QEMU CPU 建模流程：以 RISC-V 为例¶

QEMU 命令行
(-M virt -cpu ... -smp ... -numa ...)
        ↓
system/vl.c 解析机器类型和 CPU 选项
        ↓
MachineState.cpu_type 确定当前机器要使用的 CPU 型号
        ↓
板级代码创建一个或多个 RISCVHartArrayState
        ↓
每个 RISCVHartArrayState 实例化若干 RISCVCPU
        ↓
riscv_cpu_init() 把 RISCVCPUClass.def 的默认值写入实例
        ↓
CPU realize / accelerator 相关初始化
        ↓
进入运行阶段，执行翻译、异常、中断、CSR 等逻辑

TYPE_CPU
  └─ TYPE_RISCV_CPU
       ├─ TYPE_RISCV_DYNAMIC_CPU
       │    ├─ TYPE_RISCV_CPU_MAX
       │    ├─ TYPE_RISCV_CPU_BASE32
       │    ├─ TYPE_RISCV_CPU_BASE64
       │    └─ TYPE_RISCV_CPU_BASE128
       ├─ TYPE_RISCV_VENDOR_CPU
       │    ├─ TYPE_RISCV_CPU_IBEX
       │    ├─ TYPE_RISCV_CPU_SHAKTI_C
       │    ├─ TYPE_RISCV_CPU_THEAD_C906
       │    ├─ TYPE_RISCV_CPU_VEYRON_V1
       │    ├─ TYPE_RISCV_CPU_XIANGSHAN_NANHU
       │    └─ TYPE_RISCV_CPU_G233
       └─ TYPE_RISCV_BARE_CPU
            ├─ TYPE_RISCV_CPU_RV32I
            ├─ TYPE_RISCV_CPU_RV32E
            ├─ TYPE_RISCV_CPU_RV64I
            └─ TYPE_RISCV_CPU_RV64E

// path: target/riscv/cpu-qom.h
#define TYPE_RISCV_CPU_G233 RISCV_CPU_TYPE_NAME("g233-cpu")

// path: target/riscv/cpu.c
DEFINE_RISCV_CPU(TYPE_RISCV_CPU_G233, TYPE_RISCV_VENDOR_CPU,
    .misa_mxl_max = MXL_RV64,
    .misa_ext = RVI | RVM | RVA | RVC | RVU,
    .priv_spec = PRIV_VERSION_1_12_0,
    .vext_spec = VEXT_VERSION_1_00_0,
    .cfg.ext_xg233 = true,
    .cfg.ext_zicsr = true,
    .cfg.ext_zifencei = true,
    .cfg.mmu = true,
    .cfg.pmp = true,
    .cfg.max_satp_mode = VM_1_10_SV39,
),

// path: target/riscv/cpu.c
#define DEFINE_RISCV_CPU(type_name, parent_type_name, ...)  \
    {                                                       \
        .name = (type_name),                                \
        .parent = (parent_type_name),                       \
        .class_data = &(const RISCVCPUDef) {                \
             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
             .cfg.max_satp_mode = -1,                       \
             __VA_ARGS__                                    \
        },                                                  \
    }

// path: target/riscv/cpu.c
static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
{
    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
    RISCVCPUClass *pcc = RISCV_CPU_CLASS(object_class_get_parent(c));

    if (pcc->def) {
        mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
    } else {
        mcc->def = g_new0(RISCVCPUDef, 1);
    }

    if (data) {
        const RISCVCPUDef *def = data;
        ...
        mcc->def->misa_ext |= def->misa_ext;
        riscv_cpu_cfg_merge(&mcc->def->cfg, &def->cfg);
    }
}

// path: target/riscv/cpu.c
static void riscv_cpu_init(Object *obj)
{
    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(obj);
    RISCVCPU *cpu = RISCV_CPU(obj);
    CPURISCVState *env = &cpu->env;

    env->misa_mxl = mcc->def->misa_mxl_max;
    env->misa_ext_mask = env->misa_ext = mcc->def->misa_ext;
    riscv_cpu_cfg_merge(&cpu->cfg, &mcc->def->cfg);

    if (mcc->def->priv_spec != RISCV_PROFILE_ATTR_UNUSED) {
        cpu->env.priv_ver = mcc->def->priv_spec;
    }
    if (mcc->def->vext_spec != RISCV_PROFILE_ATTR_UNUSED) {
        cpu->env.vext_ver = mcc->def->vext_spec;
    }
    ...
}

// path: target/riscv/cpu_cfg.h
struct RISCVCPUConfig {
#define BOOL_FIELD(x) bool x;
#define TYPED_FIELD(type, x, default) type x;
#include "cpu_cfg_fields.h.inc"
};

// path: target/riscv/cpu_cfg_fields.h.inc
BOOL_FIELD(ext_xg233)

// path: target/riscv/cpu_cfg.h
MATERIALISE_EXT_PREDICATE(xg233)

// path: target/riscv/cpu.c
ISA_EXT_DATA_ENTRY(xg233, PRIV_VERSION_1_12_0, ext_xg233),

// path: target/riscv/cpu.c
const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[] = {
    ...
    MULTI_EXT_CFG_BOOL("xg233", ext_xg233, false),
    { },
};

// path: target/riscv/cpu.c
DEFINE_RISCV_CPU(TYPE_RISCV_CPU_G233, TYPE_RISCV_VENDOR_CPU,
    ...
    .cfg.ext_xg233 = true,
    ...
),

.misa_ext = RVI | RVM | RVA | RVC | RVU,
.cfg.ext_zicsr = true,
.cfg.ext_zifencei = true,
.cfg.ext_xg233 = true,

// path: system/vl.c
current_machine->cpu_type = machine_default_cpu_type(current_machine);
if (cpu_option) {
    current_machine->cpu_type = parse_cpu_option(cpu_option);
}

// path: target/riscv/cpu.c
static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
{
    ...
    typename = g_strdup_printf(RISCV_CPU_TYPE_NAME("%s"), cpuname[0]);
    oc = object_class_by_name(typename);
    ...
}

// path: hw/riscv/virt.c
mc->default_cpu_type = TYPE_RISCV_CPU_BASE;
mc->possible_cpu_arch_ids = riscv_numa_possible_cpu_arch_ids;
mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
mc->numa_mem_supported = true;
mc->cpu_cluster_has_numa_boundary = true;

// path: hw/riscv/numa.c
int riscv_socket_count(const MachineState *ms)
{
    return (numa_enabled(ms)) ? ms->numa_state->num_nodes : 1;
}

// path: hw/riscv/virt.c
object_initialize_child(OBJECT(machine), soc_name, &s->soc[i],
                        TYPE_RISCV_HART_ARRAY);
object_property_set_str(OBJECT(&s->soc[i]), "cpu-type",
                        machine->cpu_type, &error_abort);
object_property_set_int(OBJECT(&s->soc[i]), "hartid-base",
                        base_hartid, &error_abort);
object_property_set_int(OBJECT(&s->soc[i]), "num-harts",
                        hart_count, &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);

// path: hw/riscv/riscv_hart.c
static void riscv_harts_realize(DeviceState *dev, Error **errp)
{
    RISCVHartArrayState *s = RISCV_HART_ARRAY(dev);
    int n;

    s->harts = g_new0(RISCVCPU, s->num_harts);
    for (n = 0; n < s->num_harts; n++) {
        if (!riscv_hart_realize(s, n, s->cpu_type, errp)) {
            return;
        }
    }
}

// path: hw/riscv/riscv_hart.c
object_initialize_child(OBJECT(s), "harts[*]", &s->harts[idx], cpu_type);
qdev_prop_set_uint64(DEVICE(&s->harts[idx]), "resetvec", s->resetvec);
...
s->harts[idx].env.mhartid = s->hartid_base + idx;
return qdev_realize(DEVICE(&s->harts[idx]), NULL, errp);