Brian Cain [Mon, 22 Jun 2026 22:28:22 +0000 (15:28 -0700)]
target/hexagon: Add cpu modes, mmu indices, next_PC to state
Add cpu execution mode (user/supervisor/guest), MMU index, and next_PC
to DisasContext and translation state. Declare the MMU_INDEX bit field
in TB_FLAGS and use it to propagate the mmu index into translations.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:28:20 +0000 (15:28 -0700)]
target/hexagon: Add implementation of cycle counters
Add cycle counting infrastructure for system emulation:
- PCYCLE_ENABLED TB flag to gate cycle counting
- gen_pcycle_counters() to emit cycle count increments
- Real implementations replacing pcycle stubs in cpu_helper.c
- hex_cycle_count TCG global for t_cycle_count
- pcycle_enabled context field in DisasContext
All pcycle code is guarded by #ifndef CONFIG_USER_ONLY.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:28:11 +0000 (15:28 -0700)]
target/hexagon: Implement do_raise_exception()
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:28:08 +0000 (15:28 -0700)]
target/hexagon: Add vmstate representation
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:28:05 +0000 (15:28 -0700)]
target/hexagon: Add new macro definitions for sysemu
Also: add nop TCG overrides for break, unpause, fetchbo; add TCG
override for dczeroa_nt (non-temporal variant of dczeroa).
break: this hardware breakpoint instruction is used with the in-silicon
debugger feature, this is not modeled.
unpause: this instruction is used to resume hardware threads that are
stalled by pause instructions. pause is modeled as a nop, or in RR
mode as an EXCP_YIELD. This instruction is safe to ignore.
Since prefetch functions are not modeled, fetchbo is safe to ignore.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:28:02 +0000 (15:28 -0700)]
target/hexagon: Add TCG values for sreg, greg
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:28:00 +0000 (15:28 -0700)]
target/hexagon: Add guest, system reg number defs
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:59 +0000 (15:27 -0700)]
target/hexagon: Add a placeholder fp exception
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:58 +0000 (15:27 -0700)]
target/hexagon: Add privilege check, use tag_ignore()
Add system event and cause code definitions needed for exception
handling in sysemu mode. Add privilege checks that raise exceptions
for guest/supervisor-only instructions executed without appropriate
privilege.
Expose hex_gen_exception_end_tb() via translate.h (previously the
static gen_exception_end_tb) so that it can be called from the
generated privileged-instruction TCG stubs.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:56 +0000 (15:27 -0700)]
target/hexagon: Suppress unused-variable warnings for sysemu source regs
The analyze_read() methods on GuestSource, GuestPairSource,
SystemSource, and SystemPairSource were no-ops because these
source registers do not need read-tracking in the analyze phase.
However, gen_analyze_funcs.py unconditionally declares the
register-number variable (e.g. GsN) via decl_reg_num() for all
registers that are read or written. When building with
hexagon-softmmu, the generated analyze function bodies are
compiled (outside the #ifndef CONFIG_USER_ONLY guard), and the
declared-but-unreferenced register-number variable triggers
-Werror=unused-variable under both gcc and clang.
Override decl_reg_num() in each class to declare the register number with
G_GNUC_UNUSED, suppressing the warning.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:55 +0000 (15:27 -0700)]
target/hexagon: Handle system/guest registers in gen_analyze_funcs.py and hex_common.py
Add register classes for guest (G) and system (S) registers to
hex_common.py, and update gen_analyze_funcs.py to handle them.
Guest and system registers can only appear once per packet (one
transfer instruction each), so there is no read-after-write hazard
to detect during the analyze phase. Source classes (GuestSource,
GuestPairSource, SystemSource, SystemPairSource) provide a no-op
analyze_read() since these register reads do not need tracking.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:54 +0000 (15:27 -0700)]
target/hexagon: Add missing A_CALL attr, hintjumpr to multi_cof
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:53 +0000 (15:27 -0700)]
target/hexagon: Fix badva reference, delete CAUSE
The BADVA reg is referred to with the wrong identifier. The
CAUSE reg field of SSR is not yet modeled, we will dump
the SSR in a subsequent commit.
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:29:04 +0000 (15:29 -0700)]
target/hexagon/idef-parser: open input file in binary mode
On Windows, opening a file in text mode causes fread() to return fewer
bytes than ftell() reported, because CRLF sequences are translated to
LF on read. This causes idef-parser to report an error and abort.
Open the input file in binary mode ("rb") so that ftell() and fread()
agree on the file size across all platforms.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Mon, 22 Jun 2026 22:27:50 +0000 (15:27 -0700)]
target/hexagon: use cmd_array() instead of get_id()
get_id() returns the compiler's short name not a program.
Passing it directly as the command for the idef-parser preprocessing
custom_target happened to work for native gcc/clang builds but
breaks under cross compilers such as emcc or any ccache-wrapped compiler.
Brian Cain [Sun, 28 Jun 2026 19:03:58 +0000 (12:03 -0700)]
configs/meson: disable hexagon idef-parser for emscripten builds
The idef-parser is a native build tool that requires glib-2.0 on the
build machine. In emscripten cross builds, emconfigure sets
PKG_CONFIG_LIBDIR to emscripten's sysroot which prevents native
pkg-config from finding system-installed packages. Disable idef-parser
by default for emscripten since the wasm target does not need it.
Reviewed-by: Kohei Tokunaga <ktokunaga.mail@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-11-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Rename to FVDOT_sh so that we can introduce an insn
of the same name from FEAT_SME_F8F16.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOPA (widening, 2-way, FP8 to FP16)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FDOT (multiple, multiple and single, FP8 to FP16)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260625015159.719300-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMLAL (multiple and indexed, FP8 to FP16)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMLAL (multiple, multiple and single, FP8 to FP16)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Rename patterns to include _sh suffix, so that we can
distinguish insns of the same name from FEAT_SME_F8F16.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Enable FADD/FSUB (half-precision) with FEAT_SME_F8F16
These two instructions can be enabled with either
FEAT_SME_F8F16 or FEAT_SME_F16F16.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: fix && vs || mixup in feature function] Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 12:45:27 +0000 (13:45 +0100)]
docs/system: add FEAT_ECV_POFF to the emulation list
We already had this implemented since 2808d3b38a5 (target/arm:
Implement FEAT_ECV CNTPOFF_EL2 handling) but it has its own feature
name now. Add it to the list.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624124527.1018912-7-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 12:45:26 +0000 (13:45 +0100)]
target/arm: trigger timer recalc on HCR:(E2H|TGE) changes
Toggling the HCR state affects the offset calculated in
gt_phys_raw_cnt_offset so we should trigger a re-calculation on its
change.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624124527.1018912-6-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 12:45:25 +0000 (13:45 +0100)]
target/arm: gate check on scr_el3 behind ARM_FEATURE_EL3 check
We shouldn't be reading SCR_EL3 unless ARM_FEATURE_EL3 is enabled, if
it is then we check SCR_ECVEN allows tweaking the offset.
Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260624124527.1018912-5-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 12:45:24 +0000 (13:45 +0100)]
target/arm: trigger timer recalc on SCR:ECVEN change
Toggling the ECVEN state affects the offset calculated in
gt_phys_raw_cnt_offset so we should trigger a re-calculation on its
change.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624124527.1018912-4-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 12:45:23 +0000 (13:45 +0100)]
target/arm: trigger timer recalculation when toggling CNTHCTL:ECV
When toggling the state of ECV we affect the offset applied to timers.
As a result we should trigger a recalculation of the timer value to
take into account the new offset.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624124527.1018912-3-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 12:45:22 +0000 (13:45 +0100)]
target/arm: split evaluation of CNTHCTL timer IRQ masks
Whether the physical and virtual timer IRQs are masked are independent
of each other so the checking of CNTHCTL:CNTPMASK shouldn't depend of
not changing CNTVMASK.
While unlikely to be seen in real life we should still make sure we
behave correctly.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624124527.1018912-2-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Matyáš Bobek [Mon, 22 Jun 2026 16:08:10 +0000 (18:08 +0200)]
hw/arm: Plug FlexCAN into FSL_IMX6 and Sabrelite
FlexcanState is added to the FslIMX6State struct like other peripherals.
Add two new machine properties to Sabrelite machine for linking
the embedded FlexCAN instances to QEMU CAN buses by name.
No other machine uses FslIMX6State.
Signed-off-by: Matyáš Bobek <matyas.bobek@gmail.com> Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-id: 4159df998b0508bb411284ef406de23bbc5edfd8.1782140438.git.matyas.bobek@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Matyáš Bobek [Mon, 22 Jun 2026 16:08:09 +0000 (18:08 +0200)]
hw/net/can/flexcan: NXP FlexCAN core emulation
Added the FlexCAN2 emulator implementation core, with
CAN_FLEXCAN Kconfig flag and MAINTAINERS entry.
FlexCAN2 version can be found in i.MX6 SoCs and others.
More information about the implementation can be found in [1].
Some macro and struct defintions were borrowed from the Linux kernel.
The original authors agreed with relicensing them to GPL-2.0-or-later on
the qemu-devel mailing list.
Matyáš Bobek [Mon, 22 Jun 2026 16:08:08 +0000 (18:08 +0200)]
hw/misc/imx6_ccm: Add PLL3 and CAN clock
Add fixed frequency (480 MHz) PLL3, of which the FlexCAN
clock is derived, and compute FlexCAN frequency based on
the divider configuration (CCM_CSCMR2).
The clock frequency will be used for computing timestamps
in FlexCAN emulator.
Signed-off-by: Matyáš Bobek <matyas.bobek@gmail.com> Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-id: 95da33074f8b79842566d61e4e04448b1e622080.1782140438.git.matyas.bobek@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Matyáš Bobek [Mon, 22 Jun 2026 16:08:07 +0000 (18:08 +0200)]
hw/arm/sabrelite: Introduce class SabreliteMachineState
Create full class SabreliteMachineState extending MachineState.
Previously, Sabrelite board MachineState was declared indirectly by the
DEFINE_MACHINE_ARM macro. FslIMX6State was only instantiated in the
sabrelite_init function. For FlexCAN device, machine properties
will be used to select QEMU CAN buses. A custom class is therefore
required, so the CanBusState "connections" can then be added as fields.
Signed-off-by: Matyáš Bobek <matyas.bobek@gmail.com> Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-id: 115740db83cf2e5a5e7bb349130c9706934ec1f3.1782140438.git.matyas.bobek@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Thu, 18 Jun 2026 16:33:09 +0000 (17:33 +0100)]
tests/tcg/aarch64/system/gpc-test.c: Basic test for granule protection check
* Sets up granule protection tables
* Enables GPC and bypass windows
* Performs memory accesses in the protected region to
check for allowed and disallowed reads.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260618-jmac-gpc3b-v3-6-353e546067e7@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Thu, 18 Jun 2026 16:33:08 +0000 (17:33 +0100)]
tests/tcg/aarch64/system: Alternative boot object for exception logging
This allows us to record information about exceptions using a small
area of memory, and continue with the test so it can verify exceptions
have been taken where expected.
LOGGING_VECTOR_TABLE is added to switch this on, and vec_logging_boot.o
is built from boot.S with this flag. Since boot.o is created for multiple
test targets, we have to build a separate object and selectively link this
new vec_logging_boot.o into particular test binaries.
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618-jmac-gpc3b-v3-5-353e546067e7@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Thu, 18 Jun 2026 16:33:07 +0000 (17:33 +0100)]
target/arm/cpu-features.h: x-rme now means GPC3
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260618-jmac-gpc3b-v3-4-353e546067e7@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Thu, 18 Jun 2026 16:33:06 +0000 (17:33 +0100)]
target/arm/ptw.c: Add Granule Bypass Windows
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618-jmac-gpc3b-v3-3-353e546067e7@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Thu, 18 Jun 2026 16:33:05 +0000 (17:33 +0100)]
target/arm: Setup new registers for GPC3
Adds GPCBW_EL3. A custom write function is necessary to flush TLBs
when this register is written. Also allows write to the GPCBW bit of
GPCCR_EL3.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260618-jmac-gpc3b-v3-2-353e546067e7@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Thu, 18 Jun 2026 16:33:04 +0000 (17:33 +0100)]
target/arm/tcg/cpu64.c: Extra test for GPC3.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260618-jmac-gpc3b-v3-1-353e546067e7@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 15 Jun 2026 10:50:29 +0000 (11:50 +0100)]
hw/intc/gicv5: Define and use GICV5_PENDING_IRQ_NONE
The GICv5PendingIrq struct representation of "there is no pending
interrupt" sets the prio field to PRIO_IDLE, and generally to avoid
confusion we also set the intid to 0. We want to return this value
or initialize some variable to it in several places in the GICv5
implementation, and the support for the virtual interrupt domain
introduces more.
Define a convenience macro for this special-case struct value, and
use it instead of opencoding either the structure initializer or
explicit assignment to the two fields.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260615105029.2898872-6-peter.maydell@linaro.org
Peter Maydell [Mon, 15 Jun 2026 10:50:28 +0000 (11:50 +0100)]
target/arm: GICv5 cpuif: Remove ICC_HAPR_EL1
The ICC_HAPR_EL1 register reported the current running priority of
the CPU. However this can be easily calculated by reading the
APR register, so it has been removed in the newly released A.a
version of the GICv5 spec (IHI 111701).
Remove QEMU's implementation of this register. (This is OK for
us to do without warning because our GICv5 support is listed
as "experimental"; we anticipated that this kind of spec change
might happen.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260615105029.2898872-5-peter.maydell@linaro.org
Peter Maydell [Mon, 15 Jun 2026 10:50:27 +0000 (11:50 +0100)]
target/arm: GICv5 cpuif: Tag ICC_PPI_PRIORITYR<n> regs as ARM_CP_NO_RAW
The GICv5 system registers are all tagged with ARM_CP_NO_RAW, because
we don't want them to use the standard mechanisms for migration or
KVM state synchronization. (GICv5 handling of both migration and KVM
support is a "will be implemented later" feature.) We missed this tag
on the ICC_PPI_PRIORITYR<n>_EL1 registers; add it.
Fixes: ef540c1d301 ("target/arm: GICv5 cpuif: Implement PPI priority registers") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260615105029.2898872-4-peter.maydell@linaro.org
Peter Maydell [Mon, 15 Jun 2026 10:50:26 +0000 (11:50 +0100)]
target/arm: GICv5 cpuif: Recalculate IRQ/FIQ on ICC_PCR_EL1 write
When the guest writes ICC_PCR_EL1 we should recheck whether we should
be signalling IRQ or FIQ, because we use this priority mask value in
determining whether the highest priority interrupt should be
signalled or not.
Fixes: 9bd90bddb79b ("target/arm: GICv5 cpuif: Signal IRQ or FIQ") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260615105029.2898872-3-peter.maydell@linaro.org
Peter Maydell [Mon, 15 Jun 2026 10:50:25 +0000 (11:50 +0100)]
arm/gicv5: Add URL to GICv5 specification
The GICv5 specification has now been assigned its final document ID
for a rev A.a spec version. This seems like a good point to add a
pointer to the spec to the main source files.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Tested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260615105029.2898872-2-peter.maydell@linaro.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618041517.573469-11-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618041517.573469-10-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FDOT (multiple and indexed vector)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618041517.573469-9-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618041517.573469-8-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FDOT (multiple and single vector)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618041517.573469-7-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMLALL (multiple and indexed vector)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618041517.573469-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618041517.573469-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMLALL (multiple and single vector)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618041517.573469-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOPA (widening, 4-way fp8 to fp32)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618041517.573469-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Move tile_vslice_{index, offset} to vec_internal.h
Move in preparation for being used outside sme_helper.c.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618041517.573469-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Use expand_pred_N for helper_sve_not_zpz_N
These is a bitwise operation; with expand_pred_N,
we can always operate on uint64_t.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618040718.572950-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Enable FEAT_SVE_AES instructions in streaming mode.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618040718.572950-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Rename from isar_feature_aa64_sve2_aes to match
the feature name: FEAT_SVE_AES.
Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618040718.572950-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618040718.572950-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618040718.572950-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Implement with a DO_COMPACT macro and general purpose
predicate handling.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618040718.572950-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618040718.572950-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
jack wang [Wed, 17 Jun 2026 16:14:06 +0000 (00:14 +0800)]
hw/timer/imx_epit: Replace DPRINTF with trace events
Clean up the codebase by removing the outdated DEBUG_IMX_EPIT
and DPRINTF macros, replacing them with modern QEMU trace events.
This also removes an empty and meaningless DPRINTF("\n") in the
imx_epit_realize function.
Signed-off-by: jack wang <163wangjack@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260617161406.14705-1-163wangjack@gmail.com
[PMM: remove stray blank lines from bottom of trace-events file] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Brian Cain [Wed, 24 Jun 2026 05:48:32 +0000 (22:48 -0700)]
tests/docker: add flex and bison to emsdk-wasm64-cross
The hexagon idef-parser requires flex and bison as host build
tools. Add them to the emsdk-wasm64-cross container image so that
wasm64 builds including hexagon-softmmu can find them.
Stefan Hajnoczi [Sun, 28 Jun 2026 03:06:04 +0000 (23:06 -0400)]
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* target/i386/mshv: CPU model support
* target/i386/mshv: first part of migration support
* target/i386/mshv: faster register access for MMIO exits
* target/i386/tdx: add support for AMX alias bits in CPUID and AVX10
* Deprecate memory-encryption in favor of confidential-guest-support
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (45 commits)
i386/tdx: Add CPUID_24_0_EBX_AVX10_VL_MASK as supported
i386/tdx: Make AMX alias bits supported
i386/tdx: Use .has_gpa field to check if the gpa is valid
machine: Deprecate memory-encryption
qemu-options: Add description of tdx-guest object
qemu-options: Add confidential-guest-support to machine options
qemu-options: Change memory-encryption to confidential-guest-support in the example
i386/sev: Remove the example that references memory-encryption
target/i386/mshv: use the register page to set registers
target/i386/mshv: use the register page to get registers
target/i386/mshv: hv_vp_register_page setup for the vcpu
include/hw/hyperv: add hv_vp_register_page struct definition
accel: remove unnecessary #ifdefs
target/i386/mshv: migrate CET/SS MSRs
target/i386/mshv: migrate MTRR MSRs
target/i386/mshv: migrate MSRs
target/i386/mshv: reconstruct hflags after load
target/i386/mshv: migrate XSAVE state
target/i386/mshv: migrate pending ints/excs
target/i386/mshv: move msr code to arch
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Linisha [Fri, 26 Jun 2026 18:11:18 +0000 (23:41 +0530)]
docs/system: add general note about architecture and machine differences
Add a note near the start of the introduction explaining that QEMU
options, properties, and command lines may differ between target
architectures and machine types. This helps prevent confusion when
examples shown for one architecture do not work for another, such as
the pflash0/pflash1 options visible in -machine help on some machines
but not others.
Stefan Hajnoczi [Fri, 26 Jun 2026 11:58:03 +0000 (07:58 -0400)]
Merge tag 'pbouvier/pr/ci-20260625' of https://gitlab.com/p-b-o/qemu into staging
Changes:
- [PATCH v2 0/6] gitlab: expose more info about CI runner environment (=?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>) Link: https://lore.kernel.org/qemu-devel/20260624124657.2725376-1-berrange@redhat.com
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmo9qdAACgkQtEQ30Zwo
# Yt8wMwwAhjB7xy4Eu3gt+leYEq9Yfq44fFGAnBQlN1kvEJhYkxJIA0KSoTZHGSQ/
# Kn97Quhc4kUI4+VvW++pDLevRZ1L80bcKPIM1PtOv5+VKvzCpEjzso6xYodpXTB5
# XgoXgnfTrLagccVeQLObex7PYPVtiQRV0xGXpQSgDqzbxgczgeEqR6YuED7eZVaJ
# ya2JdrIGnpKRhaal+RoCfSnqkRVYvIqs1/CVW2a3VZAq9+kLsx22NceDmX4v22mU
# O/rV4NlfjQ/2FuJvr/Zdnq8RFMHZwFW/NitKWH8esdgXwShnScNq/w4cHS/8CiYC
# 0jq1PxMNuI6q9yjQrXxDMdzJaPjyFnjCFCEYCyZsl9Iokb1GnWVT8xDB07HHRXwL
# nH6YYepSEhlEhY2RFkR4lT9q4p2XoTXlASgxpn6MLu+4V+vuh2A47KNNuClmiLnL
# JQfeF4970RHuJOzxxlzcIpjxHJSxi4SjbGKIuQZ6Hu1eIVx4Tly2Xep4mxa5qCZN
# KIwoRaKZ
# =jvzH
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 25 Jun 2026 18:21:04 EDT
# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF
* tag 'pbouvier/pr/ci-20260625' of https://gitlab.com/p-b-o/qemu:
gitlab: greatly expand captured info about CI runner environment
gitlab: pull before_script logic into .base_meson_job_template
gitlab: pull ccache setup into .base_meson_ccache_job_template
gitlab: use .base_meson_job_template from crossbuild jobs
gitlab: move .meson_job_template into base.yaml
gitlab: remove unused .cross_test_artifacts template
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Conflicts:
- .gitlab-ci.d/buildtest-template.yml
Context conflict with commit 559d83437174 ("gitlab: ensure "check-XXX'
jobs capture functional test logs") moving the artifacts section.
The stsi 3.2.2 page is being prepared by the kvm module and the size is
clamped by the kernel. As the memory is mapped in the guest, another
guest VCPU could race and overwrite the count and messing up the move
operation. For any out of bound count, fall back to the kernel buffer.
Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20260622092035.400959-1-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Stefan Hajnoczi [Thu, 25 Jun 2026 23:25:44 +0000 (19:25 -0400)]
Merge tag 'pull-11.1-testing-updates-230626-1' of https://gitlab.com/stsquad/qemu into staging
testing and gitlab updates:
- present a dev friendly cmd line in functional test logs
- tell pylint to skip c-modules
- widen the capture of functional tests logs in gitlab
- remove workaround for MacOS build targets
- update the gitlab bug template for security process
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmo6W8MACgkQ+9DbCVqe
# KkRwDwf+NiRSwHfbjVSPOWws8wVSZHcgzeArHPsXtYrebi+rX9+l+bdIeRNFTfDX
# +6FvA5lWMbIB+pNFAkPdtjvpzzmV+tjaer6lR//0riF4Ch3TufYHhDVIjuvJaI/d
# mvsVUAFCS6AMb9sdky2mGA8SHeO5dV7XqMquTOH/tfs/M3PuLFMj8qcVFzXlmC79
# pzbpahCSJsclFj8traFYiAR2ofGXUH2PkW5aEctD1LnyAbGEHdEO8vR3KKB7ysHA
# OySKG0IXTBmyH03rZ9WHskVlH/xVZjo+FPro0moduTVOLeCksNBnuxdmKJKvPVVy
# vSrF/TOjZbmgg9vVlGULFNKTu3VlAQ==
# =2LgM
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 23 Jun 2026 06:11:15 EDT
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* tag 'pull-11.1-testing-updates-230626-1' of https://gitlab.com/stsquad/qemu:
gitlab: update bug template for sec issues & tool assistance
gitlab: remove build target hacks
gitlab: ensure "check-XXX' jobs capture functional test logs
tests/functional: tell pylint not to check c-modules
python/qemu: dump a developer friendly version of cmdline to logs
python/qemu: split console from harness args
python/qemu: split arg between base and harness lists
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
projects / thirdparty / qemu.git / log
