summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
13 daysUpdate version for 11.1.1 releasev11.1.1staging-11.1stable-11.1Michael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv/tcg: sret in virtual user mode raises virtual instruction exceptionChristian S. Lima
Currently, when a `sret` is executed in virtual user mode, qemu raise an `illegal instruction exception`, but in this case the correct behavior is to raise a `virtual instruction exception` and the code already contains a check to it, but it's not enough to catch. This patch is useful to improve the correctness of the virtualization of the risc v architecture. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3622 Signed-off-by: Christian S. Lima <christianslima@proton.me> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260808031849.59726-1-christianslima@proton.me> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 85d38315fd19cda7fcfec5350f27cdfa15742600) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: Allow UXL to be 3 in mstatus on rv128Frédéric Pétrot
Valid UXL field values for mstatus were restricted to fix a reported issue, but this inadvertently broke the experimental rv128 support where a value of 3 validly represents 128-bit execution. Update the mstatus write logic to permit UXL=3 when running on an rv128 CPU. Fixes: dcd028517749 ("target/riscv: Apply UXL WARL handling to vsstatus") Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Chao Liu <chao.liu@processmission.com> Message-ID: <20260819105655.33391-3-frederic.petrot@univ-grenoble-alpes.fr> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit a9779d24be31338d90aa19a560e69cc4c9660627) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: Restore register dump zero paddingJoel Stanley
The register values lost their leading zeroes when the underlying type was changed, resulting in mismatched padding and harder to read output. Print with a runtime field width based on MXL, so values are 16 hex digits on rv64 and 8 on rv32, matching the csr and fp dump. This avoids adding target_ulong back into the dump. Fixes: c4e6bc63853c ("target/riscv: Fix size of gpr and gprh") Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Max Chou <max.chou@sifive.com> Message-ID: <20260813032421.54438-1-joel@jms.id.au> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 409c7d8682ae91c5e275d744d55a2ac19789534a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24tests/qtest: remove trace output from k230 watchdog testChao Liu
The interrupt mode test does not depend on trace output, but passes a trace file to QEMU. This makes startup fail when QEMU is built without the log or simple trace backend, so qtest cannot connect. Drop the unnecessary trace option. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4126 Signed-off-by: Chao Liu <chao.liu@processmission.com> Reviewed-by: Bin Meng <bin.meng@processmission.com> Message-ID: <20260813054329.35425-1-chao.liu@processmission.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit e4ae434836a98039ed0511dea506992b55e55865) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: enforce even register constraints for Zdinx fcvt pairswangyang
fcvt.d.h and fcvt.h.d access a 64-bit double held in a register pair, so under Zdinx/Zhinxmin the odd-rd (fcvt.d.h) and odd-rs1 (fcvt.h.d) encodings are reserved. Add the missing REQUIRE_EVEN checks so those encodings raise an illegal-instruction exception instead of retiring. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4109 Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn> Message-ID: <ea287909fd6043e0bbcdbfdcb0cc8063@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit e68cc2e5cd28333ac76d757ed2db7d2f7635d09a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: reject FMV.X.W/FMV.W.X under Zfinxwangyang
Zfinx explicitly excludes the FMV transfer instructions, but trans_fmv_x_w/trans_fmv_w_x used REQUIRE_ZFINX_OR_F so a Zfinx-only CPU accepted them. Require RVF instead so the transfers trap with an illegal instruction when only Zfinx is present. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4108 Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn> Message-ID: <36c7cfebd27b4b6e8bcdd00e09e9dda0@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit af1e669cef162e8d9b5f2f176e8b909d61c4b530) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: honor zicbo* envcfg gating in linux-user modewangyang
In user-only builds check_zicbo_envcfg() skipped the envcfg check entirely (#if !defined(CONFIG_USER_ONLY)), so cbo.inval/cbo.flush/ cbo.zero retired unconditionally in linux-user even though the machine-level envcfg fields are never initialized. Give the user-mode build a senvcfg-based gate, and initialize SENVCFG_CBZE at reset when ext_zicboz is enabled so cbo.zero stays usable while cbo.inval/cbo.flush remain illegal, matching the user-mode view of a typical firmware/kernel setup. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4107 Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn> Message-ID: <9b2f22fc402b48b8ba81f72be8ed04bc@wangyang25.otcaix.iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 12289f2f9a0f1ffa6a75c2b189a0273dc455dfb0) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Fix typo in th.lbib formatRichard Henderson
th.lbib should format the same as th.lbia, and the other increment insns, with the address register in parenthesis. Cc: qemu-stable@nongnu.org Fixes: 318df7238b9 ("disas/riscv: Add support for XThead* instructions") Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20260812223142.349142-41-richard.henderson@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit ecbd3a031f12669da98cdf929cbc7dbb88d3450f) (Mjt: fix-up across v11.1.0-496-g7de6afd53186 "disas/riscv: Drop explicit zero of rv_opcode_data fields") Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Fix isa decoding of rev8Richard Henderson
The encoding of rev8 is different for rv32 and rv64. Cc: qemu-stable@nongnu.org Fixes: 02c1b569a15 ("disas/riscv: Add Zb[abcs] instructions") Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20260812223142.349142-40-richard.henderson@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit d610e55c8390a8bfd15d0a4f1521d7fc46e4e0b7) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Fix rv32 encoding of zext.hRichard Henderson
For rv64, pack with rs2 = 0 does not encode zext.h. Cc: qemu-stable@nongnu.org Fixes: 02c1b569a15 ("disas/riscv: Add Zb[abcs] instructions") Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20260812223142.349142-39-richard.henderson@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit d4151cf2675124e26b3383ae06f7352a23f17399) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32A-Shehab
The Zicfilp landing-pad enable (LPE, bit 2) and Zicfiss shadow-stack enable (SSE, bit 3) controls live in the low 32 bits of menvcfg and henvcfg, and the CFI specification defines them for both RV32 and RV64. QEMU only adds MENVCFG_LPE/MENVCFG_SSE (and the henvcfg equivalents) to the writable mask inside the "riscv_cpu_mxl(env) == MXL_RV64" block, so on RV32 these bits are silently dropped and the features cannot be enabled. This is inconsistent with write_senvcfg(), which already handles SENVCFG_LPE/SENVCFG_SSE regardless of MXLEN. Hoist the LPE/SSE mask handling out of the RV64-only block in write_menvcfg() and write_henvcfg() so the bits become writable on RV32 as well. The upper-half writers (write_menvcfgh/write_henvcfgh) are unaffected because these bits reside in the low 32 bits. Reproducible on qemu-system-riscv32 -cpu rv32,zicfilp=true,zicfiss=true: an M-mode write of menvcfg.{LPE,SSE} reads back as zero, while the same program on rv64 keeps the bits set. Fixes: 4923f672e3d7 ("target/riscv: Introduce elp state and enabling controls for zicfilp") Fixes: 8205bc127a83 ("target/riscv: introduce ssp and enabling controls for zicfiss") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4045 Signed-off-by: A-Shehab <ahshehab24@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260726080537.13913-1-ahshehab24@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit bd1ee9ab3c39f269d8bea8acf83ea833a69a6e10) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24hw/riscv/riscv-iommu: preserve requested perm in spa_fetch()Andrew Jones
b18e3f0e2d0f fixed spa_fetch() faults whose TTYP used the leaf PTE permission instead of the original request permission. However, it kept that request-narrowed value in iotlb->perm after a successful walk, and riscv_iommu_translate() caches iotlb->perm for later accesses to the same IOVA. That means a write to an RW mapping can cache the entry as write-only. A later read then hits the cache and faults even though the mapping allows it, which showed up in NVMe testing as bogus completions and controller timeouts. Keep the requested permission in a separate req_perm and use it for all permission checks and fault-type decisions. Accumulate the leaf permissions separately and copy them to iotlb->perm only after the full walk succeeds, so cached entries describe the mapping rather than the current request. Since faults leave iotlb->perm as the original request, the S-stage and G-stage TTYP fixes remain intact. Fixes: b18e3f0e2d0f ("hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults") Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260717144525.1154204-1-andrew.jones@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit aa51eec004461f671f878145d3fc921c6cabee48) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEsAndrew Jones
Commit b795ea0ba471 ("hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access") placed its check ahead of the leaf-vs-non-leaf branch in riscv_iommu_spa_fetch(), so it fires on every PTE walked, including non-leaf/table entries. Per the RISC-V privileged spec's address translation algorithm (Sv39/Sv48/etc., the "leaf PTE has been reached" step, followed separately by the U-bit permission check), the U bit is only defined and checked for the leaf PTE reached at the end of the walk -- non-leaf PTEs don't carry a meaningful U bit at all. Move the check after the leaf/non-leaf branch, alongside the other leaf-only checks, mirroring how the G_STAGE U-bit check (added in 9158c900ab30) is already correctly placed. Fixes: b795ea0ba471 ("hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access") Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Message-ID: <20260717112340.1071148-1-andrew.jones@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit f16fd27b3fe3c305d95c61d3516e458c45c6e8c9) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Decode unsigned vector immediates as unsignedTANG Tiancheng
rv_codec_v_i decodes all .vi operands with operand_vimm(), which sign-extends bits 19:15. That matches spec operands named imm, but not the .vi forms whose operand is uimm; uimm=31 is decoded as -1 and printed by the shared 6-bit 'u' formatter as 63. Add rv_codec_v_i_u/operand_vuimm() for the 5-bit uimm forms: vsll.vi, vsrl.vi, vsra.vi, vnsrl.wi, vnsra.wi, vssrl.vi, vssra.vi, vnclipu.wi, vnclip.wi, vslideup.vi, vslidedown.vi, vrgather.vi, vaeskf1.vi, vaeskf2.vi, vsm3c.vi, vsm4k.vi and vwsll.vi. The remaining rv_codec_v_i entries are the signed imm forms. Fixes: 07f4964d1785 ("disas/riscv.c: rvv: Add disas support for vector instructions") Fixes: 9d92f56d4a44 ("disas/riscv: Add support for vector crypto extensions") Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260703-b4-disas-xthead-fix-riscv-next-v4-4-84c566330bc7@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 00cec77a7f9f80eb6dc8f0c27009403729e3641e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Use signed type for vector immediatesTANG Tiancheng
operand_vimm() sign-extends the 5-bit vector immediate field in bits 19:15, but returns uint32_t. This sends negative immediates through an unsigned type before they are assigned to rv_decode.imm. Return int32_t to match the signed value extracted by the helper. Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260703-b4-disas-xthead-fix-riscv-next-v4-3-84c566330bc7@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 7899d3c6bdb008dd301b474f3524bad5f37a411e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Fix 6-bit immediate extractionTANG Tiancheng
rv_codec_r2_imm6 is used for XThead instructions whose 6-bit immediate field is encoded in bits 25:20. The old expression left-shifted by 38 and then right-shifted by 60, so it kept only bits 25:22. Use extract32() to decode bits 25:20 directly. This fixes the immediate printed for th.srri and th.tst. Fixes: 318df7238b9f ("disas/riscv: Add support for XThead* instructions") Suggested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260703-b4-disas-xthead-fix-riscv-next-v4-2-84c566330bc7@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 7a8454ef293085a45686929577b7d5a5daded242) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24disas/riscv: Fix th.srri decodingTANG Tiancheng
target/riscv/xthead.decode defines th.srri as funct6=000100 in bits 31:26, with the 6-bit immediate in bits 25:20. decode_xtheadbb() switches on bits 31:25, i.e. funct6 plus imm[5]. Therefore valid th.srri encodings are 0001000 and 0001001. The current 0000100 and 0000101 cases use the wrong funct6 value and decode valid th.srri instructions as illegal. Fix the cases to match funct6=000100 with both imm[5] values. Fixes: 318df7238b9f ("disas/riscv: Add support for XThead* instructions") Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260703-b4-disas-xthead-fix-riscv-next-v4-1-84c566330bc7@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 6985cfc87512e96c0abfa7fffc836e7bd3889048) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24tests/qtest: Add seed CSR zero extension testIvan Efremov
Add a qtest that reads the seed CSR on RV64 machine with Zkr support and verifies that the upper 32 bits are clear. Signed-off-by: Ivan Efremov <nendensu@ispras.ru> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260802113130.7818-3-nendensu@ispras.ru> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit e80cf294797870b019d31dd299328aebdfaaa76c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: Fix seed CSR sign extensionIvan Efremov
The SEED_OPST_* macros expanded to int expressions. When bit 31 was present, converting a CSR seed value to target_ulong on RV64 sign extended the value and incorrectly set the upper 32 bits. Make the SEED_OPST_* constants unsigned so that CSR values are zero extended on RV64. Fixes: 77442380ecbe ("target/riscv: rvk: add CSR support for Zkr") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4121 Signed-off-by: Ivan Efremov <nendensu@ispras.ru> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260802113130.7818-2-nendensu@ispras.ru> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 51362da8f73b13ad029287ee33e190a212894183) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: do not count ECALL in minstretZephyr Li
With icount enabled, helper_raise_exception() leaves ECALL in icount_get_raw() because it exits without restoring the current TB state. This makes minstret count an instruction that does not retire. Adjust only the fixed minstret baseline so that mcycle accounting remains unchanged. Add an RV64 softmmu regression test for the issue. Fixes: 4fe8ae09062d ("target/riscv: Combine mhpmcounter and mhpmcounterh") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4087 Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260730032122.2564190-1-fritchleybohrer@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 5a9fa8b5820998a5aca02ecf3df12819f7ff2173) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: Fix memory leak in riscv_trigger_unrealize()Zeng Chi
In riscv_trigger_unrealize(), the per-trigger QEMUTimer objects are created in riscv_trigger_realize() using timer_new_ns(). However, unrealize only calls timer_del() to cancel them, but never frees the timer objects themselves. This results in a memory leak every time a CPU instance is unrealized (e.g., during hot-unplug or machine teardown). Fix it by replacing timer_del() with timer_free(), which internally cancels the timer and frees its memory. The separate timer_del() call is no longer needed. Fixes: 820552a92e32 ("target/riscv: dynamic alloc of debug trigger arrays") Signed-off-by: Zeng Chi <zengchi@kylinos.cn> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-ID: <20260724063927.3360599-1-zeng_chi911@163.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit d5ab0bdefe418593a744fd0c625add607117c972) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: use SXL instead of MXL for read_sstatusAbhigyan Kumar
According to the RISC-V spec, a 64-bit system can have M-mode in 64-bit with S-mode being 32-bit (SXL bits or mstatus[35:34] being 1). In this case, read_sstatus should use SXL. QEMU doesn't allow changing the SXL bits in mstatus in M-mode. This was because of the missing MSTATUS64_SXL mask in write_mstatus. Now, both the SXL field in mstatus can be safely modified in M-mode and read_sstatus correctly uses SXL not MXL. Fixes: b550f89457 ("target/riscv: Compute mstatus.sd on demand") Signed-off-by: Abhigyan Kumar <314abh@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260723142254.1683113-1-314abh@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit ebef6685a1a29b0b106b6ff3931ffc22c489e0ae) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24target/riscv: Fix PC sync in trans_sspopchk for CFI exception handlingMax Chou
Move gen_update_pc call before conditional logic to ensure consistent PC state regardless of execution path. Previously, the host instructions generated to update the cpu_pc were only executed in the failure path when shadow stack validation failed. This created inconsistent PC synchronization. This inconsistency caused issues in CF_PCREL mode where subsequent instructions calculated wrong relative offsets from stale pc_save values, and could lead to incorrect exception return addresses. This fix ensures PC is always synchronized before any helper that might raise an exception, maintaining consistent translator state across all execution paths. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4118 Signed-off-by: Max Chou <max.chou@sifive.com> [ahshehab: rebased on current master; file moved to target/riscv/tcg/insn_trans/ and the ssp load is now 64-bit wide] Tested-by: A-Shehab <ahshehab24@gmail.com> Signed-off-by: A-Shehab <ahshehab24@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260730181852.1622-1-ahshehab24@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit 4a884ba94b43f5b2a640f4ea882655503f9ae954) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24whpx: i386: inject back dbMohamed Mediouni
When we get a debug exception other than int1, inject it back to the guest. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260812082814.27217-7-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 93f38b6e8817280e1a51102d2dfd21115b8d4e88) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24whpx: i386: work around Hyper-V FP state odditiesMohamed Mediouni
On Hyper-V looks like we need to fetch both the legacy and new state instead of being able to rely on xsave. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260812082814.27217-6-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 37ce6d8da75754f725db8cc27ae6c82a2e5b930e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24whpx: i386: synchronise PAT tooMohamed Mediouni
https://github.com/cmspam/winq-emu hints that this might be wanted for some use-cases and it's a step towards full state sync: > Linux uses PAT to mark virtio-gpu / Venus shared memory as > Write-Combining. Previously the partition's PAT was not > synchronised with the guest, so the guest's MTRR/PAT cache-type > computation could fall back to UC for memory that should be WC. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260812082814.27217-5-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7b0516912e44e73ba0859e91aed848d5be26f05e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24whpx: i386: enable fast hypercall outputMohamed Mediouni
Already enabled on Arm so extending it to x86. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260812082814.27217-4-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 3bfcd8ef6bd26cb80175f40f60e67bc6f42fa0a4) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24hw/i386: fw_cfg: do not set VMX feature control on WHPXMohamed Mediouni
Hyper-V doesn't allow setting this bit on build 26100. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260812082814.27217-3-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 32452bac6d991e9778dd7a9fb2b3eed3a2b23d71) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24whpx: i386: fix xsaves enablement in legacy probing pathMohamed Mediouni
Without this, Linux will crash in a configuration where xsaves is expected. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260812082814.27217-2-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7c84752396d16c3379091fa8341c902aa67ec3d3) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-24hw/watchdog: Add lower bound check for watchdogNumberChinmay Rath
Add missing lower bound check for H_WATCHDOG H_CALL's watchdogNumber parameter as per PAPR documentation ver 12.10.00 section 14.15.5 'H_WATCHDOG'. Closes : https://gitlab.com/qemu-project/qemu/-/work_items/3600 Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Chinmay Rath <rathc@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260818104551.76023-1-rathc@linux.ibm.com [harshpb: corrected title prefix to hw/watchdog] Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com> (cherry picked from commit eea4de1bd8e8bdaa9a69b130a1a154f7c113979f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21tests/tcg/aarch64: Add regression test for whilewr/whilerwRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260811191540.79882-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 32953700108cc3305f27b591d66b5fb73806266a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/arm: Fix SVE2 WHILEWR/WHILERW zero diff boundary caseRichard Henderson
The trans_WHILE_ptr function incorrectly handles the case where the address difference divided by ESIZE results in zero. This happens when the address difference is less than ESIZE but greater than zero. Fix by dropping direct comparisons of op0 vs op1, and instead testing the scaled diff vs 0. Merge with the bounding to the maximum vector length via wrapping arithmetic. Cc: qemu-stable@nongnu.org Fixes: 14f6dad168e ("target/arm: Implement SVE2 WHILERW, WHILEWR") Reported-by: YanjunYang <yang.yanjun1@sanechips.com.cn> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260811191540.79882-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit bab972a2b0e34b889fbe8deb1e41cbea47e797f2) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21tcg: Export tcg_gen_ussub_i{32,64,tl}Richard Henderson
Move from tcg-op-gvec.c to tcg-op.c. Use a temporary, to cover the possibility of operand overlap. (Cc for stable as this is a prerequisite for the bug fix in the next commit.) Cc: qemu-stable@nongnu.org Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-id: 20260811191540.79882-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit b4f6f672a3e100706ddc249c26c2c149cdac1636) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21hw/intc/arm_gicv3: Have GIC kconfig select GICv3 for HVF and WHPXPhilippe Mathieu-Daudé
While trying to fix the GICv3 dependency on KVM and WHPX in commit 39a8c3941eb, we missed the Kconfig ARM_GIC symbol only selects GICv3 for TCG, not HVF and WHPX. Fix that. Cc: qemu-stable@nongnu.org Fixes: 39a8c3941eb ("hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX") Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-id: 20260812220816.94034-1-philmd@oss.qualcomm.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit a0c093900d84f6668c27eaeab4ca74935b5857b2) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21hw/intc: Fix arm kvm gicv3 selectionRichard Henderson
While 39a8c3941e may have fixed WHPX, it certainly didn't help KVM: $ QTEST_QEMU_BINARY=./qemu-system-aarch64 ./tests/qtest/arm-cpu-features ... qemu-system-aarch64: unknown type 'kvm-arm-gicv3' That patch did remove a test for TARGET_AARCH64, which is fine because it has been a long time since we supported KVM for AArch32. Cc: qemu-stable@nongnu.org Fixes: 39a8c3941e ("hw/intc/arm_gicv3: Fix ARM_GICV3 dependency for KVM / WHPX") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20260812200308.289238-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit d05febdd32cc6d6a0700994d25ae3ffccdc97e76) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21tcg: Defer tb_flush when initial thread region alloc failsRichard Henderson
A vCPU hotplug may happen at any time. When the new thread is started, the region pool may be exhausted. Do not abort. Rename tcg_region_thread_initial_alloc to differentiate it from tcg_region_initial_alloc__locked. The renamed function now uses tcg_region_alloc__locked and is prepared for failure. In tcg_tb_alloc, allow code_gen_ptr to be NULL. Treat that as any other region exhaustion. Reorg with while instead of goto. Tested-by: Yogesh Vyas <yvyas1991@gmail.com> Reviewed-by: Yogesh Vyas <yvyas1991@gmail.com> Reported-by: Anushree Mathur <anushree.mathur@linux.ibm.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2984 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit f5d2d8532f3c3cefb644fe9c1866a21b75f76faf) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21tcg: Return success from tcg_region_allocRichard Henderson
Invert the sense of the boolean result from 'error' to 'success'. Tested-by: Yogesh Vyas <yvyas1991@gmail.com> Reviewed-by: Yogesh Vyas <yvyas1991@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit fcdbc78ad4dea4b6baac581be5f7350ce47dc218) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21tcg: Return success from tcg_region_alloc__lockedRichard Henderson
Invert the sense of the boolean result from 'error' to 'success'. Tested-by: Yogesh Vyas <yvyas1991@gmail.com> Reviewed-by: Yogesh Vyas <yvyas1991@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit e131c28b6eb24c0b7f7f21591b2b2c7568267337) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/loongarch: check FPE before reading fcc in bceqz/bcnezJan Mercl
gen_cz_bc() loads env->cf[cj] without CHECK_FPE, unlike every other translator that touches an fcc register (trans_fcmp.c.inc and trans_fmov.c.inc, for movcf2gr/movgr2cf/movcf2fr/movfr2cf/fsel). A guest that manages the FPU lazily -- Linux clears CSR.EUEN.FPE in lose_fpu() on every context switch -- relies on the next fcc access raising a Floating-Point-Disabled exception so the kernel can restore that task's fcc. Because bceqz and bcnez never raise it, they branch on the condition flag left behind by whichever task last owned the FPU. Real Loongson hardware does raise the exception, so this is TCG-only. It surfaces as Go binaries dying at startup in runtime.check() with "fatal error: float64nan1" -- roughly one process start in a thousand once the guest has more runnable tasks than vCPUs -- and in general as a conditional branch silently taking the wrong path. With four tasks each executing 5M bcnez on a 2-vCPU guest, master mispredicts 89 of 20000000. With this patch, 0 of 100000000 over five runs; a Loongson-3C5000 is likewise 0 of 600000000. CHECK_FPE is defined in trans_farith.c.inc, which translate.c includes before trans_branch.c.inc, so it is already in scope. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4209 Cc: qemu-stable@nongnu.org Signed-off-by: Jan Mercl <0xjnml@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20260819132422.5164-1-0xjnml@gmail.com> Signed-off-by: Song Gao <gaosong@loongson.cn> (cherry picked from commit 215a4fc08f2aafce54c168cf41c64c79187430c1) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21meson: make linker warnings non-fatal on LinuxPaolo Bonzini
These cause a werror=true build to fail with Meson 1.12.0, as it now makes linker warnings fatal as well. Cc: qemu-stable@nongnu.org Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 501187d0bc62a46628acc25e0ea0187094f04246) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21serial: clear transmit retry callback on unrealizePaolo Bonzini
The GSource is removed when resetting but remains active (and can cause use-after-free) on hot-unplug. Remove it before the character device is disconnected. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4125 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit eb3f7fe382babbab44419603e81da56abb91d11a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/i386: decode opcode extensions group 3 /1 as TESTAndrey Polivoda
According to Table A-6 in Volume 3 of AMD64 Architecture Programmer's Manual, opcodes F6 and F7 (opcode extensions group 3) with ModRM's reg field values of 0 and 1 can be used to encode a TEST instruction. Although Intel 64 and IA-32 Architectures Software Developer's Manual leaves the cell 1 of opcode extensions group 3 blank in the opcode table (Table A-6, Volume 2D), the instruction in a group 3 with reg field of ModRM byte set to 1 actually behaves like TEST instruction on Intel CPUs. Currently, QEMU decodes group 3 instruction as TEST only if reg field of ModRM byte is 0. When the reg field is 1, QEMU raises a #UD exception. This behavior does not match real Intel and AMD hardware. This patch fixes this issue by duplicating the existing [0x00] and [0x08] X86_OP_ENTRYrr(AND, ...) entries into slots [0x01] and [0x09] in the opcodes_grp3 table. Fixes: d7c41a60d0c5 ("target/i386: move C0-FF opcodes to new decoder (except for x87)") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3580 Signed-off-by: Andrey Polivoda <apolivodaa433@gmail.com> Cc: qemu-devel@nongnu.org Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20260621032524.1138213-1-apolivodaa433@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 380b9596181760f371713604ea3472c56c19deb9) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/i386: allow transition to virtual-8086 mode only if CPL == 0 and CPU ↵Andrey Polivoda
is not in long mode According to the pseudocode for the IRET instruction in both the Intel 64 and IA-32 Architectures Software Developer's Manual and the AMD64 Architecture Programmer's Manual, a transition to virtual-8086 mode is allowed only if all of the following conditions are met: 1. The new EFLAGS.VM bit is set to 1. 2. The Current Privilege Level (CPL) is 0. 3. The CPU is in protected mode (and not in long mode). Currently, QEMU performs only the first check. This omission allows a transition to virtual-8086 mode from long mode, and also enables the guest's userspace to trigger this switch. During a legitimate transition, the EFLAGS register is updated in a way that allows modification of sensitive fields, such as IOPL and IF (which is expected, as only privileged code should be able to initiate this transition). However, due to the lack of appropriate checks, an unprivileged guest userspace process can now force this transition and freely modify these fields. This allows the userspace to: 1. Disable interrupts, preventing other processes from running on the CPU. 2. Gain direct hardware I/O access by elevating EFLAGS.IOPL to 3. 3. Crash the guest kernel by setting CS and SS to resemble segments with RPL = 0 and triggering an exception. Since the kernel is unaware that the process entered virtual-8086 mode, it will misinterpret the exception as originating from kernel space. This patch fixes this bug by adding the missing CPL and long mode checks before jumping to the `return_to_vm86` label. Fixes: 90a9fdae1f1a ("more ring 0 operations") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3583 Signed-off-by: Andrey Polivoda <apolivodaa433@gmail.com> Cc: qemu-devel@nongnu.org Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20260622082119.11903-1-apolivodaa433@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 36f634fe4ab6b266031164ab8d1160e6d11addda) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/i386: fix long mode segment override prefix decodingCraaijo, Jos
On x86, the ES/CS/SS/DS segment override prefixes are null prefixes in long mode, and should be ignored. (AMD APM Volume 3, Section 1.2.4) This patch fixes the prefix decoding to correctly ignore the prefixes in 64-bit mode. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3391 Signed-off-by: Jos Craaijo <jos.craaijo@ou.nl> Tested-by: Yudistira Putra <pyudistira519@gmail.com> Link: https://lore.kernel.org/r/20260623-fix-x86-long-mode-segment-override-decoding-v1-1-26d9d4b5804e@ou.nl Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 3589cd995b4facf34071e944fd8ec2294524e25a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/i386: fix incorrect decoding of EXTRQ_iSimon Scherer
The decoding of the extrq instruction with an immediate operand (EXTRQ_i) is incorrect. Per the AMD manual the instruction encoding looks as follows: EXTRQ xmm1, imm8, imm8 66 0F 78 /0 ib ib The /0 indicates that the "Reg" field of the ModR/M byte must be equal to 0 and the XMM register operand is specified by the "R/M" field. However, qemu incorrectly uses the "Reg" field to extract the register operand. This patch instead extracts the XMM register operand from the "R/M" field. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3611 Signed-off-by: Simon Scherer <scherer.simon89@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20260625155613.192643-1-scherer.simon89@gmail.com [Check for the reg field to be 0. Make decoding of REPZ+66 consistent between 0F 78 and 0F 79. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit ce0ee66044be066cbbf076a7530fe4e8f638f847) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-21target/i386: Clear OF, SF, and AF for fcomi/fucomiSimon Scherer
helper_fcomi_ST0_FT0() and helper_fucomi_ST0_FT0() only cleared CC_Z, CC_P, and CC_C before merging in the comparison result, leaving CC_O, CC_S, and CC_A untouched from whatever they were set to beforehand. The Intel SDM documents FCOMI/FCOMIP/FUCOMI/FUCOMIP as setting OF, SF, and AF to 0 unconditionally. The AMD manual doesn't mention them at all. However, testing on multiple real Intel and AMD systems confirms all three are unconditionally cleared regardless of the comparison result or their prior value. Since fcomi_ccval[] only ever contains CC_C, CC_Z, 0, or CC_Z|CC_P|CC_C, and CC_O|CC_S|CC_Z|CC_A|CC_P|CC_C already covers every flag bit, CC_SRC can be assigned from fcomi_ccval[ret + 1] directly instead of ORing it into a masked cpu_cc_compute_all() result. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4133 Signed-off-by: Simon Scherer <scherer.simon89@gmail.com> Link: https://lore.kernel.org/r/20260807062831.19618-1-scherer.simon89@gmail.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 0924d9d3db3617f49ba9282acc6d85b349404ce6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-20accel/tcg: Allow overlapping reads in record_saveIlya Chichkov
record_save() assumed that a target reads the bytes of an insn as a strictly ascending sequence of adjacent chunks, and asserted that each read begins exactly where the previous one ended. That assumption no longer holds for riscv. Since f9eaa1542b ("target/riscv: support atomic instruction fetch (Ziccif)"), decode_opc() loads a full aligned word whenever pc is 4-byte aligned, even when the insn turns out to be a 2-byte compressed one, so the record may already hold bytes past the end of the insn being translated. When such a compressed insn sits at page offset 0xffc, pc_next becomes 0xffe, which is within MAX_INSN_LEN of the end of the page, and riscv_tr_translate_insn() probes the next insn to decide whether it would cross the page boundary. That probe reads at offset 2 while the record already covers [0,4), and the assert fires: qemu-system-riscv32: accel/tcg/translator.c:395: record_save: Assertion `offset == db->record_start + db->record_len' failed. record_save() is only reached when the insn is fetched from MMIO, so this is visible on boards that execute code from a region created with memory_region_init_io(), such as an XIP flash window mapped over a serial flash controller. Both sides of the collision are correct: the wide fetch is required for Ziccif atomicity, and the probe is required for correct fault reporting at a page boundary, per 00c07344fa ("target/riscv: Make translator stop before the end of a page"). Unlike a86d3352ab ("target/riscv: do not use translator_ldl in opcode_at"), where a non-translation caller had no business using translator_ld*, the probe here is a genuine translation read whose bytes must be recorded. Relax the invariant instead. Keep requiring that a read neither moves backwards nor leaves a gap, but let a read overlapping the recorded range extend it only by the bytes past its end. Cc: qemu-stable@nongnu.org Fixes: f9eaa1542b ("target/riscv: support atomic instruction fetch (Ziccif)") Signed-off-by: Ilya Chichkov <ilya.chichkov.dev@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20260814142159.3800744-1-ilya.chichkov.dev@gmail.com> (cherry picked from commit 784b7f28e2761fbd3c753883be949eb3d1ffe228) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-20tcg/optimize: Fix s_mask computation for shiftsRichard Henderson
Skip s_mask computation for logical right shift. Cc: qemu-stable@nongnu.org Fixes: 93a967fbb57 ("tcg/optimize: Propagate sign info for shifting") Reported-by: Jacob Young <jacobly@ziglang.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 5fe51606146cbf04dac07bf27256febbe56881e7) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-20tcg/optimize: INDEX_op_mul is commutativeRichard Henderson
Cc: qemu-stable@nongnu.org Fixes: 7a2f7084525 ("tcg/optimize: Sink commutative operand swapping into fold functions") Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> (cherry picked from commit 3181e53c13a1a68e2b54c94b1766f8e384c01b4c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-08 08:39:50 +0000