RISC-V PR for 11.2
* Add experimental Zvabd extension support
* Mask vsepc according to IALIGN
* Reset vCPU on VM reset via MP_STATE_INIT_RECEIVED
* Improve modeling of the Atlantis UART
* Fix IOMMU entry leak with ioatc-limit=0
* Fix integer handling issues in k230_gsdma and k230_decomp_gzip
* Reclaim invalidated IOATC entries for IOMMU
* Duct tape fix for QMP and RV profiles introspection
* Move RISC-V 'Z' CPU properties section to removed features
* Use TSO barriers instead of full barriers for Ztso
* Make mnstatus.MNPELP writable with Zicfilp
* Gate envcfg CBO fields on extensions
* Fix stale PMP state across reset
* Use 1ULL for a value we're going to shift by 63
* Remove unused IMISC macro
* Encode debug translation ranges in IOMMU
* Allow regular mstatus MPV/GVA writes again
* Fix uninitialised upper half in pmu_timer_trigger_irq
* Fix CPU state access on big-endian hosts
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmrgREAACgkQr3yVEwxT
# gBPBHxAAmIzV1LXJAxQTvU46+1j+4+mSvGr37byb1iU8yg+dJCNtYpFLHKdNjF0Q
# Fn+5uBL+QJC3rEA0Xbq6iF4EP2GO8t/Qm4rElLmWCw1xzraj7RAZrNJHWCebLp1j
# PLS53gINaQNIuE6DC91mwcuWanKo7q+tvOiwcShaVyUH771J1+1xVOkpcbkQaVrZ
# a54IfHIcs4TIsKrpmxCJPkEuBcL4VtaK5JwcqbeCQQ68v7L7qQpec75t9idr3o25
# Pn/BOsHwkXoJ1qxFuY61JGhUpFKUzZIqd6HKqwv4SENZY+O87J79R9X/HU9H17xh
# B75+h91ZFSZ2luNd2vZCCMx4vOXuCa+YE/m0ZmyyjJnGLA4LHRoeFRmUUu5Dxzkn
# kP+psnaeUfcI6W71d8Dcqov1g1O7MBdVrQD1hzK8IeAuYL438cLZpo9WT6TVX5cn
# /DRCyDR4f6uzf8Lnh0wItJGzSUlW2xadFLu357KsJ0+lpytpmYolOBxUGJXtJu2g
# BSfgQX9y9xhszCbFopngunu3guOlDoHZEJ9l29+tXicezvJxXw+FRyc4EU3onRtz
# zXGWa7sN4XGifzoDorbVcWGpOT2w2LI1himS4N9qXWNCZ4s115xENMVCMDRt6a9Z
# aZRyBib2nbrrgnO4JJbxBUe/MViBfQlc+AuqMmEwrwdP3LRBbZA=
# =qxZ6
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 27 Oct 2026 01:27:12 AM CDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20261027' of https://github.com/alistair23/qemu: (29 commits)
target/riscv: Fix CPU state access on big-endian hosts
target/riscv: fix uninitialised upper half in pmu_timer_trigger_irq()
target/riscv/csr.c: allow regular mstatus MPV/GVA writes again
hw/riscv/riscv-iommu: encode debug translation ranges
include/hw/intc/riscv_imsic.h: remove unused macro
target/riscv: Use 1ULL for a value we're going to shift by 63
target/riscv: pmp: reset the derived PMP bounds and rule count
target/riscv: pmp: clear A and L on every implemented PMP entry at reset
target/riscv: gate envcfg CBO fields on extensions
target/riscv: make mnstatus.MNPELP writable with Zicfilp
target/riscv: Use TSO barriers instead of full barriers for Ztso
docs: Move RISC-V 'Z' CPU properties section to removed features
target/riscv/cpu.c: duct tape fix for QMP + RV profiles introspection
hw/riscv/riscv-iommu: reclaim invalidated IOATC entries
hw/riscv/riscv-iommu: serialize IOATC accesses
hw/dma: fix k230_gsdma integer handling issues
qtest: fix k230_decomp_gzip test integer handling issues
hw/misc: use hwaddr for the k230_decomp_gzip input address
hw/misc: fix calculating input address overflow in k230_decomp_gzip
hw/misc: fix calculating output address overflow in k230_decomp_gzip
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
s390x fixes/features for 11.2:
- Implement resizable vt220 console
- Deprecate dependencies of deprecated features
- Reclaim DMA slots during, for example, guest reboot
- MAINTAINERS updates
# -----BEGIN PGP SIGNATURE-----
#
# iIsEABYKADMWIQQB3Dhbwk4ZE3uUN6KmTx4R4Fx3tAUCat9bfhUcZmFybWFuQGxp
# bnV4LmlibS5jb20ACgkQpk8eEeBcd7S3cAD/TgRQLU3bVmRldeDwAJIca3EG1O1m
# tAJ+uLxcGTBgeY8BANYOrWc3WU+oez472RyUamEkmEnM+xjrt1Wd5amO3eoI
# =6GYD
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 26 Oct 2026 08:54:06 AM CDT
# gpg: using EDDSA key 01DC385BC24E19137B9437A2A64F1E11E05C77B4
# gpg: issuer "farman@linux.ibm.com"
# gpg: Good signature from "Eric Farman <farman@linux.ibm.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: D2C6 0504 C9E8 F568 CFE5 87B5 3827 B212 71BF 9562
# Subkey fingerprint: 01DC 385B C24E 1913 7B94 37A2 A64F 1E11 E05C 77B4
* tag 's390x-20261026' of https://gitlab.com/efarman/qemu:
MAINTAINERS: Update s390 boot reviewer
MAINTAINERS: Add other s390x tree
s390x/pci: reclaim DMA slots upon IOMMU disable
s390x/sclpconsole: implement resizing for vt220 consoles
target/s390x: mark feats dependent on deprecated feats as deprecated
target/s390x: externalize feat dependency array
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Assets cached before the stamp files were introduced have no
corresponding .stamp file. The script already copes with that when
reading the timestamp, by assuming the QEMU v10.1 release date, which
makes such assets eligible for removal.
However, since commit c1bb594fe4, removing the asset also
unconditionally unlinks its .stamp file. For these old entries that
file does not exist, so unlink() raises FileNotFoundError and the
script aborts after deleting the first such asset, leaving the rest of
the cache uncleaned and returning an error.
Pass missing_ok=True so that a missing .stamp file is not an error.
Fixes: c1bb594fe4 ("scripts/clean_functional_cache: Remove also .stamp files")
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
l2vic_update_all() called l2vic_update() for each of the 1024 irqs, and
every call rescanned all of int_status for an active vid. ciad runs it
on each interrupt return, so this was a hot function for an OS boot.
Check once whether a vid is active, then deliver the lowest irq that is
both pending and enabled by scanning int_pending & int_enable a word at
a time. The delivered irq is unchanged.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
hexagon_modify_ssr() flushed the softtlb on any change to SSR.EX, UM, GM,
or ASID, but only ASID affects translation. EX/UM/GM just pick the mode,
which is already captured in mmu_idx.
EX toggles on every exception entry/rte, so the flush created a feedback
loop where a TLB miss wiped the softtlb and guaranteed the next accesses
missed too.
Rename hex_mmu_mode_change() to hex_mmu_asid_change() to match what now
triggers it, and narrow it to this thread's mmu indices: the ASID lives in
the thread's private SSR, so other CPUs are unaffected.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
tlbinvasid cleared each matching JTLB entry via fTLBW(), and these would
hit hex_tlbw()'s flush. tlbinvasid could trigger several full flushes.
Since the softtlb isn't ASID-tagged, clear all matching valid bits first
and flush once.
The hardware threads share one JTLB but have their own softtlb, so the
flush has to be broadcast to every CPU rather than just the one running
the invalidation.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
implicit_usr_write is per-packet DC state. It was not cleared before
analyzing the next packet. Reset it together with the other per-packet
state.
When running qfloat_v81 ubsan reported:
target/hexagon/translate.c:725:32: runtime error: load of value 192,
which is not a valid value for type '_Bool'
target/hexagon/translate.c:874:12: runtime error: load of value 192,
which is not a valid value for type '_Bool'
Fixes: 3e98496691 ("Hexagon (target/hexagon) Implicit writes to USR don't force packet commit")
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
ciad cleared the last interrupt the L2VIC delivered regardless of its
mask. So a ciad for any other interrupt would get applied incorrectly.
Only clear the active interrupt when the ciad acknowledges the CPU
interrupt that its VID group is delivered on, and only if that interrupt
was taken or set with siad.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
A thread entering wait mode raises CPU_INTERRUPT_HALT on itself and only
takes it once its TB ends. If another thread resumes it in between, the
HALT is still pending.
Clear the HALT on resume.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Without this check, a halted thread that gets an NMI while
its modectl E-bit is still set won't wake if no interrupt_request bits
happen to be pending.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Move BQL_LOCK_GUARD() to the top of hex_check_interrupts.
There was a race with hex_interrupt_update on other vCPU threads when
enabling MTTCG.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Download the firmware and run it on the corresponding DSP machine.
The images are third-party binaries, so the tests run only when untrusted
code is allowed.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Let the hexagon-sim-style machines their QDSP6 subsystem, and with it the
l2vic and QTimer.
The config table's subsystem base is updated to align with the chosen
address.
Reviewed-by: Anton Johansson <anjo@rev.ng>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Config table entries are host-endian values but are consumed by the
little-endian Hexagon guest. Serialize the ROM backing storage explicitly.
Fixes: 197870349f ("hw/hexagon: add hex-subsys")
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Firmware brings a Hexagon DSP's clocks up by programming a PLL and polling
its lock-detect. Then it asks the RCG to switch to the new clock.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Build the virt machine with the hex-board helpers instead of its own
copies, and drop the machine state that nothing used. The machine, its
device tree and its devices are unchanged; virt writes interrupts as the
bare line number.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Move what virt.c does to build a board out of it into helpers in a new
hex-board.c, so that other Hexagon machines that describe themselves
with a generated device tree can reuse it.
This will be used by future commits.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
hex_subsys_create() always maps the main DDR at address 0. This is appropriate
for hexagon-sim-style machines, but real SoCs map it elsewhere.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Add tests for: vallocframe, atomics, trap2, CFI/restricted branches, and
scalar fp instructions.
New instructions not yet supported by the toolchain are manually encoded
with .word directives.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
gen_callr wrote the link register before consuming the target, so
"callr r31" jumped to the new return address instead of the old LR
value. Copy the target to a temporary first.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Add decode and translation for trap2 and the vallocframe and vdeallocframe
instruction forms introduced with v83. Model vector stack overflow as a
precise exception and report it to linux-user as SIGSEGV.
Teach the IDEF parser about VSP and vector frame checks. Describe the
vallocframe and vdeallocframe instruction semantics in system.idef, and move
the vector stack overflow check into a shared TCG generator helper.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
The scalar atomic instructions are able to perform a word or double-word
read-modify-write atomically.
Also add the v85 dcfetch_multi instruction, which prefetches multiple
data cache lines. It is modelled as a no-op, as other dcfetch
instructions are.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
SSR.SS enables a single-step debug event after each packet executed in
user or guest mode.
Carry the state in a new SS_ACTIVE TB flag. When it is set, translate
one packet per TB and raise HEX_EVENT_DEBUG w/PC at the next packet (which
becomes ELR).
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
The architecture scrambles only the LR word of the {FP, LR} frame that
allocframe stores. With the idef parser enabled, fFRAME_SCRAMBLE built
the XOR key with FRAMEKEY in both halves of the 64-bit value, so the
stored FP was scrambled as well.
deallocframe is also parser-generated and applies the same incorrect
transform a second time, which masks the error. dealloc_return uses the
hand-written TCG implementation that correctly descrambles only LR, so
it leaves FP corrupt when returning from a frame allocated by the parser.
Add a regression test that sets a nonzero FRAMEKEY, allocates a frame,
and returns through dealloc_return to validate the restored FP.
Uncovered by testing some boot images using QuRT.
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Changes:
- [PATCH v2 00/11] multi-target: prefix helpers with target prefix (Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>)
Link: https://lore.kernel.org/qemu-devel/20261024163249.77855-1-pierrick.bouvier@oss.qualcomm.com
- [PATCH v3 0/9] multi-target: add riscv64-softmmu (Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>)
Link: https://lore.kernel.org/qemu-devel/20261024061616.27381-1-pierrick.bouvier@oss.qualcomm.com
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmrc7KoACgkQtEQ30Zwo
# Yt9AtQv/emGY3zTTlV+hBUs1wktL5RS75ODu3q2xw+GLmF/lj93PBcxy1ExOtIQl
# 77TU/FHZdGHK4fRRJkqigo5YJmR+zaghjbPydyNQca6EOLvIWvkmIXnPRP1AaxDz
# e2cXzVfvazXUpJDrt47nxY8869lWXTDXpzQ55PpgXEHxfNQSbG/PzZWV6ZHujM/t
# c08PR7kZjlu10bAUCGX4OUVV0LBpAzdV2vxg1Vs2vhJv93B2wo3AfCOHv8oAYgrQ
# ZZFCJY/hWHAOJQy5zHdWcfoOOO0X65gJhV9/hQPs0bTn0pbPZI+p7z58o8S4rjm3
# 9mU680pevHqvURTe07Fu9uYx6d2lAN7h8Y7mwnMEE94wOqOBIQSiebzVttRyDTQ1
# E8XzOvnqBbW7JegSzJzn8LnDme0Ee92+TgQT4pRxJXqr89D+14tGqj8riu0+oojI
# DTUdEvyyqN7E0InvobmOrLtp+qfR+O/emEKmGBqbNNV2qSQV40vFInTLV2BTsK7/
# 7rRkf9St
# =CRFI
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 24 Oct 2026 12:36:42 PM CDT
# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF
* tag 'pbouvier/pr/multi_target-20261024' of https://gitlab.com/p-b-o/qemu:
meson.build: list all remaining softmmu targets as comments
meson.build: add riscv64-softmmu to multi-target
target/riscv/kvm: restrict kvm-accel-riscv-cpu to riscv targets
target/riscv/tcg: restrict tcg-accel-riscv-cpu to riscv targets
target/riscv: rename virt_acpi_setup to riscv_virt_acpi_setup
hw/riscv/virt: restrict scope of virt_is_acpi_enabled to this file
test/unit/multi-target: check QOM types can be initialized with any target
hw/riscv/virt: make machine available for riscv targets only
target-info: add target_base_riscv
target/tricore: remove explicit target specific prefix
target/rx: remove explicit target specific prefix
target/or1k: remove explicit target specific prefix
target/microblaze: remove explicit target specific prefix
target/hppa: remove explicit target specific prefix
target/hexagon: remove explicit target specific prefix
target/alpha: remove explicit target specific prefix
tcg: prefix helpers with target base architecture
target/sparc: define crypto helpers using HELPER macro
tcg: introduce HELPER_INFO macro
target/rx: define and call helpers using HELPER macro
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
mstatus and mstatus_hs are uint64_t but accessed through
tcg_gen_[ld|st]_tl(..., offsetof(mstatus))
which on a big-endian host running riscv32 incorrectly accesses the
top 32 bits rather than the lower bits.
Widen the operations to 64 bit so the lower bits are modified.
Fixes: 284d697c74 ("target/riscv: Merge m/vsstatus and m/vsstatush into one uint64_t unit")
Reviewed-by: Tommaso Califano <tcalifano@redhat.com>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20261023063025.8827-1-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Richard Henderson