[PATCH 0/5] Hexagon: enable MTTCG

[PATCH 0/5] Hexagon: enable MTTCG

[Brian Cain]

Turning on mttcg exposed some bugs, the fixes for those are included in this
series.

A previous series (since landed) also provided some fixes for
TLB/barriers/LL-SC: https://lore.kernel.org/qemu-devel/20260927024347.3545385-1-brian.cain@oss.qualcomm.com/

Brian Cain (5):
  target/hexagon: acquire BQL before reading interrupt state
  target/hexagon: check exception_index in has_work
  target/hexagon: drop a pending HALT when resuming
  hw/intc: ciad should forward its mask to l2vic
  target/hexagon: enable MTTCG for system emulation

 configs/targets/hexagon-softmmu.mak |  1 +
 include/hw/intc/hex-l2vic.h         | 14 ++++++++++----
 hw/intc/hex-l2vic.c                 | 10 +++++++---
 target/hexagon/cpu.c                |  6 ++++--
 target/hexagon/cpu_helper.c         |  1 +
 target/hexagon/hex_interrupts.c     |  8 +++++---
 target/hexagon/op_helper.c          | 14 +++++++++-----
 7 files changed, 37 insertions(+), 17 deletions(-)

-- 
2.34.1

[PATCH 1/5] target/hexagon: acquire BQL before reading interrupt state

[Brian Cain]

Move BQL_LOCK_GUARD() to the top of hex_check_interrupts.

There was a race with hex_interrupt_update on other vCPU threads when
enabling MTTCG.

Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/hex_interrupts.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/hexagon/hex_interrupts.c b/target/hexagon/hex_interrupts.c
index 03e1f28da9b..340007dd545 100644
--- a/target/hexagon/hex_interrupts.c
+++ b/target/hexagon/hex_interrupts.c
@@ -386,17 +386,19 @@ bool hex_check_interrupts(CPUHexagonState *env)
 {
     CPUState *cs = env_cpu(env);
     bool int_handled = false;
-    bool ssr_ex = get_ssr_ex(env);
+    bool ssr_ex;
     int max_ints = 32;
     bool schedcfgen;
 
+    BQL_LOCK_GUARD();
+
+    ssr_ex = get_ssr_ex(env);
+
     /* Early exit if nothing pending */
     if (get_ipend(env) == 0) {
         restore_state(env, false);
         return false;
     }
-
-    BQL_LOCK_GUARD();
     /* Only check priorities when schedcfgen is set */
     schedcfgen = get_schedcfgen(env);
     for (int i = 0; i < max_ints; i++) {
-- 
2.34.1

[PATCH 2/5] target/hexagon: check exception_index in has_work

[Brian Cain]

Without this check, a halted thread that gets an NMI while
its modectl E-bit is still set won't wake if no interrupt_request bits
happen to be pending.

Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index f20d6de6f63..896d72825a6 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -392,6 +392,9 @@ static bool hexagon_cpu_has_work(CPUState *cs)
 {
     CPUHexagonState *env = cpu_env(cs);
 
+    if (qatomic_read(&cs->exception_index) != HEX_EVENT_NONE) {
+        return true;
+    }
     return hexagon_thread_is_enabled(env) &&
         (cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_SWI
             | CPU_INTERRUPT_K0_UNLOCK | CPU_INTERRUPT_TLB_UNLOCK
-- 
2.34.1

[PATCH 3/5] target/hexagon: drop a pending HALT when resuming

[Brian Cain]

A thread entering wait mode raises CPU_INTERRUPT_HALT on itself and only
takes it once its TB ends.  If another thread resumes it in between, the
HALT is still pending.

Clear the HALT on resume.

Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/cpu_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/hexagon/cpu_helper.c b/target/hexagon/cpu_helper.c
index 6dc06401ad5..b6f31aefc0f 100644
--- a/target/hexagon/cpu_helper.c
+++ b/target/hexagon/cpu_helper.c
@@ -138,6 +138,7 @@ static void hexagon_resume_thread(CPUHexagonState *env)
     clear_wait_mode(env);
     cs = env_cpu(env);
     ASSERT_DIRECT_TO_GUEST_UNSET(env, cs->exception_index);
+    cpu_reset_interrupt(cs, CPU_INTERRUPT_HALT);
     cs->halted = false;
     cs->exception_index = HEX_EVENT_NONE;
     qemu_cpu_kick(cs);
-- 
2.34.1

[PATCH 4/5] hw/intc: ciad should forward its mask to l2vic

[Brian Cain]

ciad cleared the last interrupt the L2VIC delivered regardless of its
mask.  So a ciad for any other interrupt would get applied incorrectly.

Only clear the active interrupt when the ciad acknowledges the CPU
interrupt that its VID group is delivered on, and only if that interrupt
was taken or set with siad.

Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 include/hw/intc/hex-l2vic.h | 14 ++++++++++----
 hw/intc/hex-l2vic.c         | 10 +++++++---
 target/hexagon/op_helper.c  | 14 +++++++++-----
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/include/hw/intc/hex-l2vic.h b/include/hw/intc/hex-l2vic.h
index edc278266cb..ae067fe95eb 100644
--- a/include/hw/intc/hex-l2vic.h
+++ b/include/hw/intc/hex-l2vic.h
@@ -31,8 +31,13 @@ typedef struct HexL2VicInterfaceClass {
     void (*update_vid)(HexL2VicInterface *l2vic, uint32_t group,
                         uint32_t value);
 
-    /* Clear interrupt using CIAD instruction */
-    void (*clear_interrupt)(HexL2VicInterface *l2vic);
+    /*
+     * Clear interrupts using the CIAD instruction.
+     * @mask the CPU interrupts that the CIAD acknowledged.  The interrupt is
+     * only cleared if @mask has the CPU interrupt that its VID group is
+     * delivered on.
+     */
+    void (*clear_interrupt)(HexL2VicInterface *l2vic, uint32_t mask);
 } HexL2VicInterfaceClass;
 
 DECLARE_OBJ_CHECKERS(HexL2VicInterface, HexL2VicInterfaceClass,
@@ -52,10 +57,11 @@ static inline void l2vic_update_vid(HexL2VicInterface *l2vic, uint32_t group,
     k->update_vid(l2vic, group, value);
 }
 
-static inline void l2vic_clear_interrupt(HexL2VicInterface *l2vic)
+static inline void l2vic_clear_interrupt(HexL2VicInterface *l2vic,
+                                         uint32_t mask)
 {
     HexL2VicInterfaceClass *k = HEX_L2VIC_INTERFACE_GET_CLASS(l2vic);
-    k->clear_interrupt(l2vic);
+    k->clear_interrupt(l2vic, mask);
 }
 
 #endif /* HW_INTC_HEX_L2VIC_H */
diff --git a/hw/intc/hex-l2vic.c b/hw/intc/hex-l2vic.c
index 736f1be3b1d..b73ecb821e4 100644
--- a/hw/intc/hex-l2vic.c
+++ b/hw/intc/hex-l2vic.c
@@ -448,12 +448,16 @@ static void l2vic_interface_update_vid_impl(HexL2VicInterface *iface,
     l2vic_update_all(s);
 }
 
-static void l2vic_interface_clear_interrupt_impl(HexL2VicInterface *iface)
+static void l2vic_interface_clear_interrupt_impl(HexL2VicInterface *iface,
+                                                 uint32_t mask)
 {
     HexL2VICState *s = HEX_L2VIC(iface);
+    const uint32_t size = L2VIC_INTERRUPT_MAX;
+    const uint32_t active_irq = find_first_bit32(s->int_status, size);
 
-    if (s->vid < L2VIC_INTERRUPT_MAX) {
-        clear_bit32(s->vid, s->int_status);
+    /* VID group n is delivered on CPU interrupt n + 2 */
+    if (active_irq != size && (mask & BIT(get_vid(s, active_irq) + 2))) {
+        clear_bit32(active_irq, s->int_status);
     }
     l2vic_update_all(s);
 }
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 9850dc07289..2b8414f5f53 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -1613,26 +1613,30 @@ void HELPER(raise_stack_overflow)(CPUHexagonState *env, uint32_t slot,
 void HELPER(ciad)(CPUHexagonState *env, uint32_t mask)
 {
     uint32_t iad;
+    uint32_t was_set;
     HexagonCPU *cpu;
 
     BQL_LOCK_GUARD();
     cpu = env_archcpu(env);
     if (cpu->cfg.hex_def->hex_version >= HEX_VER_V81) {
         iad = hexagon_globalreg_read(cpu->globalregs, HEX_SREG_IAD,
-                                     env->threadId) & ~mask;
-        hexagon_globalreg_write(cpu->globalregs, HEX_SREG_IAD, iad,
+                                     env->threadId);
+        was_set = iad & mask;
+        hexagon_globalreg_write(cpu->globalregs, HEX_SREG_IAD, iad & ~mask,
                                 env->threadId);
     } else {
         uint32_t ipendad =
             hexagon_globalreg_read(cpu->globalregs, HEX_SREG_IPENDAD,
                                    env->threadId);
 
-        fSET_FIELD(ipendad, IPENDAD_IAD,
-                   fGET_FIELD(ipendad, IPENDAD_IAD) & ~mask);
+        iad = fGET_FIELD(ipendad, IPENDAD_IAD);
+        was_set = iad & mask;
+        fSET_FIELD(ipendad, IPENDAD_IAD, iad & ~mask);
         hexagon_globalreg_write(cpu->globalregs, HEX_SREG_IPENDAD,
                                 ipendad, env->threadId);
     }
-    l2vic_clear_interrupt(cpu->l2vic);
+    /* Only an interrupt that was taken, or set with siad, can be cleared */
+    l2vic_clear_interrupt(cpu->l2vic, was_set);
     hex_interrupt_update(env);
 }
 
-- 
2.34.1

[PATCH 5/5] target/hexagon: enable MTTCG for system emulation

[Brian Cain]

Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 configs/targets/hexagon-softmmu.mak | 1 +
 target/hexagon/cpu.c                | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/configs/targets/hexagon-softmmu.mak b/configs/targets/hexagon-softmmu.mak
index 1ba6420d205..633b7b3f8b7 100644
--- a/configs/targets/hexagon-softmmu.mak
+++ b/configs/targets/hexagon-softmmu.mak
@@ -8,3 +8,4 @@ TARGET_NOT_USING_LEGACY_NATIVE_ENDIAN_API=y
 TARGET_NEED_FDT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
+TARGET_SUPPORTS_MTTCG=y
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index 896d72825a6..0416c37515b 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -809,9 +809,8 @@ void hexagon_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 #endif
 
 static const TCGCPUOps hexagon_tcg_ops = {
-    /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
-    .mttcg_supported = false,
+    .mttcg_supported = true,
     .initialize = hexagon_translate_init,
     .translate_code = hexagon_translate_code,
     .get_tb_cpu_state = hexagon_get_tb_cpu_state,
-- 
2.34.1

Re: [PATCH 1/5] target/hexagon: acquire BQL before reading interrupt state

[Pierrick Bouvier]

On 10/18/2026 11:09 PM, Brian Cain wrote:
> Move BQL_LOCK_GUARD() to the top of hex_check_interrupts.
> 
> There was a race with hex_interrupt_update on other vCPU threads when
> enabling MTTCG.
> 
> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
> ---
>  target/hexagon/hex_interrupts.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH 2/5] target/hexagon: check exception_index in has_work

[Pierrick Bouvier]

On 10/18/2026 11:09 PM, Brian Cain wrote:
> Without this check, a halted thread that gets an NMI while
> its modectl E-bit is still set won't wake if no interrupt_request bits
> happen to be pending.
> 
> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
> ---
>  target/hexagon/cpu.c | 3 +++
>  1 file changed, 3 insertions(+)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH 3/5] target/hexagon: drop a pending HALT when resuming

[Pierrick Bouvier]

On 10/18/2026 11:09 PM, Brian Cain wrote:
> A thread entering wait mode raises CPU_INTERRUPT_HALT on itself and only
> takes it once its TB ends.  If another thread resumes it in between, the
> HALT is still pending.
> 
> Clear the HALT on resume.
> 
> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
> ---
>  target/hexagon/cpu_helper.c | 1 +
>  1 file changed, 1 insertion(+)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH 5/5] target/hexagon: enable MTTCG for system emulation

[Pierrick Bouvier]

On 10/18/2026 11:09 PM, Brian Cain wrote:
> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
> ---
>  configs/targets/hexagon-softmmu.mak | 1 +
>  target/hexagon/cpu.c                | 3 +--
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/configs/targets/hexagon-softmmu.mak b/configs/targets/hexagon-softmmu.mak
> index 1ba6420d205..633b7b3f8b7 100644
> --- a/configs/targets/hexagon-softmmu.mak
> +++ b/configs/targets/hexagon-softmmu.mak
> @@ -8,3 +8,4 @@ TARGET_NOT_USING_LEGACY_NATIVE_ENDIAN_API=y
>  TARGET_NEED_FDT=y
>  CONFIG_SEMIHOSTING=y
>  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
> +TARGET_SUPPORTS_MTTCG=y

This one is not needed since introduction of TCGCPUOps.mttcg_supported:
https://gitlab.com/qemu-project/qemu/-/commit/a3d40b5effafdd299d1850f0c9956f60199b5b56

You can remove this makefile change.

> diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
> index 896d72825a6..0416c37515b 100644
> --- a/target/hexagon/cpu.c
> +++ b/target/hexagon/cpu.c
> @@ -809,9 +809,8 @@ void hexagon_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
>  #endif
>  
>  static const TCGCPUOps hexagon_tcg_ops = {
> -    /* MTTCG not yet supported: require strict ordering */
>      .guest_default_memory_order = TCG_MO_ALL,
> -    .mttcg_supported = false,
> +    .mttcg_supported = true,
>      .initialize = hexagon_translate_init,
>      .translate_code = hexagon_translate_code,
>      .get_tb_cpu_state = hexagon_get_tb_cpu_state,

For the rest,
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH 4/5] hw/intc: ciad should forward its mask to l2vic

[Pierrick Bouvier]

On 10/18/2026 11:09 PM, Brian Cain wrote:
> ciad cleared the last interrupt the L2VIC delivered regardless of its
> mask.  So a ciad for any other interrupt would get applied incorrectly.
> 
> Only clear the active interrupt when the ciad acknowledges the CPU
> interrupt that its VID group is delivered on, and only if that interrupt
> was taken or set with siad.
> 
> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
> ---
>  include/hw/intc/hex-l2vic.h | 14 ++++++++++----
>  hw/intc/hex-l2vic.c         | 10 +++++++---
>  target/hexagon/op_helper.c  | 14 +++++++++-----
>  3 files changed, 26 insertions(+), 12 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>