* [PULL 1/9] hw/hexagon: register the V68N_1024 machine
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 2/9] target/hexagon: read BADVA as an alias of BADVA0/1 Brian Cain
` (8 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell; +Cc: brian.cain, Pierrick Bouvier
This DSP definition file was present but not referenced. Also: add a
'sim' alias for this machine to indicate a recent machine with
memory-map resembling that used by 'hexagon-sim'.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
hw/hexagon/hexagon_dsp.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/hw/hexagon/hexagon_dsp.c b/hw/hexagon/hexagon_dsp.c
index 5b2b6e312b6..ff110234b09 100644
--- a/hw/hexagon/hexagon_dsp.c
+++ b/hw/hexagon/hexagon_dsp.c
@@ -29,6 +29,7 @@
#include "semihosting/semihost.h"
#include "machine_cfg_v66g_1024.h.inc"
+#include "machine_cfg_v68n_1024.h.inc"
#define TYPE_HEXAGON_DSP_MACHINE "hexagon-dsp-machine"
OBJECT_DECLARE_SIMPLE_TYPE(HexagonDspMachineState, HEXAGON_DSP_MACHINE)
@@ -181,6 +182,23 @@ static void v66g_1024_init(ObjectClass *oc, const void *data)
mc->default_cpus = 4;
}
+static void v68n_1024_config_init(MachineState *machine)
+{
+ hexagon_common_init(machine, v68_rev, &v68n_1024);
+}
+
+static void v68n_1024_init(ObjectClass *oc, const void *data)
+{
+ MachineClass *mc = MACHINE_CLASS(oc);
+
+ mc->desc = "Hexagon V68N_1024";
+ mc->alias = "sim";
+ mc->init = v68n_1024_config_init;
+ init_mc(mc);
+ mc->default_cpu_type = TYPE_HEXAGON_CPU_V68;
+ mc->default_cpus = 6;
+}
+
static const TypeInfo hexagon_machine_types[] = {
{
.name = TYPE_HEXAGON_COMMON_MACHINE,
@@ -199,6 +217,11 @@ static const TypeInfo hexagon_machine_types[] = {
.parent = TYPE_HEXAGON_DSP_MACHINE,
.class_init = v66g_1024_init,
},
+ {
+ .name = MACHINE_TYPE_NAME("V68N_1024"),
+ .parent = TYPE_HEXAGON_DSP_MACHINE,
+ .class_init = v68n_1024_init,
+ },
};
DEFINE_TYPES(hexagon_machine_types)
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 2/9] target/hexagon: read BADVA as an alias of BADVA0/1
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
2026-09-05 20:05 ` [PULL 1/9] hw/hexagon: register the V68N_1024 machine Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 3/9] target/hexagon: kick vCPU when re-asserting interrupts Brian Cain
` (7 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell; +Cc: brian.cain, Pierrick Bouvier
BADVA is sort of a virtual register: it reads back as either BADVA0
or BADVA1, selected by SSR[BVS]. sreg_read() instead returned the
separate copy that set_badva_regs() stores in t_sreg[HEX_SREG_BADVA].
Guest code that writes BADVA0/BADVA1 directly was reading back a stale BADVA.
Uncovered by the h2 hypervisor kernel/mem/tlbmiss test.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
target/hexagon/op_helper.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 71555a7ba36..5d64c5523bb 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -1889,6 +1889,13 @@ static inline QEMU_ALWAYS_INLINE uint32_t sreg_read(CPUHexagonState *env,
HexagonCPU *cpu;
g_assert(bql_locked());
+ if (reg == HEX_SREG_BADVA) {
+ uint32_t ssr = env->t_sreg[HEX_SREG_SSR];
+ if (GET_SSR_FIELD(SSR_BVS, ssr)) {
+ return env->t_sreg[HEX_SREG_BADVA1];
+ }
+ return env->t_sreg[HEX_SREG_BADVA0];
+ }
if (reg < HEX_SREG_GLB_START) {
return env->t_sreg[reg];
}
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 3/9] target/hexagon: kick vCPU when re-asserting interrupts
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
2026-09-05 20:05 ` [PULL 1/9] hw/hexagon: register the V68N_1024 machine Brian Cain
2026-09-05 20:05 ` [PULL 2/9] target/hexagon: read BADVA as an alias of BADVA0/1 Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 4/9] hw/intc: name the L2VIC edge trigger check Brian Cain
` (6 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell; +Cc: brian.cain, Pierrick Bouvier
hex_interrupt_update() used cpu_resume() to make a halted vCPU notice a
newly pending interrupt. cpu_resume() is meant for a vCPU stopped by the
vm-state machinery: besides kicking the thread it clears cpu->stop and
cpu->stopped, and resets exception_index to -1. Clearing the stop flags
can undo a pause requested via the monitor or by migration, and resetting
exception_index discards an exception the vCPU had already latched.
Only the kick is wanted here, so call qemu_cpu_kick() directly.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
target/hexagon/hex_interrupts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/hexagon/hex_interrupts.c b/target/hexagon/hex_interrupts.c
index 7dde1294b2e..2b2834af95f 100644
--- a/target/hexagon/hex_interrupts.c
+++ b/target/hexagon/hex_interrupts.c
@@ -441,7 +441,7 @@ void hex_interrupt_update(CPUHexagonState *env)
const int exe_mode = get_exe_mode(hex_env);
if (exe_mode != HEX_EXE_MODE_OFF) {
cpu_interrupt(cs, CPU_INTERRUPT_SWI);
- cpu_resume(cs);
+ qemu_cpu_kick(cs);
}
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 4/9] hw/intc: name the L2VIC edge trigger check
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (2 preceding siblings ...)
2026-09-05 20:05 ` [PULL 3/9] target/hexagon: kick vCPU when re-asserting interrupts Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 5/9] target/hexagon: assert guest register pair alignment Brian Cain
` (5 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell
Cc: brian.cain, Philippe Mathieu-Daudé, Pierrick Bouvier
Link: https://lore.kernel.org/qemu-devel/c3f2f4e2-79e9-4b3f-8bae-88c669a34c0b@oss.qualcomm.com/
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
hw/intc/hex-l2vic.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/hw/intc/hex-l2vic.c b/hw/intc/hex-l2vic.c
index a986f0bdf35..736f1be3b1d 100644
--- a/hw/intc/hex-l2vic.c
+++ b/hw/intc/hex-l2vic.c
@@ -92,7 +92,7 @@ typedef struct HexL2VICState {
DECLARE_BITMAP32(int_pending, L2VIC_INTERRUPT_MAX);
/* Which enabled interrupt is active */
DECLARE_BITMAP32(int_status, L2VIC_INTERRUPT_MAX);
- /* Edge or Level interrupt */
+ /* 1 for edge-triggered, 0 for level-triggered */
DECLARE_BITMAP32(int_type, L2VIC_INTERRUPT_MAX);
DECLARE_BITMAP32(int_group_n[4], L2VIC_INTERRUPT_MAX);
qemu_irq irq[8];
@@ -249,6 +249,11 @@ static inline bool vid_active(HexL2VICState *s)
return active_irq != size;
}
+static bool edge_triggered_irq(HexL2VICState *s, int irq)
+{
+ return test_bit32(irq, s->int_type);
+}
+
static bool l2vic_update(HexL2VICState *s, int irq)
{
bool pending;
@@ -270,7 +275,7 @@ static bool l2vic_update(HexL2VICState *s, int irq)
* enable bit set across deliveries -- the firmware enables once
* and expects the interrupt to remain enabled.
*/
- if (test_bit32(irq, s->int_type)) {
+ if (edge_triggered_irq(s, irq)) {
clear_bit32(irq, s->int_enable);
}
s->vid = irq;
@@ -299,7 +304,7 @@ static void l2vic_set_irq(void *opaque, int irq, int level)
if (level) {
set_bit32(irq, s->int_pending);
- } else if (!test_bit32(irq, s->int_type)) {
+ } else if (!edge_triggered_irq(s, irq)) {
clear_bit32(irq, s->int_pending);
}
l2vic_update(s, irq);
@@ -328,7 +333,7 @@ static void l2vic_write(void *opaque, hwaddr offset, uint64_t val,
while ((bit = ctz32(bits)) < 32) {
int irq = base_irq + bit;
- if (test_bit32(irq, s->int_type)) {
+ if (edge_triggered_irq(s, irq)) {
set_bit32(irq, s->int_pending);
}
bits &= ~(1u << bit);
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 5/9] target/hexagon: assert guest register pair alignment
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (3 preceding siblings ...)
2026-09-05 20:05 ` [PULL 4/9] hw/intc: name the L2VIC edge trigger check Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 6/9] hexagon: raise imprecise exception for multi-TLB matches Brian Cain
` (4 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell
Cc: brian.cain, Philippe Mathieu-Daudé, Pierrick Bouvier
Link: https://lore.kernel.org/qemu-devel/f7f34a43-c1cc-4dd8-a859-9ab72e1b015f@oss.qualcomm.com/
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
target/hexagon/op_helper.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 5d64c5523bb..7ad99ced7ab 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -1927,6 +1927,8 @@ uint32_t HELPER(greg_read)(CPUHexagonState *env, uint32_t reg)
uint64_t HELPER(greg_read_pair)(CPUHexagonState *env, uint32_t reg)
{
+ g_assert((reg & 1) == 0);
+
if (reg == HEX_GREG_G0 || reg == HEX_GREG_G2) {
return (uint64_t)(env->greg[reg]) |
(((uint64_t)(env->greg[reg + 1])) << 32);
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 6/9] hexagon: raise imprecise exception for multi-TLB matches
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (4 preceding siblings ...)
2026-09-05 20:05 ` [PULL 5/9] target/hexagon: assert guest register pair alignment Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 7/9] tests/functional/hexagon: add tests, update to v0.2.14 Brian Cain
` (3 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell; +Cc: brian.cain, Pierrick Bouvier
The TLB walk stopped at the first matching entry, so instruction and data
translations did not detect a second valid mapping for the same VA and ASID.
Scan the remaining entries after selecting the translation. On a second
match, retain the first entry for the access but record
HEX_CAUSE_IMPRECISE_MULTI_TLB_MATCH as a pending imprecise exception.
Move that exception out of the synchronous TLB-fill result and check for it
after every packet, rather than only packets containing tlbp. This delivers
the architectural imprecise exception after an ordinary memory access and
avoids treating it as a precise permission fault. Clear the pending state
when starting a new translation and after delivering the exception.
The v0.2.14 mmu_multi_tlb systest uncovered this bug.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
hw/hexagon/hexagon_tlb.c | 10 ++++++++++
target/hexagon/hex_mmu.c | 12 +++++++++---
target/hexagon/hexswi.c | 1 +
target/hexagon/translate.c | 22 ++++++++--------------
4 files changed, 28 insertions(+), 17 deletions(-)
diff --git a/hw/hexagon/hexagon_tlb.c b/hw/hexagon/hexagon_tlb.c
index c76805abac9..157d03e51bf 100644
--- a/hw/hexagon/hexagon_tlb.c
+++ b/hw/hexagon/hexagon_tlb.c
@@ -326,6 +326,16 @@ bool hexagon_tlb_find_match(HexagonTLBState *tlb, uint32_t asid,
for (uint32_t i = 0; i < tlb->num_entries; i++) {
if (hex_tlb_entry_match(tlb->entries[i], asid, VA, access_type,
PA, prot, size, excp, cause_code, mmu_idx)) {
+ if (*excp == 0) {
+ for (i++; i < tlb->num_entries; i++) {
+ if (hex_tlb_entry_match_noperm(tlb->entries[i], asid,
+ VA)) {
+ *excp = HEX_EVENT_IMPRECISE;
+ *cause_code = HEX_CAUSE_IMPRECISE_MULTI_TLB_MATCH;
+ break;
+ }
+ }
+ }
return true;
}
}
diff --git a/target/hexagon/hex_mmu.c b/target/hexagon/hex_mmu.c
index d6258c673d1..d6ee7c40798 100644
--- a/target/hexagon/hex_mmu.c
+++ b/target/hexagon/hex_mmu.c
@@ -71,10 +71,16 @@ bool hex_tlb_find_match(CPUHexagonState *env, uint32_t VA,
uint32_t ssr = env->t_sreg[HEX_SREG_SSR];
uint8_t asid = GET_SSR_FIELD(SSR_ASID, ssr);
int cause_code = 0;
+ bool found;
- bool found = hexagon_tlb_find_match(cpu->tlb, asid, VA, access_type,
- PA, prot, size, excp, &cause_code,
- mmu_idx);
+ env->imprecise_exception = 0;
+ found = hexagon_tlb_find_match(cpu->tlb, asid, VA, access_type,
+ PA, prot, size, excp, &cause_code,
+ mmu_idx);
+ if (*excp == HEX_EVENT_IMPRECISE) {
+ env->imprecise_exception = *excp;
+ *excp = 0;
+ }
if (cause_code) {
env->cause_code = cause_code;
}
diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c
index 75f0a9cc520..4705e915aea 100644
--- a/target/hexagon/hexswi.c
+++ b/target/hexagon/hexswi.c
@@ -934,6 +934,7 @@ void hexagon_cpu_do_interrupt(CPUState *cs)
break;
case HEX_EVENT_IMPRECISE:
+ env->imprecise_exception = 0;
if (get_exe_mode(env) == HEX_EXE_MODE_WAIT) {
env->gpr[HEX_REG_PC] = env->wait_next_pc - 4;
clear_wait_mode(env);
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index be75e5fdeb8..5d3d67e5d3e 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -1065,20 +1065,14 @@ static void update_exec_counters(DisasContext *ctx)
* A tlbp instruction may detect multiple TLB matches and set a pending
* imprecise exception. Raise it after the packet that ran the tlbp.
*/
-static void check_imprecise_exception(Packet *pkt)
+static void check_imprecise_exception(DisasContext *ctx)
{
- for (int i = 0; i < pkt->num_insns; i++) {
- if (pkt->insn[i].opcode == Y2_tlbp) {
- TCGv PC = tcg_constant_tl(pkt->pc);
- TCGLabel *label = gen_new_label();
- tcg_gen_brcondi_tl(TCG_COND_EQ, hex_imprecise_exception,
- 0, label);
- gen_helper_raise_exception(tcg_env,
- hex_imprecise_exception, PC);
- gen_set_label(label);
- return;
- }
- }
+ TCGv PC = tcg_constant_tl(ctx->pkt.pc);
+ TCGLabel *label = gen_new_label();
+
+ tcg_gen_brcondi_tl(TCG_COND_EQ, hex_imprecise_exception, 0, label);
+ gen_helper_raise_exception(tcg_env, hex_imprecise_exception, PC);
+ gen_set_label(label);
}
#endif
@@ -1182,7 +1176,7 @@ static void gen_commit_packet(DisasContext *ctx)
}
#ifndef CONFIG_USER_ONLY
- check_imprecise_exception(&ctx->pkt);
+ check_imprecise_exception(ctx);
#endif
if (ctx->pkt_ends_tb || ctx->base.is_jmp == DISAS_NORETURN) {
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 7/9] tests/functional/hexagon: add tests, update to v0.2.14
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (5 preceding siblings ...)
2026-09-05 20:05 ` [PULL 6/9] hexagon: raise imprecise exception for multi-TLB matches Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 8/9] tests/functional/hexagon: update arch tests " Brian Cain
` (2 subsequent siblings)
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell; +Cc: brian.cain, Pierrick Bouvier
Add tests for direct-to-guest interrupts, multi-TLB match case, {u,}timer
registers.
Update to the v0.2.14 tests and switch to the new 'sim' machine name.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
tests/functional/hexagon/test_systests.py | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/tests/functional/hexagon/test_systests.py b/tests/functional/hexagon/test_systests.py
index f36e015f502..983ee1672ce 100755
--- a/tests/functional/hexagon/test_systests.py
+++ b/tests/functional/hexagon/test_systests.py
@@ -21,8 +21,8 @@ class SysTestsStandaloneTests(QemuSystemTest):
SYSTEST_TIMEOUT_SEC = 30
ASSET_TARBALL = Asset(
- "https://github.com/qualcomm/qemu-hexagon-testing/releases/download/v0.2.11/systests_standalone.tar.gz",
- "b5777aa65245de7710a7a08d717953c1362be7c8b60d9014c9fee8b17610ad1c",
+ "https://github.com/qualcomm/qemu-hexagon-testing/releases/download/v0.2.14/systests_standalone.tar.gz",
+ "f0c535d746384126954757b6ce54452c5fe82624618c79862495eec24718a6ff",
)
def setUp(self):
@@ -34,7 +34,7 @@ def binary(self, name):
self.assertTrue(os.path.exists(path))
return path
- def run_exit_zero(self, binary_name, *extra_args, machine="V66G_1024"):
+ def run_exit_zero(self, binary_name, *extra_args, machine="sim"):
self.set_machine(machine)
self.set_vm_arg("-display", "none")
self.set_vm_arg("-kernel", self.binary(binary_name))
@@ -47,7 +47,7 @@ def run_exit_zero(self, binary_name, *extra_args, machine="V66G_1024"):
f"code {self.vm.exitcode()}, expected 0")
def run_console_pattern(self, binary_name, pattern, *extra_args,
- machine="V66G_1024"):
+ machine="sim"):
self.set_machine(machine)
self.set_vm_arg("-display", "none")
self.set_vm_arg("-kernel", self.binary(binary_name))
@@ -90,5 +90,14 @@ def test_access(self):
def test_semihost(self):
self.run_console_pattern("semihost", "PASS", "-append", "arg1", "arg2")
+ def test_dtg_interrupt(self):
+ self.run_exit_zero("dtg_interrupt")
+
+ def test_mmu_multi_tlb(self):
+ self.run_exit_zero("mmu_multi_tlb")
+
+ def test_timer_reg(self):
+ self.run_exit_zero("timer_reg")
+
if __name__ == "__main__":
QemuSystemTest.main()
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 8/9] tests/functional/hexagon: update arch tests to v0.2.14
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (6 preceding siblings ...)
2026-09-05 20:05 ` [PULL 7/9] tests/functional/hexagon: add tests, update to v0.2.14 Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-05 20:05 ` [PULL 9/9] target/hexagon: decode the DMA insts as unimp Brian Cain
2026-09-07 12:32 ` [PULL 0/9] hex queue Peter Maydell
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell; +Cc: brian.cain, Pierrick Bouvier
Some of the tests run longer now, extend the timeout to 180s
in order to keep it robust.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
tests/functional/hexagon/test_arch_tests.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tests/functional/hexagon/test_arch_tests.py b/tests/functional/hexagon/test_arch_tests.py
index 8e71386c186..5d7ce487436 100755
--- a/tests/functional/hexagon/test_arch_tests.py
+++ b/tests/functional/hexagon/test_arch_tests.py
@@ -17,12 +17,12 @@ class ArchTestsUart(QemuSystemTest):
Tests output results via UART.
"""
- timeout = 60
+ timeout = 180
ASSET_TARBALL = Asset(
"https://github.com/qualcomm/qemu-hexagon-testing/releases/"
- "download/v0.2.12/arch_tests_uart.tar.gz",
- "871a339bf78cac0ebaf1b2509bfcd5b249ad8190be33e0cf848283b2f6915323",
+ "download/v0.2.14/arch_tests_uart.tar.gz",
+ "ce93cb90b9d757c1946dfe8fe6abcec8292b08a66546ac51b2dd48650b05fa91",
)
def run_uart_test(self, test_name: str,
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PULL 9/9] target/hexagon: decode the DMA insts as unimp
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (7 preceding siblings ...)
2026-09-05 20:05 ` [PULL 8/9] tests/functional/hexagon: update arch tests " Brian Cain
@ 2026-09-05 20:05 ` Brian Cain
2026-09-07 12:32 ` [PULL 0/9] hex queue Peter Maydell
9 siblings, 0 replies; 15+ messages in thread
From: Brian Cain @ 2026-09-05 20:05 UTC (permalink / raw)
To: qemu-devel, richard.henderson, peter.maydell
Cc: brian.cain, Philippe Mathieu-Daudé, Pierrick Bouvier
These instructions are used by some guest test cases during system
initialization. It's handy to unblock some tests for now and we'll
follow up with a full implementation later.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
target/hexagon/gen_tcg.h | 28 +++++++++++++++++++++++++++
target/hexagon/genptr.c | 1 +
target/hexagon/tag_rev_info.c.inc | 10 ++++++++++
target/hexagon/imported/encode_pp.def | 11 +++++++++++
target/hexagon/imported/system.idef | 11 +++++++++++
5 files changed, 61 insertions(+)
diff --git a/target/hexagon/gen_tcg.h b/target/hexagon/gen_tcg.h
index 1d25391282a..5f7df66ae67 100644
--- a/target/hexagon/gen_tcg.h
+++ b/target/hexagon/gen_tcg.h
@@ -1329,6 +1329,34 @@
do { } while (0)
#define fGEN_TCG_Y2_syncht(SHORTCODE) \
do { } while (0)
+
+#define fGEN_TCG_DMA_UNIMP() \
+ qemu_log_mask(LOG_UNIMP, "'%s' is not implemented\n", \
+ opcode_names[insn->opcode])
+#define fGEN_TCG_Y6_dmstart(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); RsV = RsV; } while (0)
+#define fGEN_TCG_Y6_dmresume(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); RsV = RsV; } while (0)
+#define fGEN_TCG_Y6_dmlink(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); RsV = RsV; RtV = RtV; } while (0)
+#define fGEN_TCG_Y6_dmcfgwr(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); RsV = RsV; RtV = RtV; } while (0)
+#define fGEN_TCG_Y6_dmcfgrd(SHORTCODE) \
+ do { \
+ fGEN_TCG_DMA_UNIMP(); \
+ RsV = RsV; \
+ tcg_gen_movi_tl(RdV, 0); \
+ } while (0)
+#define fGEN_TCG_Y6_dmpoll(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); tcg_gen_movi_tl(RdV, 0); } while (0)
+#define fGEN_TCG_Y6_dmwait(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); tcg_gen_movi_tl(RdV, 0); } while (0)
+#define fGEN_TCG_Y6_dmpause(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); tcg_gen_movi_tl(RdV, 0); } while (0)
+#define fGEN_TCG_Y6_dmsyncht(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); tcg_gen_movi_tl(RdV, 0); } while (0)
+#define fGEN_TCG_Y6_dmtlbsynch(SHORTCODE) \
+ do { fGEN_TCG_DMA_UNIMP(); tcg_gen_movi_tl(RdV, 0); } while (0)
#define fGEN_TCG_Y2_dcfetchbo(SHORTCODE) \
do { \
RsV = RsV; \
diff --git a/target/hexagon/genptr.c b/target/hexagon/genptr.c
index 1f109d44de8..9f53fcb6b95 100644
--- a/target/hexagon/genptr.c
+++ b/target/hexagon/genptr.c
@@ -16,6 +16,7 @@
*/
#include "qemu/osdep.h"
+#include "qemu/log.h"
#include "cpu.h"
#include "internal.h"
#include "tcg/tcg-op.h"
diff --git a/target/hexagon/tag_rev_info.c.inc b/target/hexagon/tag_rev_info.c.inc
index 11c90f86ad1..a91b91a23e6 100644
--- a/target/hexagon/tag_rev_info.c.inc
+++ b/target/hexagon/tag_rev_info.c.inc
@@ -575,6 +575,16 @@ static const struct tag_rev_info tag_rev_info[XX_LAST_OPCODE] = {
[J2_jumprh] = { .introduced = 0x73, .removed = HEX_VER_NONE },
[L2_loadw_aq] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
[L4_loadd_aq] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmcfgrd] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmcfgwr] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmlink] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmpause] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmpoll] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmresume] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmstart] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmsyncht] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmtlbsynch] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
+ [Y6_dmwait] = { .introduced = HEX_VER_V68, .removed = HEX_VER_NONE },
[M7_dcmpyiw] = { .introduced = HEX_VER_V67, .removed = HEX_VER_NONE },
[M7_dcmpyiw_acc] = { .introduced = HEX_VER_V67, .removed = HEX_VER_NONE },
[M7_dcmpyiwc] = { .introduced = HEX_VER_V67, .removed = HEX_VER_NONE },
diff --git a/target/hexagon/imported/encode_pp.def b/target/hexagon/imported/encode_pp.def
index 1c64495d519..d9e8ea2aebd 100644
--- a/target/hexagon/imported/encode_pp.def
+++ b/target/hexagon/imported/encode_pp.def
@@ -529,6 +529,17 @@ DEF_ENC32(Y5_l2fetch, ICLASS_ST" 011 01 00sssss PP-ttttt --------")
DEF_ENC32(Y6_l2gcleanpa, ICLASS_ST" 011 01 01----- PP-ttttt --------")
DEF_ENC32(Y6_l2gcleaninvpa,ICLASS_ST" 011 01 10----- PP-ttttt --------")
+DEF_ENC32(Y6_dmcfgrd, "10101000000sssssPP------101ddddd")
+DEF_ENC32(Y6_dmcfgwr, "10101000000sssssPP-ttttt110-----")
+DEF_ENC32(Y6_dmlink, "10100110000sssssPP-ttttt010-----")
+DEF_ENC32(Y6_dmpause, "10101000000-----PP------011ddddd")
+DEF_ENC32(Y6_dmpoll, "10101000000-----PP------010ddddd")
+DEF_ENC32(Y6_dmresume, "10100110000sssssPP------100-----")
+DEF_ENC32(Y6_dmstart, "10100110000sssssPP------001-----")
+DEF_ENC32(Y6_dmsyncht, "10101000000-----PP-----0111ddddd")
+DEF_ENC32(Y6_dmtlbsynch,"10101000000-----PP-----1111ddddd")
+DEF_ENC32(Y6_dmwait, "10101000000-----PP------001ddddd")
+
/*******************************/
/* */
diff --git a/target/hexagon/imported/system.idef b/target/hexagon/imported/system.idef
index 9e85bed0a6e..02aee8ce8ee 100644
--- a/target/hexagon/imported/system.idef
+++ b/target/hexagon/imported/system.idef
@@ -222,6 +222,17 @@ Q6INSN(Y2_isync,"isync",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET),"Memory Syn
Q6INSN(Y2_barrier,"barrier",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_SLOT0ONLY,A_RESTRICT_PACKET_AXOK),"Memory Barrier",{fBARRIER();})
Q6INSN(Y2_syncht,"syncht",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_SLOT0ONLY,A_RESTRICT_NOPACKET),"Memory Synchronization",{fSYNCH();})
+Q6INSN(Y6_dmstart,"dmstart(Rs32)",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Start",{RsV=RsV;})
+Q6INSN(Y6_dmlink,"dmlink(Rs32,Rt32)",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Link",{RsV=RsV; RtV=RtV;})
+Q6INSN(Y6_dmpoll,"Rd32=dmpoll",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Poll",{RdV=0;})
+Q6INSN(Y6_dmwait,"Rd32=dmwait",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Wait",{RdV=0;})
+Q6INSN(Y6_dmsyncht,"Rd32=dmsyncht",ATTRIBS(A_PRIV,A_NOTE_PRIV,A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA SynchT",{RdV=0;})
+Q6INSN(Y6_dmtlbsynch,"Rd32=dmtlbsynch",ATTRIBS(A_PRIV,A_NOTE_PRIV,A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA TLB Synch",{RdV=0;})
+Q6INSN(Y6_dmcfgrd,"Rd32=dmcfgrd(Rs32)",ATTRIBS(A_PRIV,A_NOTE_PRIV,A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Config Read",{RsV=RsV; RdV=0;})
+Q6INSN(Y6_dmcfgwr,"dmcfgwr(Rs32,Rt32)",ATTRIBS(A_PRIV,A_NOTE_PRIV,A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Config Write",{RsV=RsV; RtV=RtV;})
+Q6INSN(Y6_dmpause,"Rd32=dmpause",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Pause",{RdV=0;})
+Q6INSN(Y6_dmresume,"dmresume(Rs32)",ATTRIBS(A_NOTE_NOPACKET,A_RESTRICT_NOPACKET,A_DMA,A_RESTRICT_SLOT0ONLY,A_NO_TIMING_LOG),"DMA Resume",{RsV=RsV;})
+
Q6INSN(Y2_dcfetchbo,"dcfetch(Rs32+#u11:3)",ATTRIBS(A_RESTRICT_PREFERSLOT0,A_DCFETCH,A_RESTRICT_NOSLOT1_STORE),"Data Cache Prefetch",{fEA_RI(RsV,uiV); fDCFETCH(EA);})
Q6INSN(Y2_dckill,"dckill",ATTRIBS(A_PRIV,A_NOTE_PRIV,A_NOTE_NOPACKET,A_RESTRICT_SLOT0ONLY,A_RESTRICT_NOPACKET,A_CACHEOP,A_DCFLUSHOP),"Data Cache Invalidate",{fDCKILL();})
--
2.34.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [PULL 0/9] hex queue
2026-09-05 20:05 [PULL 0/9] hex queue Brian Cain
` (8 preceding siblings ...)
2026-09-05 20:05 ` [PULL 9/9] target/hexagon: decode the DMA insts as unimp Brian Cain
@ 2026-09-07 12:32 ` Peter Maydell
9 siblings, 0 replies; 15+ messages in thread
From: Peter Maydell @ 2026-09-07 12:32 UTC (permalink / raw)
To: Brian Cain; +Cc: qemu-devel, richard.henderson
On Sat, 5 Sept 2026 at 21:05, Brian Cain <brian.cain@oss.qualcomm.com> wrote:
>
> The following changes since commit ff1d2d19d7e24893e2012d879f8e73077e17b9bd:
>
> Merge tag 'pull-11.1-check-tcg-meson-040926-2' of https://gitlab.com/stsquad/qemu into staging (2026-09-04 16:52:58 +0100)
>
> are available in the Git repository at:
>
> https://github.com/qualcomm/qemu tags/pull-hex-20260905
>
> for you to fetch changes up to dfad6f9ff1a4600893ef6b3c21382225e604535e:
>
> target/hexagon: decode the DMA insts as unimp (2026-09-05 12:04:01 -0700)
>
> ----------------------------------------------------------------
> hexagon: TLB, badva fixes + DMA
>
> Add fixes for TLB, badva behavior and an unimp placeholder for the
> DMA instruction set.
>
> ----------------------------------------------------------------
> Brian Cain (9):
> hw/hexagon: register the V68N_1024 machine
> target/hexagon: read BADVA as an alias of BADVA0/1
> target/hexagon: kick vCPU when re-asserting interrupts
> hw/intc: name the L2VIC edge trigger check
> target/hexagon: assert guest register pair alignment
> hexagon: raise imprecise exception for multi-TLB matches
> tests/functional/hexagon: add tests, update to v0.2.14
> tests/functional/hexagon: update arch tests to v0.2.14
> target/hexagon: decode the DMA insts as unimp
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.2
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 15+ messages in thread