From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit f893c46c3931b3684d235d221bf8b7844ddbf1d7:

  Merge tag 'qemu-openbios-20260707' of https://github.com/mcayland/qemu into staging (2026-07-08 16:01:29 +0200)

are available in the Git repository at:

  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20260710

for you to fetch changes up to ec7d32428757d5813935cbe099449f6201980d80:

  tests: update SPCR loongarch64 and riscv64 test data (2026-07-09 16:21:52 +1000)

----------------------------------------------------------------
RISC-V PR for 11.1

* Fix IOMMU fault type for spa_fetch() faults
* Check IOMMU for reserved PTE bits
* Fault when IOMMU !PTE_U and no priv access
* Fault IOMMU for non-user PTE in G_STAGE
* Check IOMMU reserved MSI PTE basic bits
* Record fault on IOMMU-generated MSI write
* Move RISC-V TCG files and fix --disable-tcg
* Check for misaligned IOMMU IOHGATP_PPN
* Update IOMMU ioval2 when faulting in spa_fetch()
* Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
* Set IOMMU ftype and iova in riscv_iommu_ctx()
* Check PCIe DOE mailbox length for overflows
* Add extensions after v7.1-rc4 update
* Remove job building OpenSBI firmware binaries
* Correct ACPI field sequence in SPCR table

----------------------------------------------------------------
Alistair Francis (1):
      hw/pci/pcie_doe: Check mailbox length for overflows

Bin Meng (1):
      gitlab-ci: Remove job building OpenSBI firmware binaries

Daniel Henrique Barboza (32):
      hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
      hw/riscv/riscv-iommu.c: check for reserved PTE bits
      hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
      hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
      hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
      hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
      target/riscv: move valid_vm_* satp arrays to cpu.c
      hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
      target/riscv: move TCG only files to tcg subdir
      target/riscv/machine.c: do not migrate pmp state with kvm
      target/riscv: move pmp files to tcg subdir
      target/riscv: tidy up riscv_sysemu_ops
      target/riscv: move debug.h to tcg subdir
      target/riscv: remove csr.h from kvm-cpu.c
      target/riscv: move csr.h to tcg subdir
      target/riscv: move custom_csrs logic to tcg-cpu.c
      target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
      target/riscv: move some irq helpers to cpu.c
      target/riscv: move riscv_cpu_claim_interrupts to cpu.c
      target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
      target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
      target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
      hw/riscv/riscv_hart.c isolate tcg only bits
      target/riscv/gdbstub.c: isolate TCG only checks
      target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
      target/riscv/tcg: remove unused riscv_cpu_get_geilen()
      target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
      target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
      hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
      hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
      hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
      hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()

Heinrich Schuchardt (3):
      tests: allow differences in SPCR
      hw/acpi: correct field sequence in SPCR table
      tests: update SPCR loongarch64 and riscv64 test data

Wang Yechao (1):
      target/riscv/kvm: add extensions after v7.1-rc4 update

Zephyr Li (2):
      target/riscv: Remove unused tcg/tcg.h include
      gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job

 MAINTAINERS                                        |   2 -
 hw/riscv/riscv-iommu-bits.h                        |   1 +
 hw/riscv/riscv-iommu.h                             |   1 +
 include/hw/riscv/fdt-common.h                      |   1 +
 target/riscv/cpu.h                                 |  24 +-
 target/riscv/{ => tcg}/csr.h                       |   6 +-
 target/riscv/{ => tcg}/debug.h                     |   0
 target/riscv/{ => tcg}/pmp.h                       |   0
 target/riscv/{ => tcg}/pmu.h                       |   0
 target/riscv/{ => tcg}/vector_internals.h          |   0
 tests/qtest/libqos/qos-riscv-iommu.h               |   4 +-
 hw/acpi/aml-build.c                                |   4 +-
 hw/intc/riscv_aclint.c                             |   8 +
 hw/intc/riscv_imsic.c                              |  24 ++
 hw/pci/pcie_doe.c                                  |  27 +-
 hw/riscv/fdt-common.c                              |  52 ++++
 hw/riscv/riscv-iommu-sys.c                         |  16 +-
 hw/riscv/riscv-iommu.c                             | 117 +++++++-
 hw/riscv/riscv_hart.c                              |   8 +-
 hw/riscv/tt_atlantis.c                             |   1 -
 hw/riscv/virt.c                                    |   1 -
 target/riscv/cpu.c                                 | 318 ++++++++++++++++++---
 target/riscv/gdbstub.c                             |  10 +-
 target/riscv/kvm/kvm-cpu.c                         |   4 +-
 target/riscv/machine.c                             |  15 +-
 target/riscv/monitor.c                             |   4 +-
 target/riscv/riscv-qmp-cmds.c                      |   2 +-
 target/riscv/{ => tcg}/bitmanip_helper.c           |   0
 target/riscv/{ => tcg}/cpu_helper.c                | 253 +---------------
 target/riscv/{ => tcg}/crypto_helper.c             |   0
 target/riscv/{ => tcg}/csr.c                       |  45 +--
 target/riscv/{ => tcg}/debug.c                     |   2 +-
 target/riscv/{ => tcg}/fpu_helper.c                |   0
 target/riscv/{ => tcg}/m128_helper.c               |   0
 target/riscv/{ => tcg}/mips_csr.c                  |   2 +-
 target/riscv/{ => tcg}/op_helper.c                 |   2 +-
 target/riscv/{ => tcg}/pmp.c                       |   2 +-
 target/riscv/{ => tcg}/pmu.c                       |  52 ----
 target/riscv/tcg/tcg-cpu.c                         |  30 +-
 target/riscv/{ => tcg}/th_csr.c                    |   2 +-
 target/riscv/{ => tcg}/translate.c                 |   0
 target/riscv/{ => tcg}/vcrypto_helper.c            |   0
 target/riscv/{ => tcg}/vector_helper.c             |   0
 target/riscv/{ => tcg}/vector_internals.c          |   0
 target/riscv/{ => tcg}/zce_helper.c                |   0
 target/riscv/time_helper.c                         |  33 ++-
 .../{ => tcg}/insn_trans/trans_privileged.c.inc    |   0
 target/riscv/{ => tcg}/insn_trans/trans_rva.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvb.c.inc  |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvbf16.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvd.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvf.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvh.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvi.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvk.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvm.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvv.c.inc  |   0
 target/riscv/{ => tcg}/insn_trans/trans_rvvk.c.inc |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzabha.c.inc |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzacas.c.inc |   0
 .../{ => tcg}/insn_trans/trans_rvzalasr.c.inc      |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzawrs.c.inc |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzce.c.inc   |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzcmop.c.inc |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzfa.c.inc   |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzfh.c.inc   |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzicbo.c.inc |   0
 .../{ => tcg}/insn_trans/trans_rvzicfiss.c.inc     |   0
 .../{ => tcg}/insn_trans/trans_rvzicond.c.inc      |   0
 .../riscv/{ => tcg}/insn_trans/trans_rvzimop.c.inc |   0
 .../riscv/{ => tcg}/insn_trans/trans_svinval.c.inc |   0
 .../riscv/{ => tcg}/insn_trans/trans_xlrbr.c.inc   |   0
 .../riscv/{ => tcg}/insn_trans/trans_xmips.c.inc   |   0
 .../riscv/{ => tcg}/insn_trans/trans_xthead.c.inc  |   0
 .../insn_trans/trans_xventanacondops.c.inc         |   0
 .../riscv/{ => tcg}/insn_trans/trans_zilsd.c.inc   |   0
 .gitlab-ci.d/crossbuilds.yml                       |   8 +
 .gitlab-ci.d/opensbi.yml                           |  88 ------
 .gitlab-ci.d/opensbi/Dockerfile                    |  34 ---
 .gitlab-ci.d/qemu-project.yml                      |   1 -
 target/riscv/meson.build                           |  17 --
 target/riscv/tcg/meson.build                       |  31 +-
 tests/data/acpi/loongarch64/virt/SPCR              | Bin 80 -> 80 bytes
 tests/data/acpi/riscv64/virt/SPCR                  | Bin 90 -> 90 bytes
 84 files changed, 666 insertions(+), 586 deletions(-)
 rename target/riscv/{ => tcg}/csr.h (96%)
 rename target/riscv/{ => tcg}/debug.h (100%)
 rename target/riscv/{ => tcg}/pmp.h (100%)
 rename target/riscv/{ => tcg}/pmu.h (100%)
 rename target/riscv/{ => tcg}/vector_internals.h (100%)
 rename target/riscv/{ => tcg}/bitmanip_helper.c (100%)
 rename target/riscv/{ => tcg}/cpu_helper.c (92%)
 rename target/riscv/{ => tcg}/crypto_helper.c (100%)
 rename target/riscv/{ => tcg}/csr.c (99%)
 rename target/riscv/{ => tcg}/debug.c (99%)
 rename target/riscv/{ => tcg}/fpu_helper.c (100%)
 rename target/riscv/{ => tcg}/m128_helper.c (100%)
 rename target/riscv/{ => tcg}/mips_csr.c (99%)
 rename target/riscv/{ => tcg}/op_helper.c (99%)
 rename target/riscv/{ => tcg}/pmp.c (99%)
 rename target/riscv/{ => tcg}/pmu.c (86%)
 rename target/riscv/{ => tcg}/th_csr.c (99%)
 rename target/riscv/{ => tcg}/translate.c (100%)
 rename target/riscv/{ => tcg}/vcrypto_helper.c (100%)
 rename target/riscv/{ => tcg}/vector_helper.c (100%)
 rename target/riscv/{ => tcg}/vector_internals.c (100%)
 rename target/riscv/{ => tcg}/zce_helper.c (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_privileged.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rva.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvb.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvbf16.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvd.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvf.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvh.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvi.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvk.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvm.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvv.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvvk.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzabha.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzacas.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzalasr.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzawrs.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzce.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzcmop.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzfa.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzfh.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzicbo.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzicfiss.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzicond.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_rvzimop.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_svinval.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_xlrbr.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_xmips.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_xthead.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_xventanacondops.c.inc (100%)
 rename target/riscv/{ => tcg}/insn_trans/trans_zilsd.c.inc (100%)
 delete mode 100644 .gitlab-ci.d/opensbi.yml
 delete mode 100644 .gitlab-ci.d/opensbi/Dockerfile

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

On 7/10/26 05:54, alistair23@gmail.com wrote:
> From: Alistair Francis <alistair.francis@wdc.com>

> RISC-V PR for 11.1
> 
> * Fix IOMMU fault type for spa_fetch() faults
> * Check IOMMU for reserved PTE bits
> * Fault when IOMMU !PTE_U and no priv access
> * Fault IOMMU for non-user PTE in G_STAGE
> * Check IOMMU reserved MSI PTE basic bits
> * Record fault on IOMMU-generated MSI write
> * Move RISC-V TCG files and fix --disable-tcg
> * Check for misaligned IOMMU IOHGATP_PPN
> * Update IOMMU ioval2 when faulting in spa_fetch()
> * Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
> * Set IOMMU ftype and iova in riscv_iommu_ctx()
> * Check PCIe DOE mailbox length for overflows
> * Add extensions after v7.1-rc4 update
> * Remove job building OpenSBI firmware binaries
> * Correct ACPI field sequence in SPCR table

Is it the same as usual for riscv pull requests, -- everything with
Fixes: or Resolves: tag should be picked up for the current qemu stable
releases?

(Cc'ing Daniel too since he has largest share of contributions here).

Thanks,

/mjt

> ----------------------------------------------------------------
> Alistair Francis (1):
>        hw/pci/pcie_doe: Check mailbox length for overflows
> 
> Bin Meng (1):
>        gitlab-ci: Remove job building OpenSBI firmware binaries
> 
> Daniel Henrique Barboza (32):
>        hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
>        hw/riscv/riscv-iommu.c: check for reserved PTE bits
>        hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
>        hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
>        hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
>        hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
>        target/riscv: move valid_vm_* satp arrays to cpu.c
>        hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
>        target/riscv: move TCG only files to tcg subdir
>        target/riscv/machine.c: do not migrate pmp state with kvm
>        target/riscv: move pmp files to tcg subdir
>        target/riscv: tidy up riscv_sysemu_ops
>        target/riscv: move debug.h to tcg subdir
>        target/riscv: remove csr.h from kvm-cpu.c
>        target/riscv: move csr.h to tcg subdir
>        target/riscv: move custom_csrs logic to tcg-cpu.c
>        target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
>        target/riscv: move some irq helpers to cpu.c
>        target/riscv: move riscv_cpu_claim_interrupts to cpu.c
>        target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
>        target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
>        target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
>        hw/riscv/riscv_hart.c isolate tcg only bits
>        target/riscv/gdbstub.c: isolate TCG only checks
>        target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
>        target/riscv/tcg: remove unused riscv_cpu_get_geilen()
>        target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
>        target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
>        hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
>        hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
>        hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
>        hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
> 
> Heinrich Schuchardt (3):
>        tests: allow differences in SPCR
>        hw/acpi: correct field sequence in SPCR table
>        tests: update SPCR loongarch64 and riscv64 test data
> 
> Wang Yechao (1):
>        target/riscv/kvm: add extensions after v7.1-rc4 update
> 
> Zephyr Li (2):
>        target/riscv: Remove unused tcg/tcg.h include
>        gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job

On 7/11/2026 3:32 AM, Michael Tokarev wrote:
> On 7/10/26 05:54, alistair23@gmail.com wrote:
>> From: Alistair Francis <alistair.francis@wdc.com>
> 
>> RISC-V PR for 11.1
>>
>> * Fix IOMMU fault type for spa_fetch() faults
>> * Check IOMMU for reserved PTE bits
>> * Fault when IOMMU !PTE_U and no priv access
>> * Fault IOMMU for non-user PTE in G_STAGE
>> * Check IOMMU reserved MSI PTE basic bits
>> * Record fault on IOMMU-generated MSI write
>> * Move RISC-V TCG files and fix --disable-tcg
>> * Check for misaligned IOMMU IOHGATP_PPN
>> * Update IOMMU ioval2 when faulting in spa_fetch()
>> * Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
>> * Set IOMMU ftype and iova in riscv_iommu_ctx()
>> * Check PCIe DOE mailbox length for overflows
>> * Add extensions after v7.1-rc4 update
>> * Remove job building OpenSBI firmware binaries
>> * Correct ACPI field sequence in SPCR table
> 
> Is it the same as usual for riscv pull requests, -- everything with
> Fixes: or Resolves: tag should be picked up for the current qemu stable
> releases?
> 
> (Cc'ing Daniel too since he has largest share of contributions here).


Yes sir.  All "Fixes" and "Resolves" from this batch fixes bugs that
are also applicable for qemu-stable.

Cheers,
Daniel


> 
> Thanks,
> 
> /mjt
> 
>> ----------------------------------------------------------------
>> Alistair Francis (1):
>>        hw/pci/pcie_doe: Check mailbox length for overflows
>>
>> Bin Meng (1):
>>        gitlab-ci: Remove job building OpenSBI firmware binaries
>>
>> Daniel Henrique Barboza (32):
>>        hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
>>        hw/riscv/riscv-iommu.c: check for reserved PTE bits
>>        hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
>>        hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
>>        hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
>>        hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
>>        target/riscv: move valid_vm_* satp arrays to cpu.c
>>        hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
>>        target/riscv: move TCG only files to tcg subdir
>>        target/riscv/machine.c: do not migrate pmp state with kvm
>>        target/riscv: move pmp files to tcg subdir
>>        target/riscv: tidy up riscv_sysemu_ops
>>        target/riscv: move debug.h to tcg subdir
>>        target/riscv: remove csr.h from kvm-cpu.c
>>        target/riscv: move csr.h to tcg subdir
>>        target/riscv: move custom_csrs logic to tcg-cpu.c
>>        target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
>>        target/riscv: move some irq helpers to cpu.c
>>        target/riscv: move riscv_cpu_claim_interrupts to cpu.c
>>        target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
>>        target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
>>        target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
>>        hw/riscv/riscv_hart.c isolate tcg only bits
>>        target/riscv/gdbstub.c: isolate TCG only checks
>>        target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
>>        target/riscv/tcg: remove unused riscv_cpu_get_geilen()
>>        target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
>>        target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
>>        hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
>>        hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
>>        hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
>>        hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
>>
>> Heinrich Schuchardt (3):
>>        tests: allow differences in SPCR
>>        hw/acpi: correct field sequence in SPCR table
>>        tests: update SPCR loongarch64 and riscv64 test data
>>
>> Wang Yechao (1):
>>        target/riscv/kvm: add extensions after v7.1-rc4 update
>>
>> Zephyr Li (2):
>>        target/riscv: Remove unused tcg/tcg.h include
>>        gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
>