From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit 30e8a06b64aa58a3990ba39cb5d09531e7d265e0:

  Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2026-06-29 17:41:42 +0200)

are available in the Git repository at:

  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20260701

for you to fetch changes up to 64ce9ac18757d79f3b5b337f7bcbdd0dabef3ce1:

  hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0 (2026-07-01 20:14:20 +1000)

----------------------------------------------------------------
RISC-V PR for 11.1

* Fix IMSIC CSR write and add tests
* Parametrise debug trigger number
* Add 'svbare' satp-mode
* Fix RINTC PLIC context ID for KVM
* Avoid abort when reading vtype before env->xl is set
* Skip reset for KVM irqchip
* Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
* More FDT cleanups (PLIC)
* Make FCTL.BE in IOMMU read only 0
* Check DC.TC reserved bits in IOMMU
* Apply UXL WARL handling to vsstatus
* Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU
* Set RISCV_IOMMU_FQ_HDR_PV appropriately
* Fix MSI MRIF IOMMU interrupt-pending offset
* Report QEMU CPU archid as 42
* Check PMP before updating PTE
* Add the Tenstorrent Atlantis machine

----------------------------------------------------------------
Alistair Francis (1):
      hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr

Charlie Jenkins (1):
      target/riscv: Report QEMU CPU archid as 42

Chris Rauer (1):
      hw/i2c: Add DesignWare I2C Controller

Daniel Henrique Barboza (16):
      target/riscv/cpu: add CPU unrealize callback
      target/riscv: dynamic alloc of debug trigger arrays
      target/riscv: add 'num-triggers' debug property
      target/riscv/cpu.c: add 'svbare' satp-mode
      hw/riscv/sifive_u.c: remove unneeded qemu_fdt_get_phandle() call
      hw/riscv/sifive_u.c: use intc_phandle in plic creation
      hw/riscv/sifive_u: add #address-cells in PLIC FDT
      hw/riscv/virt.c: change 'plic' nodename to 'interrupt-controller'
      hw/riscv: add create_fdt_plic() helper
      hw/riscv/riscv-iommu: rename regs_rw to regs
      hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
      hw/riscv/riscv-iommu: check DC.TC reserved bits
      hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
      hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
      hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
      hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0

Inochi Amaoto (1):
      target/riscv: Check PMP before updating PTE

Joel Stanley (9):
      target/riscv: Avoid NULL deref in IMSIC CSR write
      tests/functional/riscv64: Use newer kernel for tuxrun boot
      tests/functional/riscv64: Add virt machine AIA boot test
      hw/riscv/virt: Move AIA initialisation to helper file
      hw/riscv/aia: Provide number of irq sources
      hw/riscv/aia: Configure stride for the M-mode IMSIC
      hw/riscv: Add Tenstorrent Atlantis machine
      hw/riscv/atlantis: Integrate i2c controllers
      hw/riscv/atlantis: Add some i2c peripherals

Meng Zhuo (1):
      target/riscv/kvm: skip FP/Vector sync on KVM_PUT_RUNTIME_STATE

Nicholas Piggin (4):
      hw/riscv/boot: Describe discontiguous memory in boot_info
      hw/riscv/boot: Account for discontiguous memory when loading firmware
      target/riscv: tt-ascalon: Enable Zkr extension
      tests/functional/riscv64: Add tt-atlantis tests

Qingwei Hu (3):
      hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM
      hw/intc: riscv_aplic: Skip reset for KVM irqchip
      hw/intc: riscv_imsic: Skip reset for KVM irqchip

SeungJu Cheon (1):
      target/riscv: Apply UXL WARL handling to vsstatus

ZhengXiang Qin (1):
      target/riscv: avoid abort when reading vtype before env->xl is set

 MAINTAINERS                                  |  21 +
 docs/system/riscv/tt_atlantis.rst            |  41 ++
 docs/system/target-riscv.rst                 |   1 +
 hw/riscv/aia.h                               |  26 +
 hw/riscv/riscv-iommu-bits.h                  |   4 +
 hw/riscv/riscv-iommu.h                       |  26 +-
 include/hw/i2c/designware_i2c.h              |  56 ++
 include/hw/riscv/boot.h                      |  12 +-
 include/hw/riscv/fdt-common.h                |   5 +
 include/hw/riscv/sifive_u.h                  |   2 +
 include/hw/riscv/tt_atlantis.h               |  64 +++
 include/hw/riscv/virt.h                      |   2 +-
 target/riscv/cpu.h                           |  39 +-
 target/riscv/debug.h                         |   1 +
 hw/i2c/designware_i2c.c                      | 745 +++++++++++++++++++++++++++
 hw/intc/riscv_aplic.c                        |   4 +
 hw/intc/riscv_imsic.c                        |   4 +
 hw/riscv/aia.c                               |  94 ++++
 hw/riscv/boot.c                              |  34 +-
 hw/riscv/fdt-common.c                        |  30 ++
 hw/riscv/k230.c                              |   8 +-
 hw/riscv/microchip_pfsoc.c                   |   8 +-
 hw/riscv/opentitan.c                         |   6 +-
 hw/riscv/riscv-iommu-hpm.c                   |   4 +-
 hw/riscv/riscv-iommu.c                       |  73 ++-
 hw/riscv/shakti_c.c                          |   6 +-
 hw/riscv/sifive_u.c                          |  48 +-
 hw/riscv/spike.c                             |   6 +-
 hw/riscv/tt_atlantis.c                       | 617 ++++++++++++++++++++++
 hw/riscv/virt-acpi-build.c                   |  29 +-
 hw/riscv/virt.c                              | 148 ++----
 hw/riscv/xiangshan_kmh.c                     |   6 +-
 target/riscv/cpu.c                           |  43 +-
 target/riscv/cpu_helper.c                    |   8 +
 target/riscv/csr.c                           |  48 +-
 target/riscv/debug.c                         |  46 +-
 target/riscv/kvm/kvm-cpu.c                   |  19 +-
 target/riscv/machine.c                       |  16 +-
 hw/i2c/Kconfig                               |   5 +
 hw/i2c/meson.build                           |   1 +
 hw/riscv/Kconfig                             |  13 +
 hw/riscv/meson.build                         |   2 +
 tests/functional/riscv64/meson.build         |   1 +
 tests/functional/riscv64/test_opensbi.py     |   4 +
 tests/functional/riscv64/test_tt_atlantis.py |  57 ++
 tests/functional/riscv64/test_tuxrun.py      |  11 +-
 46 files changed, 2196 insertions(+), 248 deletions(-)
 create mode 100644 docs/system/riscv/tt_atlantis.rst
 create mode 100644 hw/riscv/aia.h
 create mode 100644 include/hw/i2c/designware_i2c.h
 create mode 100644 include/hw/riscv/tt_atlantis.h
 create mode 100644 hw/i2c/designware_i2c.c
 create mode 100644 hw/riscv/aia.c
 create mode 100644 hw/riscv/tt_atlantis.c
 create mode 100755 tests/functional/riscv64/test_tt_atlantis.py

On 01.07.2026 13:17, alistair23@gmail.com wrote:
...
> RISC-V PR for 11.1
> 
> * Fix IMSIC CSR write and add tests
> * Parametrise debug trigger number
> * Add 'svbare' satp-mode
> * Fix RINTC PLIC context ID for KVM
> * Avoid abort when reading vtype before env->xl is set
> * Skip reset for KVM irqchip
> * Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
> * More FDT cleanups (PLIC)
> * Make FCTL.BE in IOMMU read only 0
> * Check DC.TC reserved bits in IOMMU
> * Apply UXL WARL handling to vsstatus
> * Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU
> * Set RISCV_IOMMU_FQ_HDR_PV appropriately
> * Fix MSI MRIF IOMMU interrupt-pending offset
> * Report QEMU CPU archid as 42
> * Check PMP before updating PTE
> * Add the Tenstorrent Atlantis machine
> 
> ----------------------------------------------------------------
> Alistair Francis (1):
>        hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr
> 
> Charlie Jenkins (1):
>        target/riscv: Report QEMU CPU archid as 42
> 
> Chris Rauer (1):
>        hw/i2c: Add DesignWare I2C Controller
> 
> Daniel Henrique Barboza (16):
>        target/riscv/cpu: add CPU unrealize callback
>        target/riscv: dynamic alloc of debug trigger arrays
>        target/riscv: add 'num-triggers' debug property
>        target/riscv/cpu.c: add 'svbare' satp-mode
>        hw/riscv/sifive_u.c: remove unneeded qemu_fdt_get_phandle() call
>        hw/riscv/sifive_u.c: use intc_phandle in plic creation
>        hw/riscv/sifive_u: add #address-cells in PLIC FDT
>        hw/riscv/virt.c: change 'plic' nodename to 'interrupt-controller'
>        hw/riscv: add create_fdt_plic() helper
>        hw/riscv/riscv-iommu: rename regs_rw to regs
>        hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
>        hw/riscv/riscv-iommu: check DC.TC reserved bits
>        hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
>        hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
>        hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
>        hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
> 
> Inochi Amaoto (1):
>        target/riscv: Check PMP before updating PTE
> 
> Joel Stanley (9):
>        target/riscv: Avoid NULL deref in IMSIC CSR write
>        tests/functional/riscv64: Use newer kernel for tuxrun boot
>        tests/functional/riscv64: Add virt machine AIA boot test
>        hw/riscv/virt: Move AIA initialisation to helper file
>        hw/riscv/aia: Provide number of irq sources
>        hw/riscv/aia: Configure stride for the M-mode IMSIC
>        hw/riscv: Add Tenstorrent Atlantis machine
>        hw/riscv/atlantis: Integrate i2c controllers
>        hw/riscv/atlantis: Add some i2c peripherals
> 
> Meng Zhuo (1):
>        target/riscv/kvm: skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
> 
> Nicholas Piggin (4):
>        hw/riscv/boot: Describe discontiguous memory in boot_info
>        hw/riscv/boot: Account for discontiguous memory when loading firmware
>        target/riscv: tt-ascalon: Enable Zkr extension
>        tests/functional/riscv64: Add tt-atlantis tests
> 
> Qingwei Hu (3):
>        hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM
>        hw/intc: riscv_aplic: Skip reset for KVM irqchip
>        hw/intc: riscv_imsic: Skip reset for KVM irqchip
> 
> SeungJu Cheon (1):
>        target/riscv: Apply UXL WARL handling to vsstatus
> 
> ZhengXiang Qin (1):
>        target/riscv: avoid abort when reading vtype before env->xl is set


Hi!

Is there anything here worth picking up for the stable series
(besides "target/riscv: Check PMP before updating PTE")?

For example,

  46d96da130 target/riscv: avoid abort when reading vtype before env->xl 
is set
  5a3fd18f4f hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
  13c2fc34f1 hw/riscv/riscv-iommu: check DC.TC reserved bits
  6ed77682d5 hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
  887d2d75b1 hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
  3cee183ff9 hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
  64ce9ac187 hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0

resolves various bugs from the qemu issue/work-items tracker.

Thanks,

/mjt

On Thu, Jul 2, 2026 at 8:54 PM Michael Tokarev <mjt@tls.msk.ru> wrote:
>
> On 01.07.2026 13:17, alistair23@gmail.com wrote:
> ...
> > RISC-V PR for 11.1
> >
> > * Fix IMSIC CSR write and add tests
> > * Parametrise debug trigger number
> > * Add 'svbare' satp-mode
> > * Fix RINTC PLIC context ID for KVM
> > * Avoid abort when reading vtype before env->xl is set
> > * Skip reset for KVM irqchip
> > * Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
> > * More FDT cleanups (PLIC)
> > * Make FCTL.BE in IOMMU read only 0
> > * Check DC.TC reserved bits in IOMMU
> > * Apply UXL WARL handling to vsstatus
> > * Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU
> > * Set RISCV_IOMMU_FQ_HDR_PV appropriately
> > * Fix MSI MRIF IOMMU interrupt-pending offset
> > * Report QEMU CPU archid as 42
> > * Check PMP before updating PTE
> > * Add the Tenstorrent Atlantis machine
> >
> > ----------------------------------------------------------------
> > Alistair Francis (1):
> >        hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr
> >
> > Charlie Jenkins (1):
> >        target/riscv: Report QEMU CPU archid as 42
> >
> > Chris Rauer (1):
> >        hw/i2c: Add DesignWare I2C Controller
> >
> > Daniel Henrique Barboza (16):
> >        target/riscv/cpu: add CPU unrealize callback
> >        target/riscv: dynamic alloc of debug trigger arrays
> >        target/riscv: add 'num-triggers' debug property
> >        target/riscv/cpu.c: add 'svbare' satp-mode
> >        hw/riscv/sifive_u.c: remove unneeded qemu_fdt_get_phandle() call
> >        hw/riscv/sifive_u.c: use intc_phandle in plic creation
> >        hw/riscv/sifive_u: add #address-cells in PLIC FDT
> >        hw/riscv/virt.c: change 'plic' nodename to 'interrupt-controller'
> >        hw/riscv: add create_fdt_plic() helper
> >        hw/riscv/riscv-iommu: rename regs_rw to regs
> >        hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
> >        hw/riscv/riscv-iommu: check DC.TC reserved bits
> >        hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
> >        hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
> >        hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
> >        hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
> >
> > Inochi Amaoto (1):
> >        target/riscv: Check PMP before updating PTE
> >
> > Joel Stanley (9):
> >        target/riscv: Avoid NULL deref in IMSIC CSR write
> >        tests/functional/riscv64: Use newer kernel for tuxrun boot
> >        tests/functional/riscv64: Add virt machine AIA boot test
> >        hw/riscv/virt: Move AIA initialisation to helper file
> >        hw/riscv/aia: Provide number of irq sources
> >        hw/riscv/aia: Configure stride for the M-mode IMSIC
> >        hw/riscv: Add Tenstorrent Atlantis machine
> >        hw/riscv/atlantis: Integrate i2c controllers
> >        hw/riscv/atlantis: Add some i2c peripherals
> >
> > Meng Zhuo (1):
> >        target/riscv/kvm: skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
> >
> > Nicholas Piggin (4):
> >        hw/riscv/boot: Describe discontiguous memory in boot_info
> >        hw/riscv/boot: Account for discontiguous memory when loading firmware
> >        target/riscv: tt-ascalon: Enable Zkr extension
> >        tests/functional/riscv64: Add tt-atlantis tests
> >
> > Qingwei Hu (3):
> >        hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM
> >        hw/intc: riscv_aplic: Skip reset for KVM irqchip
> >        hw/intc: riscv_imsic: Skip reset for KVM irqchip
> >
> > SeungJu Cheon (1):
> >        target/riscv: Apply UXL WARL handling to vsstatus
> >
> > ZhengXiang Qin (1):
> >        target/riscv: avoid abort when reading vtype before env->xl is set
>
>
> Hi!
>
> Is there anything here worth picking up for the stable series
> (besides "target/riscv: Check PMP before updating PTE")?
>
> For example,
>
>   46d96da130 target/riscv: avoid abort when reading vtype before env->xl
> is set
>   5a3fd18f4f hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
>   13c2fc34f1 hw/riscv/riscv-iommu: check DC.TC reserved bits
>   6ed77682d5 hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
>   887d2d75b1 hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
>   3cee183ff9 hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
>   64ce9ac187 hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
>
> resolves various bugs from the qemu issue/work-items tracker.

Everything with a Fixes tag should be backported to releases that have
the relevant commits

Alistair

>
> Thanks,
>
> /mjt

Hi Michael,

On 7/2/2026 7:54 AM, Michael Tokarev wrote:
> On 01.07.2026 13:17, alistair23@gmail.com wrote:
> ...
>> RISC-V PR for 11.1
>>
>> * Fix IMSIC CSR write and add tests
>> * Parametrise debug trigger number
>> * Add 'svbare' satp-mode
>> * Fix RINTC PLIC context ID for KVM
>> * Avoid abort when reading vtype before env->xl is set
>> * Skip reset for KVM irqchip
>> * Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
>> * More FDT cleanups (PLIC)
>> * Make FCTL.BE in IOMMU read only 0
>> * Check DC.TC reserved bits in IOMMU
>> * Apply UXL WARL handling to vsstatus
>> * Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU
>> * Set RISCV_IOMMU_FQ_HDR_PV appropriately
>> * Fix MSI MRIF IOMMU interrupt-pending offset
>> * Report QEMU CPU archid as 42
>> * Check PMP before updating PTE
>> * Add the Tenstorrent Atlantis machine
>>
>> ----------------------------------------------------------------
>> Alistair Francis (1):
>>        hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr
>>
>> Charlie Jenkins (1):
>>        target/riscv: Report QEMU CPU archid as 42
>>
>> Chris Rauer (1):
>>        hw/i2c: Add DesignWare I2C Controller
>>
>> Daniel Henrique Barboza (16):
>>        target/riscv/cpu: add CPU unrealize callback
>>        target/riscv: dynamic alloc of debug trigger arrays
>>        target/riscv: add 'num-triggers' debug property
>>        target/riscv/cpu.c: add 'svbare' satp-mode
>>        hw/riscv/sifive_u.c: remove unneeded qemu_fdt_get_phandle() call
>>        hw/riscv/sifive_u.c: use intc_phandle in plic creation
>>        hw/riscv/sifive_u: add #address-cells in PLIC FDT
>>        hw/riscv/virt.c: change 'plic' nodename to 'interrupt-controller'
>>        hw/riscv: add create_fdt_plic() helper
>>        hw/riscv/riscv-iommu: rename regs_rw to regs
>>        hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
>>        hw/riscv/riscv-iommu: check DC.TC reserved bits
>>        hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
>>        hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
>>        hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
>>        hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
>>
>> Inochi Amaoto (1):
>>        target/riscv: Check PMP before updating PTE
>>
>> Joel Stanley (9):
>>        target/riscv: Avoid NULL deref in IMSIC CSR write
>>        tests/functional/riscv64: Use newer kernel for tuxrun boot
>>        tests/functional/riscv64: Add virt machine AIA boot test
>>        hw/riscv/virt: Move AIA initialisation to helper file
>>        hw/riscv/aia: Provide number of irq sources
>>        hw/riscv/aia: Configure stride for the M-mode IMSIC
>>        hw/riscv: Add Tenstorrent Atlantis machine
>>        hw/riscv/atlantis: Integrate i2c controllers
>>        hw/riscv/atlantis: Add some i2c peripherals
>>
>> Meng Zhuo (1):
>>        target/riscv/kvm: skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
>>
>> Nicholas Piggin (4):
>>        hw/riscv/boot: Describe discontiguous memory in boot_info
>>        hw/riscv/boot: Account for discontiguous memory when loading firmware
>>        target/riscv: tt-ascalon: Enable Zkr extension
>>        tests/functional/riscv64: Add tt-atlantis tests
>>
>> Qingwei Hu (3):
>>        hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM
>>        hw/intc: riscv_aplic: Skip reset for KVM irqchip
>>        hw/intc: riscv_imsic: Skip reset for KVM irqchip
>>
>> SeungJu Cheon (1):
>>        target/riscv: Apply UXL WARL handling to vsstatus
>>
>> ZhengXiang Qin (1):
>>        target/riscv: avoid abort when reading vtype before env->xl is set
> 
> 
> Hi!
> 
> Is there anything here worth picking up for the stable series
> (besides "target/riscv: Check PMP before updating PTE")?
> 
> For example,
> 
>   46d96da130 target/riscv: avoid abort when reading vtype before env->xl is set
>   5a3fd18f4f hw/riscv/riscv-iommu.c: make FCTL.BE read only 0
>   13c2fc34f1 hw/riscv/riscv-iommu: check DC.TC reserved bits
>   6ed77682d5 hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
>   887d2d75b1 hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
>   3cee183ff9 hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
>   64ce9ac187 hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
> 
> resolves various bugs from the qemu issue/work-items tracker.

All riscv-iommu stuff is worth getting. They are all fixes for code that is
around since QEMU 9.x or something.

In fact there's more to come in future PRs (I'm actively hunting riscv-iommu
stuff in gitlab) so same thing applies for those future cases too.


Cheers,
Daniel

> 
> Thanks,
> 
> /mjt

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.