Merge tag 'pull-hex-20261024' of https://github.com/qualcomm/qemu into staging

hexagon: v85, DSP machines, singlestep, bugfixes

- v85 scalar: atomics, CFI/_rb, vector stack
- new DSP machines: SM8975 NSP, SA8797P NSP0, SC8480XP NSP0, SA8775P CDSP0,
QCS6490 CDSP.
- bugfixes:
    - coverity, ubsan findings in semihosting, decoder
    - handling framekey w/dealloc_return
- handle singlestep exception
- performance improvements: TLB flush, l2vic
- test coverage
- MTTCG fixes: enabling MTTCG exposed races in lock/interrupts and ciad.

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEPWaq5HRZSCTIjOD4GlSvuOVkbDIFAmrdHbgACgkQGlSvuOVk
# bDKcORAAvSuPyWD6BQ7qa62QR2EFNgv338hFt678y/XevFVAXG5DkZAMghL3+eSn
# DuLGW6Np9ov2PhnUoyA0sEskNujqbaMb1FKHrVBdaqQo7rvc45du4cqCsiLjR+jg
# StxJyxnx9OwhVtJ46T7nGm51p7c9oPAOsIkU0wH9wQnSBv2nmGMtPrd443xSEmm0
# nyJpRaHwMRAanPeHih3jOLprs2ZdTFmQi/wPwI6FyuT+jTFTOvge8T4aqWoTgxzN
# TYikrF1UXWfmQbhd3X7ZTNVF2Ep4yleI8c9J17oKiVLsz3Ugcio3n6uWLS895xs1
# dp6WRFXwI3SwNcZn3Uubq6gVKwlbRk9fkgj42byYbve8akrQ7HbIHUaQIKichVRS
# znBNovyyTgquvEsleuxebirQrdjgtgzCt4p8MlIjs2YAt84/oGxaRYhNYCvR7jmB
# eEoB2csNP8vbpLBEW0KeDP5Fc1ymwMwESCU+LJprFDyNlLLF2a4iBXf8koBpA+CL
# EuosWG+bAg/gUDVtHtoO9Pb5IHHS918q8VOuBdXo/ZalE0GpAM2GRyMX6MsqKUVa
# gpOWc1N6/jIknZR5j4CTp+zXvxdBCe5RUpiDIc0LxFiOMJgVzclEBkhnCusbD9hr
# 49esZPwomkh/M54dHanxSYGi/60+1aotuFymTx9goEMn6Kl37yk=
# =BBjT
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 24 Oct 2026 11:06:00 PM CEST
# gpg:                using RSA key 3D66AAE474594824C88CE0F81A54AFB8E5646C32
# gpg: Good signature from "Brian Cain (OSS Qualcomm) <brian.cain@oss.qualcomm.com>" [unknown]
# gpg:                 aka "Brian Cain (QUIC) <quic_bcain@quicinc.com>" [unknown]
# gpg:                 aka "Brian Cain <bcain@kernel.org>" [unknown]
# gpg:                 aka "Brian Cain (QuIC) <bcain@quicinc.com>" [unknown]
# gpg:                 aka "Brian Cain (CAF) <bcain@codeaurora.org>" [unknown]
# gpg:                 aka "bcain" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6350 20F9 67A7 7164 79EF  49E0 175C 464E 541B 6D47
#      Subkey fingerprint: 3D66 AAE4 7459 4824 C88C  E0F8 1A54 AFB8 E564 6C32

* tag 'pull-hex-20261024' of https://github.com/qualcomm/qemu: (40 commits)
  hw/intc/hex-l2vic: find the next pending irq a word at a time
  target/hexagon: only flush the softtlb when SSR.ASID changes
  target/hexagon: flush the softtlb once per tlbinvasid
  target/hexagon: avoid negative slot shift
  target/hexagon: reset implicit USR write state
  target/hexagon: assert qfloat shift
  hw/intc: ciad should forward its mask to l2vic
  target/hexagon: drop a pending HALT when resuming
  target/hexagon: check exception_index in has_work
  target/hexagon: acquire BQL before reading interrupt state
  tests/functional/hexagon: boot DSP firmware
  hw/hexagon: add subsystem-base property
  hw/hexagon: add v79NA1 machine
  hw/hexagon: add the SM8975 NSP machine
  hw/hexagon: add the SA8797P NSP0 machine
  hw/hexagon: add the SC8480XP NSP0 machine
  hw/hexagon: add the SA8775P CDSP machine
  hw/hexagon: add the QCS6490 CDSP machine
  hw/misc: add the QDSP6SS PLL, RCG
  hw/hexagon: convert virt board to hex-board
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>