We can now demonstrate what previous changes allow us to do. Since all
callbacks have a userdata pointer, we can use that mechanism to move an
object through all of them.
In other words, we can now have stateful plugins without resorting to
any global variable.
As an example, we implement tb counting plugin with our cpp plugin. It
produces an output similar to hotblocks, with same performance.
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260615193526.2883349-27-pierrick.bouvier@oss.qualcomm.com
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
C++ has a different style when it comes to space around references,
dereferences, so don't report it.
Also, closing templates with >> gets wrongly confused with >> operator,
so just relax this check.
Some examples:
ERROR: spaces required around that '&' (ctx:WxV)
+ auto &[counter, p] = *static_cast<TbData*>(udata);
^
ERROR: spaces required around that '*' (ctx:VxO)
+ auto &[counter, p] = *static_cast<TbData*>(udata);
^
ERROR: spaces required around that '>>' (ctx:VxW)
+ std::vector<std::pair<Vaddr, uint64_t>> v; ^
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260615193526.2883349-25-pierrick.bouvier@oss.qualcomm.com
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
RISC-V PR for 11.1
* Disable svpbmt if satp_mode is less then sv39
* Fix PMP address alignment
* Mstatus write bug fixes
* Add 'cbo' insns to disassembler
* Do not hide Sstc CSRs from gdbstub
* Reject Svinval instructions in U-mode
* Save opcode before zicbo helpers
* Fault with reserved PTE.PBMT val
* Allow LOAD_ADDR_MIS promotion to AMO fault
* Make riscv cpu.h target independent
* Add PMA access fault
* Disable svnapot if satp_mode is less then sv39
* Fix disassembler inst_length calculation
* Add RISC-V big-endian target support
* Add the implied rules for G and B extensions
* Print privilege level and ELP in riscv_cpu_dump_state
* Improve alignment in riscv_cpu_dump_state
* Mask vxrm csrw write to the low 2 bits
* Reorder Smrnmi CPU fields above CPU reset line
* Supplement cpu topology arguments
* Don't insert DDT cache in Bare mode
* Fix 'iommu-map' FDT entry
* Fix mstatus.FS dirty tracking for FP exception-raising instructions
* Enable `mnret` disassembly
* Add support for K230 board
* FDT creation helpers
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmoxH8EACgkQr3yVEwxT
# gBOA0A/9EoqSh73fuWzBwOANN7sXBDRJwOzCetvoTqyXzbUtQJGPbslldLDoYA0K
# GfqdmFNqi6pp01pBm/eWUu2vxid1d1IID+4g7LQ1TIyexbc58Qm7Hb1r+F1RSLj4
# NcZc+RGvJ+3D/hXUfj1dnT+yxUDsVAuf1NPONR9E9CD4q8gkvtA79Lwj3o/2Ks18
# 02ZPi8+vc5XmSjtwGVFdcxu4je89vvhzl4P+zwZMKOOU04bpsCG5chSRfSiGUnuz
# jae/5YDOk4v6T61Yt3kDFc9CkuenhiDSHMiQy/PD/ufvBOlA3EzyIago3SO0DP9d
# ZW+aVHOJ7SgcUPFbj6kkLo/FhXraXmKVo4vDhASoKHydoL1s6ZAR7TCAwLXa39Rq
# z15OGtRzdQX48AkeUjeN+Mz6lxHusm4MmsBhMAnPxzhiGRjOH024SR2C9iSeuB4h
# mMmYi25z48NLK5oilEhPAy37xUYUuRa+HoO07puQdLLReiuMyIWAwubhwMsog3MR
# IULX57BlxrxqVSt3z7sLGAwBEz353ARYNSiDYR+2XXt8Qjy6kY7ONrSfeJMhjbH7
# wrYQ0+30Af+b7Lpm8kpapeEsn1KWYIJU//ji5tbgAmd0sSLCiAqZX6GwzFKoGUKO
# u9Gc+A7vISxD5bBw33Z0Pp/zL1QUBom/pdZUHhaAGtKIuwLSA8s=
# =iXpr
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 16 Jun 2026 06:04:49 EDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260616' of https://github.com/alistair23/qemu: (83 commits)
hw/riscv: add create_fdt_socket_cpu_sifive()
hw/riscv/fdt_common.c: create create_fdt_socket_cpu_internal()
hw/riscv/spike.c: use create_fdt_socket_cpus()
hw/riscv: add create_fdt_socket_cpus()
hw/riscv: add fdt_create_cpu_socket_subnode() helper
hw/riscv/sifive_u.c: add cpu-map, cluster and core DTs
hw/riscv: add create_fdt_clint() helper
hw/riscv/spike.c: add intc_phandles array
hw/riscv/sifive_u.c: add intc_phandles array
hw/riscv: add create_fdt_socket_memory() helper
hw/riscv/numa: make numa_enabled() public
hw/riscv: add fdt-common helper
hw/riscv/sifive_u.c: add a FDT phandle to cpu-intc
docs/system/riscv: add documentation for k230 machine
tests/qtest: add test for K230 watchdog
hw/watchdog: add k230 watchdog initial support
hw/riscv: add k230 board initial support
target/riscv: add thead-c908 cpu support
disas/riscv: enable `mnret` disassembly
target/riscv: rvv: Set mstatus.FS dirty when vector FP raises exceptions
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The sifive_u board does not share the same CPU socket FDT bits from the
other boards. In particular the riscv,isa creation is done using either
CPU0 from soc.e_cpus.harts, and for all other CPUs soc.u_cups.harts is
used.
It would be too cumbersome to add all these details in the common code
so we're going to add a special sifive_u only helper that shares the
common bits with the common helper used by the other boards.
create_fdt_socket_cpu_internal() contains the common bits shared between
the sifive_u board and the rest.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260615203734.954428-13-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
We want to consolidate the CPU socket FDT creation into a single helper.
'virt' and spike has the same code but sifive_u does not have cpu-map,
cluster and core subnodes.
These subnodes are present in other boards even in single socket configs
without NUMA. This is a strong indicator that their presence doesn't
hurt a NUMA-less board like sifive_u.
Add these DTs to make the FDT standardization straightforward.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260615203734.954428-9-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
The clint FDT generation uses a cells array (clint_cells) that are
populated in the middle of the loop that creates the CPU socket FDT.
This is completely fine but it differs from the other boards that
creates the clint cells array right before creating the clint FDT.
'virt' and 'sifive_u' store the intc phandles in a intc_phandles array
during FDT CPU socket creation, and this array is used to create the
clint FDT cells.
Standardize the clint FDT creation for spike doing the same here,
allowing us to move everything to a common helper later.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260615203734.954428-7-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
There's FDT logic gated around 'numa_enabled()' in virt.c and spike.c.
We want to move the FDT code to a common helper without having to call
hw/riscv/numa.c functions from it, but at the same time being aware of
the FDT changes if numa is enabled.
To do that the boards will inform the FDT helpers if we have
numa_enabled in the env or not. And for the boards to be able to do
that we need the static 'numa_enabled' function to be public.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260615203734.954428-4-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
According to the RISC-V privileged spec 3.1.6, any instruction that
modifies FP extension state (FP CSRs including fflags, or f registers)
must set mstatus.FS to Dirty. Raising fflags bits is modifying fcsr
(an FP CSR).
When a vector FP instruction raises a floating-point exception, it
modifies fflags (an FP CSR), but current implementation was not marking
mstatus.FS dirty in this case.
Fix the issue by snapshot fflags before the element loop and OR
MSTATUS_FS into env->mstatus if any new exception bits are set
afterwards.
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260611105037.157773-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
According to the RISC-V privileged spec 3.1.6, any instruction that
modifies FP extension state (FP CSRs including fflags, or f registers)
must set mstatus.FS to Dirty. Raising fflags bits is modifying fcsr
(an FP CSR).
Scalar FP instructions that write integer registers (FP comparisons and
FP-to-integer conversions) never call mark_fs_dirty at translation time
to set mstatus.FS to dirty. However, they can raise FP exception flags
via softfloat functions, which modifies fflags without any mechanism to
dirty mstatus.FS.
The affected helpers:
- Comparisons: fle/fleq/flt/fltq/feq
— raise NV on NaN operands
- FP-to-integer: fcvt.[w|wu|l|lu]/fcvtmod.w.d
— raise NX on inexact or NV on out-of-range
Fix this issue by
1. Save float_exception_flags before the softfloat operation
2. Perform the operation
3. If any new exception bits are set, set fs to dirty
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260611105037.157773-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Based on the DT documentation of 'iommu-map':
https://www.kernel.org/doc/Documentation/devicetree/bindings/pci/pci-iommu.txt
- iommu-map: Maps a Requester ID to an IOMMU and associated IOMMU specifier
data.
The property is an arbitrary number of tuples of
(rid-base,iommu,iommu-base,length).
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
----------
We're adding a no-op entry (length = 0) in iommu-map:
qemu_fdt_setprop_cells(ms->fdt, name, "iommu-map",
0, iommu_sys_phandle, 0, 0, 0,
iommu_sys_phandle, 0, 0xffff);
This is easily seen in the generated DT:
iommu-map = <0x00 0x8000 0x00 0x00 0x00 0x8000 0x00 0xffff>;
The tuple (0 0 0x8000 0) does nothing since it has length = 0. The
information we want to advertise is in the second tuple only. Thus
remove the empty tuple.
While we're at it, seems like we've mistaken the API and we're using
0xffff as 'last address', but in fact it is length. This means that
we're telling the DT we're mapping 0x0 -> 0xfffe, which wasn't our
intention. Therefore change size to '0x10000' to reflect the address
mapping we want (0x0 -> 0xffff).
Found while reviewing the RISC-V Server Platform DT generation, which
happens to copy a lot of code from the 'virt' board, and this nit is
also present there.
Fixes: 2c12de1460 ("hw/riscv/virt: Add IOMMU as platform device if the option is set")
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20260608210642.464131-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
