From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit 759c456b1d22fe4083c8b384da27d3f56fd53f82:

  Merge tag 'linux-user-next-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-04-27 12:57:33 -0400)

are available in the Git repository at:

  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20260429-1

for you to fetch changes up to 4d82676cfc6e14099d0e529445a5ee520752ebe5:

  target/riscv: rvv: Handle mask/source overlap of vector reduction instructions (2026-04-29 14:25:06 +1000)

----------------------------------------------------------------
RISC-V PR for 11.1.

* Use standard EN_PRI bit for PRI IOMMU
* Add draft RISC-V Zbr ext as xbr0p93
* Forbid to use legacy native endianness API
* Fix irq_overflow_left residual value bug in IOMMU
* Add IPSR.PMIP RW1C support to IOMMU
* Use kvm timer frequency when kvm enabled
* Fix stale ptshift and base on page walk restart
* Fix heap OOB in ACLINT MTIMER multi-socket
* Reject RISC-V HTIF invalid signature ranges
* Fix RV32 henvcfg/stateen CSR handling
* Add Zvfbfa extension support
* Allow fractional LMUL on vector SHA instructions
* Add Tenstorrent mvendorid
* Warn if a ELF format file is loaded as a binary
* Initialize riscv_excp_names[] and riscv_intr_names[] using designated initializer
* Mask xepc[0] only when Zc* extension is enabled
* Generate access fault if sc comparison fails
* Don't OR mip.SEIP when mvien is one
* Use ELEN for Fractional LMUL check
* Fix Zjpm implementation
* Handle mask/source overlap of vector reduction instructions

----------------------------------------------------------------
Alistair Francis (3):
      target/riscv: Generate access fault if sc comparison fails
      target/riscv: Don't OR mip.SEIP when mvien is one
      target/riscv: Use ELEN for Fractional LMUL check

Anton Blanchard (2):
      target/riscv: rvv: Allow fractional LMUL on vector SHA instructions
      target/riscv: rvv: Handle mask/source overlap of vector reduction instructions

Bruno Sa (2):
      target/riscv: preserve RV32 henvcfgh on henvcfg writes
      target/riscv: fix RV32 stateen CSR handling

Djordje Todorovic (1):
      target/riscv: Use MO_LE for instruction fetch

Emmanuel Blot (3):
      util: export CRC32[C] lookup tables
      target/riscv: add draft RISC-V Zbr ext as xbr0p93
      disas: diassemble RISC-V xlrbr (crc32) instructions

Frank Chang (7):
      target/riscv: Initialize riscv_excp_names[] and riscv_intr_names[] using designated initializer
      target/riscv: Mask xepc[0] only when Zc* extension is enabled
      target/riscv: Add a helper to return the current effective priv mode
      target/riscv: Fix pointer masking PMM field selection logic
      target/riscv: Fix pointer masking for virtual-machine load/store insns
      target/riscv: Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm()
      target/riscv: Fix pointer masking translation mode check bug

Frédéric Pétrot (2):
      target/riscv: Make LQ and SQ use 128-bit ld/st
      target/riscv: Remove MTTCG check for x-rv128 CPU model

Jay Chang (3):
      hw/riscv/riscv-iommu: Use standard EN_PRI bit for PRI
      hw/riscv/riscv-iommu-hpm: Fix irq_overflow_left residual value bug
      hw/riscv/riscv-iommu: Add IPSR.PMIP RW1C support

Joel Stanley (1):
      target/riscv: tt-ascalon: Add Tenstorrent mvendorid

Max Chou (9):
      target/riscv: Add cfg properties for Zvfbfa extensions
      target/riscv: Add the Zvfbfa extension implied rule
      target/riscv: rvv: Add new VTYPE CSR field - altfmt
      target/riscv: rvv: Introduce reset_ill_vtype to reset illegal vtype CSR
      target/riscv: Use the tb->cs_base as the extend tb flags
      target/riscv: Introduce altfmt into DisasContext
      target/riscv: Introduce BF16 canonical NaN for Zvfbfa extension
      target/riscv: rvv: Support Zvfbfa vector bf16 operations
      target/riscv: Expose Zvfbfa extension as a cpu property

Munkhbaatar Enkhbaatar (1):
      riscv_htif: reject invalid signature ranges (end <= begin)

Nicholas Piggin (1):
      hw/riscv/boot: Warn if a ELF format file is loaded as a binary

Philippe Mathieu-Daudé (12):
      target/riscv: Use explicit little-endian LD/ST API
      target/riscv: Explode MO_TExx -> MO_TE | MO_xx (again)
      target/riscv: Conceal MO_ALIGN|MO_TE within load_acquire / store_release
      target/riscv: Factor tiny ldn() helper in gdbstub
      target/riscv: Simplify riscv_cpu_gdb_write_register()
      target/riscv: Expose mo_endian_env()
      target/riscv: Have gdbstub consider CPU endianness
      target/riscv: Replace MO_TE by mo_endian (MIPS extension)
      target/riscv: Replace MO_TE by mo_endian (Zilsd extension)
      target/riscv: Replace MO_TE by mo_endian (Zalasr extension)
      target/riscv: Replace MO_TE -> MO_LE
      configs/targets: Forbid RISC-V to use legacy native endianness APIs

Sebastián Alba Vives (2):
      target/riscv: fix stale ptshift and base on page walk restart
      hw/intc: fix heap OOB in ACLINT MTIMER multi-socket

Yicong Yang (1):
      hw/riscv/virt-acpi-build.c: Use kvm timer frequency when kvm enabled

Yong-Xuan Wang (1):
      target/riscv: fix address masking

 MAINTAINERS                                  |   5 +-
 configs/targets/riscv32-linux-user.mak       |   1 +
 configs/targets/riscv32-softmmu.mak          |   1 +
 configs/targets/riscv64-bsd-user.mak         |   1 +
 configs/targets/riscv64-linux-user.mak       |   1 +
 configs/targets/riscv64-softmmu.mak          |   1 +
 disas/riscv-xlrbr.h                          |  19 +
 hw/riscv/riscv-iommu-bits.h                  |   1 +
 include/exec/translation-block.h             |   1 +
 include/qemu/crc32.h                         |  14 +
 include/qemu/crc32c.h                        |   1 +
 target/riscv/cpu.h                           |  48 +-
 target/riscv/cpu_cfg.h                       |   1 +
 target/riscv/cpu_vendorid.h                  |   2 +
 target/riscv/helper.h                        |  65 ++
 target/riscv/internals.h                     |  33 +-
 target/riscv/cpu_cfg_fields.h.inc            |   2 +
 target/riscv/xlrbr.decode                    |  30 +
 disas/riscv-xlrbr.c                          |  79 +++
 disas/riscv.c                                |   2 +
 hw/char/riscv_htif.c                         |   6 +
 hw/intc/riscv_aclint.c                       |  10 +-
 hw/riscv/boot.c                              |  23 +-
 hw/riscv/riscv-iommu-hpm.c                   |   1 +
 hw/riscv/riscv-iommu.c                       |  11 +-
 hw/riscv/virt-acpi-build.c                   |   7 +-
 target/riscv/bitmanip_helper.c               |  20 +
 target/riscv/cpu.c                           | 110 +--
 target/riscv/cpu_helper.c                    | 119 +++-
 target/riscv/csr.c                           | 135 +++-
 target/riscv/gdbstub.c                       |  42 +-
 target/riscv/op_helper.c                     |  28 +-
 target/riscv/tcg/tcg-cpu.c                   |  29 +-
 target/riscv/translate.c                     |  24 +-
 target/riscv/vector_helper.c                 | 398 ++++++++++-
 util/crc32.c                                 |  81 +++
 util/crc32c.c                                |   4 +-
 target/riscv/insn_trans/trans_rva.c.inc      |   6 +
 target/riscv/insn_trans/trans_rvi.c.inc      |  32 +-
 target/riscv/insn_trans/trans_rvv.c.inc      | 990 +++++++++++++++++----------
 target/riscv/insn_trans/trans_rvvk.c.inc     |   3 +-
 target/riscv/insn_trans/trans_rvzalasr.c.inc |  18 +-
 target/riscv/insn_trans/trans_xlrbr.c.inc    |  45 ++
 target/riscv/insn_trans/trans_xmips.c.inc    |  24 +-
 target/riscv/insn_trans/trans_zilsd.c.inc    |   4 +-
 disas/meson.build                            |   3 +-
 target/riscv/meson.build                     |   1 +
 tests/tcg/riscv64/Makefile.softmmu-target    |   5 +
 tests/tcg/riscv64/test-crc32.S               |  64 ++
 util/meson.build                             |   1 +
 50 files changed, 1922 insertions(+), 630 deletions(-)
 create mode 100644 disas/riscv-xlrbr.h
 create mode 100644 include/qemu/crc32.h
 create mode 100644 target/riscv/xlrbr.decode
 create mode 100644 disas/riscv-xlrbr.c
 create mode 100644 util/crc32.c
 create mode 100644 target/riscv/insn_trans/trans_xlrbr.c.inc
 create mode 100644 tests/tcg/riscv64/test-crc32.S

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.