qemu/qemu.git, branch stable-11.1

Update version for 11.1.1 release

2026-08-26T07:15:48+00:00

Signed-off-by: Michael Tokarev

target/riscv/tcg: sret in virtual user mode raises virtual instruction exception

2026-08-24T19:03:18+00:00

Currently, when a `sret` is executed in virtual user mode, qemu raise an `illegal instruction exception`, but in this case the correct behavior is to raise a `virtual instruction exception` and the code already contains a check to it, but it's not enough to catch. This patch is useful to improve the correctness of the virtualization of the risc v architecture. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3622 Signed-off-by: Christian S. Lima Reviewed-by: Alistair Francis Message-ID: <20260808031849.59726-1-christianslima@proton.me> Signed-off-by: Alistair Francis (cherry picked from commit 85d38315fd19cda7fcfec5350f27cdfa15742600) Signed-off-by: Michael Tokarev

target/riscv: Allow UXL to be 3 in mstatus on rv128

2026-08-24T19:01:49+00:00

Valid UXL field values for mstatus were restricted to fix a reported issue, but this inadvertently broke the experimental rv128 support where a value of 3 validly represents 128-bit execution. Update the mstatus write logic to permit UXL=3 when running on an rv128 CPU. Fixes: dcd028517749 ("target/riscv: Apply UXL WARL handling to vsstatus") Signed-off-by: Frédéric Pétrot Reviewed-by: Daniel Henrique Barboza Reviewed-by: Chao Liu Message-ID: <20260819105655.33391-3-frederic.petrot@univ-grenoble-alpes.fr> Signed-off-by: Alistair Francis (cherry picked from commit a9779d24be31338d90aa19a560e69cc4c9660627) Signed-off-by: Michael Tokarev

target/riscv: Restore register dump zero padding

2026-08-24T19:01:01+00:00

The register values lost their leading zeroes when the underlying type was changed, resulting in mismatched padding and harder to read output. Print with a runtime field width based on MXL, so values are 16 hex digits on rv64 and 8 on rv32, matching the csr and fp dump. This avoids adding target_ulong back into the dump. Fixes: c4e6bc63853c ("target/riscv: Fix size of gpr and gprh") Signed-off-by: Joel Stanley Reviewed-by: Anton Johansson Reviewed-by: Max Chou Message-ID: <20260813032421.54438-1-joel@jms.id.au> Signed-off-by: Alistair Francis (cherry picked from commit 409c7d8682ae91c5e275d744d55a2ac19789534a) Signed-off-by: Michael Tokarev

tests/qtest: remove trace output from k230 watchdog test

2026-08-24T18:59:57+00:00

The interrupt mode test does not depend on trace output, but passes a trace file to QEMU. This makes startup fail when QEMU is built without the log or simple trace backend, so qtest cannot connect. Drop the unnecessary trace option. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4126 Signed-off-by: Chao Liu Reviewed-by: Bin Meng Message-ID: <20260813054329.35425-1-chao.liu@processmission.com> Signed-off-by: Alistair Francis (cherry picked from commit e4ae434836a98039ed0511dea506992b55e55865) Signed-off-by: Michael Tokarev

target/riscv: enforce even register constraints for Zdinx fcvt pairs

2026-08-24T18:59:18+00:00

fcvt.d.h and fcvt.h.d access a 64-bit double held in a register pair, so under Zdinx/Zhinxmin the odd-rd (fcvt.d.h) and odd-rs1 (fcvt.h.d) encodings are reserved. Add the missing REQUIRE_EVEN checks so those encodings raise an illegal-instruction exception instead of retiring. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4109 Reviewed-by: Alistair Francis Signed-off-by: wangyang Message-ID: Signed-off-by: Alistair Francis (cherry picked from commit e68cc2e5cd28333ac76d757ed2db7d2f7635d09a) Signed-off-by: Michael Tokarev

target/riscv: reject FMV.X.W/FMV.W.X under Zfinx

2026-08-24T18:59:07+00:00

Zfinx explicitly excludes the FMV transfer instructions, but trans_fmv_x_w/trans_fmv_w_x used REQUIRE_ZFINX_OR_F so a Zfinx-only CPU accepted them. Require RVF instead so the transfers trap with an illegal instruction when only Zfinx is present. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4108 Reviewed-by: Alistair Francis Signed-off-by: wangyang Message-ID: <36c7cfebd27b4b6e8bcdd00e09e9dda0@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis (cherry picked from commit af1e669cef162e8d9b5f2f176e8b909d61c4b530) Signed-off-by: Michael Tokarev

target/riscv: honor zicbo* envcfg gating in linux-user mode

2026-08-24T18:58:58+00:00

In user-only builds check_zicbo_envcfg() skipped the envcfg check entirely (#if !defined(CONFIG_USER_ONLY)), so cbo.inval/cbo.flush/ cbo.zero retired unconditionally in linux-user even though the machine-level envcfg fields are never initialized. Give the user-mode build a senvcfg-based gate, and initialize SENVCFG_CBZE at reset when ext_zicboz is enabled so cbo.zero stays usable while cbo.inval/cbo.flush remain illegal, matching the user-mode view of a typical firmware/kernel setup. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4107 Reviewed-by: Alistair Francis Signed-off-by: wangyang Message-ID: <9b2f22fc402b48b8ba81f72be8ed04bc@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis (cherry picked from commit 12289f2f9a0f1ffa6a75c2b189a0273dc455dfb0) Signed-off-by: Michael Tokarev

disas/riscv: Fix typo in th.lbib format

2026-08-24T18:57:07+00:00

th.lbib should format the same as th.lbia, and the other increment insns, with the address register in parenthesis. Cc: qemu-stable@nongnu.org Fixes: 318df7238b9 ("disas/riscv: Add support for XThead* instructions") Reviewed-by: Alistair Francis Signed-off-by: Richard Henderson Message-ID: <20260812223142.349142-41-richard.henderson@linaro.org> Signed-off-by: Alistair Francis (cherry picked from commit ecbd3a031f12669da98cdf929cbc7dbb88d3450f) (Mjt: fix-up across v11.1.0-496-g7de6afd53186 "disas/riscv: Drop explicit zero of rv_opcode_data fields") Signed-off-by: Michael Tokarev

disas/riscv: Fix isa decoding of rev8

2026-08-24T18:52:02+00:00

The encoding of rev8 is different for rv32 and rv64. Cc: qemu-stable@nongnu.org Fixes: 02c1b569a15 ("disas/riscv: Add Zb[abcs] instructions") Reviewed-by: Alistair Francis Signed-off-by: Richard Henderson Message-ID: <20260812223142.349142-40-richard.henderson@linaro.org> Signed-off-by: Alistair Francis (cherry picked from commit d610e55c8390a8bfd15d0a4f1521d7fc46e4e0b7) Signed-off-by: Michael Tokarev