clint-timebase-frequency=1000 Signed-off-by: Sebastian Huber Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Me

[PULL 28/56] target/riscv: rvv: Apply vext_check_input_eew to vector indexed load/store instructions

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-10-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org ---

[PULL 26/56] target/riscv: rvv: Apply vext_check_input_eew to vector integer extension instructions(OPMVV)

From: Max Chou Handle the overlap of source registers with different EEWs. Co-authored-by: Anton Blanchard Reviewed-by: Daniel Henrique Barboza Signed-off-by: Max Chou Message-ID: <20250408103938.3623486-8-max.c...@sifive.com> Signed-off-by: Alistair Francis Cc: qemu-sta...@nongnu.org --- t

[PULL 19/56] common-user/host/riscv: use tail pseudoinstruction for calling tail

From: Icenowy Zheng The j pseudoinstruction maps to a JAL instruction, which can only handle a jump to somewhere with a signed 20-bit destination. In case of static linking and LTO'ing this easily leads to "relocation truncated to fit" error. Switch to use tail pseudoinstruction, which is the st

[PULL 18/56] target/riscv: fix endless translation loop on big endian systems

From: Ziqiao Kong On big endian systems, pte and updated_pte hold big endian host data while pte_pa points to little endian target data. This means the branch at cpu_helper.c:1669 will be always satisfied and restart translation, causing an endless translation loop. The correctness of this patch

[PULL 14/56] hw/riscv: microchip_pfsoc: Rework documentation

From: Sebastian Huber Mention that running the HSS no longer works. Document the changed boot options. Reorder documentation blocks. Update URLs. Signed-off-by: Sebastian Huber Reviewed-by: Alistair Francis Message-ID: <20250319061342.26435-7-sebastian.hu...@embedded-brains.de> Signed-off-b

[PULL 12/56] hw/riscv: Allow direct start of kernel for MPFS

From: Sebastian Huber Further customize the -bios and -kernel options behaviour for the microchip-icicle-kit machine. If "-bios none -kernel filename" is specified, then do not load a firmware and instead only load and start the kernel image. For test runs, use an approach similar to riscv_find

[PULL 10/56] hw/riscv: More flexible FDT placement for MPFS

From: Sebastian Huber If the kernel entry is in the high DRAM area, place the FDT into this area. Signed-off-by: Sebastian Huber Reviewed-by: Alistair Francis Message-ID: <20250319061342.26435-3-sebastian.hu...@embedded-brains.de> Signed-off-by: Alistair Francis --- hw/riscv/microchip_pfsoc.

[PULL 02/56] hw/riscv/virt-acpi-build: Add support for RIMT

From: Sunil V L RISC-V IO Mapping Table (RIMT) is a new static ACPI table used to communicate IOMMU information to the OS. Add support for creating this table when the IOMMU is present. The specification is frozen and available at [1]. [1] - https://github.com/riscv-non-isa/riscv-acpi-rimt/rele

[PULL 07/56] target/riscv: pmp: remove redundant check in pmp_is_locked

From: Loïc Lefort Remove useless check in pmp_is_locked, the function will return 0 in either case. Signed-off-by: Loïc Lefort Reviewed-by: Daniel Henrique Barboza Reviewed-by: Alistair Francis Reviewed-by: LIU Zhiwei Message-ID: <20250313193011.720075-6-l...@rivosinc.com> Signed-off-by: Ali