RISC-V PR for 11.1
* Fix IMSIC CSR write and add tests
* Parametrise debug trigger number
* Add 'svbare' satp-mode
* Fix RINTC PLIC context ID for KVM
* Avoid abort when reading vtype before env->xl is set
* Skip reset for KVM irqchip
* Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
* More FDT cleanups (PLIC)
* Make FCTL.BE in IOMMU read only 0
* Check DC.TC reserved bits in IOMMU
* Apply UXL WARL handling to vsstatus
* Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU
* Set RISCV_IOMMU_FQ_HDR_PV appropriately
* Fix MSI MRIF IOMMU interrupt-pending offset
* Report QEMU CPU archid as 42
* Check PMP before updating PTE
* Add the Tenstorrent Atlantis machine
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpE6SoACgkQr3yVEwxT
# gBOxNQ//bI4BvnT65Kd2UNMgtAwwPPcehpsyPzC2S3BcflniXQL+fV6sQ7IreKta
# 6dclp/v5v+yhbB4bd/E1s/UPOF3YD4A9noUFifIhymBkafmqA4YRNsvPByeGiSD8
# xVkHhX5qUT9NW5wKnivEDjO8mndBMRm5YEXQ6uT5ulUsZr3Ir8wPOCJITZ8ZqKwb
# 6dbbXStf1aTIBzu53KaNhNpi9DQqKV5UeV7CiSuhuwWU0qmVg1RAZMg9X3oB80rE
# WpWqH0rg9Z0Cn+3XL+oKSzbLD5SrrTV+Ohq+K8zT2rEk+hIXOE3shAPm2xfTT9Q2
# g65nBOf2UmNWeHlvn3XC2LtmIWq10/A78ogGgm4XwHx8TXIeA2KIKboyS8T37XAb
# NwUllq9LRtfDVtDevpiTn6t7Oa7TC8zrxDJTT1rg/p+3D6MdfkonifwJJgVAwfuG
# NF7R2iePKPQliWr1hi6W+ghzQMRFXgNBwUNOL39/BQguy5IqvNmSk6ovhl8IFocf
# aXGh9U35DqgrsUvMa/7Fgf4uI2QNhERBGJrHfL0SPZ82sKb5CTrMw9URwg0DFnEF
# 8v/zQ9xL4eF0uZn0OtaNlLXRCblDxcHSgecwix9Vip5toFIc1P8ar9FX98Zd/H5l
# UD/a3ENtiwb6hnKhZ+45iM/NIFJeUK7A0944VnQzx00tA06wJLw=
# =a4hl
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 01 Jul 2026 12:17:14 CEST
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260701' of https://github.com/alistair23/qemu: (39 commits)
hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
hw/riscv/atlantis: Add some i2c peripherals
hw/riscv/atlantis: Integrate i2c controllers
hw/i2c: Add DesignWare I2C Controller
tests/functional/riscv64: Add tt-atlantis tests
hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr
hw/riscv: Add Tenstorrent Atlantis machine
target/riscv: tt-ascalon: Enable Zkr extension
hw/riscv/aia: Configure stride for the M-mode IMSIC
hw/riscv/aia: Provide number of irq sources
hw/riscv/virt: Move AIA initialisation to helper file
hw/riscv/boot: Account for discontiguous memory when loading firmware
hw/riscv/boot: Describe discontiguous memory in boot_info
target/riscv: Check PMP before updating PTE
target/riscv: Report QEMU CPU archid as 42
hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
target/riscv: Apply UXL WARL handling to vsstatus
hw/riscv/riscv-iommu: check DC.TC reserved bits
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The Tenstorrent Atlantis platform is a collaboration between Tenstorrent
and CoreLab Technology. It is based on the Atlantis SoC, which includes
the Ascalon-X CPU and other IP from Tenstorrent and CoreLab Technology.
The Tenstorrent Ascalon-X is a high performance 64-bit RVA23 compliant
RISC-V CPU.
Add the tt-atlantis machine containing serial console, interrupt
controllers, and device tree support.
The Atlantis boot images loaded from include OpenSBI and an initial DTB
that is passed to OpenSBI. This is approximated in the model by having
QEMU build the device tree rather than load a DTB image directly.
Subsequent stages may use the modified DTB provided by OpenSBI or opt to
supply their own.
qemu-system-riscv64 -M tt-atlantis -m 512M \
-kernel Image -initrd rootfs.cpio -nographic
Co-Developed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260630024952.1520546-8-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Some of the system registers are shared among all threads
in the core. This object contains the representation and
interface to the system registers.
Reviewed-by: Sid Manning <sid.manning@oss.qualcomm.com>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
The GICv5PendingIrq struct representation of "there is no pending
interrupt" sets the prio field to PRIO_IDLE, and generally to avoid
confusion we also set the intid to 0. We want to return this value
or initialize some variable to it in several places in the GICv5
implementation, and the support for the virtual interrupt domain
introduces more.
Define a convenience macro for this special-case struct value, and
use it instead of opencoding either the structure initializer or
explicit assignment to the two fields.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260615105029.2898872-6-peter.maydell@linaro.org
* target/i386/mshv: CPU model support
* target/i386/mshv: first part of migration support
* target/i386/mshv: faster register access for MMIO exits
* target/i386/tdx: add support for AMX alias bits in CPUID and AVX10
* Deprecate memory-encryption in favor of confidential-guest-support
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmo9sDwUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroOHBwf8Dx4gkbzOFxmCNX3EaW+ROYwlyAC7
# ADo9LFloDHXforRYTm4mBXNUVNF1/KFA6Tf92rzBlUZgp9KuMy/KhWZ1GbNsE+9b
# k5/1RF9/IxRHy6GL69apdHEKY2OYzXl76or2HF3wMd6Mu77qD8Onthko81VaLWox
# 5ZOBz6NaSnykzs9RimkVLtD9HswtFile2NWTPSliUV874lEJioNi9RcdhnQvJCnX
# WqGWViC0THucIGCm+NVhSEmvRnAFbPgUBPvQuy7skLu+R7Ryy7GAWmE/gFlSrYy2
# 4c4zt4SB0tFYJlT9db5ZdaUSgCs52CFawQ9uTSEjNSmEEuQFzXGo6BeY4w==
# =4V0w
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 25 Jun 2026 18:48:28 EDT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (45 commits)
i386/tdx: Add CPUID_24_0_EBX_AVX10_VL_MASK as supported
i386/tdx: Make AMX alias bits supported
i386/tdx: Use .has_gpa field to check if the gpa is valid
machine: Deprecate memory-encryption
qemu-options: Add description of tdx-guest object
qemu-options: Add confidential-guest-support to machine options
qemu-options: Change memory-encryption to confidential-guest-support in the example
i386/sev: Remove the example that references memory-encryption
target/i386/mshv: use the register page to set registers
target/i386/mshv: use the register page to get registers
target/i386/mshv: hv_vp_register_page setup for the vcpu
include/hw/hyperv: add hv_vp_register_page struct definition
accel: remove unnecessary #ifdefs
target/i386/mshv: migrate CET/SS MSRs
target/i386/mshv: migrate MTRR MSRs
target/i386/mshv: migrate MSRs
target/i386/mshv: reconstruct hflags after load
target/i386/mshv: migrate XSAVE state
target/i386/mshv: migrate pending ints/excs
target/i386/mshv: move msr code to arch
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
In this change the we rewrite the existing MSR logic to make MSRs
migratable:
- we map them on existing QEMU fields in the CPU. A table and a macro
MSHV_ENV_FIELD is used to associate a HV register name to the their msr
index and their offset in the cpu state struct. The list is not
exhaustive and will be extended in follow-up commits.
- mshv_set/get_msrs() fns are called in the arch_load/store_vcpu_state()
fns. they use use generic registers ioctl's and map the input/output
via load/store_to/from_env() from/to the hv register content to the
cpu state representation.
- init_msrs() has been moved from mshv-vcpu to the msr source file
- we need to perform some filtering of MSR because before writing and
reading, because the hvcalls will fail if the partition doesn't
support a given MSRs.
- Some MSRs are partition-wide and so we will only write the to on the
BSP.
Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20260417105618.3621-21-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
qemu_irq_intercept_in() saves original IRQ handlers by allocating
new QOM objects, which are never freed. On a PC machine, this leaks
IRQ objects (one per IOAPIC pin) on every qtest run.
Rather than tracking allocations to free later, avoid them: add an
"observer" field to IRQState, called by qemu_set_irq() after the
real handler. Interception sets the observer instead of rewriting
handlers, so there's nothing to save and nothing to leak.
Fix qemu_notirq() to route through qemu_set_irq() so inverted IRQs
trigger observers too. Drop the LSan suppression.
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260623-b4-ui-v4-3-4656aec3398d@redhat.com>
Refactor the RamDiscardManager interface into two distinct components:
- RamDiscardSource: An interface that state providers (virtio-mem,
RamBlockAttributes) implement to provide discard state information
(granularity, populated/discarded ranges, replay callbacks).
- RamDiscardManager: A concrete QOM object that wraps a source, owns
the listener list, and handles listener registration/unregistration
and notifications.
This separation moves the listener management logic from individual
source implementations into the central RamDiscardManager, reducing
code duplication between virtio-mem and RamBlockAttributes.
The change prepares for future work where a RamDiscardManager could
aggregate multiple sources.
Note, the original virtio-mem code had conditions before discard:
if (vmem->size) {
rdl->notify_discard(rdl, rdl->section);
}
however, the new code calls discard unconditionally. This is considered
safe, since the populate/discard of sections are already asymmetrical
(unplug & unregister all listener section unconditionally).
Reviewed-by: Peter Xu <peterx@redhat.com>
Acked-by: David Hildenbrand <david@kernel.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260604-rdm5-v5-1-5768e6a0943d@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Accelerators patches queue
- Avoid double hv_vcpu_destroy() call during teardown on HVF ARM
- Constify various AddressSpace/MemoryRegionCache arguments
- Clarify physical_memory_*() API in "system/physmem.h"
- Extract "accel/tcg/cpu-loop.h" out of "exec/cpu-common.h"
- Restrict few TCG-specific code
- Remove pre-C11 check
- Various header cleanups
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmoz5EIACgkQ4+MsLN6t
# wN4pJhAAtQ+qMRS49PoXnyBkPnuTZlnIjhy0gpXp7wRAiZiOQFjgIkX7F8YKz/aQ
# Hu15PIsbvH7mjzTiSfW48Km/3qzzCx0F0U9KsNaZLCJ+/HVctaN94slewgAfA6qc
# sEuVq6u70oaeGjYVM1wmUXhK3h2vfpWPnE81qjUJBnjsfC99T24TMmtY0CGw8f9J
# UJ6SpkwlES9B6YeJ0GFACCZMTMD0QiXuAtKzfL/2aD1Ts31qY9DG/bdlmDJJ3R0Y
# y/ZcWjvPQE4NDdcMfuW4/ywz7sAX/h0XreMIb2OL5ppE0qYDBqpB6SFGWjg4uQ5r
# yDhzVhdrPT2HxXl9LTYOjlAQEHrs3Pm0170G7OwCVs+gtlloZqV08sJ+61J2jv73
# OH2YsQh/sIy9QUPZxI+LloBRLApMg5mjY9KP5DPH2qmsOpvE4fj07hq+EXS3OCuz
# L+3TMD0fhxI+RHg8/zaqidc3+Xb4zN/H069Qkjx0wyQI7QMmfK4rU4CJV6MP6d9r
# r9qngtxVfbGfXpaDqan73TjKHx/ZnOgNQqrfaeypiAkiyIoOPRzeG3H6T17HlOBX
# S2Pz4vllzs0SS1vC4OKnS1BI2eEf6ge14ozKGQqh5qOvfKlTy4s8fXX/2MKIaqMG
# cVE4lkL2suLoxmOu2zsEvDBCVUaRLWZLJZib1J4B/UIvvC3rpQs=
# =Jj+Z
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 18 Jun 2026 08:27:46 EDT
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'accel-20260618' of https://github.com/philmd/qemu: (48 commits)
accel/tcg: Restrict headers being TCG specific
accel/tcg: Move cpu_loop_exit_*() out of 'exec/cpu-common.h'
accel/tcg: Have cpu_loop_exit_requested() take const @cpu argument
accel/tcg: Move cpu_restore_state() out of 'exec/cpu-common.h'
accel/tcg: Move cpu_unwind_state_data() out of 'exec/cpu-common.h'
accel/tcg: Move cpu_exec_step_atomic() out of 'exec/cpu-common.h'
accel/tcg: Move cpu_exec() out of 'exec/cpu-common.h'
accel/tcg: Remove cpu_loop_exit() stub
hw/s390x/ipl: Remove TCG dependency in handle_diag_308()
system/memory: Rename cpu_exec_init_all() -> machine_memory_init()
system/memory: Remove unnecessary CONFIG_USER_ONLY guards
exec/cpu-common.h: Avoid including unused exec/page-protection.h header
exec/cpu-common.h: Avoid including unused 'tcg/debug-assert.h' header
exec/cpu-common.h: Avoid including unused 'exec/vaddr.h' header
exec/cpu-common.h: Include missing 'qemu/thread.h' header
ui/cocoa: Use qemu_input_map_osx_to_linux
util/cutils: drop qemu_strnlen() in favor of strnlen()
configure: honor --extra-ldflags when forced to use objc_LINKER
meson: build macOS signed binary as part of the default target
accel/tcg: Restrict IOMMU declarations
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
UI patches for 2026-06-17
- retire input-legacy.c
- sdl2 fixes
To: qemu-devel@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmoyu8oACgkQ2ujhCXWW
# nOX6RA//TQRZhYpHWGZSKsBWkC1UXPSHXfsbaMrrv9L8U66nXxN9FZgqukisw8rq
# udUNHzdhfRVlTOcEDYscgNeGTIIZ/2phFrNOE0759Q4BIg7CNaEBhvjNmzp/tAVV
# XImS3RzzVdE2RJKN8DAaFKqCAIa2NF8ZPr7NtjIK/VwUPQ0AtfY/plVGtfkChSTx
# +WZt2gTkli0WMGYFz0ZXttqtfuts1fCTxyNUwBItNQkgXzM9+lPmIHYOSF4huPa1
# ek03WVrA6k9ke+A9lNpSl1l/a6g8FBOfHSzSBBWhjT8pQN0iChLzxzkBXWKbvBOk
# PhprHBTNVzY1ogLp3WupVcXTDl/bgaHS/4cv75plR5qHrZC7Z0sDachr7MtVvrDW
# SsSV7Ni2ggiXJ8EspGPKNQ1PFV69TmwSeRVGaJUlXUDdr25k6sN59sqLpwBMZb/O
# UwxeqUI3LXmFdjzGoGHmHdB4UneENOEHoTBTqj/lkHjm+sxB504/ZIewhK7bjtlr
# efi11fRB3+XAUZVrC9BCmaeD+ZZANqQ5PXex8KfZpD5+H7VuJVEnAIIvCQqNCg4i
# UGDuqWV7qxsVP6jMdidtUYKPiKZEGChAYGsYNvoJ+mXusebkJLHY6zUyIcMEcJCL
# Bu/oFF9PaPYBBvvS45hzn5MVgR//ylWZpEFqtqRzXYrxCzruvRE=
# =VcKS
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 17 Jun 2026 11:22:50 EDT
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5
* tag 'ui-input-pr-v1' of https://gitlab.com/marcandre.lureau/qemu: (27 commits)
ui/sdl2: Set GL ES profile before creating initial GL context
ui/sdl2: Explicitly specify EGL platform
ui/pixman: fix zero rowstride in qemu_pixman_image_new_shareable()
ui/input: Have qemu_input_is_absolute() take a const QemuConsole
tools/qemu-vnc: Have console_get_mouse/keyboard take const QemuConsole
ui/input: remove old LED handler broadcast queue
ui/dbus: switch LED handling to Notifier-based input API
ui/spice: switch LED handling to Notifier-based input API
ui/vnc: switch LED handling to Notifier-based input API
hw/input/virtio-input-hid: use qemu_input_handler_set_leds_mask() for LED state
hw/input/hid: use qemu_input_handler_set_leds_mask() for LED state
hw/input/ps2: use qemu_input_handler_set_leds_mask() for LED state
ui/input: qemu_input_handler_register to warn for unused result
hw/m68k: keep QemuInputHandlerState in next-kbd
hw/input: keep QemuInputHandlerState in stellaris
hw/input: keep QemuInputHandlerState in adb-kbd
hw/arm: keep QemuInputHandlerState in musicpal
hw/input/ps2: keep QemuInputHandlerState in PS2State
ui/input: add LED state tracking to QemuInputHandlerState
ui/input: remove dead declaration
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Track the input handled state, and dispose it on unrealize.
Also free some allocated fields during unrealize.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
RISC-V PR for 11.1
* Disable svpbmt if satp_mode is less then sv39
* Fix PMP address alignment
* Mstatus write bug fixes
* Add 'cbo' insns to disassembler
* Do not hide Sstc CSRs from gdbstub
* Reject Svinval instructions in U-mode
* Save opcode before zicbo helpers
* Fault with reserved PTE.PBMT val
* Allow LOAD_ADDR_MIS promotion to AMO fault
* Make riscv cpu.h target independent
* Add PMA access fault
* Disable svnapot if satp_mode is less then sv39
* Fix disassembler inst_length calculation
* Add RISC-V big-endian target support
* Add the implied rules for G and B extensions
* Print privilege level and ELP in riscv_cpu_dump_state
* Improve alignment in riscv_cpu_dump_state
* Mask vxrm csrw write to the low 2 bits
* Reorder Smrnmi CPU fields above CPU reset line
* Supplement cpu topology arguments
* Don't insert DDT cache in Bare mode
* Fix 'iommu-map' FDT entry
* Fix mstatus.FS dirty tracking for FP exception-raising instructions
* Enable `mnret` disassembly
* Add support for K230 board
* FDT creation helpers
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmoxH8EACgkQr3yVEwxT
# gBOA0A/9EoqSh73fuWzBwOANN7sXBDRJwOzCetvoTqyXzbUtQJGPbslldLDoYA0K
# GfqdmFNqi6pp01pBm/eWUu2vxid1d1IID+4g7LQ1TIyexbc58Qm7Hb1r+F1RSLj4
# NcZc+RGvJ+3D/hXUfj1dnT+yxUDsVAuf1NPONR9E9CD4q8gkvtA79Lwj3o/2Ks18
# 02ZPi8+vc5XmSjtwGVFdcxu4je89vvhzl4P+zwZMKOOU04bpsCG5chSRfSiGUnuz
# jae/5YDOk4v6T61Yt3kDFc9CkuenhiDSHMiQy/PD/ufvBOlA3EzyIago3SO0DP9d
# ZW+aVHOJ7SgcUPFbj6kkLo/FhXraXmKVo4vDhASoKHydoL1s6ZAR7TCAwLXa39Rq
# z15OGtRzdQX48AkeUjeN+Mz6lxHusm4MmsBhMAnPxzhiGRjOH024SR2C9iSeuB4h
# mMmYi25z48NLK5oilEhPAy37xUYUuRa+HoO07puQdLLReiuMyIWAwubhwMsog3MR
# IULX57BlxrxqVSt3z7sLGAwBEz353ARYNSiDYR+2XXt8Qjy6kY7ONrSfeJMhjbH7
# wrYQ0+30Af+b7Lpm8kpapeEsn1KWYIJU//ji5tbgAmd0sSLCiAqZX6GwzFKoGUKO
# u9Gc+A7vISxD5bBw33Z0Pp/zL1QUBom/pdZUHhaAGtKIuwLSA8s=
# =iXpr
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 16 Jun 2026 06:04:49 EDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260616' of https://github.com/alistair23/qemu: (83 commits)
hw/riscv: add create_fdt_socket_cpu_sifive()
hw/riscv/fdt_common.c: create create_fdt_socket_cpu_internal()
hw/riscv/spike.c: use create_fdt_socket_cpus()
hw/riscv: add create_fdt_socket_cpus()
hw/riscv: add fdt_create_cpu_socket_subnode() helper
hw/riscv/sifive_u.c: add cpu-map, cluster and core DTs
hw/riscv: add create_fdt_clint() helper
hw/riscv/spike.c: add intc_phandles array
hw/riscv/sifive_u.c: add intc_phandles array
hw/riscv: add create_fdt_socket_memory() helper
hw/riscv/numa: make numa_enabled() public
hw/riscv: add fdt-common helper
hw/riscv/sifive_u.c: add a FDT phandle to cpu-intc
docs/system/riscv: add documentation for k230 machine
tests/qtest: add test for K230 watchdog
hw/watchdog: add k230 watchdog initial support
hw/riscv: add k230 board initial support
target/riscv: add thead-c908 cpu support
disas/riscv: enable `mnret` disassembly
target/riscv: rvv: Set mstatus.FS dirty when vector FP raises exceptions
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The I2C interrupts are only routed to the legacy interrupt controller. This means
that for modern device trees that use the GIC, the interrupts don't work. This patch
adds a splitter to route the I2C interrupt to both the legacy interrupt controller and the GIC.
Testing
Add these lines to QEMU invocation
-drive if=none,id=i2c_storage,format=raw,file=eeprom.bin \
-device at24c-eeprom,bus=i2c-bus.1,address=0x50,drive=i2c_storage,rom-size=4096 \
note: eeprom.bin is all zeros
Before this change, running i2c get to read from EEPROM would result in this
i2cget -y 1 0x50
Error: Read failed
After this change, running i2c to read from EEPROM results in this
i2cget -y 1 0x50
0x00
The eeprom can now also be enabled in the device tree. Before the
eeprom driver load would fail due to the read failing
ls -l /sys/bus/i2c/devices/i2c-1/1-0050/ | grep -i eeprom
-rw------- 1 root root 4096 May 17 16:57 eeprom
Signed-off-by: Nicholas Righi <nicholasrighi@gmail.com>
Message-id: 20260609024027.22140-1-nicholasrighi@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add an "identifier" property to the SMMUv3 device and use it when
building the ACPI IORT SMMUv3 node Identifier field.
This avoids relying on device enumeration order and provides a stable
per-device identifier. A subsequent patch will use the same identifier
when generating the DSDT description for Tegra241 CMDQV, ensuring that
the IORT and DSDT entries refer to the same SMMUv3 instance.
The identifier is assigned at pre-plug time, accounting for the ITS Group
node that build_iort() places before SMMUv3 nodes in the IORT table, so
that identifiers are globally unique across all IORT nodes.
No functional change: IORT blob content for bios-tables qtest is identical
to before.
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-27-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Introduce a GPtrArray in VirtMachineState to track all SMMUv3 devices
created on the virt machine, and use it when building the IORT table
instead of relying on object_child_foreach_recursive() walks of the
object tree.
This avoids recursive object traversal and provides a foundation for
subsequent patches that need direct access to SMMUv3 instances for
CMDQV-related handling.
No functional change. No bios-tables qtest failures observed.
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-10-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add support for selecting and initializing a CMDQV backend based on the
cmdqv OnOffAuto property.
If set to OFF, CMDQV is not used and the default IOMMUFD-backed allocation
path is taken.
If set to AUTO, QEMU attempts to probe a CMDQV backend during device setup.
If probing succeeds, the selected ops are stored in the accelerated SMMUv3
state and used. If probing fails, QEMU silently falls back to the default
path.
If set to ON, QEMU requires CMDQV support. Probing is performed during
setup and failure results in an error.
When a CMDQV backend is active, its callbacks are used for vIOMMU
allocation, free, and reset handling. Otherwise, the base implementation
is used.
The current implementation wires up the Tegra241 CMDQV backend through the
generic ops interface. Functional CMDQV behaviour is added in subsequent
patches.
No functional change.
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-9-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
There's FDT logic gated around 'numa_enabled()' in virt.c and spike.c.
We want to move the FDT code to a common helper without having to call
hw/riscv/numa.c functions from it, but at the same time being aware of
the FDT changes if numa is enabled.
To do that the boards will inform the FDT helpers if we have
numa_enabled in the env or not. And for the boards to be able to do
that we need the static 'numa_enabled' function to be public.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260615203734.954428-4-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
