target/openrisc: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224161804.90064-4-philmd@linaro.org>

target/openrisc: Use explicit big-endian LD/ST API

The OpenRISC architecture uses big endianness. Directly
use the big-endian LD/ST API.

Mechanical change running:

  $ for a in uw w l q; do \
      sed -i -e "s/ld${a}_p(/ld${a}_be_p(/" \
        $(git grep -wlE '(ld|st)u?[wlq]_p' target/openrisc/);
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224161804.90064-3-philmd@linaro.org>

hw/intc: Mark OpenRISC-specific peripheral as big-endian

The Open Multi-Processor Interrupt Controller (ompic) is only
used by the OpenRISC target, which is only built as big-endian.
Therefore the DEVICE_NATIVE_ENDIAN definition expand to
DEVICE_BIG_ENDIAN (besides, the DEVICE_LITTLE_ENDIAN case isn't
tested). Simplify directly using DEVICE_BIG_ENDIAN.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224161804.90064-2-philmd@linaro.org>

hw/microblaze: Build files once

Previous commit removed the last target-specific use in
hw model units, we can now build them once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-7-philmd@linaro.org>

hw/microblaze: Replace TARGET_BIG_ENDIAN -> target_big_endian()

Check endianness at runtime to remove the target-specific
TARGET_BIG_ENDIAN definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-6-philmd@linaro.org>

target/microblaze: Build system files once

Previous commit removed the last target-specific use in
system units, we can now build them once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-5-philmd@linaro.org>

target/microblaze: Avoid target-specific migration headers in machine.c

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header requiered:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-4-philmd@linaro.org>

target/microblaze: Directly check endianness via CPUConfig::endi flag

The MicroBlazeCPUConfig::endi flag reports whether the CPU is
configure in little endianness. Directly use this knowledge
instead of evaluating MemOp from mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-3-philmd@linaro.org>

target/m68k: Replace MD_TLONG -> MD_I32 in monitor.c

m68k's monitor_defs[] array implicitly uses type=MD_TLONG for
all its entries. Since we only build this target as 32-bit,
use the explicit MD_I32 type to avoid an indirect target_long
use.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-10-philmd@linaro.org>

target/loongarch: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since LoongArch use little-endian order.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-8-philmd@linaro.org>

target/loongarch: Use explicit little-endian LD/ST API

The LoongArch architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/loongarch/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-1-philmd@linaro.org>

target/loongarch: Inline cpu_ldl_code() call in cpu_do_interrupt()

In preparation of removing the cpu_ldl_code wrapper, inline it.

Since LoongArch instructions are always stored in little-endian
order, replace MO_TE -> MO_LE.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20251224161456.89707-6-philmd@linaro.org>

target/loongarch: Replace MO_TE -> MO_LE

We only build the LoongArch target using little endianness
order, therefore the MO_TE definitions expand to the little
endian one. Use the latter which is more explicit.

Mechanical change running:

  $ sed -i -e s/MO_TE/MO_LE/ \
        $(git grep -wl MO_TE target/loongarch/)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-5-philmd@linaro.org>

target/loongarch: Use hwaddr type for physical addresses

Replace variables used with get_physical_address(), which
expect a physical addresses, by the 'hwaddr' type, instead
of the 'target_ulong' one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-4-philmd@linaro.org>

target/loongarch: Replace target_ulong -> uint64_t for DMW and TLBRBADV

The Direct Mapping Configuration Window and Bad Virtual
Address CSR registers are declared as uint64_t since their
introduction in commit 398cecb9c3e ("target/loongarch: Add
CSRs definition"):

 296 typedef struct CPUArchState {
 ...
 345     uint64_t CSR_TLBRBADV;
 ...
 359     uint64_t CSR_DMW[4];
 ...
 385 } CPULoongArchState;

Use the proper uint64_t type instead of target_ulong
(which would otherwise be truncated on 32-bit builds).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20251224161456.89707-3-philmd@linaro.org>

hw/loongarch: Use explicit little-endian LD/ST API

The LoongArch architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' hw/loongarch/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-2-philmd@linaro.org>

target/hppa: Remove target_ulong use in disas_log() handler

Since commit 85c19af63e7 ("include/exec: Use vaddr in DisasContextBase
virtual addresses") the DisasContextBase::pc_first field is a vaddr
type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-9-philmd@linaro.org>

target/hppa: Avoid target-specific migration headers in machine.c

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header required:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-8-philmd@linaro.org>

target/hppa: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-5-philmd@linaro.org>

target/hppa: Use explicit big-endian LD/ST API

The HPPA architecture uses big endianness. Directly use
the big-endian LD/ST API.

Mechanical change using:

  $ end=be; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/hppa/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-4-philmd@linaro.org>

target/hppa: Remove unnecessary @cpu variable by using cpu_env()

Partly revert changes introduced by commit b2c2d00f48c ("target/hppa:
add 64 bit support to gdbstub"), restoring the cpu_env() call and
removing the unused @cpu argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-3-philmd@linaro.org>

target/hppa: Use big-endian variant of cpu_ld/st_data*()

We only build the HPPA target using big endianness order,
therefore the cpu_ld/st_data*() definitions expand to the big
endian declarations. Use the explicit big-endian variants.

Mechanical change running:

  $ tgt=hppa; \
    end=be; \
    for op in data mmuidx_ra; do \
      for ac in uw sw l q; do \
        sed -i -e "s/cpu_ld${ac}_${op}/cpu_ld${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
      for ac in w l q; do \
        sed -i -e "s/cpu_st${ac}_${op}/cpu_st${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-2-philmd@linaro.org>

target/hexagon: Use little-endian variant of cpu_ld/st_data*()

We only build the Hexagon target using little endianness order,
therefore the cpu_ld/st_data*() definitions expand to the little
endian declarations. Use the explicit little-endian variants.

Mechanical change running:

  $ tgt=hexagon; \
    end=le; \
    for op in data mmuidx_ra; do \
      for ac in uw sw l q; do \
        sed -i -e "s/cpu_ld${ac}_${op}/cpu_ld${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
      for ac in w l q; do \
        sed -i -e "s/cpu_st${ac}_${op}/cpu_st${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251219185025.97318-3-philmd@linaro.org>

target/hexagon: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since Hexagon use little-endian order.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251224160708.89085-2-philmd@linaro.org>

target/avr: Inline translator_lduw()

translator_lduw() is defined in "exec/translator.h" as:

 192 static inline uint16_t
 193 translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
 194 {
 195     return translator_lduw_end(env, db, pc, MO_TE);
 196 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since AVR only exists in little-endian.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251218213053.61665-3-philmd@linaro.org>

target/alpha: Introduce alpha_phys_addr_space_bits()

In preparation for dropping TARGET_PHYS_ADDR_SPACE_BITS, add a
a runtime function to correctly represent the size of the physical
address space for EV4-6 based on the current CPU version.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260112-phys_addr-v3-1-5f90fdb4015f@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

target/alpha: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106155755.53646-5-philmd@linaro.org>

target/alpha: Inline cpu_ldl_code() call in do_unaligned_access()

In preparation of removing the cpu_ldl_code wrapper, inline it.
Use the return address argument.

Since Alpha instructions are always stored in little-endian
order, replace MO_TE -> MO_LE.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106155755.53646-4-philmd@linaro.org>

hw/alpha: Use explicit little-endian LD/ST API

The Alpha architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change running:

  $ for a in uw w l q; do \
      sed -i -e "s/ld${a}_p(/ld${a}_le_p(/" \
        $(git grep -wlE '(ld|st)u?[wlq]_p' hw/alpha/);
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106155755.53646-2-philmd@linaro.org>

meson: Allow system binaries to not have target-specific units

As we are moving toward a single binary, targets might end
without any target-specific objects (all objects being in
the 'common' source set). Allow this by checking the
target_system_arch[] dictionary contains the target key
before using it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-2-philmd@linaro.org>

system/ioport: Do not open-code address_space_ld/st_le() methods

When a variable size is known, prefer the address_space_ld/st()
API. Keep address_space_read/write() for blobs.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-23-philmd@linaro.org>

system/ioport: Declare x86-specific I/O port in little-endian order

X86 in/out port (related to ISA bus) uses little endianness:
- enforce little endianness in x86 cpu_in/out() accessors,
- serialize QTest in/out port accesses as little-endian.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-22-philmd@linaro.org>

system/memory: Inline address_space_stq_internal()

As its name suggests, address_space_stq_internal() is an
internal method which can be inlined like all the other
ones in this file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-7-philmd@linaro.org>

system/memory: Split MemoryRegionCache API to 'memory_cached.h'

We have 115 direct inclusions of "system/memory.h", and 91 headers
in include/ use it: hundreds of files have to process it.
However only one single header really uses the MemoryRegionCache
API: "hw/virtio/virtio-access.h". Split it out to a new header,
avoiding processing unused inlined functions hundreds of times.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-6-philmd@linaro.org>

system/physmem: Convert DEBUG_SUBPAGE printf() to trace events

Defining DEBUG_SUBPAGE allows to use raw printf() statements to
print information about some events; convert these to tracepoints.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-5-philmd@linaro.org>

system/physmem: Inline and remove leul_to_cpu()

leul_to_cpu() is only used within physmem.c: inline it
and remove.
Since @bitmap is of 'unsigned long' type, use its size
with ldn_le_p() instead of using HOST_LONG_BITS.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-4-philmd@linaro.org>

tests/qtest: Remove unnecessary 'qemu/bswap.h' include

None of these files use API declared in "qemu/bswap.h",
remove the unnecessary inclusion.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109164742.58041-2-philmd@linaro.org>

bswap: Consistently use builtin bswap() functions

Since these headers use some __builtin_bswap*(), use it
consistently in all the cases, allowing to remove the
"qemu/bswap.h" inclusion (which only defines bswap* to
the builtin equivalent).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109164742.58041-5-philmd@linaro.org>

docs/devel/loads-stores: Fix ld/stn_*_p() regexp

Fixes: afa4f6653dc ("bswap: Add stn_*_p() and ldn_*_p() functions")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109063504.71576-3-philmd@linaro.org>

MAINTAINERS: Cover 'system/memory_ldst*.h.inc' files

Missed in commit c611228c0ed ("include: move memory_ldst*
to include/system").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-2-philmd@linaro.org>

Merge tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu into staging

loongarch queue

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQQNhkKjomWfgLCz0aQfewwSUazn0QUCaWSdwgAKCRAfewwSUazn
# 0cwwAQC4xgK0x98Z10yoMfuIz5FfDq1onrFC7rd5k0K7pLgsywEA1NrLtW/lSy6Z
# xlgaus/3reiDz+zEOeBQPLibVIVQSA0=
# =8ksY
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 12 Jan 2026 06:07:46 PM AEDT
# gpg:                using EDDSA key 0D8642A3A2659F80B0B3D1A41F7B0C1251ACE7D1
# gpg: Good signature from "bibo mao <maobibo@loongson.cn>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7044 3A00 19C0 E97A 31C7  13C4 8E86 8FB7 A176 9D4C
#      Subkey fingerprint: 0D86 42A3 A265 9F80 B0B3  D1A4 1F7B 0C12 51AC E7D1

* tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu:
  hw/loongarch/virt: Add property highmem-mmio-size with virt machine
  hw/loongarch/virt: Add high MMIO support with GPEX host
  hw/loongarch/virt: Add property highmem_mmio with virt machine
  hw/loongarch/virt: Get PCI info from gpex config info
  hw/loongarch/virt: Get irq number from gpex config info
  hw/loongarch/virt: Add field gpex in LoongArchVirtMachineState
  hw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState
  target/loongarch: Add PMU register dump support in KVM
  target/loongarch: Call function loongarch_la464_init_csr() after realized
  target/loongarch: Add PMU migration support in KVM mode

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

hw/loongarch/virt: Add property highmem-mmio-size with virt machine

The default high mmio size of GPEX PCIE host controller is 64G bytes on
virt machine. If it does not meet requirements with some pass-throught HW
devices in future, it can be adjust dynamically, here adds property
highmem-mmio-size to set high mmio size.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

hw/loongarch/virt: Add high MMIO support with GPEX host

With high MMIO supported, its base address comes from high end of
physical address space. Also add high MMIO support with GPEX host bridge.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

hw/loongarch/virt: Add property highmem_mmio with virt machine

On LoongArch Virt Machine, MMIO region with GPEX host bridge is
0x40000000 -- 0x7FFFFFFF. The total size is 1G bytes and it is enough
for emulated virtio devices basically.

However on some conditions such as hostmem is added with virtio-gpu
device, the command line is -device virtio-gpu-gl,hostmem=4G. The
PCIE MMIO region is not enough, 64-bit high MMIO region is required.

Here add property highmem_mmio with virt machine, however it brings
out incompatible issue. Here the default value is false.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

hw/loongarch/virt: Get PCI info from gpex config info

PCIE host bridge configuration information such as MMIO/Conf/IO base
and size can come from gpex config info.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

hw/loongarch/virt: Get irq number from gpex config info

The base irq number of GPEX PCIE host bridge can comes from gpex::irq.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

hw/loongarch/virt: Add field gpex in LoongArchVirtMachineState

Add field gpex in structure LoongArchVirtMachineState, type of field gpex
is structure GPEXConfig and it is to record configuration information
about GPEX host bridge. And remove field pci_bus in structure
LoongArchVirtMachineState since the information is in field gpex already.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

hw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState

DRAM region is dynamically set and the last valid physical address region
with LoongArch Virt Machine. To record the last valid physical address,
field ram_end is added in structure LoongArchVirtMachineState. In future
end address of DRAM cannot exceed base addres of PCIE 64-bit MMIO region.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

target/loongarch: Add PMU register dump support in KVM

PMU is supported in KVM mode. With info registers command, PMU CSR
registers should be dumped also. And it is not necessary in TCG mode.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

target/loongarch: Call function loongarch_la464_init_csr() after realized

When CPU is realized, it will check capability of host and set guest
features, such as PMU CSR register number used by VM etc. Here move
function call with loongarch_la464_init_csr() after CPU is realized.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

target/loongarch: Add PMU migration support in KVM mode

PMU is supported in KVM mode. When VM is migrated, PMU register should
be migrated also, otherwise PMU will be disabled after migration.

Here add PMU register save and restore interface and PMU register
state migration is added also.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>

Merge tag 'pull-tcg-20260112' of https://gitlab.com/rth7680/qemu into staging

tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}
tcg/optimize: Fixes for o_mask and a_mask
linux-user: Correction to HWCAP2 accessor
linux-user: Fixes for mremap
linux-user: Implement epoll_pwait2 syscall
meson: disable libatomic with GCC >= 16

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmlkHJQdHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV8i0gf8C/MTPjEqPDij3WDA
# skE6cNyWaGF1xw8WDrGfC9GkKndBtWKZ/bZi8JmngcqfOkOzkZa5X8D25W0/esOs
# cnjqsGX3blW1YUTXgs/Go/EZguZnO23I/4/2sFdba6lo2zYmwab8HzJjYLhzRZB2
# fFyLVvVDgkCfbpomkuZM7nHlnqP1UXgxkYtdD9hhs/08Mdv/H5BwwZN/xkC+YSwt
# zLfB9fb2/5rf3u+TlUoQsHkDV7hHcAiCwUpL9W89AGTVtuwAd2K+LObebaxk8ExM
# WDSXl5CJsavdGZ7sYUqBlJBnHYdSUqMu3DvghQdn5mC1QuRVelLWJhYkNuWVLMsD
# DyH4GQ==
# =yWGs
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 12 Jan 2026 08:56:36 AM AEDT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate]

* tag 'pull-tcg-20260112' of https://gitlab.com/rth7680/qemu:
  meson: disable libatomic with GCC >= 16
  linux-user: implement epoll_pwait2 syscall
  linux-user: cleanup epoll_pwait ifdeff'ery
  tests: add tcg coverage for fixed mremap bugs
  linux-user: fix reserved_va page leak in do_munmap
  linux-user: fix mremap errors for invalid ranges
  linux-user: fix mremap unmapping adjacent region
  linux-user/elfload.c: Correction to HWCAP2 accessor
  linux-user: allow null `pathname` for statx()/fstatat()
  tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}
  tcg/optimize: Do use affected bits
  tcg/optimize: Fix a_mask computation for orc
  tcg/optimize: Save o_mask in fold_masks_zosa_int

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

meson: disable libatomic with GCC >= 16

Historically it was required to ask for libatomic explicitly with
-latomic, but with GCC >= 16 apps will get linked to libatomic
whether they ask for it or not.

This invalidates QEMU's check for atomic op support for int128
which explicitly does NOT want to use the libatomic impl. As a
result with GCC >= 16, QEMU is now getting linked to libatomic
and is activating CONFIG_ATOMIC128. This in turn exposes a bug
in GCC's libatomic.a static buld which is incompatible with the
use of -static-pie leading to build failures like:

    /usr/bin/ld: /usr/lib/gcc/x86_64-redhat-linux/16/libatomic.a(cas_16_.o): relocation R_X86_64_32 against hidden symbol `libat_compare_exchange_16_i1' can not be used when making a PIE object
    /usr/bin/ld: failed to set dynamic section sizes: bad value
collect2: error: ld returned 1 exit status

The newly introduced -fno-link-libatomic flag can be used to
disable the new automatic linking of libatomic. Setting this in
qemu_isa_flags early on ensures that the check for CONFIG_ATOMIC128
still works correctly.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260108141407.2151817-1-berrange@redhat.com>

linux-user: implement epoll_pwait2 syscall

epoll_pwait2 is the same as epoll_pwait but with timeout being
(a pointer to) struct timespec instead of an integer.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3210
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109090937.599881-3-mjt@tls.msk.ru>

linux-user: cleanup epoll_pwait ifdeff'ery

All linux targets these days have epoll_pwait system call
(while some miss epoll_wait, which is less generic).  And
all linux targets definitely has one or another epoll_*wait*
system call - so whole code block dealing with this system
call should always be present.

Remove the now-unneeded ifdef'fery.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109090937.599881-2-mjt@tls.msk.ru>

tests: add tcg coverage for fixed mremap bugs

These tests cover the first two fixes in this patch series. The final
patch is not covered because the bug it fixes is not easily observable
by the guest.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-5-mlugg@mlugg.co.uk>

linux-user: fix reserved_va page leak in do_munmap

The old logic had an off-by-one bug. For instance, assuming 4k pages on
host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then
'last = start + 4096', so 'real_last = start + 4095', so ultimately
'real_len = 4096'. I do not believe this could cause any observable bugs
in guests, because `target_munmap` page-aligns the length it passes in.
However, calls to this function in `target_mremap` do not page-align the
length, so those calls could "drop" pages, leading to a part of the
reserved region becoming unmapped. At worst, a host allocation could get
mapped into that hole, then clobbered by a new guest mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk>

linux-user: fix mremap errors for invalid ranges

If an address range given to `mremap` is invalid (exceeds addressing
bounds on the guest), we were previously returning `ENOMEM`, which is
not correct. The manpage and the Linux kernel implementation both agree
that if `old_addr`/`old_size` refer to an invalid address, `EFAULT` is
returned, and if `new_addr`/`new_size` refer to an invalid address,
`EINVAL` is returned.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-3-mlugg@mlugg.co.uk>

linux-user: fix mremap unmapping adjacent region

This typo meant that calls to `mremap` which shrink a mapping by some N
bytes would, when the virtual address space was pre-reserved (e.g.
32-bit guest on 64-bit host), unmap the N bytes following the *original*
mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-2-mlugg@mlugg.co.uk>

linux-user/elfload.c: Correction to HWCAP2 accessor

get_elf_hwcap was used when get_elf_hwcap2 should have been.

Cc: qemu-stable@nongnu.org
Fixes: fcac98d0ba8b ("linux-user: Remove ELF_HWCAP2")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3259
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106-fix-hwcap2-sve2-v1-1-1d70dff63370@linaro.org>

linux-user: allow null `pathname` for statx()/fstatat()

Since Linux 6.11, the path argument may be NULL.

Before this patch, qemu-*-linux-user failed with EFAULT when `pathname` was
specified as NULL, even for Linux kernel hosts > 6.10. This patch fixes this
issue by checking whether `arg2` is 0. If so, don't return EFAULT, but instead
perform the appropiate syscall and let the host's kernel handle null `pathname`.

Cc: qemu-stable@nongnu.org
Signed-off-by: Jean-Christian CÎRSTEA <jean.christian.cirstea@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229121416.2209295-1-jean.christian.cirstea@gmail.com>

tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}

TCG_REG_TMP0 may be used by set_vtype* to load the vtype
parameter, so delay any other use of TCG_REG_TMP0 until
the correct vtype has been installed.

Cc: qemu-stable@nongnu.org
Fixes: d4be6ee1111 ("tcg/riscv: Implement vector mov/dup{m/i}")
Reported-by: Zhijin Zeng <zengzhijin@linux.spacemit.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

tcg/optimize: Do use affected bits

We inadvertently disabled affected bits optimizations on operations
that use fold_masks_zosa.  These happen relatively often in x86 code
for extract/sextract; for example given the following:

   mov %esi, %ebp
   xor $0x1, %ebp

the optimizer is able to simplify the "extract_i64 rbp,tmp0,$0x0,$0x20"
produced by the second instruction to a move.

Cc: qemu-stable@nongnu.org
Fixes: 932522a9ddc ("tcg/optimize: Fold and to extract during optimize")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251223163720.985578-1-pbonzini@redhat.com>

tcg/optimize: Fix a_mask computation for orc

In computing a_mask, for or, we remove the bits from t1->o_mask
which are known to be zero.  For orc, the bits known to be zero
are the inverse of those known to be one.

Cc: qemu-stable@nongnu.org
Fixes: cc4033ee47c ("tcg/optimize: Build and use zero, one and affected bits in fold_orc")
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

tcg/optimize: Save o_mask in fold_masks_zosa_int

When adding o_mask to this function, we used it in a
couple of places but failed to save it for future use.
Also, update a related comment.

Cc: qemu-stable@nongnu.org
Fixes: 56f15f67ea1 ("tcg/optimize: Add one's mask to TempOptInfo")
Reported-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Merge tag 'pull-riscv-to-apply-20260109' of https://github.com/alistair23/qemu into staging

First RISC-V PR for 11.

* Remove unused import statement from sifive_u test
* Free allocated memory in core/loader
* Add all available CSRs to 'info registers'
* Add 'riscv-aia' accel prop info to documentation
* Fix IOMMU MemoryRegion owner
* Make riscv cpu.h target partially independent
* Expand AIA target[i] source handling and refactor related code
* Don't look up DDT cache in Off and Bare modes
* Add Zilsd and Zclsd extension support
* Add RISCV ZALASR extension
* Add support for MIPS P8700 CPU

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmlgmt8ACgkQr3yVEwxT
# gBMxsRAAsdrRs8jrvjJqA60vt6Q/YZRCZFTeRfGlq92zVV4cmkUIkZdCESQsbToV
# lGmbdLXXeC8huxh27zjQuoO9JZzPlg6tBzxCpuNXnrTQB57UKjLJoQ4rKJ9F6wT+
# iakZ3ky6iN9N64p1lDRwfph7hjxodb6Vxgi/iBTsWdj1p4OsJgL2kOPSVBZLdkoL
# fTngoy0bmnV83o2eXIBx09YMxCaT3zjrhIf5lZ3zIeML8wJiq9RKUTs9pDlVO5Z1
# UEeBC8SHNj6siZ5EkCk3IQf7hIq77UITR4wHMQmNLqXY25pSexzqgAKiQt5bbU38
# VyUcXZglXKyvWDPLR36kKQeSSQFaToyVYmw2pr4oZXtEwAUrh8KqprlL+o/V1kFk
# 726i03xtqpPn/HN49kzvfOatlq5qUkeLPWI5RN/q9jjE4RdNxPeSBeyy47yNoR6t
# i9jPV+Z9XhNk7OpTmFKyEEBrf2cyGBubddpDgjDlzBohaICk24pIZgUpHs5WyIkF
# 8/mz9nruUHNXYwasQ5zjHoEaNfoCAgmAMY8klNK6t7Ty5AhT5x0c/5c5WxJ4L0BC
# z0WMZrK4r3uoFeXxRqQZnaWxx0ySCQkPyCuRNGqCx8J/bFhx9VUz5xgR1fZpkfNG
# NdDCueZI3mtdULz2JFe+wwan5XPapEKArFW0RQdR4QYBHiZTrpE=
# =gVkC
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 09 Jan 2026 05:06:23 PM AEDT
# gpg:                using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65  9296 AF7C 9513 0C53 8013

* tag 'pull-riscv-to-apply-20260109' of https://github.com/alistair23/qemu: (34 commits)
  test/functional: Add test for boston-aia board
  riscv/boston-aia: Add an e1000e NIC in slot 0 func 1
  hw/riscv: Add support for MIPS Boston-aia board mode
  hw/riscv: Add support for RISCV CPS
  hw/misc: Add RISC-V CPC device implementation
  hw/misc: Add RISC-V CMGCR device implementation
  target/riscv: Add Xmipslsp instructions
  target/riscv: Add mips.pref instruction
  target/riscv: Add mips.ccmov instruction
  target/riscv: Add MIPS P8700 CSRs
  target/riscv: Add MIPS P8700 CPU
  target/riscv: Add cpu_set_exception_base
  Add RISCV ZALASR extension
  target/riscv: Add Zilsd and Zclsd extension support
  hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
  hw/intc/riscv_aplic: Factor out source_active() and remove duplicate checks
  hw/intc/riscv_aplic: Expand inactive source handling for AIA target[i]
  target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val
  target/riscv: Combine mhpmcounter and mhpmcounterh
  target/riscv: Combine minstretcfg and minstretcfgh
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

test/functional: Add test for boston-aia board

Add functional test for Boston AIA board. The P8700 RISC-V based
CPU by MIPS supports it at the moment.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260108134128.2218102-13-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

riscv/boston-aia: Add an e1000e NIC in slot 0 func 1

The Boston AIA board needs a basic GbE NIC.  There is no PCH GbE
device emulation, so use an `e1000e` instead.  We place it in
**slot 0, function 1** in order not to conflict with the existing
AHCI device in slot 0 func 0.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-12-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/riscv: Add support for MIPS Boston-aia board mode

The board model supports up to 64 harts with MIPS CPS, MIPS GCR,
MIPS CPC, AIA plic, and AIA clint devices. The model can create
boot code, if there is no -bios parameter. We can specify -smp x,
cores=y,thread=z.
Ex: Use 4 cores and 2 threads with each core to
have 8 smp cpus as follows.
  qemu-system-riscv64 -cpu mips-p8700 \
  -m 2G -M boston-aia \
  -smp 8,cores=4,threads=2 -kernel fw_payload.bin \
  -drive file=rootfs.ext2,format=raw -serial stdio

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-11-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/riscv: Add support for RISCV CPS

Add support for the Coherent Processing System for RISC-V.
This enables SMP support for RISC-V boards that require
cache-coherent multiprocessor systems.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-10-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/misc: Add RISC-V CPC device implementation

Add RISC-V implementation of the Cluster Power Controller (CPC) device.
It is based on the existing MIPS CPC implementations but adapted for
RISC-V systems.

The CPC device manages power control for CPU clusters in RISC-V
systems.

This is needed for the MIPS BOSTON AIA board.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-9-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/misc: Add RISC-V CMGCR device implementation

Add RISC-V implementation of the Coherent Manager Global Control
Register (CMGCR) device. It is based on the existing MIPS CMGCR
implementation but adapted for RISC-V systems.

The CMGCR device provides global system control for multi-core
configurations in RISC-V systems.

This is needed for the MIPS BOSTON AIA board.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-8-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add Xmipslsp instructions

Add MIPS P8700 ldp, lwp, sdp, swp instructions.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-7-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add mips.pref instruction

Add MIPS P8700 prefetch instruction defined by Xmipscbop.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-6-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add mips.ccmov instruction

Add mips.ccmov defined by Xmipscmov.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-5-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add MIPS P8700 CSRs

Define MIPS CSRs used for P8700 CPU.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-4-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add MIPS P8700 CPU

Introduce P8700 CPU by MIPS.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-3-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add cpu_set_exception_base

Add a new function, so we can change reset vector from platforms
during runtime.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-2-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Add RISCV ZALASR extension

This is based on version v0.9 of the ZALASR specification [1].
The specification is listed as in Ratified state [2].

[1]: https://github.com/riscv/riscv-zalasr/tree/v0.9
[2]: https://lf-riscv.atlassian.net/wiki/spaces/HOME/pages/16154882/All+RISC-V+Specifications+Under+Active+Development

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Roan Richmond <roan.richmond@codethink.co.uk>
Message-ID: <20251112162923.311714-1-roan.richmond@codethink.co.uk>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add Zilsd and Zclsd extension support

This patch adds support for the Zilsd and Zclsd extension,
which is documented at https://github.com/riscv/riscv-zilsd/releases/tag/v1.0

Signed-off-by: LIU Xu <liuxu@nucleisys.com>
Co-developed-by: SUN Dongya <sundongya@nucleisys.com>
Co-developed-by: ZHAO Fujin <zhaofujin@nucleisys.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <176154834968.21563.217396575391240410-1@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes

According to the RISC-V IOMMU specification:

* When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
  inbound transactions disallowed" fault (cause = 256) is reported for any
  inbound transaction.

* When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
  translated address is the same as the IOVA, unless the transaction type
  is disallowed (cause = 260).

In the current implementation, the DDT cache is incorrectly looked up
even when ddtp.iommu_mode is set to Off or Bare. This may result in
unintended cache hits.

Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
set to Off or Bare. For other modes, software is required to issue cache
invalidation commands before any inbound transactions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Message-ID: <20251028085032.2053569-1-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/intc/riscv_aplic: Factor out source_active() and remove duplicate checks

Refactor the APLIC code to consolidate repeated conditions checking
whether an interrupt source is valid, delegated, or inactive.

Signed-off-by: Nikita Novikov <n.novikov@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20251029-n-novikov-aplic_aia_ro-v1-2-39fec74c918a@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/intc/riscv_aplic: Expand inactive source handling for AIA target[i]

According to the RISC-V AIA v1.0, section 4.5.2 ("Source configurations"),
register target[i] shall be read-only zero when interrupt source i is inactive
in this domain. A source is inactive if it is delegated to a child domain or
its source mode is INACTIVE.

The previous implementation only checked SM == INACTIVE. This patch adds
full compliance:
- Return zero on read if D == 1 or SM == INACTIVE
- Ignore writes in both cases

Fixes: b6f1244678 ("intc/riscv_aplic: Fix target register read when source is inactive")
Signed-off-by: Nikita Novikov <n.novikov@syntacore.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20251029-n-novikov-aplic_aia_ro-v1-1-39fec74c918a@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val

Now that mhpmcounter is always a 64-bit value we can remove the
upper_half argument from riscv_pmu_ctr_get_fixed_counters_val() and
always return a 64-bit value.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103033713.904455-9-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Combine mhpmcounter and mhpmcounterh

According to version 20250508 of the privileged specification,
mhpmconter is a 64-bit register and mhpmcounterh refers to the top
32 bits of this register when XLEN == 32.  No real advantage is
gained by keeping them separate, and combining allows for slight
simplification.

Note, the cpu/pmu VMSTATE version is bumped breaking migration from
older versions.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-9-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-8-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Combine minstretcfg and minstretcfgh

According to version 20250508 of the privileged specification,
minstretcfg is a 64-bit register and minstretcfgh refers to the top
32 bits of this register when XLEN == 32.  No real advantage is
gained by keeping them separate, and combining them allows for slight
simplification.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-8-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-7-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Combine mcyclecfg and mcyclecfgh

According to version 20250508 of the privileged specification, mcyclecfg
is a 64-bit register and mcyclecfgh refers to the top 32 bits of this
register when XLEN == 32.  No real advantage is gained by keeping
them separate, and combining them allows for slight simplification.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-7-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-6-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Combine mhpmevent and mhpmeventh

According to version 20250508 of the privileged specification,
mhpmeventn is 64 bits in size and mhpmeventnh is only ever used
when XLEN == 32 and accesses the top 32 bits of the 64-bit
mhpmeventn registers. Combine the two arrays of target_ulong
mhpmeventh[] and mhpmevent[] to a single array of uint64_t.

This also allows for some minor code simplification where branches
handling either mhpmeventh[] or mhpmevent[] could be combined.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-6-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-5-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Bugfix make bit 62 read-only 0 for sireg* cfg CSR read

According to version 20250508 of the privileged specification, a read of
cyclecfg or instretcfg through sireg* should make the MINH bit
read-only 0, currently bit 30 is zeroed.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-5-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-4-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Fix size of mhartid

and update formatting in log.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-3-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-3-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Fix size of trivial CPUArchState fields

This commits groups together all CPUArchState fields whose behaviour can
be retained by simply changing the size of the field.

Note, senvcfg is defined to be SXLEN bits wide, but is widened to 64
bits to match henvcfg and menvcfg.  Next, [m|h]edeleg are changed to
64 bits as defined privileged specification, and hvictl is fixed to 32
bits which holds all relevant values, see HVICTL_VALID_MASK.  The
remaining fields touched in the commit are widened from [H|S|M]XLEN
to 64-bit.

Note, the cpu/hyper, cpu/envcfg, cpu/jvt, and cpu VMSTATE versions are
bumped, breaking migration from older versions.

References to the privileged/unprivileged RISCV specification refer to
version 20250508.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-2-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-2-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/riscv/riscv-iommu: Fix MemoryRegion owner

as points to the MemoryRegion itself. s is the device that owns the
MemoryRegion.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027-iommu-v1-1-0fc52a02a273@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

docs/specs/riscv-aia.rst: add 'riscv-aia' accel prop info

Add a small section talking about the 'riscv-aia' KVM setting we
implement and how it affects the provisioning of the IMSIC s-mode
in-kernel controller.

While we're at it, fix the formatting of the AIA bullet list.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251028084622.1177574-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: print all available CSRs in riscv_cpu_dump_state()

At this moment we're printing a small selection of CSRs. There's no
particular reason to not print all of them.

We're ignoring the note about CSR_SSTATUS being ommited because it can
be read via CSR_MSTATUS. There's a huge list of CSRs that would fall in
this category and it would be an extra burden to manage them, not
mentioning having to document "we're not listing X because it's the same
value as Y" to users.

Remove 'dump_csrs' and use the existing 'csr_ops' array to print all
available CSRs. Create two helpers in csr.c to identify FPU and VPU CSRs
and skip them - they'll be printed in the FPU/VPU blocks later.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv/cpu: print all FPU CSRs in riscv_cpu_dump_state()

We're missing fflags and frm.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv/cpu: add riscv_dump_csr() helper

riscv_cpu_dump_state() is using the same pattern to print a CSR given
its number. Add a helper to avoid code repetition.

While we're at it fix the identation of the 'flags & CPU_DUMP_VPU'
block.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/core/loader: Free the allocated string from size_to_str()

The string needs be be freed with g_free() according to the functions
documentation.

Coverity: CID 1642762
Fixes: f62226f7dc44 ("hw/core/loader: improve error handling in image loading functions")
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251030015306.2279148-3-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/core/loader: Free the image file descriptor on error

Coverity: CID 1642764
Fixes: f62226f7dc4 ("hw/core/loader: improve error handling in image loading functions")
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251030015306.2279148-2-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/core/loader: Fixup whitespace for get_image_size()

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by:Vishal Chourasia <vishalc@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251030015306.2279148-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

tests/functional/riscv64/test_sifive_u: Remove unused import statement

skipIfMissingCommands is not used here, remove the import to silence
a pylint warning for this file.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027112803.54564-1-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>